As cannabis sales in Alberta top the country, a Calgary professor says online sales could pose new challenges for countering fraudulent IDs and securing consumer data.

Currently, only Alberta Gaming, Liquor and Cannabis is permitted to sell cannabis online in Alberta.

But as the private sector plans to enter the market, verifying a customer’s identity online becomes a lot more difficult, said Thomas Keenan, a professor focused on data and cyber security in the University of Calgary’s School of Architecture, Planning and Landscape.

“People expect they can go on Amazon.ca and buy an Instant Pot, and people have the same expectation of other services,” said Keenan in an August interview with Postmedia. “So people’s expectation is that marijuana will be the same as the Instant Pot, and the challenge is to make sure there are regulations and that you have good proof of age.”

To buy cannabis online from the AGLC, customers need only to prove their age by inputting some personal information and have it shipped to an Alberta address, said an AGLCC spokeswoman. This means that an 18-year-old in Saskatchewan or B.C., where the legal age is 19 to purchase cannabis, could order online in Alberta and pick it up on their next trip into the province.

Right now, the AGLC verifies the age of customers through a credit file match process by giving their name, date of birth and address in Alberta. For non-Alberta residents, government-issued ID can be uploaded to the website. As a last resort, if neither is possible, ages can be verified in person at a Canada Post location.

All of these processes, Keenan said, are made infinitely more vulnerable when conducted solely online.

“Once something has been through a computer, it’s very easy to fake it,” said Keenan, noting that creating a physical fake ID is much more difficult. “And the question is, would the people on the other side be skilled enough to detect that?”

Compounded with the fact that “the average 16-year-old” has enough knowledge of photo-altering software to fake a scan of a driver’s licence, said Keenan, it’s easier than ever for documents to be forged.

“The technology is out there,” he said, “and an important point is you don’t have to be a super-skilled hacker anymore.”

The ‘gold standard’

While current age verification relies heavily on data from an Alberta driver’s licence — which Keenan calls the “gold standard” because it is difficult to fake — the Alberta government is working on a solution to that and other issues through its MyAlberta Digital ID program. Through the service, users can access health and other records online by rigorously verifying their identity online and through a letter in the mail.

But it’s not in use yet for government cannabis services, said Tricia Velthuizen, a spokeswoman for Service Alberta.

Even if the government does roll out the use of a digital ID for cannabis, Keenan said, it would be difficult for a private company selling cannabis to match the rigour and fail-safes that government databases can provide.

And as large pharmacy chains like Shoppers Drug Mart have begun to sell medical cannabis and set sights on recreational markets, the connection of data points about a consumer’s recreational substance purchases and health-related needs poses issues of data security that are difficult to legislate before they become reality.

“(The big stores) already have a lot of stuff on file about you,” said Keenan. “So when you’re going down to your drugstore to pick up your aspirin as well as your pot, they will have a higher level of information about you than Joe’s Corner Cannabis.”