Edmonton-South MLA Thomas Dang expects to be fined under the province’s Health Information Act after hacking the Alberta government’s COVID-19 vaccine record system last year but says he’s been cleared of criminal wrongdoing.
In a statement Thursday, Dang said he is no longer under criminal investigation related to his actions — which led to him stepping down in December from the NDP caucus to sit as an independent — and will not face criminal charges.
“I am excited to put this matter behind me and I am grateful to the RCMP and the Crown prosecutor for working quickly to achieve this resolution,” Dang said in the statement. “I’ve learned a lot from this experience and will absolutely do things differently in the future if similar concerns or issues are brought to me.”
RCMP spokesperson Fraser Logan told Postmedia Thursday that police have referred findings of their investigation to Alberta’s Crown Prosecution Service for their opinion. RCMP are not confirming any of the details written in Dang’s news release, he said.
A spokesperson for the Justice Department did not immediately respond to a request for comment, but Michael Bates, Dang’s lawyer, confirmed that he was informed the RCMP concluded its investigation and “a decision has been made by the Crown service that no criminal charges will be pursued.”
In March, Dang admitted that he hacked the Alberta government’s COVID-19 vaccine record system last year using Premier Jason Kenney’s birthday.
In an explanation posted online Dang said he was able to use a script plus Kenney’s birthday and COVID-19 vaccination date — both publicly available — to guess the health care number of an Albertan who wasn’t Kenney but who was a match with the premier’s other details. Dang was able to access that person’s vaccine passport PDF but said he immediately exited the website and did not save any information.
He has maintained he hacked the system to highlight vulnerabilities and argued that companies often hire security experts to test their systems.
In an interview with Postmedia, Dang said his lawyer was informed by the prosecutor in charge of his case that he would not be facing criminal charges. He said he would not do something like this again because of the chilling effect it will have on others.
“This will have a chilling effect on people who want to disclose other vulnerabilities that affect every single Albertan and what I’ve learned is that there isn’t a proper disclosure process that would allow somebody who discovered the vulnerabilities to report it without possibly going through something like this again,” he said.
“I think that frankly, that’s a shame and we need to bring forward changes that allow security issues to be brought forward without the prospect of a criminal investigation.”
After admitting to the hack, Dang began advocating for changes related to cyber security. He has promised a private member’s bill in the fall that will include a vulnerability disclosure program for people to report concerns.
Dang expects he will face a monetary fine for illegally accessing or attempting to access information under the Health Information Act. The fine has not been issued and the amount has not yet been determined.
Bates said Dang will likely receive a summons in the coming weeks for contravening section 102(2) of the act, but had no other comment on the matter “as that process has not yet occurred.”
When asked whether he would plead guilty, Dang said he would assess the situation with his lawyer.
It’s unclear what this will mean for Dang’s future with the NDP. He has sent a letter to NDP caucus chair Joe Ceci requesting permission to rejoin the caucus.
Last month NDP Leader Rachel Notley said the vetting process for the riding was still ongoing.
“If the (police) investigation is still underway, it is definitely the case that Thomas will not be able to run in the next election for us,” she said at the time.
In a statement, UCP MLA Brad Rutherford said the fine and police investigation show Dang was in the wrong.
“Given the serious nature of this RCMP investigation and the resulting fine under the Health Information Act, MLA Dang should not be allowed to rejoin the Official Opposition caucus,” he said.
At a news conference Thursday, moments after Dang’s statement came out, Notley said the party and caucus will be looking to get more information.
“I’ll be talking about this with the executive caucus and we’ll be able to get back to folks once we have a clearer picture. The same would apply to the folks on our provincial executive who are tasked with approving candidates,” she said.
Dang said he wants to run for the NDP next year.
“What I’ve done is all out there in the public and people will have to make their own decisions on how they think I handled that,” he said.
“But certainly, I feel that in terms of ethical acts that this is important to have a system in place for this type of disclosure.”
— With files from Lisa Johnson