Security bloggers and researchers claim to have uncovered a publicly available database exposing the personal information of 191 million voters on the Internet.
The information contains voters’ names, home addresses, voter IDs, phone numbers and date of birth, as well as political affiliations and a detailed voting history since 2000.
While in most states, voter registration lists are a matter of public record, many have regulations restricting access and use.
For example, South Dakota requires those requesting access to voter data to confirm that the information “may not be used or sold for any commercial purpose and may not be placed for unrestricted access on the internet.”
Security researcher Chris Vickery discovered the breach and reported it to DataBreaches.net, which has since reached out to law enforcement, as well as the California attorney general’s office.
“When one of their attorneys asked, ‘Well how much data are we talking about?’ and I read her the list of data fields and told her that we had access to voter records of over 17 million California voters, her response was ‘Wow,’ and she promptly forwarded the matter to the head of their e-crime division,” writes DataBreaches.net’s anonymous admin.
Steve Ragan, a security blogger for the security and risk management website CSO, has also investigated the breach, noting that none of the political database firms he identified and reached out to in connection with the database claimed ownership of the IP address where the files are posted.
“What Vickery has discovered is worse” than the recent breach of Hillary Clinton’s voter data by a member of Bernie Sanders’s campaign, Ragan writes, “because the data he discovered isn't a client score — it's a complete voter record for 191 million registered voters.”
“The problem is, no one seems to care that this database is out there and no one wants to claim ownership,” he says.
Because some states charge high fees for access to voter data, campaigns often turn to third-party vendors to purchase huge swaths of information at a lower price. They can then use the information to develop sophisticated data sets to help them gain an edge, much the way President Obama’s campaign did in 2012.
The exposed data set, for example, could be used as the backbone of a database for an issue-oriented campaign. Such databases can contain deeply personal information, such as whether you’re a gun owner, religious or believe in abortion.
Such information can then be used by criminals to target victims of the breach.
A police officer speaking to DataBreaches.net said that he intentionally keeps his address and other personal information off of the Internet to protect his family.
“I deal with criminals every day who know my name,” he told the site’s admin. “The thought of some vindictive criminal being able to go to this site and get my address makes me uncomfortable.”
Both Ragan and DataBreaches.net believe the dataset originated with the third-party vendor Nation Builder but that the poor configuration that resulted in its exposure was done by a customer that purchased the information.
Read more:
http://thehill.com/policy/cybersecurity/264297-report-191m-voter-records-exposed-publicly-online
