Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Inside the Largest US Voter Data Leak

upguard.com

Post reply on HN
Print view View original

81–90 of 351 posts

Re: Inside the Largest US Voter Data Leak

#81

Post by fnovd »

strictnein wrote: post #56
_Codemonkeyism wrote: post #47

As long as the CEO of an company (RNC) that gives data to an outsourcer (Deep Root Analytics) is not going to jail to give data to an unqualified company, nothing will change. If the CEO goes to jail, things will change very rapidly (CEO will manage his CMO much tighter who will first want to see an security audit not older than 6 months). At least CEOs I have reported to as CTO were very sensitive for implemention i…

What law did they break, exactly? These aren't medical or financial records. A careless programmer makes a bad choice and the CEO has to go to jail? Come on.

You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. It's like a hospital only employing 1 nurse and blaming her when patients inevitably die. The organization has a clear responsibility to employee a sufficient number of experts to protect their data. DRA is not unique here but does demonstrate a pattern of companies playing fast and loose with sensitive data with minimal repercussions. We'll keep seeing things like this until our laws are such that stewards of data like these have some sort of incentive to protect them.

Re: Inside the Largest US Voter Data Leak

#82

Post by protomyth »

1024core wrote: post #52
protomyth wrote: post #44

Earlier quoted context omitted.

Yes, for internal use is fine and dandy, but revealing it to the world is scummy, a violation of privacy, and can lead to retribution.

That's like saying "it's OK to have racist thoughts, just don't say them out aloud". Whether it's revealed or not is secondary to the act of compiling itself.

So, you would have ruled for Alabama so the KKK and Jim Crow supporters could get the list and "talk" to the businesses and people supporting the NAACP?

Re: Inside the Largest US Voter Data Leak

#83

Post by protomyth »

dsfyu404ed wrote: post #55
protomyth wrote: post #46

Earlier quoted context omitted.

Well, the KKK and Jim Crow supporters were a bit farther up the ladder of 'unpleasant'. 'Unpleasant' being used in the same meaning and tone as a southern lady saying "aren't you special".

In their day they were only mildly unpleasant. Furthermore, those groups they believed they were acting to promote policy that believed was in the best interest of the nation, regardless of how we see them in hindsight. Imagine if there existed similar databases then. Would you hire someone if you knew they were firmly pro-segregation at age 20-something in 1950-something?

Seems I have a different definition of 'mildly' since I have some strong opinions on burning crosses in peoples yards and other violences.

Re: Inside the Largest US Voter Data Leak

#84

Post by ploggingdev »

I have this theory that the only way regular people will start caring about privacy breaches such as this one is to use that data against them in a malicious way. Tell the average Joe that the data of all US voters has been leaked, "Hmmm. That's bad." and they move on with their lives as if nothing happened. Instead, if this data is used to impersonate the average Joe on social media or if it's used to trick their mobile carrier into porting out their number, then they'll take notice. (I am not suggesting people do this, it was just part of a thought experiment)

Unless the company involved is sued to bankruptcy and the people involved are prosecuted, sending a strong message to companies dealing with user data, nothing will change. But that's unlikely to happen as this company is backed by the RNC.

While we're on the topic of collecting personal data of people, there's a simple solution : just don't collect it unless it's absolutely necessary. Stop asking me to broadcast my address in my newsletter. Stop asking me to submit my billing address when I make payments online. Stop asking me for my mobile number when I visit a fast food restaurant. Most of the companies that collect this data are not competent enough to keep it secure. The reason companies ask for an address to broadcast in users' newsletters is some anti-spam act which does not prevent the spammers from doing their job. I imagine it's also a requirement for companies to collect a billing address for certain types of online payments. Change the law to remove these poorly thought out legislature.

More generally, we need regulations on how user data is used by companies. They should not be allowed to store user data indefinitely. If a user closes an account with a company, retain the data for a short period (eg- 1 year) and then delete the data automatically. Companies should not be allowed to build shadow profiles of users.

Re: Inside the Largest US Voter Data Leak

#85

Post by nostrademons »

kevindqc wrote: post #76
VonGuard wrote: post #38

Earlier quoted context omitted.

So that the two parties who voted for this to be the case can have unfettered access to their potential voters, go to their houses, send them things, and know for sure they're only hitting up people in their party, so as not to mobilize the other side. Nothing that would harm the 2-party system ever changes in the US, and nothing ever will.

But why does it need to be public? In the US, you register with the party no? So the party you register with your information, and they can do what you said > go to their houses, send them things, and know for sure they're only hitting up people in their party, so as not to mobilize the other side.

Depends on the state, but in general, no. You register as a member of the party. You register with the state. Voter registration information is used to determine who's eligible to vote, and you don't necessarily need to have a party affiliation to be able to vote (I don't, for example).

My guess is that it's public to avoid unfairly preferencing the major parties, so that they give at least lip service to the idea that "anyone can run for office". The U.S. is pretty sensitive about seeming like it has a fair and open political system, even if other aspects of the system mean that in practice a third party doesn't have a snowball's chance in hell.

Re: Inside the Largest US Voter Data Leak

#86

Post by pc86 »

apeace wrote: post #63

> Spreadsheets containing this accumulated data—last updated around the January 2017 presidential inauguration—constitute a treasure trove of political data and modeled preferences used by the Trump campaign Genuinely curious: can you really have 198 million rows in a spreadsheet?

I used to work in this field (political consulting, the data around it, nothing terrible interesting on the tech front at the time though). It was most likely broken down by Congressional district.

Re: Inside the Largest US Voter Data Leak

#87

Post by [deleted] »

thatcat wrote: post #58
wildmusings wrote: post #33

Earlier quoted context omitted.

In the United States, the First Amendment protects your right to compile publicly available data in any way you see fit. I have experience working on a political campaign and they ALL have databases such as this.

What is the publically available source to view voting history ? I thought that was protected information.

[deleted]

Re: Inside the Largest US Voter Data Leak

#89

Post by travoc »

thegayngler wrote: post #71
yahelc wrote: post #18

Earlier quoted context omitted.

Voter files being public data depends on which state you're talking about -- you're looking at ~50 different sets of laws and regulations. Some states restrict access to only political parties using it for political uses and prohibit distribution to non-parties/candidates. Some states (Florida, for example) will let anyone just apply to get it. To your latter question, some states, like California, do include email a…

https://en.wikipedia.org/wiki/Secret_ballot All 50 states have some form of secret ballot. Only WV has an open ballot.

This is voter registration data, not ballot data.

Re: Inside the Largest US Voter Data Leak

#90

Post by mrpoptart »

vinhboy wrote: post #69

> It would ultimately take days, from June 12th to June 14th, for Vickery to download 1.1 TB of publicly accessible files Do security firms have special permission to do this? Because as a private citizen, I am pretty sure I would go to jail if I tried this.

IANAL, but I'm pretty sure if someone leaves a Top-Secret document on the ground, and you pick it up, you don't go to jail for that. The data is accessible to the public -- this isn't a hack, this is just downloading.
Post reply on HN