154 Million Voter Records Exposed Due To Database Error (dailydot.com)

blottsie writes: Chris Vickery, a security researcher at MacKeeper, has uncovered a new voter database containing 154 million voter records, exposed as a result of a CouchDB installation error. The database includes names, addresses, Facebook profile URLs, gun ownership, and more. Who exposed the voter database? Vickery believes the suspect may be linked to L2, a company specializing in voter data utilization, after he noticed that the voter ID field was labeled "LALVOTERID." After calling the company, L2 said the database likely belongs to one of their clients, noting that there are very few clients big enough to have a national database like that. The database was secured within three hours of their phone call. L2's CEO Bruce Willsie said that the client told L2 that they were hacked and the firewall had been taken down. Their client is conducting their own research to figure out the extent of the incursion. The Daily Dot reports: "Why does this keep happening, and what is our government doing about it? No federal agency is enforcing data security in political organizations or non-profits, and so far, neither are state attorneys general."

Comments

What's the problem?

[DoofusOfDeath]

"Why does this keep happening, and what is our government doing about it?"

If one accepts that all information may be freely shared unless specific restrictions apply, and if the people named in the database hold no such restrictions on those data, then what's the problem?

Re: What's the problem?

[ememisya]

I think this can be seen as "the government" demonstrating why it's a terrible idea to have digital records online for something as sensitive as voter information.

Why does it keep happening?

[hrieke]

My flippant answer:
Cause companies refuse to pay market rate for those who actually know how to secure these things , & pay for the hardware and services.

Honestly however, this is not a government issue, this is a private industry issue, and it's going to cost money.

Re:Why does it keep happening?

[plopez]

In software there are no consequences for idiocy. There are no laws governing the quality of software, e.g. requiring warranties or health and safety laws. In addition Software "Engineers" are not true engineers as there is no licensing procedure and unlike true engineers no liability for a poor design. So these so called Software "Engineers" can slap code together and get away with out getting sued. The same is true of Network "Engineers", Security "Engineers" etc.

There is no such thing as "Software Engineering".

Re:Why does it keep happening?

[The_Revelation]

I don't know that I completely agree. I think Software Engineers are forgiven mistakes given the complexity of the environment within which they work, however there is liability in any industry, and depending on the level to which you are producing products (ie. medical, scientific), they are held to a certain level of quality.

The way the industry typically regulates software is by requiring testing. However, testing can't always predict edge cases, for which modern operating systems have a plethora of.

Additionally, the product that the engineer produces can only be as good as the tools on which it is running, and often the fault will either come from hardware or the bugs in the runtime environment.

Besides all of this, typically Computer Systems Engineers who choose to major in software still have to do all the other STEM subjects the rest of the faculty does.

Often, the real problem is that the products are designed by Companies rather than individual Software Engineers. That said, look at the guys that made The Pirate Bay, or Napster. They were clearly held accountable for their software.

Re:Why does it keep happening?

[The-Ixian]

This reminds me of the time that I worked in the returns department of a consumer goods manufacturing company.

The product was good but all I ever saw was the crap. Pallets and pallets of non-working things.

I didn't have a very good opinion of the company's product at that time.

However, the number of items returned was a tiny fraction of the amount of product sold.

My point is that when all you hear about is breach after breach, it is easy to come to the conclusion that everything is easily breached.

I don't think that is true. Just think about all of the databases in the world.

I would be willing to bet that the odds of being breached are still fairly low if you actually spend the resources on taking reasonable security measures.

I think that what we are seeing is an intersection between growing computer savvy (as everyone who grows up with the technology really grok it) and status quo (legacy) network concepts.

I think it is absolutely possible to secure a network if the will to do it is there.

Re:Why does it keep happening?

[CaptainDork]

This.

Data breaches will halt very soon after litigation becomes the norm.

At this writing, gatekeepers are not held responsible.

For every breach, the custodian of the data should pay out the nose.

Until then?

Yawn.

Re:Why does it keep happening?

[Thud457]

You're a real nasty piece of work.
I like the way you think.

Re:Why does it keep happening?

[bondsbw]

I don't recall most bridge engineers needing to deal with authentication, authorization, encryption (in transit and at rest), hashing, firewalls, routing tables, protocol configurations, and numerous other things that can be incredibly complicated while being very easy to misconfigure.

Do bridge engineers come back out to add new features to bridges every few weeks?

Has a bridge ever been moved from crossing a busy highway to crossing a river?

Are there bridge hackers who can unleash botnets to exploit vulnerabilities in hundreds of thousands of bridges around the world at the same time? How many orchestrated DOS attacks are conducted on bridges?

Hell, most bridges are vulnerable to something as simple as exploding a fuel truck nearby. (Which happened again to the exact same bridge less than 3 years later.)

Yes, people would be screaming. Bridges would need to be tremendously more complicated and would be subject to attacks that can be performed at nearly the speed of light. But that isn't the case; your analogy is flawed.

Frankly, it's easy when your discipline is built on top of a very consistent foundation such as physics. Software engineering is built on layers upon layers of mathematical and organizational abstraction, each layer making it easier to reason about things but potentially introducing issues which are outside of what you expected to deal with. (Not to mention that the number of computer systems in the world is so large that we simply can't produce enough qualified engineers to adequately harden all of them, or even most of them.)

Re:Why does it keep happening?

[DontTrustWhatIType]

That's part of the problem - the other is that there are too many people who claim to know what they are doing when it comes to privacy and security, too few who actually do, and no one who is hiring can tell the difference. Getting a cert or a degree does not make you an expert.

Because "Oops"

[penguinoid]

The reason it keeps happening is that when it happens, the CEO (who, incidentally, decided that security was an expense to be minimized) merely says "Oops, sorry." and then there are no consequences.

Re:Because "Oops"

[tomhath]

What consequences do you think there should be in this case? The data was already publicly available - L2 was selling it to anyone willing to write a check.

Re:Because "Oops"

[quantaman]

The reason it keeps happening is that when it happens, the CEO (who, incidentally, decided that security was an expense to be minimized) merely says "Oops, sorry." and then there are no consequences.

I think that's it. It's not that companies don't care about security, it's just that they can't really afford to care that much. Good security doesn't make them any money and bad security doesn't cost that much, in a world of finite resources the things with poor ROI are the ones that get neglected.

Re:Because "Oops"

[whoever57]

L2 was selling it to anyone willing to write a check.

So the data had value. How about deducting the lost value from his bonus?

Re:Because "Oops"

[plopez]

What needs to happen is that failure must be made expensive.

Re:Because "Oops"

[AmiMoJo]

The problem is that personal data is hard to put a value on. Due to mass insecurity its value on the black market is quite low now, and it's always difficult to prove damages resulting from loss of it.

Why? Because they can't do it themselves

[John Jorsett]

The feds do a lousy job of it themselves, in fact a much worse job. The Office of Personnel Management leak exposed millions of security-cleared personnel's records, including mine. I've already had somebody try to get credit in my name, probably from that breach (but could be from one that my former employer suffered as well). The OPM leak contained exponentially more revealing info than this one. I haven't heard of anyone getting fired for it, either, just the director getting to "step down". BFD.

Re:Why? Because they can't do it themselves

[gtall]

Yep, because all federal agencies are the same, right? And if some agency of the fed. gov. was given the task of writing the regs and enforcing them for security, Congress would take years to write the legislation to make it happen because the Conservatives would be screeching about fed. overreach, the right of people to be insecure, etc. The Liberals would get their panties in a knot over privacy and making sure it was multi-culti. Then the agency would be burdened with several Congressional committees' oversight because every two-bit committee chair would think they should have a say. Once enacted, special interest groups would sue on whatever grounds makes them happy. Several years later, the fed. agency is now tasked.

Now let's say the first company to get the shaft over bad security by our fed. agency decides its legal team should have a go. That's several more years of legal fees. The outcome is uncertain and companies would quickly realize it is cheaper to pay their legal dept (they are there all the time anyhow) than actually fix security.

Now...about the federal gov's security, it really has nothing to do with how it would enforce security, does it?

Re:What else is there and where do they get the da

[Sperbels]

Of course I know that such information can be stitched together from various databases and online sources if one makes a concerted effort to do so. I kind of surprised they've done that though.

So ALL the voters?

[Anonymous Coward]

As of a couple years ago there were 146 million registered voters in the US. A 150m+ breach means EACH AND EVERY VOTER IN THE UNITED STATES.

Re: So ALL the voters?

[Anonymous Coward]

What voter database contains gun ownership?

Re: So ALL the voters?

[packrat0x]

What voter database contains gun ownership?

This database was created from 100's of other databases. Some states require you to register your firearms. Apparently those databases got included as well.

Re: So ALL the voters?

[Anonymous Coward]

And this is exactly why mandatory firearm registration is such a huge no-go issue to anyone who actually cares.

Re:So ALL the voters?

[T.E.D.]

OMG! I found another breach! Right here: ON THE STATE OF OKLAHOMA'S OWN WEBSITE!

You see, it turns out voter registration database are a matter of Public Record. Not only are they not private, but states are legally required to provide them to citizens upon request.

There was no installation error

[campuscodi]

From the article: "Willsie stated that the client told L2 that they were hacked and the firewall had been taken down. The client was now conducting their own research to determine the extent of the incursion." It was a hack, not an installation error.

Re:There was no installation error

[plopez]

Unless the installation was so negligent it allowed an attack. This is clearly a case of trotting out the Evil Hackers(tm) to deflect focus on the company's stupidity.

Meh!

[riverat1]

The names of registered voters, their party registration and whether they voted in an election is already publicly available information. The rest of what was listed in the story is just a matter of leg work that anyone can do if they want to. It doesn't seem like a big deal to me.

publicly available information

[clovis]

People keep saying it was gathered from publicly available databases.

What publicly available database has gun ownership? Neither the states nor the feds knows who owns guns. It's against the law (I know, lol) for them to maintain a database of gun owners.

And how about household income? Where can a person get the household income of other people from a publicly available database?

Re:publicly available information

[guevera]

Voter registration information is a public record. It is publicly available. In some states you have to send a letter and a few bucks for the DVD it's copied on. In others you have to check a TOS like form to promise not to use the data for commercial communications. Etc.

Voter registration is public information and it should be.

Who owns guns absolutely should not be held in any government database. There are laws that restrict exactly that (on the federal level). But don't kid yourself. California explicitly records the sale of every gun in a state DOJ database. Is it legal? Probably not. And if you've got 10 years and a few million bucks to spare on a quixotic pursuit of justice, you can try and prove it.

Re:publicly available information

[jratcliffe]

Gun ownership info could be gathered from a number of sources. Those response cards on warranties where people indicate their interests, subscriber lists for magazines (which you can buy), etc. etc. It wouldn't be entirely accurate (there are lots of people who own guns who subscribe to Guns & Ammo, and people who don't own guns who do subscribe), but you can get a pretty decent approximation.

Household income's not that hard to get either (although not the official numbers).

Re: publicly available information

[31415926535897]

Gun ownership may not be known by governments generally, and shouldn't be. However, my great state of Illinois requires registration. Gun owners are registered in the Firearm Owner Identification (FOID) database. If you are caught with ammo in your car and you don't have a FOID card, you're the lucky recipient of a fresh felony charge (can happen if your spouse leaves ammo in the car).

That doesn't explain the other 49 states, and Illinois' data shouldn't be public, but unfortunately our government knows who owns guns. In theory you might have a FOID and no gun, but that's probably a very small percentage. (And I should add: the gang bangers in Chicago who get their guns illegally definitely don't have this ID)

Re:publicly available information

[Software]

It's probably a compilation of data from public records (such as voting registration) and private records (household surveys, etc.).

Why does this keep happening...?

[fustakrakich]

That's what I asked when Die Hard 2 came out...

Wait...

[vomitology]

Facebook IDs are part of a voting record?

Mackeeper = Malware

[MacColossus]

Mackeeper is the number 1 source of adware and malware on the Mac. This "security researcher" works for a company that is evil as f*ck. I'm guessing he hacked and shared the database and then claimed white hat glory for finding the breach. SMH.

Re:Mackeeper = Malware

[jasnw]

Wish I had mod points. I was just about to suggest that before anyone takes this report too seriously, a report based on one source, that they go and google MacKeeper. I think I would throw the bullshit flag on this unless it's confirmed by a real, and honest, cybersecurity firm. There's lots of things in this that don't make much sense.

Re:Mackeeper = Malware

[tgv]

Was going to write the same. MacKeeper is paid malware, plain and simple. I don't know why they'd have security researchers, nor why such a researcher would be interested in such matters.

Because US privacy laws suck

[cliffjumper222]

For comparison, while data protection and privacy are fundamental rights in the EU, there is no equivalent protection in the US.

EU data protection consists of several principles, which include, rules on data quality standards, on sensitive data, independent supervision, the purpose limitation principle, rules on inter-agency exchange or transfer of data to third states, time limits for the retention of data, effective judicial review and access possibilities, independent oversight, proportionality elements, notification requirements after surveillance or data breaches, access, correction and deletion rights as well as rules on automated decisions, data security as well as technical protection. These rights and principles are subject to restrictions, but these restrictions are limited by proportionality elements and are continually subject to judicial review. Some of these EU rights, such as notification, supervision or judicial review can also be found in certain US Acts, for instance in the ECPA, however, they only exist in a mitigated form.

Most of the EU data protection guarantees simply do not exist in US law. Good for businesses, bad for humans.

Or maybe it should say 154 million voter records..

[guevera]

...exposed because they're public record.

WTF

[GrandCow]

>Chris Vickery, a security researcher at MacKeeper

Are you fucking kidding me?

An article quotes someone who is a "security researcher" for one of the biggest malware companies plaguing macs, and instead of being told to eat every dick on the planet, they're given a link on slashdot so they look somewhat legitimate??? GREAT FUCKING JOB!

it was a typo

[Provocateur]

LOLVOTERID, dammit, not his sister LALVOTERID.

"best in class", my ass. Couldn't even spell, ffs

NRA membership database perhaps?

[wiredog]

Or firearms manufacturers.

Re: What else is there and where do they get the d

[packrat0x]

Why would a database of voter records include a party affiliation field? Don't know how you do it in the US, but in the UK we only store the relationship between voter number and vote slip number, and even that is only on paper and burnt a year later along with the vote slips.

Party affiliation is public record in the states. How easy it is to obain the records varies, but some (like Florida) are downloadable, including home address (determines which local elections you are able to vote in).

Security researcher?

[dnaumov]

MacKeeper is the biggest distributor of Mac MALWARE. WTF?

More exclusive than the one-percenters

[lucm]

They think only white men that own land can vote.

It's been infiltrated and corrupted by commies and anarchists over the years so it lost its purity, but that's the spirit of the electoral college.

Re:What else is there and where do they get the da

[lucm]

That's enough information for the Democrats Youth death squads. Currently they're just trying to kill trump, but anyone who vote against Clinton/Sanders will soon be a target too.

no registration or no public info?

[stomv]

The government has a whole bunch of info that it collects but doesn't make public. Drivers license info. Social security info. Information about minors. Tax information. Are you arguing that "anyone who actually cares" is against the Federal Government collecting information on gun ownership or on making that information public? Because if its the former, does "anyone who actually cares" also oppose all government collection of information?

Voter registrations are NOT private

[T.E.D.]

Note that a state's voter registration records are NOT private data. Its public record, and anybody has a right to ask for it. For example, here's a link to where you can get the entire registration database for my state.

Voter registration records include voters' name, address, date of birth, political affiliation, voter ID number, precinct and voting history, technology center district, school district and municipality.

I used to have a copy for my precinct on my hard-drive. A candidate just up and emailed it to me, unasked.

Re:Voter registrations are NOT private

[ledow]

Correct.

But in the entire EU, for instance, linking such data to anything else - including date of birth, or facebook profile, etc. instantly takes it out of the "it's just public data" into it's "protected data".

And in the EU - under our data protection laws that the US currently refuse to abide by causing all sorts of problems with cloud services - this breach would cost you MILLIONS of dollars. Literally, a hospital was fined hundreds of thousands for losing a handful of medical records that they COULDN'T prove were encrypted when they were put onto a disc for transfer (that was then lost in the post). Get that? A huge fine for not being able to reasonable prove the disc was encrypted before you sent it?

The "solution" that the summary is looking for? Proper data protection laws like everyone else has.

Literally, I work in schools. I can be PERSONALLY liable if data leaks out that includes, say, a child's name and the class they are in , or their date of birth, or their latest exam score. It's all classed as "personal data" and thus, if held on a computer, subject to the Data Protection Act and, as such, if the leak is due to an ability to disprove it was any minor failing on my part, I can be held liable myself. Let alone the company I work for. Let alone if you're just slack and don't follow best practice.

That's how you stop that shit leaking out. You enforce the damn laws.

Literally, have been > this close to having an unrelated member of staff sacked because they ignored the IT user agreement with regards to this and typed in some kid's names and dates of births on a website registered in Panama (i.e. not subject to EU Data Protection). As it was, there was a massive fuss, full backup from my superiors all the way to the top, immediate cessation of use of the service, and complete audit of what services we use along with every-staff warning. Are we a multi-national? Nope, we're a small prep school (ages 5-13). Did data actually get out or get made public? Nope. Did the potential legal consequences scare the shit out of the school leadership? Absolutely.

Is this the norm in Europe? Yes. You can find any number of cases and "it was a rogue employee" just doesn't cut it as a defence any more.

But America won't respect that we have to do this with any data on our people, so we can't use your cloud services for many things AT ALL, you won't provide guarantees that you'll follow EU law while in the EU (Google have, OneCloud have, but others - e.g. iCloud - had not last time I checked - this is why AWS has so many European centres). And you keep asking us for full personal data for flying to America and refuse to secure that in anywhere near the same fashion.

Data protection is something to take seriously. But in a country where your SSN is this magic secret number that can be abused to do powerful things, it's shocking that they still haven't learned that.

Re: What else is there and where do they get the d

[Woldscum]

It is for party primaries. So only party members can vote only for their party. You are given different ballets depending on your affiliation. This is different in each state.

Re:What else is there and where do they get the da

[Woldscum]

Proof of Residency
First name + middle name + Last Name
Date of Birth
Physical Dwelling Address
USPS Mailing Address (PO Box if used)
City
State
Zip/postal code
Party affiliation (Or None)

This is what I provide to my local Registrar of Voters. I also need a photo ID that matches the above info when I vote.

Re: What else is there and where do they get the d

[whitesea]

It is for party primaries. So only party members can vote only for their party. You are given different ballets depending on your affiliation. This is different in each state.

Blue Swan vs Red Swan?