4 ms·

I am pretty disgusted by this. First of all they basically leaked every single citizens who is of voting age PII. It sounds like the admin username and password

I am pretty disgusted by this. First of all they basically leaked every single citizens who is of voting age PII. It sounds like the admin username and password was visible for all to see inside the HTML source. Although I should be, I am not actually surprised by the lack of security in a political parties application. What I don't understand is why the interior ministry is providing political parties with the entire voter registry, which includes PII. I never gave my consent for this. It probably explains why I am getting spam SMS's from different parties on a daily basis(which is extremely annoying), but worse than that, soon we will all be forced to join the biometric database and I have zero confidence in the ability of the interior ministry to protect that. Personally I am no fan of GDPR, but I am starting to see why it's necessary.

bskap 7y ago
In much of the US, voter registrations are considered public record by state law. For example: https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710 https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710 Israel may have a similar law but I don't speak Hebrew and I suspect any searches I do for this will get buried by the news of the leak, so I don't think I'll be successful in finding it.
- benja123 7y ago
  That's pretty bad IMO. What information is available? In this case the information included first name, last name, ID number, phone number, address and parents names
  - bskap 7y ago
    > name, address, political jurisdiction, gender, date of birth, voting record, date of registration, and registration number Voting record in this case means which elections you voted in, not who you voted for. It is explicitly illegal to use these records to send advertisements, but who knows how well that works
  - dvirsky 7y ago
    These are most of the details that you get asked on the phone when you are asked to verify yourself in a lot of contexts (not banking, but say getting medical records from your health provided over the phone, etc).
- beagle3 7y ago
  The information is not public record in Israel. Apparently, the parties voted themselves the right to that data when the election cycle starts (6 months or so before the actual elections, or something like that), under the promise that "they will keep it safe, and delete it afterwards, and only use it themselves". Needless to say, it has leaked out to marketers/private-investigators/bittorrent in basically every election cycle so far.
traceroute66 7y ago
Some might call it karma for all the spyware. Feels different when the shoe is on the other foot, doesn't it.
- discordance 7y ago
  I don't think that's fair or equatable. Everyone deserves privacy and the protection of their identity, regardless of their government or defense force's questionable ethics.
- knolax 7y ago
  I don"t see how the vast majority of the 6M who had their information leaked had anything to do with "all the spyware".
- arkitaip 7y ago
  Bizarre that you would hold individual citizens responsible for the actions of a government.
  - varjag 7y ago
    Not an unreasonable thing in a democracy.
luckylion 7y ago
> Personally I am no fan of GDPR, but I am starting to see why it's necessary. Am not a fan either (but likely for different reasons), but would this be solved by Israel adopting GDPR? I'd assume they already have data privacy laws in place, and this still happens. I also don't think that it's a question of increased fines - those just become part of the business plan.
- chaosite 7y ago
  Israeli privacy laws are from 1981. They don't really cover PII by itself, only in certain cases, and they consequences are insufficient. Israel could probably do with something like the GDPR or CCPA.
  - seemslegit 7y ago
    There are more recent ones, and they explicitly exempt privacy violations for political canvassing purposes.
- benja123 7y ago
  GDPR would have required the app provider to encrypt our personal data and in addition it would have required the government (or who ever is working with them) to make sure either through audit or legal agreement that this is happening. At a minimum it would guarantee legal consequences for those companies that are not protecting PII
  - luckylion 7y ago
    The issue is that "requiring best practice" doesn't really help a lot when people/companies/institutions are simply breaking the law. If I understand correctly from the article: Political parties in Israel receive the information of Israeli voters before the elections and have to protect their privacy and cannot copy, erase or transfer the registry. But they did, because reasons. It would be nice if they committed their extralegal activities with more care so they create less collateral damage, sure, but the issue is that people/companies/institutions who don't care about law ... don't care about the law. > At a minimum it would guarantee legal consequences for those companies that are not protecting PII I understand the sentiment, and I wish that was true. Alas, my experience is that it is not.
deleted 7y ago
[deleted]
BuildTheRobots 7y ago
This is the same in the UK. Pay a £5,000 registration free [as a political party] and you get a full and un-redacted copy of the electoral roll [for the ward you're standing in]. I only realised after trying to find out how UKIP were addressing marketing with my name on it. edit: made it clear it was only on a per-ward basis.
- darrenf 7y ago
  This doesn't seem to be quite true; the Electoral Commission have a PDF explaining who is allowed copies of the full, un-redacted register be it for free or for money: https://www.electoralcommission.org.uk/sites/default/files/2019-08/List%20of%20people%20entitled%20to%20be%20supplied%20with%20the%20electoral%20register.pdf https://www.electoralcommission.org.uk/sites/default/files/2... UKIP would be allowed a copy for free, being a registered political party. Those entitled to a copy for money are limited, rather than just "anyone who pays five grand". OTOH, the open, edited register is more widely available, but it has been possible to remove yourself from that and has been for some years. https://ico.org.uk/your-data-matters/electoral-register/ https://ico.org.uk/your-data-matters/electoral-register/
  - BuildTheRobots 7y ago
    Apologies for the confusion; I've edited my comment to make it more clear. My understanding is that it costs £5k to register as a political party which is then entitled a copy for free. So no, you can't buy a copy of your local ward, but every few years you can spend a small amount of money and do a little paperwork to get a copy.
- beagle3 7y ago
  ... which is not surprising, given that the Israeli law is still "We follow British laws of 1948 unless we've since overridden them; and if nothing in the new ones or British ones cover it, we defer to the Turkish ones of 1917" (which reflects the conqueror/occupier legacy)
deleted 7y ago
[deleted]
deleted 7y ago
[deleted]
einpoklum 7y ago
"Never gave my consent for this" - You do realize that the state does not govern by consent of the governed, right? ... More specifically - did you ever give your consent for everybody's biometric data to start being collected as well? They went ahead with this despite the pilot having established there are security concerns and despite public outcry against it. I should inform other readers about the icing on the cake as well: The Minister of the Interior is a convicted criminal - Arye Der'i - who served time for corruption in this exact position. He is also currently under criminal investigation for corrupt dealings involving embezzlement of charitable organization funds in favor of some real-estate purchases. He was also implicated in the "Bar'-On-Hebron" affair during his last trial, where he was trying to get a convenient attorney general appointed in exchange for agreeing on the army withdrawing from occupied Palestinian city Al-Khaleel/Hebron. He wasn't indicted on that one because he had supposedly "quit politics" and was in jail when the investigation concluded.
- benja123 7y ago
  Even at the state level I should have to give my consent before they release my data to any third party. At a minimum I would expect all of those third parties to be audited regularly. Don't get me started on Der'i..
  - einpoklum 7y ago
    Of course, they are audited every night: https://youtu.be/yEPSJF7BYOo?t=115 https://youtu.be/yEPSJF7BYOo?t=115
pelliphant 7y ago
out of curiosity, what's wrong with gdpr?
seemslegit 7y ago
Fun fact: political messages are explicitly exempt under Israeli law that bans unsolicited SMS spam

bskap 7y ago

In much of the US, voter registrations are considered public record by state law. For example: https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710 https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710 Israel may have a similar law but I don't speak Hebrew and I suspect any searches I do for this will get buried by the news of the leak, so I don't think I'll be successful in finding it.

benja123 7y ago
That's pretty bad IMO. What information is available? In this case the information included first name, last name, ID number, phone number, address and parents names
- bskap 7y ago
  > name, address, political jurisdiction, gender, date of birth, voting record, date of registration, and registration number Voting record in this case means which elections you voted in, not who you voted for. It is explicitly illegal to use these records to send advertisements, but who knows how well that works
- dvirsky 7y ago
  These are most of the details that you get asked on the phone when you are asked to verify yourself in a lot of contexts (not banking, but say getting medical records from your health provided over the phone, etc).
beagle3 7y ago
The information is not public record in Israel. Apparently, the parties voted themselves the right to that data when the election cycle starts (6 months or so before the actual elections, or something like that), under the promise that "they will keep it safe, and delete it afterwards, and only use it themselves". Needless to say, it has leaked out to marketers/private-investigators/bittorrent in basically every election cycle so far.

traceroute66 7y ago

Some might call it karma for all the spyware. Feels different when the shoe is on the other foot, doesn't it.

discordance 7y ago
I don't think that's fair or equatable. Everyone deserves privacy and the protection of their identity, regardless of their government or defense force's questionable ethics.
knolax 7y ago
I don"t see how the vast majority of the 6M who had their information leaked had anything to do with "all the spyware".
arkitaip 7y ago
Bizarre that you would hold individual citizens responsible for the actions of a government.
- varjag 7y ago
  Not an unreasonable thing in a democracy.

luckylion 7y ago

> Personally I am no fan of GDPR, but I am starting to see why it's necessary. Am not a fan either (but likely for different reasons), but would this be solved by Israel adopting GDPR? I'd assume they already have data privacy laws in place, and this still happens. I also don't think that it's a question of increased fines - those just become part of the business plan.

chaosite 7y ago
Israeli privacy laws are from 1981. They don't really cover PII by itself, only in certain cases, and they consequences are insufficient. Israel could probably do with something like the GDPR or CCPA.
- seemslegit 7y ago
  There are more recent ones, and they explicitly exempt privacy violations for political canvassing purposes.
benja123 7y ago
GDPR would have required the app provider to encrypt our personal data and in addition it would have required the government (or who ever is working with them) to make sure either through audit or legal agreement that this is happening. At a minimum it would guarantee legal consequences for those companies that are not protecting PII
- luckylion 7y ago
  The issue is that "requiring best practice" doesn't really help a lot when people/companies/institutions are simply breaking the law. If I understand correctly from the article: Political parties in Israel receive the information of Israeli voters before the elections and have to protect their privacy and cannot copy, erase or transfer the registry. But they did, because reasons. It would be nice if they committed their extralegal activities with more care so they create less collateral damage, sure, but the issue is that people/companies/institutions who don't care about law ... don't care about the law. > At a minimum it would guarantee legal consequences for those companies that are not protecting PII I understand the sentiment, and I wish that was true. Alas, my experience is that it is not.

deleted 7y ago

[deleted]

BuildTheRobots 7y ago

This is the same in the UK. Pay a £5,000 registration free [as a political party] and you get a full and un-redacted copy of the electoral roll [for the ward you're standing in]. I only realised after trying to find out how UKIP were addressing marketing with my name on it. edit: made it clear it was only on a per-ward basis.

darrenf 7y ago
This doesn't seem to be quite true; the Electoral Commission have a PDF explaining who is allowed copies of the full, un-redacted register be it for free or for money: https://www.electoralcommission.org.uk/sites/default/files/2019-08/List%20of%20people%20entitled%20to%20be%20supplied%20with%20the%20electoral%20register.pdf https://www.electoralcommission.org.uk/sites/default/files/2... UKIP would be allowed a copy for free, being a registered political party. Those entitled to a copy for money are limited, rather than just "anyone who pays five grand". OTOH, the open, edited register is more widely available, but it has been possible to remove yourself from that and has been for some years. https://ico.org.uk/your-data-matters/electoral-register/ https://ico.org.uk/your-data-matters/electoral-register/
- BuildTheRobots 7y ago
  Apologies for the confusion; I've edited my comment to make it more clear. My understanding is that it costs £5k to register as a political party which is then entitled a copy for free. So no, you can't buy a copy of your local ward, but every few years you can spend a small amount of money and do a little paperwork to get a copy.
beagle3 7y ago
... which is not surprising, given that the Israeli law is still "We follow British laws of 1948 unless we've since overridden them; and if nothing in the new ones or British ones cover it, we defer to the Turkish ones of 1917" (which reflects the conqueror/occupier legacy)

deleted 7y ago

[deleted]

deleted 7y ago

[deleted]

einpoklum 7y ago

"Never gave my consent for this" - You do realize that the state does not govern by consent of the governed, right? ... More specifically - did you ever give your consent for everybody's biometric data to start being collected as well? They went ahead with this despite the pilot having established there are security concerns and despite public outcry against it. I should inform other readers about the icing on the cake as well: The Minister of the Interior is a convicted criminal - Arye Der'i - who served time for corruption in this exact position. He is also currently under criminal investigation for corrupt dealings involving embezzlement of charitable organization funds in favor of some real-estate purchases. He was also implicated in the "Bar'-On-Hebron" affair during his last trial, where he was trying to get a convenient attorney general appointed in exchange for agreeing on the army withdrawing from occupied Palestinian city Al-Khaleel/Hebron. He wasn't indicted on that one because he had supposedly "quit politics" and was in jail when the investigation concluded.

benja123 7y ago
Even at the state level I should have to give my consent before they release my data to any third party. At a minimum I would expect all of those third parties to be audited regularly. Don't get me started on Der'i..
- einpoklum 7y ago
  Of course, they are audited every night: https://youtu.be/yEPSJF7BYOo?t=115 https://youtu.be/yEPSJF7BYOo?t=115

pelliphant 7y ago

out of curiosity, what's wrong with gdpr?

seemslegit 7y ago

Fun fact: political messages are explicitly exempt under Israeli law that bans unsolicited SMS spam