Personal info on 200 million Americans left available to the public
9The security hole was left by a Republican-connected consulting firm.
It is not known known whether anyone “nefarious” (i.e. other than “white hat security researchers”) accessed the data. The white hats promptly notified the company. This particular hole was closed. No idea if there are others.
How many firms have this sort of data? 10’s of thousands? 100’s of thousands? How many of these firms have excellent security practices? Or what % of firms?
How many of these firms have purposes and practices that are inherently abusive or offensive, or disturbing? Do we trust them at all? What percentage do we trust? None?
How many are, in their intentions and actions, purer than Caesar’s wife? (Answer: zero)
Just me: I do not consider this to be an issue where it makes sense to take pro- or anti- Republican or Democrat or Independent or “whatever else” partisan positions. Or at least, not unless or until some serious and powerful political movement starts up about the abuses of commercial and government access to and use of and re-sale of personal data.
In the meantime, the organized parties do not seem to have this even on their radars, except that they wish to avoid political embarrassments.
A Republican voter data firm likely exposed your personal information for days — and you don’t have much recourse
Google amp link to the LA Times article:
- 6 comments, 27 replies
- Comment
yikes.
I can’t help but wonder how they got reddit voting and whatnot though. If it’s because people made it all public on social media to begin with though, the information is already out there for anyone to collect. Not this simply, but still things need to change from both sides- people need to understand privacy controls.
Not that privacy controls will matter as much now that ISPs know they can invest in selling your data.
@Pantheist
This data collection is a justification for my common practices, that I adopted out of instinctively avoidance rather than because I reasoned about data scavenging:
I don’t post on Reddit and my FB is mostly involved in liking what my extended family might have to say about pets and kids.
If these assholes can get at my social media stuff (I think it’s kinda locked down), let them choose to believe that i like kids and pets.
@f00l
I shouldn’t let that remark stand as is.
I was being way too much a smartass there. I knew it was a bit of a cheap shot.
Yeah I can like kids and pets on FB and all. But the companies get to my data awayway. Maybe a bit less for me than for some others; maybe not. Maybe more data collection about me.
The possible methods … just omg. The tracks almost almost all of us casually live everyday don’t stop. (including the tracks left by many of the very careful among us).
What was reported to be in this data collection is practically kid’s stuff, to my understanding.
If I wanted to seriously opt out:
I could move to a very very third world country. No smartphones for me. Ever. Burner flip phones w no gps or similar.
Change phones and phone numbers a lot. Different phone companies. All no-ID burner phones.
I could keep no browser history or bookmarks or cookies. Wipe my computer and reinstall my OS every day. Arrange to use diff IPs all the time. Try to wipe the computer when I switched ips and locations. Find software or whatever to mask or alter all my machine ID codes or software id’s amd serial numbers.
I could avoid email. I could stop shopping online. Stop ever being “personal” online.
I could not go where there are a lot of cameras. I could take only taxis and public transport and pay in cash. Or bicycle. Or walk.
I would have to arrange to be nearly invisible and completely unmemorable. I would have to speak the language like a native and blend in like a native, be able to pass as a native. Otherwise I would be obvious. Everyone would remember me. Tracking me would be easy, if anyone wanted to.
I could not use credit or debit cards. I could only minimally use banks.
If I wanted to go seriously hardcore I could try to get falsified papers or a fake ID.
I could never ever “phone home”.
They would still know all about me. Just a bit less.
@f00l I use tor for just about everything besides school and work, and I leave my phone off almost always. I’m sure they still know plenty about me, but so much tracking can be avoided if people would just accept that turning off the phone is an option.
@Pantheist
Back when pagers were common you could get a service per cell line; when you got a call, the caller info would forward to the pager.
I always had this service, reception on cell networks then not being what it is now. It also allowed you to pull the battery of out the phone or leave the phone in airplane mode and just turn it on when you wanted to.
I actually loved this. I paid for it, and a pager, long past the time when the cell CS agents understood it.
The day came when I wanted a diff pager # cause the old pager had been lost and that company had sold their business anyway. And I couldn’t find anyone at the cell company even in third level tech support who could figure out how to program the forward-to-pager service to to the new pager number. They didn’t even know how to access the “forward caller id to pager” tool.
They had never heard of it. After a few calls I gave up.
There are some industries - particularly medicine, I believe - where pagers are still in use.
I wonder if some cell companies still offer that service.
Even if I wanted cell service with a cell company that offered this, it wouldn’t help much with the fact that I usually communicate by text message w family amd many friends. Of course, I could turn off my phone and only receive text messages once an hour.
I’m currently too addicted for that. Not to text messages, I usually only check them when a personal one comes in. And my family is more likely to text once a week or once a month than once a day.
But I stream a lot or podcasts, ok I could download them.
And then there is all that instant-browsing and notification crap.
Once upon a time I swore I would not allow cell gps to stay on. Then along came Android and google maps. Sigh. I folded like a piece of paper.
I would need to become a wiser human to have a hope of managing or disciplining this better.
@Pantheist
PS
do you use tor on your cell?
What kind of slowdown do you get with tor when at home?
Do you configure tor per device or is there a way to do it at the router level?
Are there devices or services in which you do not use tor? Such as streaming?
Are there devices or OS’s where you have not been able to get tor to work?
@f00l I don’t use tor on my cell- I have a galaxy s3 and it doesn’t play nicely with it, but I only use the browser on my phone for work and the occasional silly question like “did the actor who plays petyr baelish have a stroke”. You did make me realize I’m sure I have apps that send plenty of traffic, but like I said- I try to keep the phone off most of the time. Honestly, I do that more because I’m happier when I’m less tempted to spend more time staring at a screen than the tracking issues.
For regular browsing, the slowdown for tor isn’t too bad. You’re right though, I do use a regular browser for a couple things- streaming and sites that don’t play nicely with tor. Also sometimes I’m lazy. When I’m here I usually should be schooling or working, and I almost always just pop another tab in chrome. Oh well. Anyone with an interest in me already knows I’m on meh.
I’m sure there is a way to configure it at a router level with some routers, but again, I’m too lazy for that. Default tor package I figure is good enough for me, and works. You can also run it off a usb drive and it won’t put any files on your hard drive. Haven’t run into an OS it didn’t work on yet.
@f00l Have you tried to buy paper maps lately? Fewer places sell them. Cherish your atlases. I have a basket full of road maps from various countries, and I’m keeping them. Our main library purged almost all of their paper maps a few years ago. Space, you know. They were destined for the trash- not even recycling, since they were printed in color.
@OldCatLady If you are a member of AAA, you can still get US maps for free. You can also get maps of other countries, but there’s a charge for them (in some cases, it’s non-trivial). I love my maps. They’re mine, and I’m keeping them, even though (in some cases) they no longer match reality.
@Shrdlu Yeah what she said and they’ve got the really good higbway maps. which are good for when you come up on a gridlocked convergence of highways in the middle of nowhere on a holiday weekend and plot out the old roads and get away from the fools sitting there burning gas for nothing.
@Shrdlu where do I get them? I’m an AAA gold member, and as I’ve never owned a car <10 years old, I’ve gotten my money’s worth.
@Pantheist you can either call it in and they will mail to you or you can go to any AAA office and ask for them.
@Pantheist They used to be out front, where you could just go and take them, but they’re now behind the counter, and you have to ask for them. I ought to update the maps I have acquired over the years (get new ones, I mean, not get rid of the old ones). Some places don’t really change much, but a lot of them do.
Security practices are terrible pretty much everywhere.
@awk
Except certain tech companies and government agencies. But as the old adage goes, “loose lips sink ships.” A little bit of social engineering will get you all the information you could want.
People are lazy and this kind of stuff will happen until everyone has it crammed into their brains that this can not be allowed to happen. Which will likely be never.
I once stumbled upon a file on our corporate LAN in a folder we used to exchange files company-wide that were too large for email. It caught my eye because the file name was our corporate mental health care provider. So, was it info on the plan? No, it was the name, home address, date of birth and SSN of every person in the company. You know, in case anyone needed it.
@ponagathos Regulations leading to responsible cloud data management will happen, but a few people will have to die first. The FAA works the same way.
I once witnessed our corporation post a company-wide announcement that included a spreadheet of employee statistics. Every employee was listed in the spreadsheet. And oops, they forgot to exclude the employee salary column. Yep, every employee saw the yearly salary of everyone in the company, all the way to the president.
LA Times wants a dollar (well, 99 cents) to read that article.
I’ll see if I can find it elsewhere.
Here it is from NPR: http://www.npr.org/2017/06/19/533551243/firm-contracted-by-rnc-left-millions-of-voter-files-unsecured-online
And here is the info from the original source: https://www.upguard.com/breaches/the-rnc-files
@baqui63
I read it in my phone. I guess the LA Times doesnt make people who are on mobile and default to Google AMP links pay for the articles.
@f00l I believe they give you five(?) articles a month without a subscription and use cookies to enforce this.
I was able to read the LA Times article using incognito mode, but I generally avoid doing this as I consider it to be cheating (“You want to charge for your service and I’m not going to “steal” it just because it is trivially easy to do so; find a better way, or you’ll end up going out of business.”)
I will state that if I continue to hit their paywall on a regular basis, I will pay the 99 cents. (This is the first time I’ve hit the LA Times one to my recollection.) However, I’m not interested in being “nickeled and dimed to death” by things that are freely available elsewhere, especially if the elsewhere is from a source that I already pay for (NPR, NY Times, others).
Just looked at the potential field names (not all populated for everyone) in the exposed data and have the following thoughts if I read the original story correctly…
While I’m not happy the data was exposed, it isn’t clear anybody other than the security firm got access to it.
The data is pretty much already available online, often free. Your name, address, phone number and age. The political markings, many purely speculative are not particularly bothersome to me.
It doesn’t appear to include more sensitive things like social security number or credit card numbers.
But clearly we have a government and laws that do not unferstand e-privacy and judges who appear not ready to simply apply existing privacy laws to e-data. The latter would go a long, long way to protecting us, even lacking any new laws.
@RedOak
A decade or more ago, whenthe EU was busy trying to put some degree of strong personal privacy into law, the big data firms (st that time the known companies were almost all US owned) all lobbied really hard against EU restrictions. In the EU the companies kinda lost.
But what do they care? Their HQ are majority ownership are here. The data is “anywhere and nowhere”.
And if the EU thinks the have illegal data: Hah! Prove it, motherfucker!
I assume they collect and keep forever exactly whatever they can by any means they set up.
Over here back then, we had Bush/Cheney. And the lobbying from Silicon Valley was quite effective, if I recall. Tho I’m not sure it even needed to be, since the government was all laissez faire. Privacy of personal data never really came up in a serious legislative or regulatory way, to my memory. When Obama/Biden took over, they were consumed by healthcare. And the Obama admin was happy to have a lot of data too. Not exactly eager to cut off the legal flow, if I remember correctly.
I don’t think it’s ever been a make-or-break, or a hot-button issue. I’ve not heard of a serious large attendee demonstration, or serious town hall over this. The EFF has argued for the common person, but that group doesn’t own many CongressCritters. I’ve heard of no collection of the powerful and well-heeled gathering against massive data collection.
The Bush admin seemed to take the attitude that whatever corps could collect was theirs to keep and use, at least in aggregate, and sometimes down to the personal details. And if the corps could not disclose data per se in some cases, they could sell access to slices of it.
Yeah this data memtioned today looks like stuff other companies could put together. Public resources etc. So other companies have.
A potentially profitable area of data collection does not exist in nature as a vacuum (empty of data content) for very long anymore. You could say:
The Silicon Valley version of “nature” abhors a data vacuum.
@f00l but the bottom line is the lack of privacy protections isn’t any president or politician’s fault… it is our own fault
It is our issue to own. We are the lazy ones. We don’t make it a priority for ourselves, our judges, or our politicians.
And pointing the finger at crony-relationships on any issue is also due to our own laziness. Half of us don’t even bother to vote.
When was the last time any of us individually contacted our representatives to raise privacy as an issue?
@RedOak
Some people don’t contact their representatives because they have privacy fears about the consequences of doing so. I don’t know or this is justifiable or not.
Sigh.
@f00l Hmm. I’ve never heard that concern, nor felt it when talking to our representatives, local, state, and federal.
Aside from active and assertive contact with our representatives and engaged, educated voting, the other ally of improved government is transparency - shining a light on the cronyism wherever it lies and for both main political parties.
@f00l In states that have any decent laws about open records, any and all communications from constituents are considered public information. On the federal level one would have to submit a FOIA form; states with similar laws have their own access requirements. States and the feds, however, have an amazing number of ways to keep data secret, from denying the request to delaying response to attempting to charge outrageous fees for the info.
Keep an eye on any investigations of politicians and Big Businesses and you’re likely to find, eventually, that the investigators (not only law-enforcement agencies but also private entities such as the NYTimes and ProPublica) relied to some degree on FOIA results.
So it’s like that Muslim registry they wanted, but for Republicans…
/giphy Irony!
@medz
Citizen-voters are mostly all registered up on the big lists, so to speak.
@medz It’s “nearly every registered American voter”, not just Americans who have voted Republican, nor Republicans themselves, unfortunately.
@InnocuousFarmer Oh, well you can usually look that info up anyway assuming you have the name and birthdate.
@medz Aye. It’ll be more useful to the Democrats and Russians than someone less politically motivated, probably.
I did see a line about scraped Reddit posts in there too though, so who knows what leaked. (Maybe I’d know, if I read the story more carefully.)