7 ms·

They've identified who leaked the database to AWS: http://www.diariodemexico.com.mx/inemexico-encuentra-quien-filtro-lista-nominal-amazon/ http://www.diariodem

by jordigh 11y ago

They've identified who leaked the database to AWS: http://www.diariodemexico.com.mx/inemexico-encuentra-quien-filtro-lista-nominal-amazon/ http://www.diariodemexico.com.mx/inemexico-encuentra-quien-f... The government isn't publishing details, but the article gives the impression that it was some Mexican political party acting out of line who should not have uploaded this data to US servers. It appears that each party receives a copy of electoral registrations. ¿Qué chingados? I didn't know every party got a copy of all voter registrations. This seems grossly undemocratic.

Aelinsaar 11y ago
It seems like a disaster waiting to happ- oh wait, right.
arcticfox 11y ago
If the government is relying on outside political parties to keep the data secure, it might as well be public anyways.
Spooky23 11y ago
In the US, voter registration is completely open. You can walk down to your Board of Elections and look at the full register, including party registration and whether you voted or not. For contested elections, party inspectors will note active voters who haven't voted yet and report, which generates phone calls or even volunteers dropping by to drive voters to the polls. IMO, transparency is required for democracy.
- jordigh 11y ago
  Address and occupation and whether you have any twins is open too, for the whole country? Can you look this up right now for any adult estadounidense? In Mexico, this isn't transparency, as only the political parties get a copy. This is surveillance, probably used for more effective targetted campaigning, which has historically been used for buying votes. I'm not sure I will ever renew my Mexican voter registration.
  - Spooky23 11y ago
    I'm not saying it isn't a problem. IIRC, there was a breach in Georgia with a lot of extra information similar to what you describe. If it isn't provided by the state, Political parties buy lots of information based on the voter rolls. They know alot.
    - jlg23 11y ago
      Nobody cares whether it could be worse, the point is that it must be better[1]. The data leaked is enough to gain access to almost a hundred million people's account on any web-service or, as some other comment pointed out, in Mexico's case even to real-life services like banking. [1] The United States are not the norm. You might live there, but that makes you a minority of the world population. There are some nations that actually value democracy and privacy, not just on paper.
  - mariorz 11y ago
    The database is given to parties so they can audit if people live where they are voting, or even if they live for that matter. Not giving them access is not an option, if you want the continue having a voting system that does not require trust, as the mexican voting system was designed to allow. I agree that the database should be made public for all citizens, as it currently stands, only parties registered for elections get a copy, and no doubt use it for their campaigns. This puts people outside of the party system in a disadvantage against the parties, particularly relevant for things like citizen initiatives.
  - WildUtah 11y ago
    "I'm not sure I will ever renew my Mexican voter registration." What are you going to use for ID if you don't have a credencial?
    - jordigh 11y ago
      Passport.
      - 11y ago
- eru 11y ago
  Registering with a party in the US always struck me as crazy. Can't they at least uphold the fiction that people vote on the merit of issues?
  - akira2501 11y ago
    > Can't they at least uphold the fiction that people vote on the merit of issues? It's not a direct democracy.. other than state referendums, people generally do not have an opportunity to _actually_ vote on issues.
  - boulos 11y ago
    In many (most?) primaries it's a requirement that you be a registered member of that party. Luckily for me, California doesn't subscribe to this policy.
    - aiiane 11y ago
      Except for the Republican presidential primary.
      - boulos 11y ago
        No. For example: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/03/02/so-far-trump-wins-open-primaries-and-cruz-wins-closed-and-the-calendar-is-starting-to-change-toward-more-closed-primaries/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... (The url is the whole story).
  - superuser2 11y ago
    Choosing a party is pretty much how you express a position on the issues.
    - eru 11y ago
      In most parts of the world, only a few people are officially registered with any party. Normally, you just show up and vote what you feel like.
- lazaroclapp 11y ago
  Yeah, but the database contains occupation, address and potentially can be correlated with phone numbers. In a country where phone extortion and kidnappings are things that happen with surprising regularity. Keep in mind also that your voting ID card in Mexico is your primary identification, similar to driver licenses in the U.S. The data from this breach can allow someone to create a pretty good fake of any voting card, which may be used to impersonate people for: banking operations, government processes (that don´t require the CURP, our equivalent of a SSN) and yes, also during elections. Voter fraud might not be much of a problem in the U.S. in reality, but in Mexico it definitely is.
  - DannyBee 11y ago
    "Yeah, but the database contains occupation, address and potentially can be correlated with phone numbers. " Err, the US database contains address as well. I remember when i used to run politics and elections products, we were basically the only company in the US to explicitly request they not give us names or anything we did not need (we were building street segment to voting location mapping)
    - lazaroclapp 11y ago
      Yeah, but how often have you been called in the U.S., heard someone sobbing on the other end, then told by someone else that they have your family member and that they will hurt them if you don't send them money immediately? (99% of the time they have nobody and it is a phishing call, but with this information then suddenly it becomes an easier to convince people, among other things). I have answered that call. My mom has answered that call (and contacted me over another phone to make sure it was indeed a scam). My point is that what works on the U.S. and what is considered sensitive information in the U.S. might not match what is sensitive in other societies. My mailing address and phone number are relatively public while in the U.S., but back in Mexico I would never do it that way.
- ASalazarMX 11y ago
  Then why was this such a huge deal? http://www.databreaches.net/191-million-voters-personal-info-exposed-by-misconfigured-database/ http://www.databreaches.net/191-million-voters-personal-info...
- laen 11y ago
  Exactly. I'm failing to see why this story is generating so much interest. Here's one of the 50 websites where you can see every American citizen registered to vote... includes their DOB, Address, Voter ID etc... http://www.oklavoters.com/ http://www.oklavoters.com/ and while you're there check out the removal request policy page - it's quite humorous. EDIT: If you are wondering how the website obtained data specifically for Oklahoma please see https://www.ok.gov/elections/Candidate_Info/Voter_List/index.html https://www.ok.gov/elections/Candidate_Info/Voter_List/index...
  - rvolkan 11y ago
    For some countries, voter info is as effective as SSN of US. I guess, Mexico is one of them.
  - rdudek 11y ago
    Interesting, list does not seem complete as I'm effectively missing from that list.
    - nightpool 11y ago
      the linked website is for Oklahoma only.
  - atdt 11y ago
    Doesn't the fact that they have a removal request policy page at all suggest that at least some Americans find it surprising that voter data is freely available online?
  - yxlx 11y ago
    >check out the removal request policy page - it's quite humorous. I found it childish and unprofessional, just like the reply letters TPB wrote in response to DMCA requests.
    - Hondor 11y ago
      In both cases, don't forget who it's addressed to - people who have made rude, unreasonable demands and threats. Those people are bullies so it's fair to insult them.
- draugadrotten 11y ago
  > ...party inspectors will note active voters who haven't voted yet and report, which generates phone calls or even volunteers dropping by to drive voters to the polls. Isn't this a great example why it's bad that this data is open. In Mexico, perhaps volunteers are dropping by to drive voters to/from the polls. With guns.
  - lukeschlather 11y ago
    That's way too messy when you can just threaten the poll workers with guns and stuff the ballot boxes. Or better yet, just be the poll workers yourself and skip the guns entirely.
  - warrenm 11y ago
    Why? You registered with a party and the local board of elections - the party will know if you've voted, as does the BoE. Ditch the party system, and maybe it gets better - I think it would.
- booop 11y ago
  Another possibility in contested elections is party members tracking down opposing voters with a comprehensive list of who to threaten/kill and where to find them.
- krzrak 11y ago
  > In the US, voter registration is completely open. You can walk down to your Board of Elections and look at the full register, including party registration and whether you voted or not. I don't get what purpose does it serve?
narag 11y ago
I believe it's true for Spain also, so parties can spam us with voting propaganda. The information was also sold to commercial spammers too. It was detected because small errors in spelling, not present in other records, were reproduced.
armandososa 11y ago
That link's info is so stupid. They say they know who did it, but they won't say because they don't want to alert the guilty party before the investigation is over. Guess what? the people who did it know they did it! Also, the note says that the info is on "Amazon's sales portal" WTF?
- jordigh 11y ago
  Yeah, looks like reporters can't figure out that "Amazon" means more than a website to buy things from.
- rdtsc 11y ago
  > Guess what? the people who did it know they did it! But they don't know the authorities know who did it.
  - yoo1I 11y ago
    Unless they of course they read the news, which is something that seems likely. ... which, of course, was the original point.
    - rdtsc 11y ago
      > ... which, of course, was the original point. Right, which explains they they were reluctant to put it in the news i.e. "... but they won't say because they don't want to alert the guilty party before the investigation is over." So it doesn't seem completely illogical why they'd do it as gp post suggests.
      - deleted 11y ago
        [deleted]
  - armandososa 11y ago
    If you, as a kid, broke a window in your school, and the principal is, like, "Look, we've seen the surveillance video and we know who did it, but we ain't saying anything until next friday", you'll know for sure you have until friday to lawyer up or skip town or whatever kids do.
superuser2 11y ago
Why does it matter whether it was uploaded to US servers? A wide open MongoDB is a wide open MongoDB no matter where it's physically located.
nso 11y ago
Funny thing is that you already could buy this database for a few hundred dollars at the black markets in Mexico City. You can also walk into stores there that openly sell any drug you could possibly want... like it's on display on shelfs... or guns... or whatever else you want.
- ludamad 11y ago
  This exact data though?
venomsnake 11y ago
I think that it is grossly democratic. Everyone is on the same playing field. And anyway the whole registering to vote thing is undemocratic. You have valid citizen id - you show and vote, and that is it. In Europe where everyone has government issued id card the system works fine.
- wang_li 11y ago
  In the US the suggestion that voting require an ID card is met with all the reasons people can't be bothered to get an ID card. Things like it's too far to go to get the card. Or it costs too much. Or they can't prove they are citizens. If states were at all serious about voter verification through ID, they'd make every non-constitutionally guaranteed service require a photo ID. Then when it gets back to SCOTUS they could readily report that every resident in their state already has a photo ID.

by jordigh 11y ago

Aelinsaar 11y ago

It seems like a disaster waiting to happ- oh wait, right.

arcticfox 11y ago

If the government is relying on outside political parties to keep the data secure, it might as well be public anyways.

Spooky23 11y ago

In the US, voter registration is completely open. You can walk down to your Board of Elections and look at the full register, including party registration and whether you voted or not. For contested elections, party inspectors will note active voters who haven't voted yet and report, which generates phone calls or even volunteers dropping by to drive voters to the polls. IMO, transparency is required for democracy.

jordigh 11y ago
Address and occupation and whether you have any twins is open too, for the whole country? Can you look this up right now for any adult estadounidense? In Mexico, this isn't transparency, as only the political parties get a copy. This is surveillance, probably used for more effective targetted campaigning, which has historically been used for buying votes. I'm not sure I will ever renew my Mexican voter registration.
- Spooky23 11y ago
  I'm not saying it isn't a problem. IIRC, there was a breach in Georgia with a lot of extra information similar to what you describe. If it isn't provided by the state, Political parties buy lots of information based on the voter rolls. They know alot.
  - jlg23 11y ago
    Nobody cares whether it could be worse, the point is that it must be better[1]. The data leaked is enough to gain access to almost a hundred million people's account on any web-service or, as some other comment pointed out, in Mexico's case even to real-life services like banking. [1] The United States are not the norm. You might live there, but that makes you a minority of the world population. There are some nations that actually value democracy and privacy, not just on paper.
- mariorz 11y ago
  The database is given to parties so they can audit if people live where they are voting, or even if they live for that matter. Not giving them access is not an option, if you want the continue having a voting system that does not require trust, as the mexican voting system was designed to allow. I agree that the database should be made public for all citizens, as it currently stands, only parties registered for elections get a copy, and no doubt use it for their campaigns. This puts people outside of the party system in a disadvantage against the parties, particularly relevant for things like citizen initiatives.
- WildUtah 11y ago
  "I'm not sure I will ever renew my Mexican voter registration." What are you going to use for ID if you don't have a credencial?
  - jordigh 11y ago
    Passport.
    - 11y ago
eru 11y ago
Registering with a party in the US always struck me as crazy. Can't they at least uphold the fiction that people vote on the merit of issues?
- akira2501 11y ago
  > Can't they at least uphold the fiction that people vote on the merit of issues? It's not a direct democracy.. other than state referendums, people generally do not have an opportunity to _actually_ vote on issues.
- boulos 11y ago
  In many (most?) primaries it's a requirement that you be a registered member of that party. Luckily for me, California doesn't subscribe to this policy.
  - aiiane 11y ago
    Except for the Republican presidential primary.
    - boulos 11y ago
      No. For example: https://www.washingtonpost.com/news/volokh-conspiracy/wp/2016/03/02/so-far-trump-wins-open-primaries-and-cruz-wins-closed-and-the-calendar-is-starting-to-change-toward-more-closed-primaries/ https://www.washingtonpost.com/news/volokh-conspiracy/wp/201... (The url is the whole story).
- superuser2 11y ago
  Choosing a party is pretty much how you express a position on the issues.
  - eru 11y ago
    In most parts of the world, only a few people are officially registered with any party. Normally, you just show up and vote what you feel like.
lazaroclapp 11y ago
Yeah, but the database contains occupation, address and potentially can be correlated with phone numbers. In a country where phone extortion and kidnappings are things that happen with surprising regularity. Keep in mind also that your voting ID card in Mexico is your primary identification, similar to driver licenses in the U.S. The data from this breach can allow someone to create a pretty good fake of any voting card, which may be used to impersonate people for: banking operations, government processes (that don´t require the CURP, our equivalent of a SSN) and yes, also during elections. Voter fraud might not be much of a problem in the U.S. in reality, but in Mexico it definitely is.
- DannyBee 11y ago
  "Yeah, but the database contains occupation, address and potentially can be correlated with phone numbers. " Err, the US database contains address as well. I remember when i used to run politics and elections products, we were basically the only company in the US to explicitly request they not give us names or anything we did not need (we were building street segment to voting location mapping)
  - lazaroclapp 11y ago
    Yeah, but how often have you been called in the U.S., heard someone sobbing on the other end, then told by someone else that they have your family member and that they will hurt them if you don't send them money immediately? (99% of the time they have nobody and it is a phishing call, but with this information then suddenly it becomes an easier to convince people, among other things). I have answered that call. My mom has answered that call (and contacted me over another phone to make sure it was indeed a scam). My point is that what works on the U.S. and what is considered sensitive information in the U.S. might not match what is sensitive in other societies. My mailing address and phone number are relatively public while in the U.S., but back in Mexico I would never do it that way.
ASalazarMX 11y ago
Then why was this such a huge deal? http://www.databreaches.net/191-million-voters-personal-info-exposed-by-misconfigured-database/ http://www.databreaches.net/191-million-voters-personal-info...
laen 11y ago
Exactly. I'm failing to see why this story is generating so much interest. Here's one of the 50 websites where you can see every American citizen registered to vote... includes their DOB, Address, Voter ID etc... http://www.oklavoters.com/ http://www.oklavoters.com/ and while you're there check out the removal request policy page - it's quite humorous. EDIT: If you are wondering how the website obtained data specifically for Oklahoma please see https://www.ok.gov/elections/Candidate_Info/Voter_List/index.html https://www.ok.gov/elections/Candidate_Info/Voter_List/index...
- rvolkan 11y ago
  For some countries, voter info is as effective as SSN of US. I guess, Mexico is one of them.
- rdudek 11y ago
  Interesting, list does not seem complete as I'm effectively missing from that list.
  - nightpool 11y ago
    the linked website is for Oklahoma only.
- atdt 11y ago
  Doesn't the fact that they have a removal request policy page at all suggest that at least some Americans find it surprising that voter data is freely available online?
- yxlx 11y ago
  >check out the removal request policy page - it's quite humorous. I found it childish and unprofessional, just like the reply letters TPB wrote in response to DMCA requests.
  - Hondor 11y ago
    In both cases, don't forget who it's addressed to - people who have made rude, unreasonable demands and threats. Those people are bullies so it's fair to insult them.
draugadrotten 11y ago
> ...party inspectors will note active voters who haven't voted yet and report, which generates phone calls or even volunteers dropping by to drive voters to the polls. Isn't this a great example why it's bad that this data is open. In Mexico, perhaps volunteers are dropping by to drive voters to/from the polls. With guns.
- lukeschlather 11y ago
  That's way too messy when you can just threaten the poll workers with guns and stuff the ballot boxes. Or better yet, just be the poll workers yourself and skip the guns entirely.
- warrenm 11y ago
  Why? You registered with a party and the local board of elections - the party will know if you've voted, as does the BoE. Ditch the party system, and maybe it gets better - I think it would.
booop 11y ago
Another possibility in contested elections is party members tracking down opposing voters with a comprehensive list of who to threaten/kill and where to find them.
krzrak 11y ago
> In the US, voter registration is completely open. You can walk down to your Board of Elections and look at the full register, including party registration and whether you voted or not. I don't get what purpose does it serve?

narag 11y ago

I believe it's true for Spain also, so parties can spam us with voting propaganda. The information was also sold to commercial spammers too. It was detected because small errors in spelling, not present in other records, were reproduced.

armandososa 11y ago

That link's info is so stupid. They say they know who did it, but they won't say because they don't want to alert the guilty party before the investigation is over. Guess what? the people who did it know they did it! Also, the note says that the info is on "Amazon's sales portal" WTF?

jordigh 11y ago
Yeah, looks like reporters can't figure out that "Amazon" means more than a website to buy things from.
rdtsc 11y ago
> Guess what? the people who did it know they did it! But they don't know the authorities know who did it.
- yoo1I 11y ago
  Unless they of course they read the news, which is something that seems likely. ... which, of course, was the original point.
  - rdtsc 11y ago
    > ... which, of course, was the original point. Right, which explains they they were reluctant to put it in the news i.e. "... but they won't say because they don't want to alert the guilty party before the investigation is over." So it doesn't seem completely illogical why they'd do it as gp post suggests.
    - deleted 11y ago
      [deleted]
- armandososa 11y ago
  If you, as a kid, broke a window in your school, and the principal is, like, "Look, we've seen the surveillance video and we know who did it, but we ain't saying anything until next friday", you'll know for sure you have until friday to lawyer up or skip town or whatever kids do.

superuser2 11y ago

Why does it matter whether it was uploaded to US servers? A wide open MongoDB is a wide open MongoDB no matter where it's physically located.

nso 11y ago

Funny thing is that you already could buy this database for a few hundred dollars at the black markets in Mexico City. You can also walk into stores there that openly sell any drug you could possibly want... like it's on display on shelfs... or guns... or whatever else you want.

ludamad 11y ago
This exact data though?

venomsnake 11y ago

I think that it is grossly democratic. Everyone is on the same playing field. And anyway the whole registering to vote thing is undemocratic. You have valid citizen id - you show and vote, and that is it. In Europe where everyone has government issued id card the system works fine.

wang_li 11y ago
In the US the suggestion that voting require an ID card is met with all the reasons people can't be bothered to get an ID card. Things like it's too far to go to get the card. Or it costs too much. Or they can't prove they are citizens. If states were at all serious about voter verification through ID, they'd make every non-constitutionally guaranteed service require a photo ID. Then when it gets back to SCOTUS they could readily report that every resident in their state already has a photo ID.