Slashdot Mirror
154 Million Voter Records Exposed Due To Database Error (dailydot.com)
blottsie writes: Chris Vickery, a security researcher at MacKeeper, has uncovered a new voter database containing 154 million voter records, exposed as a result of a CouchDB installation error. The database includes names, addresses, Facebook profile URLs, gun ownership, and more. Who exposed the voter database? Vickery believes the suspect may be linked to L2, a company specializing in voter data utilization, after he noticed that the voter ID field was labeled "LALVOTERID." After calling the company, L2 said the database likely belongs to one of their clients, noting that there are very few clients big enough to have a national database like that. The database was secured within three hours of their phone call. L2's CEO Bruce Willsie said that the client told L2 that they were hacked and the firewall had been taken down. Their client is conducting their own research to figure out the extent of the incursion. The Daily Dot reports: "Why does this keep happening, and what is our government doing about it? No federal agency is enforcing data security in political organizations or non-profits, and so far, neither are state attorneys general."
“This was an old copy (from about a year ago) of the national file and it had only a very small number of our standard fields,” Willsie wrote to Vickery, adding, “I’ve asked that they report back to us with their findings and their plan for hardening their system in the future.”
17 relevant information points is very small number of standard fields? Who are these people, and what kind of databases do they have for everyone?
Well I'll be dipped in shit and rolled in breadcrumbs. Who woulda thought? This almost never happens.
No, i just hate you.
I want you to die. To die.
If one accepts that all information may be freely shared unless specific restrictions apply, and if the people named in the database hold no such restrictions on those data, then what's the problem?
It was reported and quickly fixed. There is very little story here.
My flippant answer:
Cause companies refuse to pay market rate for those who actually know how to secure these things , & pay for the hardware and services.
Honestly however, this is not a government issue, this is a private industry issue, and it's going to cost money.
III.IIVIVIXIIVIVIIIVVIIIIXVIIIXIIIIIIIIVIIIIVVIII
The reason it keeps happening is that when it happens, the CEO (who, incidentally, decided that security was an expense to be minimized) merely says "Oops, sorry." and then there are no consequences.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
The feds do a lousy job of it themselves, in fact a much worse job. The Office of Personnel Management leak exposed millions of security-cleared personnel's records, including mine. I've already had somebody try to get credit in my name, probably from that breach (but could be from one that my former employer suffered as well). The OPM leak contained exponentially more revealing info than this one. I haven't heard of anyone getting fired for it, either, just the director getting to "step down". BFD.
Of course I know that such information can be stitched together from various databases and online sources if one makes a concerted effort to do so. I kind of surprised they've done that though.
As of a couple years ago there were 146 million registered voters in the US. A 150m+ breach means EACH AND EVERY VOTER IN THE UNITED STATES.
that exposed this issue I presume?
We first should get rid of that invading piece of junk that is pushing me around every since I got a Mac.
No, it was just you.
From the article: "Willsie stated that the client told L2 that they were hacked and the firewall had been taken down. The client was now conducting their own research to determine the extent of the incursion." It was a hack, not an installation error.
The names of registered voters, their party registration and whether they voted in an election is already publicly available information. The rest of what was listed in the story is just a matter of leg work that anyone can do if they want to. It doesn't seem like a big deal to me.
People keep saying it was gathered from publicly available databases.
What publicly available database has gun ownership? Neither the states nor the feds knows who owns guns. It's against the law (I know, lol) for them to maintain a database of gun owners.
And how about household income? Where can a person get the household income of other people from a publicly available database?
That's what I asked when Die Hard 2 came out...
“He’s not deformed, he’s just drunk!”
I wonder why they need so much data attached to voting records? If I were a politician and I had access to that data I wonder what I would do? Seems legit though that they need your facebook and gun ownership status to count votes and such.
This amateur-hour shit makes me sick. Saved some money outsourcing your IT work to Pakistan, eh, fuckers?
Facebook IDs are part of a voting record?
~Knowledge is knowing that a tomato is a fruit, but Wisdom is knowing not to put it in a fruit salad.
Mackeeper is the number 1 source of adware and malware on the Mac. This "security researcher" works for a company that is evil as f*ck. I'm guessing he hacked and shared the database and then claimed white hat glory for finding the breach. SMH.
Preferably pinned in an auto accident and burning to death.
Astroturf. Go incite your flamewars somewhere else.
For comparison, while data protection and privacy are fundamental rights in the EU, there is no equivalent protection in the US.
EU data protection consists of several principles, which include, rules on data quality standards, on sensitive data, independent supervision, the purpose limitation principle, rules on inter-agency exchange or transfer of data to third states, time limits for the retention of data, effective judicial review and access possibilities, independent oversight, proportionality elements, notification requirements after surveillance or data breaches, access, correction and deletion rights as well as rules on automated decisions, data security as well as technical protection. These rights and principles are subject to restrictions, but these restrictions are limited by proportionality elements and are continually subject to judicial review. Some of these EU rights, such as notification, supervision or judicial review can also be found in certain US Acts, for instance in the ECPA, however, they only exist in a mitigated form.
Most of the EU data protection guarantees simply do not exist in US law. Good for businesses, bad for humans.
First name + middle names
Last Name/Family Name
Date of Birth
Gender
Apartment Number
Street Number
City
State
Zip/postal code
Home phone
Mobile/cell phone
Work phone
Email
Party affiliation
Would be what I expect at the very least in a US based voter database. That's 14.
The fact that they store districts in the database rather than generating on the fly from the address adds a few.
So 17 isn't that surprising at all.
...exposed because they're public record.
>Chris Vickery, a security researcher at MacKeeper
Are you fucking kidding me?
An article quotes someone who is a "security researcher" for one of the biggest malware companies plaguing macs, and instead of being told to eat every dick on the planet, they're given a link on slashdot so they look somewhat legitimate??? GREAT FUCKING JOB!
"Well kids, you tried your best, and you failed. The lesson is, never try." -Homer Simpson
Why would a database of voter records include a party affiliation field? Don't know how you do it in the US, but in the UK we only store the relationship between voter number and vote slip number, and even that is only on paper and burnt a year later along with the vote slips.
LOLVOTERID, dammit, not his sister LALVOTERID.
"best in class", my ass. Couldn't even spell, ffs
WARNING: Smartphones have side effects--most of them undocumented.
Or firearms manufacturers.
Best Slashdot Co
Why would a database of voter records include a party affiliation field? Don't know how you do it in the US, but in the UK we only store the relationship between voter number and vote slip number, and even that is only on paper and burnt a year later along with the vote slips.
Party affiliation is public record in the states. How easy it is to obain the records varies, but some (like Florida) are downloadable, including home address (determines which local elections you are able to vote in).
227-3517
MacKeeper is the biggest distributor of Mac MALWARE. WTF?
They think only white men that own land can vote.
It's been infiltrated and corrupted by commies and anarchists over the years so it lost its purity, but that's the spirit of the electoral college.
lucm, indeed.
That's enough information for the Democrats Youth death squads. Currently they're just trying to kill trump, but anyone who vote against Clinton/Sanders will soon be a target too.
lucm, indeed.
The government has a whole bunch of info that it collects but doesn't make public. Drivers license info. Social security info. Information about minors. Tax information. Are you arguing that "anyone who actually cares" is against the Federal Government collecting information on gun ownership or on making that information public? Because if its the former, does "anyone who actually cares" also oppose all government collection of information?
Support a few technologists in Washington.
Voter registration records include voters' name, address, date of birth, political affiliation, voter ID number, precinct and voting history, technology center district, school district and municipality.
I used to have a copy for my precinct on my hard-drive. A candidate just up and emailed it to me, unasked.
they're just trying to kill trump
No need. He's doing that himself.
Too quick.
With his/her scrotum/labia nailed to the top of a fire ant mound, covered in honey.
It is for party primaries. So only party members can vote only for their party. You are given different ballets depending on your affiliation. This is different in each state.
Proof of Residency
First name + middle name + Last Name
Date of Birth
Physical Dwelling Address
USPS Mailing Address (PO Box if used)
City
State
Zip/postal code
Party affiliation (Or None)
This is what I provide to my local Registrar of Voters. I also need a photo ID that matches the above info when I vote.
It is for party primaries. So only party members can vote only for their party. You are given different ballets depending on your affiliation. This is different in each state.
Blue Swan vs Red Swan?
That's enough information for the Democrats Youth death squads.
The death squads have their hands full with all of the Obamacare patients whose fates they're deciding.