Inside the Largest US Voter Data Leak • Hacker News Board

Re: Inside the Largest US Voter Data Leak

#161

Post by dude01 » Mon, Jun 19, 2017, 6:14 PM UTC

_Codemonkeyism wrote: post #47

As long as the CEO of an company (RNC) that gives data to an outsourcer (Deep Root Analytics) is not going to jail to give data to an unqualified company, nothing will change. If the CEO goes to jail, things will change very rapidly (CEO will manage his CMO much tighter who will first want to see an security audit not older than 6 months). At least CEOs I have reported to as CTO were very sensitive for implemention i…

I agree. As an example, over a decade ago I was on a team deploying an app to Switzerland. They took privacy really seriously, because they told me that employees get fined/imprisoned for privacy breaches, not just corporate fines.

Re: Inside the Largest US Voter Data Leak

#162

Post by DannyBee » Mon, Jun 19, 2017, 6:15 PM UTC

cowabungamann wrote: post #139

DannyBee wrote: post #24

Speaking as a guy with a lot of experience with voter data ( I built the first "where do I vote" apps for Google and helped found the voting information project): This is actually almost entirely public data. Yes, including addresses and phone numbers and political affiliation. There are some states that is not public as part of the voter file, but you can still get it other ways publicly. For example: USPS, etc. Som…

where can I get access to this data?

Contact anyone with a voter file (google "voter file purchase")

Trivially: http://nationbuilder.com/voterfile

etc

As for "For free", states are generally required by law to give it to you if you ask. Some charge fees. Only two have crazy fees (5k and 30k) has a crazy fee (though if you challenge them, ...etc)

https://trello.com/b/IlZkwYc0/national-voter-file-states-pip...

There is a github project i'm aware of to put together all of the data: https://github.com/national-voter-file/national-voter-file

Re: Inside the Largest US Voter Data Leak

#163

Post by rayiner » Mon, Jun 19, 2017, 6:17 PM UTC

strictnein wrote: post #56

_Codemonkeyism wrote: post #47

As long as the CEO of an company (RNC) that gives data to an outsourcer (Deep Root Analytics) is not going to jail to give data to an unqualified company, nothing will change. If the CEO goes to jail, things will change very rapidly (CEO will manage his CMO much tighter who will first want to see an security audit not older than 6 months). At least CEOs I have reported to as CTO were very sensitive for implemention i…

What law did they break, exactly? These aren't medical or financial records. A careless programmer makes a bad choice and the CEO has to go to jail? Come on.

OP is clearly suggesting creating a law to avoid this sort of outcome. And while these aren't medical or financial records, they did include: "names, dates of birth, home addresses, phone numbers, and voter registration details, as well as data described as 'modeled' voter ethnicities and religions." Say on average people would pay $5 for this stuff not to be leaked. You're talking about a $1 billion fuckup resulting from a choice that is, as far as I can tell, gross negligence on the part of the programmer.

Re: Inside the Largest US Voter Data Leak

#164

Post by DannyBee » Mon, Jun 19, 2017, 6:17 PM UTC

gr3yh47 wrote: post #123

DannyBee wrote: post #57

Earlier quoted context omitted.

As I said in the other thread, this is all public data from various sources (except the modeling). It will be fully filled out. It's very common for political orgs to have the entire voter file for the US (or be able to query it using SQL)

its the aggregation and easily searchable format for 2/3 of citizens that makes this REALLY dangerous for identity theft. they were still grossly irresponsible. no consequences will happen though.

It's already aggregated and easily searchable.

Seriously.

You could, in the next 10 minutes, go purchase a national voter file with all this info on 190 million plus voters.

Just Google "national voter file purchase".

Those are pre-aggregated, and honestly, really cheap (Usually ~2k).

You can also aggregate it yourself for less if you want.

Re: Inside the Largest US Voter Data Leak

#165

Post by BinaryIdiot » Mon, Jun 19, 2017, 6:18 PM UTC

fnovd wrote: post #81

strictnein wrote: post #56

Earlier quoted context omitted.

What law did they break, exactly? These aren't medical or financial records. A careless programmer makes a bad choice and the CEO has to go to jail? Come on.

You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. It's like a hospital only employing 1 nurse and blaming her when patients inevitably die. The organization has a clear responsibility to employee a sufficient number of experts to protect their data. DRA is not unique here but does demonstrate a pattern of companies playing fast and loose wi…

> You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. It's like a hospital only employing 1 nurse and blaming her when patients inevitably die.

This isn't a very good example. A shortage of nurses will directly correlate to poor patient care and possible death. But a shortage of security experts? Who knows. I worked at an insurance company that left an access database open to the internet FOR YEARS. We ran analytics when I found it and it was never served from our web server.

So since it didn't get into the public does that mean they were responsible for their security? If the answer is "no" then how would you ever measure these unknowns?

Security is a major problem in tech. It's very difficult, it's nuanced and its vast. Security covers so so much that it would be difficult to one or maybe even a handful of security experts to fully over all aspects of an app depending on your scope.

Beyond that though is mistakes happen. People will screw up. Even security people can screw something up. Throwing someone in jail for a screw up reminds me of the war on drugs; it's not going to stop someone from making a mistake or simply not realizing an unknown unknown.

Re: Inside the Largest US Voter Data Leak

#166

Post by BinaryIdiot » Mon, Jun 19, 2017, 6:20 PM UTC

anigbrowl wrote: post #158

ksk wrote: post #134

Earlier quoted context omitted.

>You can't blame a "careless programmer" when the real problem is organizations simply not committing any resources to security. How have you established that they didn't have a sufficient number of experts? What if they purchased a product or service and it simply didn't work? Its rather harsh to point fingers without having all of the information. >We'll keep seeing things like this until our laws are such that ste…

I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people . You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web? Given that this data was collected…

> I'm really impressed at the lengths people will go to defend those whose malfeasance or ineptitude unarguably worsen the lives of up to two hundred million people. You seem like a smart person, please tell me how you think it's OK that these folks' contact details and potentially very detailed psychological and political profile information are now likely available on the dark web?

So far I've seen people disagree with simply throwing them in jail and people who want more data (was is a screw up? even security people make mistakes. Did they not have appropriate resources? etc).

I haven't seen anyone say this is OK in any way, shape or form. I see many reasonable discussions.

Re: Inside the Largest US Voter Data Leak

#167

Post by DannyBee » Mon, Jun 19, 2017, 6:21 PM UTC

yincrash wrote: post #118

DannyBee wrote: post #26

Earlier quoted context omitted.

You can get the other info trivially from other public sources.

Please link me to public sources where I can find political data analytics on myself.

The modeling is not what the parent mentioned, he mentioned the standard data fields that you can certainly acquire.

I already mentioned the modeling parts are not public.

Re: Inside the Largest US Voter Data Leak

#168

Post by mfoy_ » Mon, Jun 19, 2017, 6:22 PM UTC

nostrademons wrote: post #99

unityByFreedom wrote: post #51

Earlier quoted context omitted.

> This is actually almost entirely public data Birthday is an included item. That's definitely private as it is often used to confirm identity. "almost public" is meaningless. One data item, like credit card number, or birthday, can make this a dangerous leak.

Birthday is almost certainly public. You can get it easily from the DMV or from any of several dozen commercial providers that resell government data: https://www.dmv.org/public-records/ That it's used to confirm identity shows how weak identity-theft protections are at most institutions, not what's public information. (For that matter, mother's maiden name is basically public information as well: you can get it from…

How many dark patterns are used by truth-finder.com? Seriously.

Re: Inside the Largest US Voter Data Leak

#169

Post by anigbrowl » Mon, Jun 19, 2017, 6:24 PM UTC

nostrademons wrote: post #128

falcolas wrote: post #120

Earlier quoted context omitted.

Personally, while I understand that this is nothing illegal, I think it's terribly wrong. We just handed everyone, including the 5% of society who tend towards sociopathy, a nicely tagged, collated (and yet probably slightly inaccurate) list of minorities. Hate women? You have a nice list which includes the names, addresses, and telephone numbers of all those women. Hate muslims? Boy do I have just the list for you.…

I don't really disagree that this is a shitty data breach, but on the consequences, I'll point out that the 5% of society who tends to sociopathy already have much lower-effort means to target minorities: Hate women? Look for boobs. Hate muslims? Look for brown skin. Hate Republicans? Look for MAGA hats. That these are inaccurate signals is irrelevant: haters gonna hate, and I really don't think they care whether the…

Why do you assume sociopaths just want to pick on individuals? There are ambitious sociopaths that draw up plans for things like ethnic cleansing, genocide and so forth. We have abundant examples of such behavior within recent history.

I think your concept of sociopathy qua serial killer is uninformed and stereotypical. Most sociopaths are not stabby weirdos blinded by hatred, they're just self-centred people with different levels of emotional affect/susceptibility than the general population.

It seems not to have occurred to you that (depending on record quality) a database like this would be great resource with which to find and recruit sociopaths of various stripes.

Re: Inside the Largest US Voter Data Leak

#170

Post by jurry289 » Mon, Jun 19, 2017, 6:25 PM UTC

Related: This legally mandated "leak" happened years ago, and it even included signatures. Most of the citizens pushing for the recall of a sitting republican governor were democrats, so it seemed like punishment for a Republican state assembly to pass this one-off policy. Especially for those who have zero internet-presence. The first thing many employers see when they search for politically active democrats is this information, paired with "quick searches" of their names on criminal, pedophile and dangerous persons databases. If you want to disinsentivize political action, this is how you do it. I won't link to that site, but can confirm it's still up.

http://www.cnn.com/2012/02/01/politics/wisconsin-recall-peti...