Slashdot Mirror
2.4 Million Ontario Voters' Private Info Compromised
An anonymous reader writes "Elections Ontario, an agency tasked with the organization and conduct of general elections and by-elections in Canada's Ontario region, is warning voters about the loss and potential theft of two USB sticks containing private information of 2.4 million voters from approximately 20–25 electoral districts. The information at issue is limited to full name, gender, birth date, address, whether or not an elector voted in the last provincial election and any other personal information updates provided by voters to Elections Ontario during that time, as well as administrative codes used solely for election purposes. The information does not include how an individual voted."
Doing everything electronically and "on the net" is of such overwhelmingly critical importance that the loss of a few million voter records is of little interest to any civilized human being.
Just imagine if we had to go back to pencil and paper! The barbarism! *SHUDDER*
Sounds like the same "private" information that every candidate and party has access to during the election campaign and on election day. Not sure about the birth date, but everything else is definitely on the voter registration and tracking printouts used by poll clerks and by party scrutineers during the election.
When you have nothing left to burn you must set yourself on fire
I'm almost as alarmed by the sense of alarm. This sounds like harmless information. A ten year old hard drive is not the same as losing your current laptop, and being tagged in a Facebook photo is not as dangerous as having your social security information compromised. Maybe we should distribute useless USB sticks filled with past telephone book listings just to keep identity thieves busy..
Gently reply
What would be a valid reason to put that much info on 2 usb-sticks besides, wanting to sell it or altogether being to darn lazy to even think about security and consequences. Anyone?
Pretty much any info on these things is already publicly available, except for SINs (like SSN's for Americans), and whether you voted or not in the last election.
Relax people - it's not like credit cards or Facebook/email message archives.
...versus most corps who do not unless forced to.
Why would you include date of birth?
Political campaigns can know your name (maybe just first name), address and whether or not you voted and they can reasonably conclude gender most of the time from first name.
But ya, overall that information is pretty public (except whether or not you voted). You're in any of the phone book, land registries, employer office parties, condo corporations etc.
To ensure the person is of voting age?
FYI, Ontario is a province. net-security.org should appreciate the value of precision, and /. editors need to edit.
Sincerely, an Ontarian. (Yes, that's a word.)
Date of birth information is part of public record, too. You didn't actually think you DoB was secret did you?
On USB sticks???? What are they doing on USB sticks?!?!? Whoever put that on there, should be fired immediately, no questions asked.
Is there somewhere I can see a list of impacted districts without downloading an XLS from these nitwits?
People think I'm paranoid because I encrypt all my drives... but when I lose a disk I never have to wonder if it potentially ended up in the wrong hands. Too bad it's only done by us loonies and not as standard practice everywhere.
This data is for sale in most states, to anyone who registers as a political committee (that is, candidate campaigns, political parties, PACs, fundraising groups etc...) In Illinois it includes all the data mentioned above, plus a history of which party primaries you voted in, and all of the political subdivision you are in. We, the Illinois Green Party, used it to build a Rails app for transcribing our candidate's ballot petitions, and then verifying addresses and signatures to make sure we have sufficient valid signatures, and were turning in our best sheets. Once the Democratic machine tried to challenge the petitions, we would have the voterid already looked up. It allows us to spread transcription and lookup to a dozen volunteers, and cost less to build and run than one days of lawyer fees the machine had to pay to just file the doomed objections.
That is my biggest problem with this issue. Not that the dolts that were responsible screwed up, but that it took MONTHS of internal "investigations" before some bright spark decided that it was time to share the facts with the people most affected. Typical Ontario Liberal nanny state policies.. Bad Dalton. Down boy, stop humping granny's leg!
"If the only tool that you have is a hammer, every problem looks like a nail." Donny Rumsfeld
2.4 million is approximately 8% of the Canadian population
So congratulations to the thief (or finder) for now knowing my birthday and former address.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
...and the thieves, once they (quickly) figure out how the fields are arranged and stored.
You can hold down the "B" button for continuous firing.
Age and if you even bother to vote are important demographics. Someone in the 20-25, 'college age' group likely has different things that are important to them than say, someone who is in the 55-60 age group. A USA example would be social security. Very few 20-somethings that I know are even remotely concerned with it. On the other hand, someone who is 60 is already likely to be face the choice to retire at 62 or hold out till 65. (I know, TFA was about our northern neighbors, but I'm sure there's a similar example for people who are more familiar with Canadian social programs). So that would definitely be a reason why they would be INTERESTED in date of birth. Now, if that should be considered publicly available info is up for debate
Free Pie! The Pie is Also Evil!
Now, if that should be considered publicly available info is up for debate
It's a matter of public record.
http://www.ontario.ca/en/ontgazette/STEL01_033657.html
http://www.gazette.gc.ca/index-eng.html
Each province has their own equivalent of the Gazette. If you know the name of somebody and the province they were born in (and seriously, there's only 10), you can find what year they were born in by searching by name. All births, deaths, and name changes are published as part of the vital statistics act. You *can* have something like that be non-published (I did a name change a few years ago that was non-published), but there's a *very* strict set of criteria under which it's allowed, and it's done by special request only.
Why would you include date of birth?
DoB is included because in Canada, we use government photo ID as a requirement to be allowed to vote. Your ID has to match, and in turn your name, address and DoB has to match the registar book. No matchy, no vote.
Om, nomnomnom...
$128 in Maryland:
http://www.elections.state.md.us/voter_registration/purchase_lists.html
(and you can get 'em on CD, rather than printed out ... I seem to recall it being a spreadsheet when I saw one ... don't know if it was a flat file that someone had imported, or if they gave it to you in Excell)
Build it, and they will come^Hplain.
It is because Elections Ontario has no unique way of identifying a voter, they do not keep any unique ID like SIN number, so the way they try to match people up is via address, name, dob, etc to determine who is who for the voters list. It's horrible. That's why some people get two voting cards for two polling stations etc, and some people don't ever get one.
The data wasn't encrypted so clearly it wasn't meant for internal use.
I'm going to go out get a bunch of credit, rack it right up, and then claim my identity was stolen. The banks can go after Elections Ontario for the bill.
Why would anyone be remotely concerned about this?
*NOBODY* knows how a given individual voted in Canada, unless that individual tells somebody. They might be able to tell if or when you voted... and of course where you were at when you voted, but there is no possible way, short of doing something that *WILL* get you put under arrest (with a likely prison sentence), knowing how somebody else voted in any federal or provincial election is just not going to happen unless you can get them to tell you. And even then, the only way you could know for sure that they weren't telling the truth if they decided to lie about it is if they claimed to vote for somebody who received zero votes at the polling station where they voted (which in my experience working at those stations a few times isn't terribly likely, because even the weirdest ones on the ballots that you might think wouldn't get any votes always seem to get the odd person or persons voting for them at any given station).
File under 'M' for 'Manic ranting'
I live in one of the affected ridings, but who cares? Ok, so my birthdate wouldn't be in the whitepages, but it's sure on Facebook. This information isn't private. It's the same stuff that's been in the phonebook for decades.
Why was that info on a USB stick (for one), and why wasn't that info protected?
I've got better things to do tonight than die.
I'm glad I didn't bother to vote in the last provincial election