Alberta voter-list custody

List custody
Authorized recipients
Partner oversight
Client-side control

005 / 2026

Authorization is not the same as control. When a mass list of named home addresses and phone numbers leaves a trusted channel and shows up somewhere it was never meant to live, the failure is custody — not whether someone somewhere once had a legal right to receive a copy.

That is control before coverage.

What Alberta authorities and reporting say

In September 2026, Alberta’s government announced a temporary policy change for copies of the provincial List of Electors given to political parties and other authorized recipients. According to The Canadian Press, new copies will include only the number of voters in each voting area and municipality — not first and last names, home addresses, postal codes, phone numbers, or unique voter identifiers. The policy is set to expire at the end of 2026. Justice Minister Mickey Amery’s office said legislation this fall is planned to protect privacy and uphold election integrity, without detailing the bill.

Elections Alberta told CP the change does not affect the detailed lists Elections Alberta itself uses to administer the referendum and ensure integrity, or lists previously received by authorized recipients. Voters are still crossed off when they receive a ballot.

The policy follows a spring privacy incident. Elections Alberta has said a separatist group, the Centurion Project, published a database that included private information of nearly three million Albertans, and that investigators traced the database to a copy of the list given to the Republican Party of Alberta. The party has denied wrongdoing. A court ordered the Centurion Project site taken down after Elections Alberta sought an injunction. Elections Alberta said it is possible thousands of people viewed the database. Investigations involving Elections Alberta, the RCMP, and Alberta’s privacy watchdog have been reported as ongoing. Alberta’s Information and Privacy Commissioner opened a PIPA investigation into allegations against the Centurion Project Ltd. in May 2026.

Treat Centurion / party-copy tracing as investigators’ and Elections Alberta’s reporting — not as a completed criminal finding in this Brief. Temporary policy is not yet statute. Do not turn the October referendum debate into the thesis.

Why this matters for Alberta principals and protective intelligence

Named home addresses and phone numbers on a mass political list are classic doxxing and targeting fuel. For executives, family offices, and public-facing principals, the risk is not abstract “politics.” It is household exposure: who can find where you sleep, how to call you, and how to stitch that to other open sources.

Decision-grade protective intelligence starts with what left your control: who was authorized to receive the list, who could copy it, and what dual-channel checks look like when those identifiers surface later in an unexpected place. Minimize what third parties hold when the business or legal purpose does not require raw identifiers. Treat “authorized recipient” as a risk category — not a safety guarantee.

That is the same custody logic as third-party ID vendors that retain licence images: the scan or the list may never touch your own network, and still become your problem when it leaks.

The control question

Before the next mass personal list leaves your organization — voter data, employee directories, donor files, client rosters — answer these in writing.

Who is an authorized recipient, and under what written purpose? What fields are actually required versus convenient?

Where do copies live after delivery — including backups and staff laptops? How is onward disclosure prohibited, monitored, and proven?

What is the incident playbook when a copy appears where it should not?

If those answers live only as “they’re allowed to have it,” you are running on hope. Hope is not a control.

Forged-CS’s lane is advisory: protective-intelligence framing for exposure, diligence of who holds personal identifiers, and oversight of how licensed investigative partners engage when a matter requires regulated field work under Alberta law. We do not run a political operation, a SOC, or a guard roster. Oversight stays with the client.

Client-side diligence that moves risk

Inventory mass lists that leave your custody under “authorized use.” Political, corporate, and nonprofit environments all do this. Name the fields. Name the recipients. Name the deletion and audit expectations.

Prefer minimization when the purpose allows it. Alberta’s temporary shift to counts-by-area for party copies is a concrete example of cutting identifiers while keeping a function. Whether that balance is right for election administration is a policy debate for others. For principals and counsel, the transferable lesson is field-level minimization before the next breach story.

After an exposure of home addresses and phones, treat downstream social engineering and physical approach risk as real without panic copy. Monitor for unexpected contact using those identifiers. Harden household and staff briefings. Dual-channel any request that cites the leaked fields as proof of authenticity — a cold call that already knows your home address is not automatically a trusted institution.

For Alberta principals who travel, keep soft residential footprints, or employ household staff, fold list-exposure into the same operating picture as third-party ID scans and public metadata: what can a stranger assemble without ever touching your corporate network? Protective intelligence is the discipline of answering that early, not after the first convincing approach.

Separate investigative timelines from your control timeline. Court injunctions, privacy investigations, and criminal inquiries run on their clocks. Your custody standard can improve before those conclude.

What this Brief is not

This is not a referendum argument. It is not a finding of guilt against any party or group beyond what public investigators and Elections Alberta have stated. It is not a claim that Forged-CS audited Alberta’s List of Electors. It is decision-ready custody thinking for Alberta organizations and principals who need personal identifiers under client-side control.

Control before coverage

If the next mass list leaves as “authorized” without a custody picture, you are already negotiating from behind. Minimize fields. Name holders. Plan the failure mode. Then decide what partners you actually need.

Forged-CS is the client-side control layer — risk architecture and partner oversight, not more coverage.

— Hassan Sukhera | Forged-CS | forged-cs.com

FAQs

Did Alberta permanently change the law on voter lists?

No. Reporting describes a temporary policy for party copies through the end of 2026, with legislation planned. Temporary policy ≠ law.

Does this mean Elections Alberta stopped using detailed lists at the polls?

No. Elections Alberta has said it still uses detailed lists to administer the referendum and cross voters off when they receive a ballot.

Why does Forged-CS care about voter lists?

Because mass home-address and phone exposure is a protective-intelligence and household-security problem for principals — custody of identifiers, not campaign strategy.

Is the Centurion / party-copy link a proven crime in this Brief?

This Brief follows Elections Alberta and investigators’ public reporting. Ongoing investigations belong to those authorities.