About speararch0
Description
Personal Information of Nearly 200 million uS Citizens Leaked
The personal information of nearly 200 million US citizens was exposed
19 June 2017
Personal details of sensitive individuals pertaining to almost 200 million US citizens were accidentally disclosed by a marketing firm contracted by the Republican National Committee.
The 1.1 trillion terabytes of information includes birthdates, home addresses telephone numbers and the political views of 62% of the entire US population.
The data was accessible on a publicly accessible Amazon cloud server.
Anyone could access the data so long as they had a link to it.
Political biases exposed
The huge amount of data was discovered last week by Chris Vickery, a cyber-risk analyst with security firm UpGuard. The data appears to have been collected from a myriad of sources ranging from posts about controversial banned threads on the social network Reddit, to committees that have raised funds for the Republican Party.
The information was stored in spreadsheets that were uploaded to a server that was owned by Deep Root Analytics. The last time it was updated was in January, the month when President Donald Trump was inaugurated and had been online for an unknown period of time.
"We are fully responsible for this incident. Based on the information we have discovered so far, we don't believe that our systems were compromised," Deep Root Analytics' founder Alex Lundry told technology website Gizmodo.
"Since we learned of this event, we have updated our access settings and put in place procedures to prevent access to any future events."
In addition to personal information, the data also contained individuals' religion, ethnicity, and political biases like where they stood on controversial topics such as gun control and the right to abortion, and stem cell research.
The file names and directories indicated that the data was intended to be used by powerful Republican political organizations. The idea was to create an accurate profile of as many voters as was possible using all the data available. Some fields were left blank in the event that there was no answer.
"That such a huge national database could be constructed and hosted online without the most basic protections against data becoming publicly accessible is troubling," Dan O'Sullivan wrote on Upguard's blog.
"The capability to gather such information and then store it in a secure manner further calls into question the responsibilities owed by private companies and political campaigns to those people who are targeted by ever-higher-powered data analytics operations."
serverlist101
Privacy concerns
Although it is well-known that political parties routinely collect information on voters, this is the largest data breach of electoral data in the US. Privacy experts are concerned about the volume of data.
"This is a major concern. This isn't sensitive. It's intimate knowledge, predictions, and beliefs about people's behaviour that people have not disclosed to anyone," Frederike Kaltheuner, Privacy International's policy manager, told BBC News.
Privacy International states that all online advertising platforms function in the same way.
"It is an attack on the way democracy functions. The GOP [Republican Party] relied on publicly-collected, commercially-provided information. No one would have imagined that the data they gave to one company would end in a database which was used to make them targets politically.
"You must be in charge of what happens to your personal data and who has access to it and for what purposes," Ms Kaltheuner added.
There are concerns that leaks of information could be used for nefarious purposes, from identity fraud to the harassment of those in protection orders, or to intimidate people who are of a different political view.
"The potential for this kind of data being available publicly and on the dark web is extremely high," Paul Fletcher, an evangelist for cyber-security at security firm Alert Logic told the BBC.
Data breach over MPs' staff details
31 March 2017
Philippines elections hack 'leaks data'
11 April 2016