Another Day, Another Pile Of Voter Data Left Laying Around On A Public Server

from the you'd-think-we'd-learn-something dept

Leaving private voter or customer data easily accessible on a public-facing server is the hot new fashion trend. You'll recall that it's a problem that has plagued the Defense Department, GOP data firm Deep Root Analytics (198 million voter records exposed), Verizon's marketing partners (6 million users impacted), Time Warner Cable (4 million users impacted), and countless other companies or partners that failed to implement even basic security practices. And it's a trend that shows no sign of slowing down despite repeated, similar stories (much of it thanks to analysis by security researcher Chris Vickery).

This week yet another pile of private voter data was left publicly accessible for anybody to peruse. According to analysis by Kromtech Security’s Bob Dianchenko, a Virginia-based political consulting and robocalling company by the name of Robocent publicly exposed 2,600 files, including voter file spreadsheets (including voter phone numbers, names, addresses, political affiliations, gender, voting districts and more) and audio recordings for a number of political campaigns.

When Diachenko contacted the firm, he was told that they were a "small shop" and that "keeping track of everything can be tough." In a statement to ZDNet, which first reported the latest exposure, Robocent co-founder Travis Trawick did his best to downplay the exposure by insisting the data was stale, and publicly-available anyway:

"In an emailed statement, Robocent co-founder Travis Trawick confirmed that the data had been secured, and claimed that the data was from "an old bucket from 2013-2016 that hasn't been used in the past two years." He confirmed that the company is investigating the scope of the data that was accessible. "All exposed data was publically available information," he said, adding that he will contact affected customers "if required by law."

The problem: what's deemed "publicly available" varies from state to state. While voter data is generally a matter of public record, states like Maine and Massachusetts restrict the use of such data for political campaign purposes. Other States, like South Carolina, have restrictions on only selling said data if you're a registered voter in the state. And while the data may have been stale, it still wasn't adequately protected however you slice it; it was quickly indexed by GrayhatWarfare, a searchable database where a current list of 48,623 open S3 buckets can be perused at your leisure.

This latest exposure is believed to be the fifth major breach of voter data in the last half-decade. It's a trend that shows no real sign of slowing down despite the simplicity of protecting this data and the rampant press coverage such exposures routinely receive.

Filed Under: bob dianchenko, data breach, security, travis trawick, voter data, voting
Companies: kromtech security, robocent

Trump Puts Voter Data Collection On Hold After Highly Insecure & Potentially Illegal Process Is Widely Ridiculed

from the encryption-is-for-losers dept

At the tail end of June, The Presidential Advisory Commission on Election Integrity turned heads when it began asking states for confidential voter data. The Commission was formed via executive order back in May as part of a supposed effort to crack down on what the Trump administration has insisted (without any supporting evidence) is an epidemic of widespread voting and voter registration fraud. As part of the data collection the Trump administration demanded voter names, political affiliations, addresses, dates of birth, criminal records, the last four digits of their Social Security numbers, and more.

But it didn't take long for the entire effort to unravel. The commission's first misstep was asking states to submit this personal data via unencrypted e-mail. The commission also offered states the ability to deliver the data via a system called SAFE—the Safe Access File Exchange. Traditionally used by the military for the transfer of unclassified files too large for email, the service does allow encrypted transfers via civilian computers, but would have required numerous technical steps and guidance (the commission didn't take or offer) to adequately protect the data's integrity:

"But the site’s HTTPS setup, which enables data transmitted from a browser to the site to be sent over an encrypted connection, is problematic for civilian users in state governments. In fact, when state government officials visit the website, they are greeted with a conspicuous warning telling them that their connection is not private—implying that the data could be stolen or altered in transit."

The commission's attempt to obtain private voter data by insecure means was quickly and surprisingly laughed off by the majority of states concerned with the obvious privacy implications. Only Arkansas has fully complied with the President's request, and many states expressed concern that the request and insecure transfer of private data could violate respective state voter privacy laws. Trump's response to these entirely legitimate, bipartisan concerns about voter privacy? Taking to Twitter to accuse the states of trying to hide something:

Things have been notably complicated by a lawsuit by the ACLU, which claims the commission violated federal public access requirements by holding its first meeting in private, without public notice. The effort has also been hamstrung by a request by The Electronic Privacy Information Center (EPIC) for a temporary restraining order (TRO) on the administration's request until the privacy issue can be litigated in court. That has subsequently forced the Trump administration and its commission to suspend its data collection efforts until a Judge rules on the request:

"Today, July 10, 2017, the Commission also sent the states a follow-up communication requesting the states not submit any data until this Court rules on plaintiff's TRO motion," the government wrote (PDF) the court. The commission e-mailed state election officials early Monday that, "Until the judge rules on the TRO, we request that you hold on submitting any data."

EPIC is suing the commission on accusations that the requested information violates the privacy of American voters. EPIC also says the commission is asking the states to forward the data to an unsecure website, the Department of Defense Safe File Exchange site. The commission said that, if it prevails, it will "use an alternative means for transmitting the requested data."

This all appears to be driven by Trump's belief that the only way he could have possibly lost the popular vote is due to fraud (which again, nobody has found any evidence of). Bubbling under all of this is the additional concern that this entire effort has little to do with actually policing voter fraud, and everything to do with finding new and ingenious methods of voter suppression down the road.

Filed Under: donald trump, elections, privacy, voter data, voter fraud

GOP Data Firm Left The Personal Data Of 198 Million American Voters On Openly-Accessible Amazon Server

from the whoops-a-daisy dept

A GOP data firm has accepted responsibility for leaving the personal data of 198 million Americans (aka: most of the country's voting populace) openly accessible on an Amazon server in the biggest voter data leak in global history. Deep Root Analytics, the owner of the data, has long been contracted by the Republican National Committee to measure voter opinions on a wide variety of issues, from health care to gun control. As part of their contract with the RNC, the group pulls voter information from a wide variety of sources, ranging from Reddit to the Karl Rove super PAC American Crossroads.

This data, which includes religious affiliation and ethnicity, is then utilized to help craft PR efforts and other messaging, as well as to determine turnout and voter preferences. And, according to analysis of the data and previous profiles of the company like this one over at Ad Age, this firm was hugely influential in getting Donald Trump's "populist" message out to voters during the last election cycle.

But last week, UpGuard cyber risk analyst Chris Vickery discovered that Deep Root had been storing a massive amount of this data on Amazon servers, publicly accessible via the internet, with absolutely no apparent security precautions whatsoever:

The data repository, an Amazon Web Services S3 bucket, lacked any protection against access. As such, anyone with an internet connection could have accessed the Republican data operation used to power Donald Trump’s presidential victory, simply by navigating to a six-character Amazon subdomain: “dra-dw”.

Vickery frequently hunts for misconfigured data sources on behalf of UpGuard's Cyber Risk Team, often finding everything from military engineering plans to lists of potential terrorists -- simply sitting out in the open. Vickery had recently exposed a top defense contractor for doing something similar, albeit on a notably smaller scale. In this instance, the openly-accessible data included names, addresses, birthdates, phone numbers, troves of stored online user posts, collected over the better part of the last decade:

"Within “data_trust” are two massive stores of personal information collectively representing up to 198 million potential voters. Consisting primarily of two file repositories, a 256 GB folder for the 2008 presidential election and a 233 GB folder for 2012, each containing fifty-one files - one for every state, as well as the District of Columbia. Each file, formatted as a comma separated value (.csv), lists an internal, 32-character alphanumeric “RNC ID”—such as, for example, 530C2598-6EF4-4A56-9A7X-2FCA466FX2E2—used to uniquely identify every potential voter in the database. These RNC IDS uniquely link disparate data sets together, combining dozens of sensitive and personally identifying data points, making it possible to piece together a striking amount of detail on individual Americans specified by name."

One segment of the files contained modeled data about each individual voter's likely positions on 46 different issues. Other portions of the data detail whether voters are registered, and whether they are currently on the federal "Do Not Call" list (you may recall that the RNC is currently supporting a proposal that would let them spam your voicemail inbox without your phone ringing). Collectively, this data was collected and used by a massive number of Republican outfits, including Americans for Prosperity, market research firm TargetPoint, Causeway Solutions, and more.

The security faux pas is considered one of the most monumental ever documented in any country. The 198 million American voters exposed by this screw up dwarves the previous biggest leak -- a leak of the voting data of 93.4 million Mexican citizens -- as well as the now-third biggest leak of this kind ever -- the exposure of the data of 55 million voters in the Philippines. On the plus side, a statement being provided by Deep Root to the media takes ownership of the screw up, without too much of the couching you often see after such breaches:

"We have engaged Stroz Freidberg to conduct a thorough review, and that process is underway. Based upon this review we have determined that the access that was made without our knowledge happened because of a change that was made in the files’ asset access protocols. We are in the process of determining how that change was made and take full responsibility for the change, but suffice to say we have updated the settings to prevent further access. We believe the change that was made happened post June 1 2017, which was when we last evaluated and updated our security settings. We do not believe that our systems have been hacked. To date, the only entity that we are aware of that had access to the data was Chris Vickery."

Still, it's not exactly a confidence builder to witness the largest leak of voter data in global history as we're busy trying to ascertain just how secure our clearly dysfunctional voting systems are to malicious outside influence -- and debating the slow-but-steady erosion of consumer privacy protections being spearheaded by the GOP.

Filed Under: chris vickery, gop, online security, privacy, rnc, security, voter data
Companies: deep root