Slashdot Mirror
IT Worker Fired After Massive Georgia Data Breach Speaks Out (ajc.com)
McGruber writes: On November 17, two Georgia women filed a class action lawsuit alleging that Georgia Secretary of State Brian Kemp had released the Social Security numbers, birthdates, Drivers License numbers and other private information of all registered voters in Georgia. After the lawsuit was filed, Secretary Kemp posted an official notice of the breach on his website as required by Georgia state law.
Secretary Kemp also sent a private letter to Georgia lawmakers describing how the breach happened. In the letter, obtained by The Atlanta Journal-Constitution, Kemp said his office learned of the foul-up on Nov. 13 — four days before any public acknowledgment of the problem. In that private letter to Georgia lawmakers, Kemp also stated that he fired the IT worker who had inadvertently added the personal data including Social Security numbers and birth dates to the public statewide voter file.
Now that fired IT worker, longtime state programmer Gary Cooley, has told the Atlanta Journal Constitution newspaper that he did not actually have the security access necessary to add millions of Social Security numbers and birth dates to the data file that was released to the public. While Cooley does acknowledge a role in the gaffe, he also outlined a more complicated series of missteps and miscommunications both within Kemp's office and with PCC Technology Group, an outside vendor tasked with managing voter data for the state.
Secretary Kemp also sent a private letter to Georgia lawmakers describing how the breach happened. In the letter, obtained by The Atlanta Journal-Constitution, Kemp said his office learned of the foul-up on Nov. 13 — four days before any public acknowledgment of the problem. In that private letter to Georgia lawmakers, Kemp also stated that he fired the IT worker who had inadvertently added the personal data including Social Security numbers and birth dates to the public statewide voter file.
Now that fired IT worker, longtime state programmer Gary Cooley, has told the Atlanta Journal Constitution newspaper that he did not actually have the security access necessary to add millions of Social Security numbers and birth dates to the data file that was released to the public. While Cooley does acknowledge a role in the gaffe, he also outlined a more complicated series of missteps and miscommunications both within Kemp's office and with PCC Technology Group, an outside vendor tasked with managing voter data for the state.
News at 11:00
to take the fall. it's not the tech, that's India's bailiwick.
It says to keep following for updates and that the programmer says it's more complicated. I'm sure it is, but can we have a link that details or explains how?
for those unwilling to shuffle through two links and random popups, heres the situation:
Cooley doesnt seem to be an IT guy at all, just a liaison for an IT outsource firm that handles the data for Georgia. his department got a request from the revenue department for the data. Cooley then got approval from his departments lawyers and requested the new datafile with sensitive info. The vendor however didnt understand the request and put the sensitive data on a public network share. Cooley quickly removed it from the share, but --and this is key-- an entirely separate group of people copied the file, burned it to CD, and released it to a far broader audience. Cooley did his job, but is being blamed for something hes entirely not a part of. Namely, some other agencies cock-up.
instead of "coming clean" to a newspaper, he should have filed a wrongful termination suit. I'd wager Cooley doesnt care about that, and is just glad to get out from an underpaying cube-slave job with low oversight and piss poor accountability and management.
Good people go to bed earlier.
Nothing will change until top people like Brian Kemp or the former head of OPM are thrown into jail for years.
It was all 100% the sacrificial lamb's fault.
This message has been approved by YAHWEH.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Take your politics else where.
Unless he's got some dream friends in high places, his career is over. When he gives for anther job - right or wrong - potential employer will see he went public.
It's worse if he tries to consult on his own.
Doesn't matter if it's not the best to be fired, just as long as someone is made accountable! Go Georgia State!
Why is there a link to the article, that talks about this other link to the actual article. That's just weird.
It's not every day a data breach speaks out.
I dont usually complain about articles but what the fuck slashdot
I was actually interested in this shit! that article says no fucking thing.
-
He may not have had the access to browse through such data, but I bet he is the one who posted the data to the website. Personal info is commonly kept out of easy IT reach, though honestly most IT Directors would be able to easily circumvent such things since they are the ones that put the security restrictions in place.
Normally you'd have to go through some type of Human Resources person to get such data, but in any case the data did not post itself and the IT person was still in the best position to understand the error and strop it before it happened.
If your an IT guy and you do something that your expertise should prevent at this level, you still should get fired. That's why people hire IT techs. If an Office Manager asked me to do something I know is either wrong or risky, it's the IT departments job to say no with all it's force. Sure, it would be nice to have open remote desktops to all your computers so employees could work at home, and to a layman that could even seem like a reasonable idea, but to someone with IT knowledge it would be a move that would almost guarantee a high chance of data loss or sabotage.
When you hire a plumber, for instance, you're hiring an expert in their field. If the home owner tell you to do something against code, you say no. It's that simple. Knowing your reputation and employee info is at risk, you're supposed to head these kinds of things off, not blindly obey people without computer knowledge. It's the IT techs job to perform the due diligence of the position, that's ultimately why they get paid well, they are responsible for potentially millions of dollars in data. Boss come and go, data breaches are forever. In almost any field your expertise must come first, not your obedience.
This ^
Looks like Kemp is "canned dog shit!"
Ever body in Georgia dot Gov needs to:
1) Bunker
2) Clam Up
3) Go DEEP COVER ... get OFF THE GRID ... use the fake passport, enter Greece, claim Political Asylum ... Pronto!
People should stop using birth dates and social security numbers for security or identification purposes. We should use smart cards and public keys for identification, both for government services and financial transactions.
Where's an editor when you need one?
"The new file, he told them in an email, should include the same layout as the state’s regular statewide voter file. But, he said, it needed an addition of the three new data fields with the sensitive information."
Should be easy enough to verify this if the email hasn't been deleted or modified. If the request was to put the fields in a new file, onus on the other party. If not, onus on the Cooley.
blindly antisocialist = antisocial
We didn't have this problem with paper ballots. Everything is IT's fault now a days...
Why do we even allow this data to even exist? Did they also keep the data on how we voted?
I'm sure the Lawyers are happy.
Of course they send out party affiliation.. That's probably the most important part. it's what parties use to go "get out the vote" (or, more cynically, to construct an effective voter suppression approach) Whether the Revenue folks need it is sort of immaterial. I'd rather the process have a single standard distribution and send it out to whoever asks, or, for gosh sakes, put it online. Voter registration is a classic public record.
(You can always register as "decline to state", but then you don't necessarily get to vote in the primary, which is where the fun is)
The Sec of State in GA is an elected position and as a result Kemp answers to no-one, not even the Governor. Kemp answers to the voters, only. And only on election day. And in this state the voters are probably going to give a blank stare about all of this mess. Burning CDs is majick wizard stuff.
So Kemp will be re-elected next round.
Sig for hire.
"Cooley said the story began in late summer when the Secretary of State’s Office received a request from the Georgia Department of Revenue. The state agency, he said, wanted regular voter files plus something not given out to the public: voters’ Social Security numbers, birth dates and driver’s license numbers."
I can understand voter records including an address and birth date (verifying someone is old enough to vote and in the right precinct, and easier distinguishing between multiple people in a home with the same or similar name). But why do voter records need to include social security numbers and drivers license numbers? And why does the department of revenue need to see a list of voters? You should be able to vote without driving a car, social security numbers should only be used for social security and taxes, and voting shouldn't come with the threat of a government auditor showing up at your door. If the information isn't tracked and stored, then it can't be leaked or abused.
I'll be eagerly watching. With a headline as tantilizing as that, I wanna hear what the massive Georgia data breach said that caused the IT worker to get fired.
They are making him train his H1B replacement.
Why did Cooley request a new datafile with the sensitive information in the first place? Was he going to have someone run a script to cross-reference it with something else (like another datafile or database) so they could verify the info was authentic?
Ahh, you're new here or not paying attention. So, now that you've seen this at the state level, how do you think this goes at the Federal level where the IRS is part of the Obama Healthcare enforcement? Your medical and financial (all of it) can now be intermingled by similar mistakes, omissions, and f' ups.