154 Million Voter Records Exposed Due To Database Error (dailydot.com) 95
blottsie writes: Chris Vickery, a security researcher at MacKeeper, has uncovered a new voter database containing 154 million voter records, exposed as a result of a CouchDB installation error. The database includes names, addresses, Facebook profile URLs, gun ownership, and more. Who exposed the voter database? Vickery believes the suspect may be linked to L2, a company specializing in voter data utilization, after he noticed that the voter ID field was labeled "LALVOTERID." After calling the company, L2 said the database likely belongs to one of their clients, noting that there are very few clients big enough to have a national database like that. The database was secured within three hours of their phone call. L2's CEO Bruce Willsie said that the client told L2 that they were hacked and the firewall had been taken down. Their client is conducting their own research to figure out the extent of the incursion. The Daily Dot reports: "Why does this keep happening, and what is our government doing about it? No federal agency is enforcing data security in political organizations or non-profits, and so far, neither are state attorneys general."
More exclusive than the one-percenters (Score:3)
They think only white men that own land can vote.
It's been infiltrated and corrupted by commies and anarchists over the years so it lost its purity, but that's the spirit of the electoral college.
Re: (Score:2)
Re: (Score:2)
Why would a database of voter records include a party affiliation field? Don't know how you do it in the US, but in the UK we only store the relationship between voter number and vote slip number, and even that is only on paper and burnt a year later along with the vote slips.
Party affiliation is public record in the states. How easy it is to obain the records varies, but some (like Florida) are downloadable, including home address (determines which local elections you are able to vote in).
Re: (Score:2)
It is for party primaries. So only party members can vote only for their party. You are given different ballets depending on your affiliation. This is different in each state.
Re: (Score:2)
It is for party primaries. So only party members can vote only for their party. You are given different ballets depending on your affiliation. This is different in each state.
Blue Swan vs Red Swan?
Re: (Score:2)
That's enough information for the Democrats Youth death squads. Currently they're just trying to kill trump, but anyone who vote against Clinton/Sanders will soon be a target too.
Re: (Score:2)
Proof of Residency
First name + middle name + Last Name
Date of Birth
Physical Dwelling Address
USPS Mailing Address (PO Box if used)
City
State
Zip/postal code
Party affiliation (Or None)
This is what I provide to my local Registrar of Voters. I also need a photo ID that matches the above info when I vote.
What's the problem? (Score:2)
If one accepts that all information may be freely shared unless specific restrictions apply, and if the people named in the database hold no such restrictions on those data, then what's the problem?
Re: (Score:2)
Someone saw a probelm (Score:1)
It was reported and quickly fixed. There is very little story here.
Why does it keep happening? (Score:5, Insightful)
My flippant answer:
Cause companies refuse to pay market rate for those who actually know how to secure these things , & pay for the hardware and services.
Honestly however, this is not a government issue, this is a private industry issue, and it's going to cost money.
Re: (Score:3)
This reminds me of the time that I worked in the returns department of a consumer goods manufacturing company.
The product was good but all I ever saw was the crap. Pallets and pallets of non-working things.
I didn't have a very good opinion of the company's product at that time.
However, the number of items returned was a tiny fraction of the amount of product sold.
My point is that when all you hear about is breach after breach, it is easy to come to the conclusion that everything is easily breached.
I don't t
Re: (Score:3, Insightful)
In software there are no consequences for idiocy. There are no laws governing the quality of software, e.g. requiring warranties or health and safety laws. In addition Software "Engineers" are not true engineers as there is no licensing procedure and unlike true engineers no liability for a poor design. So these so called Software "Engineers" can slap code together and get away with out getting sued. The same is true of Network "Engineers", Security "Engineers" etc.
There is no such thing as "Software Engine
Re: (Score:1)
The way the industry typically regulates software is by requiring testing. However, testing can't always predict edge cases, for which modern operating systems have a plethora of.
Ad
Re: (Score:2)
I don't recall most bridge engineers needing to deal with authentication, authorization, encryption (in transit and at rest), hashing, firewalls, routing tables, protocol configurations, and numerous other things that can be incredibly complicated while being very easy to misconfigure.
Do bridge engineers come back out to add new features to bridges every few weeks?
Has a bridge ever been moved from crossing a busy highway to crossing a river?
Are there bridge hackers who can unleash botnets to exploit vulnera
Re: (Score:2)
I like the way you think.
Re: (Score:3)
This.
Data breaches will halt very soon after litigation becomes the norm.
At this writing, gatekeepers are not held responsible.
For every breach, the custodian of the data should pay out the nose.
Until then?
Yawn.
Re: (Score:1)
Because "Oops" (Score:5, Insightful)
The reason it keeps happening is that when it happens, the CEO (who, incidentally, decided that security was an expense to be minimized) merely says "Oops, sorry." and then there are no consequences.
Re: (Score:2)
Re: (Score:2)
So the data had value. How about deducting the lost value from his bonus?
Re: (Score:3)
The reason it keeps happening is that when it happens, the CEO (who, incidentally, decided that security was an expense to be minimized) merely says "Oops, sorry." and then there are no consequences.
I think that's it. It's not that companies don't care about security, it's just that they can't really afford to care that much. Good security doesn't make them any money and bad security doesn't cost that much, in a world of finite resources the things with poor ROI are the ones that get neglected.
Re:Because "Oops" (Score:4, Insightful)
What needs to happen is that failure must be made expensive.
Re: (Score:2)
The problem is that personal data is hard to put a value on. Due to mass insecurity its value on the black market is quite low now, and it's always difficult to prove damages resulting from loss of it.
Why? Because they can't do it themselves (Score:4, Informative)
Re: (Score:2)
Yep, because all federal agencies are the same, right? And if some agency of the fed. gov. was given the task of writing the regs and enforcing them for security, Congress would take years to write the legislation to make it happen because the Conservatives would be screeching about fed. overreach, the right of people to be insecure, etc. The Liberals would get their panties in a knot over privacy and making sure it was multi-culti. Then the agency would be burdened with several Congressional committees' ov
So ALL the voters? (Score:4, Informative)
As of a couple years ago there were 146 million registered voters in the US. A 150m+ breach means EACH AND EVERY VOTER IN THE UNITED STATES.
Re: So ALL the voters? (Score:5, Interesting)
What voter database contains gun ownership?
NRA membership database perhaps? (Score:2)
Or firearms manufacturers.
Re: (Score:2)
What voter database contains gun ownership?
This database was created from 100's of other databases. Some states require you to register your firearms. Apparently those databases got included as well.
Re: (Score:1)
And this is exactly why mandatory firearm registration is such a huge no-go issue to anyone who actually cares.
no registration or no public info? (Score:2)
Re: (Score:2)
OMG! I found another breach! Right here: ON THE STATE OF OKLAHOMA'S OWN WEBSITE! [slashdot.org]
You see, it turns out voter registration database are a matter of Public Record. Not only are they not private, but states are legally required to provide them to citizens upon request.
There was no installation error (Score:3)
Re: (Score:3)
Unless the installation was so negligent it allowed an attack. This is clearly a case of trotting out the Evil Hackers(tm) to deflect focus on the company's stupidity.
Meh! (Score:2)
The names of registered voters, their party registration and whether they voted in an election is already publicly available information. The rest of what was listed in the story is just a matter of leg work that anyone can do if they want to. It doesn't seem like a big deal to me.
publicly available information (Score:5, Interesting)
People keep saying it was gathered from publicly available databases.
What publicly available database has gun ownership? Neither the states nor the feds knows who owns guns. It's against the law (I know, lol) for them to maintain a database of gun owners.
And how about household income? Where can a person get the household income of other people from a publicly available database?
Re: (Score:2)
Voter registration information is a public record. It is publicly available. In some states you have to send a letter and a few bucks for the DVD it's copied on. In others you have to check a TOS like form to promise not to use the data for commercial communications. Etc.
Voter registration is public information and it should be.
Who owns guns absolutely should not be held in any government database. There are laws that restrict exactly that (on the federal level). But don't kid yourself. California ex
Re: (Score:2)
Gun ownership info could be gathered from a number of sources. Those response cards on warranties where people indicate their interests, subscriber lists for magazines (which you can buy), etc. etc. It wouldn't be entirely accurate (there are lots of people who own guns who subscribe to Guns & Ammo, and people who don't own guns who do subscribe), but you can get a pretty decent approximation.
Household income's not that hard to get either (although not the official numbers).
Re: publicly available information (Score:2)
Gun ownership may not be known by governments generally, and shouldn't be. However, my great state of Illinois requires registration. Gun owners are registered in the Firearm Owner Identification (FOID) database. If you are caught with ammo in your car and you don't have a FOID card, you're the lucky recipient of a fresh felony charge (can happen if your spouse leaves ammo in the car).
That doesn't explain the other 49 states, and Illinois' data shouldn't be public, but unfortunately our government knows who
Re: (Score:2)
Why does this keep happening...? (Score:1)
That's what I asked when Die Hard 2 came out...
Wait... (Score:1)
Mackeeper = Malware (Score:2)
Re: (Score:2)
Re: (Score:3)
Was going to write the same. MacKeeper is paid malware, plain and simple. I don't know why they'd have security researchers, nor why such a researcher would be interested in such matters.
Because US privacy laws suck (Score:4, Informative)
For comparison, while data protection and privacy are fundamental rights in the EU, there is no equivalent protection in the US.
EU data protection consists of several principles, which include, rules on data quality standards, on sensitive data, independent supervision, the purpose limitation principle, rules on inter-agency exchange or transfer of data to third states, time limits for the retention of data, effective judicial review and access possibilities, independent oversight, proportionality elements, notification requirements after surveillance or data breaches, access, correction and deletion rights as well as rules on automated decisions, data security as well as technical protection. These rights and principles are subject to restrictions, but these restrictions are limited by proportionality elements and are continually subject to judicial review. Some of these EU rights, such as notification, supervision or judicial review can also be found in certain US Acts, for instance in the ECPA, however, they only exist in a mitigated form.
Most of the EU data protection guarantees simply do not exist in US law. Good for businesses, bad for humans.
Or maybe it should say 154 million voter records.. (Score:2)
WTF (Score:3)
>Chris Vickery, a security researcher at MacKeeper
Are you fucking kidding me?
An article quotes someone who is a "security researcher" for one of the biggest malware companies plaguing macs, and instead of being told to eat every dick on the planet, they're given a link on slashdot so they look somewhat legitimate??? GREAT FUCKING JOB!
it was a typo (Score:2)
LOLVOTERID, dammit, not his sister LALVOTERID.
"best in class", my ass. Couldn't even spell, ffs
Security researcher? (Score:2)
MacKeeper is the biggest distributor of Mac MALWARE. WTF?
Voter registrations are NOT private (Score:3)
Voter registration records include voters' name, address, date of birth, political affiliation, voter ID number, precinct and voting history, technology center district, school district and municipality.
I used to have a copy for my precinct on my hard-drive. A candidate just up and emailed it to me, unasked.
Re: (Score:2)
Correct.
But in the entire EU, for instance, linking such data to anything else - including date of birth, or facebook profile, etc. instantly takes it out of the "it's just public data" into it's "protected data".
And in the EU - under our data protection laws that the US currently refuse to abide by causing all sorts of problems with cloud services - this breach would cost you MILLIONS of dollars. Literally, a hospital was fined hundreds of thousands for losing a handful of medical records that they COULDN