10 ms·
Personal info of 6M Israelis leaked after Likud uploads voter info
- madaxe_again 7y agoHaaretz restrained from investigating the matter too deeply in order to avoid breaking the law Of all of the crazy in this story, this is possibly the most worrying bit - journalists can’t do journalism without facing prosecution.
- dogma1138 7y agoI’m guessing it means that they didn’t tried to validate that they could get access to the registry by actually accessing it themselves.
- dotancohen 7y agoI only guessing, but presumably downloading the leaked information may be a legal grey-area that Haaretz decided to avoid.
- einpoklum 7y agoA few years back, a Ha'aretz journalist had to flee the country for a few years to avoid being targeted by the Israeli Security Service (Shabak or Shin-Bet) for having received leaked documents from a whistle-blower in the military. This was the Anat Qam - Uri Blau case. It's actually a bit more complex than that, you can look up the details.
- gowld 7y agoRemember, "journalists" have the rights of ordinary people. They aren't an elite class. Anyone who speaks about the world to another person is a journalist.
- ASalazarMX 7y agoThat's like saying "anyone who learns about the world is a scientist". Journalism is not only made of information or opinions, at least it shouldn't be.
- maratd 7y ago> That's like saying "anyone who learns about the world is a scientist". That's exactly what a scientist is? At least if they're using the scientific method to learn about the world.
- mygo 7y agoAlthough all you need to be a scientist is to use the scientific method properly, most people believe that you also need to have a PhD or a job that requires a lab coat
- benja123 7y agoI am pretty disgusted by this. First of all they basically leaked every single citizens who is of voting age PII. It sounds like the admin username and password was visible for all to see inside the HTML source. Although I should be, I am not actually surprised by the lack of security in a political parties application. What I don't understand is why the interior ministry is providing political parties with the entire voter registry, which includes PII. I never gave my consent for this. It probably explains why I am getting spam SMS's from different parties on a daily basis(which is extremely annoying), but worse than that, soon we will all be forced to join the biometric database and I have zero confidence in the ability of the interior ministry to protect that. Personally I am no fan of GDPR, but I am starting to see why it's necessary.
- bskap 7y agoIn much of the US, voter registrations are considered public record by state law. For example: https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710 https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710 Israel may have a similar law but I don't speak Hebrew and I suspect any searches I do for this will get buried by the news of the leak, so I don't think I'll be successful in finding it.
- benja123 7y agoThat's pretty bad IMO. What information is available? In this case the information included first name, last name, ID number, phone number, address and parents names
- bskap 7y ago> name, address, political jurisdiction, gender, date of birth, voting record, date of registration, and registration number Voting record in this case means which elections you voted in, not who you voted for. It is explicitly illegal to use these records to send advertisements, but who knows how well that works
- dvirsky 7y agoThese are most of the details that you get asked on the phone when you are asked to verify yourself in a lot of contexts (not banking, but say getting medical records from your health provided over the phone, etc).
- bsaul 7y agoI've always wondered if israel tech wasn't half genius half crook. They come up with fantastic technologies sometimes, but i feel like a lot of people there are just using this image of the "tech nation" to build scam or just lousy products. As an example, i was extremely surprised when an israeli airline company sent me my existing password in clear text via mail. For a country that's at the forefront of fighting terrorism and always assessing airplanes security, it seemed like an incredible mistake.
- pinkfoot 7y agoHere is my experiment: ask any Israeli company you have the pleasure of performing due diligence on to send you the patent numbers of the patents they claim they have. (Any patent number, forget localised patent claims). More than a decade, no patent numbers yet.
- KoftaBob 7y agoSounds like a common theme when it comes to relatively young tech industries. You could easily say the same thing about Chinese tech companies. Their software/security due diligence on the part of investors just hasn't caught up yet.
- scandox 7y agoIt's very similar to the US: extremely high tech in some respects and low tech in other respects. Both countries lagged heavily in Chip and Pin which would the most obvious thing to a visitor.
- deleted 7y ago[deleted]
- arkitaip 7y agoI don't see how that's even relevant here. Most countries have a highly competent and knowledgeable nucleus of tech people but that's not really relevant to tech security in the public sector.
- deleted 7y ago[deleted]
- ptah 7y agoam i correct in my understanding: in their attempt to intentionally leak voter PII to their canvassers they inadvertently leaked it to the whole internet? EDIT: "Last week, Prime Minister Benjamin Netanyahu called on Likud supporters to download the application in order to help draft more supporters and voters."
- michaelt 7y agoHas the power company "intentionally leaked" PII if they mail their customers bills, and by so doing give their customers' names and addresses to the USPS? Personally I would have said that is normal, legitimate processing; and any definition of "data leak" that included that would be so broad as to be meaningless. Of course, the leak of the full register by a negligently designed website is another matter...
- ptah 7y agoexcept addresses are effectively owned by the postal service. they are the primary users of it. the power company is merely using the postal service's addressing system
- einpoklum 7y agoActually, Netanyahu is _continuing_ to push the use of the "Elector" application to the Likud party activists - even after the publication of how it is effectively a leak of all voters' personal data. So the "inadvertently" part is now in question. Having said that - we need to differentiate between the intended use of the "Elector" app, which is individual record search, and the ability to obtain all records. The latter is due to a bug, and that's the leak. As for the former, I'm not sure exactly about its legality in the first place; perhaps others can comment on this.
- deleted 7y ago[deleted]
- air7 7y agoTechnical details can be found here (in Hebrew) [0] The gist is that, amazingly, the url "/get-admin-users" would return a list of all admin users with their plaintext passwords... And that this url appeared in the html source of the site's landing page. [0] https://internet-israel.com/%d7%97%d7%93%d7%a9%d7%95%d7%aa-%d7%90%d7%99%d7%a0%d7%98%d7%a8%d7%a0%d7%98/%d7%94%d7%9b%d7%a9%d7%9c%d7%99%d7%9d-%d7%a9%d7%94%d7%99%d7%95-%d7%91%d7%90%d7%a4%d7%9c%d7%99%d7%a7%d7%a6%d7%99%d7%aa-%d7%90%d7%9c%d7%a7%d7%98%d7%95%d7%a8/ https://internet-israel.com/%d7%97%d7%93%d7%a9%d7%95%d7%aa-%...
- lb0 7y agoThat is just amazing, - passwords in plaintext, check - deliver that list without protection, check - put a hint to this route into the landing page, check Wow!
- ak39 7y agoWow! It’s difficult here to invoke Hanlon: do not attribute to malice that which can be explained by stupidity.
- seemslegit 7y agoStupidity might be the symptom, but the root cause is almost always malice - in this case systemic corruption and malicious negligence.
- EGreg 7y agoThis. I have started to think of this rejoinder to Hanlon after the Iowa app fiasco. Stupidity may be a great cover for uncoordinated malice leading to widespread negligence. A bit like “chaos monkey” but by those who’d like to rearrange the pieces.
- blowski 7y agoI'd describe it as a vicious cycle of incompetence and misunderstanding risk. They exacerbate each other. It all begins with someone trying to get something done as cheaply as possible in an area about which they are ignorant. Whether they are a "corrupt cowboy" or "cost-efficient genius" mostly depends on whether the project is a success, and that depends on luck.
- rubyss 7y agoThis is classic israeli tech. If you're not aware, some people like to say that the israeli tech industry is divided into two - There's a lot of good talent working for the big multinational companies/startups that are targeting US/EU/Asia, and the local market gets the scraps that remain. This is how we end up with really shitty local apps and services, but export really good product to everyone else. It sucks - the local market is too small to have real competition, so shitty apps gain a monopoly easily and never budge from their spot. This is just another example of the talent working for local stuff being bad, it's not new and it's not surprising, although this time it's much bigger obviously.
- seemslegit 7y agoThis is classic market distribution in any country, including the US, in any profession, including highly regulated ones.
- dvirsky 7y agoIt's more extreme because the domestic market size is a fraction of the US' domestic market.
- sho 7y agoThe response from the company was hilarious: > The firm that developed the application, Feed-b, commented that the vulnerability was a “one-off incident that was immediately dealt with" Yeah... after a screw-up of that magnitude you don't even need a second vulnerability.
- oliwarner 7y agoOr even trust their ability to audit for other issues.
- alienalp 7y agoSimilar thing happened at Turkey. Voter data got leaked by one of opposition parties.
- jefftk 7y agoIn the US voter registrations are already public. How did Likud get a copy if that's not the same in Israel?
- dvirsky 7y agoIt's available to political parties under restrictions that they do not make it public and delete it after the campaign is over.
- zentiggr 7y agoNot that I'm excusing any of the developers or users of this Elector app... I find it's sometimes an illuminating point of view, to see these sorts of egregious failures from the point of view that there is a range of possible outcomes of any effort, from complete entropic chaos to a perfect expression of the intent and specifications. Efforts like these simply fail to approach the ideal closely enough to avoid the costs of the inherent chaos. I don't think so much about trying to herd people toward the light of perfect code and process. I do think about ways to mitigate the cost of the chaos. And then occasionally I get this vision of people who fail to consider the effects of breaches getting doxxed themselves, but that also seems vindictive, and as Tim Ferriss rightly pointed out just this week, can involve permanent damage to others. We humans are a tough bunch to sort out.
- forgotmypw16 7y agoOn a log enough time scale, all information will either become public or bitrot into non-existence.
- timmy_g 7y agoDoes anyone have a link to the dump?
- timmy_g 7y agoBecause it doesn't seem anyone actually saved that page. If so it was just a scare...