Alberta MLA Thomas Dang fined $7,200 for hacking COVID-19 vaccine records portal

An Alberta legislature member who admitted to hacking the province's COVID-19 vaccine records portal has been ordered to pay a $7,200 fine.

Thomas Dang was sentenced in the Provincial Court of Alberta in Edmonton on Tuesday by Judge Michelle Doyle. 

"Given the gravity of the offence, a sentencing court must impose a sentence that deters others from engaging in the sort of conduct that Mr. Dang engaged in," Doyle said.

"The sentence imposed must also send a message to the community that Mr. Dang's conduct is to be denounced."

Dang, who sits as an independent member representing Edmonton-South, pleaded guilty on Nov. 4 to a Health Information Act charge of illegally attempting to access private information.

"This is an unusual case," Doyle said during sentencing, noting the maximum fine for such an offence is $200,000.

Former NDP MLA

Dang, 27, is a former member of the NDP caucus, but left almost a year ago when RCMP began investigating a hack of Alberta's COVID-19 vaccine website.

He admitted to using his computer in September 2021 to follow up on a tip from a constituent about possible loopholes that were allowing access to people's private health information on the website.

He said when he ran into roadblocks trying to breach the vaccination site, he used former premier Jason Kenney's birth date and vaccination dates, both publicly available, which allowed him to break through the site's privacy safeguards.

Doyle said that Dang also managed to access the vaccination record of someone the court identified as Ms. AB, who shares the same birth date as Kenney and was vaccinated the same month as him.

"Mr. Dang did not reveal Ms. AB's health records to anyone and the installed script [on his computer] did not seek information beyond the health number and COVID vaccination records," Doyle said, adding that the legislature member's actions did not affect the functioning of the portal.

"His intention was to provide Alberta Health with the means to prevent such unauthorized activities by others who may have had a nefarious purpose."

A spokeswoman for Dang said the sentence was fair.

"Mr. Dang remains relieved that no criminal charges were laid and is looking forward to putting this matter behind him so he can focus on representing his constituents for the remainder of his term and begin planning the next chapter of his career," Leah Ward said in a statement.

The breach

From Sept. 19-23, 2021, Dang generated more than 1.75 million queries. The agreed statement of facts says Dang initially ran tests with his own information, and then used former premier Jason Kenney's date of birth and vaccination dates to test if he could access Kenney's health number.

After five attempts, his internet protocol (IP) address was blocked. Dang said he bypassed the block using a widely available program and regained access to the website.

Previously, Dang said that after he alerted NDP caucus staff and the information was relayed to Alberta Health, the province released a new version of the website within a week. The new version fixed the flaw he had identified.

Doyle told the court that Alberta Health was not provided with the source of the information, but RCMP was able to trace the web portal inquiries to Dang and executed a search warrant at his home.

'Not impulsive, but planned'

The judge said there is no doubt that Dang is "an exceptionally intelligent young man" who has a bright future ahead of him, adding that he has "enjoyed accomplishments well beyond his years."

"I have considered that Mr. Dang's actions were not impulsive, but planned and deliberate and continued for several days," Doyle said.

"His conduct was, in my view, inconsistent with the trust placed in him by his constituents."

She said Dang thought he was doing something beneficial for the community, but lost "sight of context and he broke the law."

However, the judge said she can also give Dang credit for showing remorse and fully co-operating with investigators.

Doyle sentenced him to pay $6,000 for the Health Information Act charge, plus $1,200 for the Victims of Crime Fund.

Dang has said he does not plan to seek re-election in the spring 2023 vote.