An Alberta legislature member who admitted to hacking the province’s COVID-19 vaccine records portal has been ordered to pay a $7,200 fine.
Judge Michelle Doyle sentenced Thomas Dang in the Provincial Court of Alberta in Edmonton on Tuesday.
“Given the gravity of the offence, a sentencing court must impose a sentence that deters others from engaging in the sort of conduct that Mr. Dang engaged in,” Doyle said. “The sentence imposed must also send a message to the community that Mr. Dang’s conduct is to be denounced.”
Dang, who sits as an Independent member representing Edmonton-South, pleaded guilty on Nov. 4 to a Health Information Act charge of illegally attempting to access private information.
“This is an unusual case,” Doyle said during sentencing, noting the maximum fine for such an offence is $200,000.
Dang, 27, is a former member of the NDP caucus, but left almost a year ago when RCMP began investigating a hack of Alberta’s COVID-19 vaccine website. He admitted to using his computer in September 2021 to follow up on a tip from a constituent about possible loopholes that were allowing access to people’s private health information on the website.
He said when he ran into roadblocks trying to breach the vaccination site, he used former premier Jason Kenney’s birth date and vaccination dates, both publicly available, which allowed him to break through the site’s privacy safeguards.
Doyle said that Dang also managed to access the vaccination record of someone the court identified as Ms. AB, who shares the same birth date as Kenney and was vaccinated the same month as him.
“Mr. Dang did not reveal Ms. AB’s health records to anyone and the installed script (on his computer) did not seek information beyond the health number and COVID vaccination records,” Doyle said, adding that the legislature member’s actions did not affect the functioning of the portal.
“His intention was to provide Alberta Health with the means to prevent such unauthorized activities by others who may have had a nefarious purpose.”
Doyle told the court that Alberta Health was not provided with the source of the information, but RCMP was able to trace the web portal inquiries to Dang and executed a search warrant at his home.
Dang has said he does not plan to seek re-election in the spring 2023 vote.
A spokeswoman for Dang said the sentence was fair.
“Mr. Dang remains relieved that no criminal charges were laid and is looking forward to putting this matter behind him so he can focus on representing his constituents for the remainder of his term and begin planning the next chapter of his career,” Leah Ward said in a statement.
The judge said there is no doubt that Dang is “an exceptionally intelligent young man” who has a bright future ahead of him, adding that he has “enjoyed accomplishments well beyond his years.”
“I have considered that Mr. Dang’s actions were not impulsive, but planned and deliberate and continued for several days,” Doyle said.
“His conduct was, in my view, inconsistent with the trust placed in him by his constituents.”
She said Dang thought he was doing something beneficial for the community, but lost “sight of context and he broke the law.”
However, the judge said she can also give Dang credit for showing remorse and fully co-operating with investigators.
“He entered a guilty plea, signifying that he accepts responsibility for his conduct … sparing the Crown from proving his guilt in trial.”
Doyle sentenced him to pay $6,000 for the Health Information Act charge, plus $1,200 for the Victims of Crime Fund.
She set a deadline of June 30, 2023, for Dang to pay the fine, but said his lawyer can request an extension.