Inside the Largest US Voter Data Leak • Hacker News Board

Re: Inside the Largest US Voter Data Leak

#261

Post by elihu » Mon, Jun 19, 2017, 10:26 PM UTC

What are the legal implications of a campaign using this leaked modelling data? Would it be breaking any existing laws to use data that was leaked to the public without the permission of the original company that did the modelling? (If nothing else, I suppose it's probably a copyright violation.)

Hypothetically, could one deliberately leak a trove of modelling data with some fake voters inserted, and then monitor the mailbox associated with that fake voter and sue any organization you don't like that sends campaign flyers for using the data without permission?

Re: Inside the Largest US Voter Data Leak

#262

Post by PeterisP » Mon, Jun 19, 2017, 10:31 PM UTC

remline wrote: post #75

_Codemonkeyism wrote: post #47

As long as the CEO of an company (RNC) that gives data to an outsourcer (Deep Root Analytics) is not going to jail to give data to an unqualified company, nothing will change. If the CEO goes to jail, things will change very rapidly (CEO will manage his CMO much tighter who will first want to see an security audit not older than 6 months). At least CEOs I have reported to as CTO were very sensitive for implemention i…

If this data has private information on non-republicans then jail them for having it, not for leaking it. There is no special purpose in these two groups of colluding Americans that grants them special rights to gather data on their non-associates any differently than any other member of the public.

No special rights are needed - the kind of data that is described in the article may be difficult and/or expensive to get, but it's not illegal to get, not illegal to have, and not illegal to distribute to others. It would be legal for you to do the same - maybe it shouldn't be legal (and it isn't so in e.g EU), but it currently is in USA.

If the leak would've been published willingly by Deep Root Analytics, there would be no crime (according to current USA privacy rules) here at all, no currently valid reason to jail anyone.

Re: Inside the Largest US Voter Data Leak

#263

Post by wildmusings » Mon, Jun 19, 2017, 10:32 PM UTC

thatcat wrote: post #232

jellicle wrote: post #66

Earlier quoted context omitted.

How one votes is secret. Whether one votes is typically compiled by the government and made available to political parties and often the general public.

enzanki_ars and BoiledCabbage cite the publicly accessible preference/views data categories which included the party you vote for

Sorry to be pedantic, but precision matters here. You can't find out who someone voted for, only what party they are registered as.

Re: Inside the Largest US Voter Data Leak

#264

Post by PeterisP » Mon, Jun 19, 2017, 10:47 PM UTC

vinhboy wrote: post #69

> It would ultimately take days, from June 12th to June 14th, for Vickery to download 1.1 TB of publicly accessible files Do security firms have special permission to do this? Because as a private citizen, I am pretty sure I would go to jail if I tried this.

They don't have a special permission, but each case is treated individually - what exactly technically you did matters just a little, the intent (not claimed intent, but the intent that the judge/jury would imply), circumstances and what you do afterwards with the data matter much more.

I.e., if a respected company downloads the data, reviews what horrible things it has and reports it to proper authorities (and gets legal advice before that on how best do it), then they're very likely to be treated as not done anything bad;

If I'd do the same, contact them asking to fix the vulnerability "or else", and then download the data and publish an angry video rant on youtube, that might land me in trouble, as (expected) intent matters a lot for prosecuting crimes.

Re: Inside the Largest US Voter Data Leak

#265

Post by smt88 » Mon, Jun 19, 2017, 10:54 PM UTC

anigbrowl wrote: post #173

smt88 wrote: post #80

Earlier quoted context omitted.

In the US, Nazis can march through Washington, and police will spend time and money protecting them. They'll do this for any group with any ideology. Needless to say, our countries have different ideas about which freedoms can and cannot be sacrified. Using public data to guess at someone's race isn't, out of context, illegal. It is in some situations, but not this one.

Yeah, and that's a Bad Thing. Turns out our institutions do not magically immunize the USA from authoritarian ideologies or operations, which is rather worrisome because if the USA were devolve from democracy to dictatorship then there's no other country that's going to ride to the rescue, so the likely outcome would be an extremely unpleasant civil war.

Who decides which ideologies are authoritarian or not? It isn't an objective or universal reality. There are plenty of people in this country who think a Bernie Sanders presidency would have been as dangerous as Stalinism.

If we didn't have freedom of speech, we'd be just like Russia. The opposition is demonized at best, snuffed out of existence at worst.

Re: Inside the Largest US Voter Data Leak

#266

Post by PeterisP » Mon, Jun 19, 2017, 10:55 PM UTC

317070 wrote: post #5

rootsudo wrote: post #2

In other news, already known information. Every USA states has clear laws on releasing whose registered with which party, past affiliation and address. Clickbait.

From the article: > Along with home addresses, birthdates, and phone numbers, the records include advanced sentiment analyses used by political groups to predict where individual voters fall on hot-button issues such as gun ownership, stem cell research, and the right to abortion, as well as suspected religious affiliation and ethnicity. In some Western countries, the mere existence of such a database would be illega…

As far as I understand, the religion/ethnicity columns are not a fact, not a record and not something private provided by the person themselves or some agency - it's a modelling guess that they've made based on other publicly available data.

So, if I look at your post history and make a guess about what religion and ethnicity you might have, and write that down, am I in possession of an illegal database if I lived in e.g. France?

I did take a quick look, and it seems that I have a good idea about your full name, face, hair color, political views and party affiliation, your employer, etc. All this data (together with demographics of others) would also allow to make some guess about your religious preferences. All of that might be wrong, but it might also be right, so let's assume for the sake of argument that I write my guesses down and happen to have an entry that contains your full name, ethnicity and religion, just like the leaked data has.

Should this be considered a crime?

Does this change depending on how many people I look at?

Does this change depending on how accurate my guesses are?

Re: Inside the Largest US Voter Data Leak

#267

Post by political_tech » Mon, Jun 19, 2017, 10:55 PM UTC

_Codemonkeyism wrote: post #47

As long as the CEO of an company (RNC) that gives data to an outsourcer (Deep Root Analytics) is not going to jail to give data to an unqualified company, nothing will change. If the CEO goes to jail, things will change very rapidly (CEO will manage his CMO much tighter who will first want to see an security audit not older than 6 months). At least CEOs I have reported to as CTO were very sensitive for implemention i…

Throwaway account because of involvement in this field.

Even though the RNC is a private organization, it doesn't operate like a normal company. The partnerships that it makes with companies that it awards contracts to are largely relationship-driven, not actually driven by objective analysis of value propositions. Those decisions tend to be made at the COO/CoS (Chief of Staff) level.

Re: Inside the Largest US Voter Data Leak

#268

Post by political_tech » Mon, Jun 19, 2017, 10:56 PM UTC

shostack wrote: post #224

DannyBee wrote: post #24

Speaking as a guy with a lot of experience with voter data ( I built the first "where do I vote" apps for Google and helped found the voting information project): This is actually almost entirely public data. Yes, including addresses and phone numbers and political affiliation. There are some states that is not public as part of the voter file, but you can still get it other ways publicly. For example: USPS, etc. Som…

The modeling info is the real value. So taking that modeled data, loading it into Cambridge Analytica (which I understand is somewhat of a DMP in this sense), and leveraging it with highly-customized creative targeted against Custom Audience uploads using this modeled data would be insanely valuable to a political player with the capital to deploy this info weapon.

CA offers DMP services as part of their product suite, but they specialize in doing this kind of modeling as a professional service.

Re: Inside the Largest US Voter Data Leak

#269

Post by ksk » Mon, Jun 19, 2017, 11:01 PM UTC

dredmorbius wrote: post #251

ksk wrote: post #124

Earlier quoted context omitted.

>I have this theory that the only way regular people will start caring about privacy breaches such as this one is to use that data against them in a malicious way The other thought experiment is to adopt the opposite point of view that privacy is overrated. You can adopt various worldviews from 'everything is grey' to 'this is good, that is bad" but punishing someone to care about same things you care about is a pret…

There's a pretty compelling argument though, that people aren't good at making long-term assessments of diffuse, but potent, risks, and/or are willing to, or can be coerced into, arbitraging long-term interests with short-term exigency. Gresham's law, availability hueristics, optimism bias, distribution of cognitive skills, various aspects of game theory, and more, strongly suggest this. Examples: global warming, pol…

Yeah, and all those biases apply to people on HN too - You (the proverbial) aren't good at making assessments either. Also, flipping it for arguments sake, how come software companies are never penalized for introducing software bugs? How would you like it if an accountant wanted to send you to jail because you introduced a security bug and their critical data got wiped out and they went out of business? Or should we go back to blaming them for not having backups because we have an a-priori assumption that "shit happens" when it comes to software? Well, the other side could say 'shit happens' too.

Re: Inside the Largest US Voter Data Leak

#270

Post by political_tech » Mon, Jun 19, 2017, 11:02 PM UTC

Taniwha wrote: post #233

I think people are missing the big legal liability .... this information has been published to the world, it contains estimates of people's deeply held political beliefs - some of it will be wildly wrong and those people might consider that they have been libeled .... roll on the lawsuits

The liability wouldn't be with the RNC or Deep Root; the liability would be on the entity that actually published the information. That's if you consider this to meet the legal definition of publishing (the legal definition of libel, as I understand it, is "to publish in print (including pictures), writing or broadcast through radio, television or film...").