News for hackers. Stuff that matters.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by Afforess on Monday December 28, 2015 @10:19AM (#10801476)
As far as I can tell, the only "breach" here is revealing what candidates or parties voters chose. The voter registries are public in nearly all states. I've used public voter registries to look up addresses, even when I only had a name. Information such as a personal address, phone number, etc have always been trivial to look up.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by JadeNB on Monday December 28, 2015 @10:42AM (#10801570)
> The voter registries are public in nearly all states.

The article specifically mentions this:

> While the majority of states make their voter registration lists available as a matter of public record and do not restrict use, some states restrict use. For example, South Dakota requires the requestor of voter registration data to sign a statement …. In California, information on voter registration cards is considered confidential, and subject to many restrictions to access and use …. And in Hawaii, voter registration information may only be used for elections and by the government.

It is implied that the victims include voters from these three states (and explicitly stated that they include voters from California), so it is a genuine data breach in that sense.

> As far as I can tell, the only "breach" here is revealing what candidates or parties voters chose.

Also, as other commenters have mentioned, the list of fields at http://www.databreaches.net/wp-content/uploads/DataFields.jp... does include your party (which I think is information as public as the voting record anyway), but does not seem to include your specific vote.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by krisdol on Monday December 28, 2015 @10:29AM (#10801505)
I don't disagree with the general notion of your comment, but in

> As far as I can tell, the only "breach" here is revealing what candidates or parties voters chose

Why put "breach" in double-quotes? That's a very serious privacy concern if voters did not want this information to be public.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by JadeNB on Monday December 28, 2015 @10:46AM (#10801603)
> Why put "breach" in double-quotes? That's a very serious privacy concern if voters did not want this information to be public.

I think that this is a very important point. It doesn't matter how important it is to you that my information is public; the seriousness of its exposure depends on how important it is to me. (I am using 'you' and 'me' here not to argue with you specifically—in fact I agree with you!—but rather as generic pronouns.)

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by eli on Monday December 28, 2015 @11:07AM (#10801750)
It's not a breach because nothing was exposed that wasn't already public. Public voter rolls are one way we prevent fraud.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by krisdol on Monday December 28, 2015 @12:10PM (#10802097)
I don't expect who I voted for to be public record. I'm not a lawyer, but I don't believe this information is intended to be public record. There are risks of not only employers, but government workers and officials discriminating against someone based on their vote. The ballot should be as secret as possible.

edit: I pieced together information from other comments and noticed that who one voted for is not available, even through this breach. That's great. My comment here was addressing the breach as it was presented in this comment thread.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by oxguy3 on Monday December 28, 2015 @05:22PM (#10803747)
Who you voted for isn't public, but if you voted in a primary, it is often public which party's primary you voted in. Voting in a particular party's primary doesn't necessarily mean you're an actual supporter of that party though. I've heard of plenty of cases where members of one party voted in the other party's primary because they wanted the less-electable candidate to be that party's nominee.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by JadeNB on Monday December 28, 2015 @11:14AM (#10801796)
Your replies in this thread suggest that you take the public nature of voting registration lists to be axiomatic, but it is not; as the article discusses (and as I quoted at https://news.ycombinator.com/item?id=10801570 ), there are (more or less strict) laws regarding confidentiality of voter registration lists in some states, some of whose voters are affected by this breach.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by eli on Monday December 28, 2015 @11:21AM (#10801839)
Laws in various states restrict how you can use the data, but does any state prevent you from accessing it? It's illegal to misuse the data regardless of how you acquired it, including from this "leak"

I assure you there are already databases of every registered voter in America. You're not allowed to do certain things with some of the data, but its always been available.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by JadeNB on Monday December 28, 2015 @11:27AM (#10801867)
> Laws in various states restrict how you can use the data, but does any state prevent you from accessing it?

That's an interesting and subtle point, to which I don't know how to respond fairly. My information on these laws comes solely from the article, which says:

> In California, information on voter registration cards is considered confidential, and subject to many restrictions to access and use ….

"[S]ubject to many restrictions" links to https://www.lavote.net/Documents/purchase-order-for-voter-el.... I suppose that you could argue that these restrictions do not prevent you (assuming you are a US person) from accessing the data, but I think that the data are far from being public, which is what I understood you to be saying.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by thomasrossi on Monday December 28, 2015 @11:41AM (#10801941)
When the vote they implicitly consent for that data to be public. The problem is that this db is serving the data to users who are not gong to the proper office to ask for them.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by dfc on Monday December 28, 2015 @10:36AM (#10801543)

  > revealing what candidates or parties voters chose
This did not happen.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by JadeNB on Monday December 28, 2015 @10:44AM (#10801591)
> > revealing what candidates or parties voters chose

> This did not happen.

The list of fields at http://www.databreaches.net/wp-content/uploads/DataFields.jp... does include 'party', although I suppose that information is only as confidential as the voter registration anyway.

EDIT: The replies indicate that my last sentence was unclear. Contrary to what it seemed to say, it meant that, since the voter registration isn't confidential, neither is the party information (except that sometimes the voter registration is confidential, as discussed in the article and my 'uncle' comment (https://news.ycombinator.com/item?id=10801570 )). Maybe I should have phrased it, equivalently but more clearly, as "that information is as public as the voter registration anyway".

The point of my comment was just that it is not true that "voters' parties weren't revealed", which I took to be part of dfc's comment (https://news.ycombinator.com/item?id=10801543 ).

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by billyhoffman on Monday December 28, 2015 @11:07AM (#10801748)
Party registration is not private. It's public. Even if it was private in many states you can only vote in a primary with you are a registered member of that party which are then included in the voter registration lists.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by saalweachter on Monday December 28, 2015 @12:40PM (#10802249)
The party affiliation data in the voter roles is probably one of the most heavily used fields in there to boot. A lot of petitions need to be signed by a certain number of registered party members -- the local party apparatus has to get signatures each (election) year to demonstrate that they are indeed the local apparatus for that party, individuals wanting to primary need a certain number of signatures to get on the primary ballot, you may also need to collect signatures to force an open (write-in) primary with no specified candidates...

Campaigns will also use it to target their literature; you might send one mailer to the members of your own party ("X is a totally loyal party member, here's seven things he did to support our core party values!"), another mailer to the opposition party ("X is not a total baby eater, here's five ways he crossed party lines to support things you probably care about!"), and a spattering of other mailers to the third-parties to emphasize support for their particular interests.

The weirder thing to me is that these databases also include birthdays. You could send birthday cards to everyone.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by eli on Monday December 28, 2015 @11:01AM (#10801705)
Party registration is not secret at all, at least not in any state I'm familiar with.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by maxerickson on Monday December 28, 2015 @11:05AM (#10801736)
People should understand that the party declaration is public information (or at least, not very private). Whether they do is another question.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by pogue on Monday December 28, 2015 @11:50AM (#10801997)
Texas doesn't have party registration, which is why that field might be blank for the example query listed in the article.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by natch on Monday December 28, 2015 @11:13AM (#10801789)
You have no way to know this, unless you are the researcher or have access to the full list of fields somehow.

The list of fields shown is not complete, as they clearly state. They may have a reason known only to them, don't ask me what it is, for holding back information on fields they did not show.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by afarrell on Monday December 28, 2015 @11:05AM (#10801743)
> I've used public voter registries to look up addresses, even when I had only a name

This is why Wikipedia founder Jimmy Wales (and presumably other victims of stalking or DV) does not vote.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by eli on Monday December 28, 2015 @10:53AM (#10801643)
It does not have candidates voted for (how could it?) Just party registration, which is public. All of the data in this database appears to already be public records.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by kazazes on Monday December 28, 2015 @11:09AM (#10801764)
That's the question: why are the "primary_2000" and "general_2000" fields redacted strings? http://www.databreaches.net/wp-content/uploads/DataFields.jp...
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by gregshap on Monday December 28, 2015 @11:30AM (#10801882)
The values for those fields would usually be a boolean indicating whether you voted or not. For a primary it might have the party, meaning which party's primary you voted in.

For a Get Out the Vote operation it's very valuable to know how consistently people have voted in the past. If you look like a supporter but you vote inconsistently, I might call and ask if you need a ride to the polls. If you already vote every time, I'll allocate resources elsewhere, or ask you to donate/volunteer.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by kazazes on Monday December 28, 2015 @11:36AM (#10801917)
Yes, my point is that the author did not care to redact the other booleans for the other years, but did redact those two specifically.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by eli on Monday December 28, 2015 @11:17AM (#10801815)
It's probably whether or not you voted in those races, not who you voted for.

That said, both RNC and DNC databases track who you are likely to have voted for in each race, but that's just a guess. It's a secret ballot. Nobody knows who you voted for.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by pjc50 on Monday December 28, 2015 @10:41AM (#10801564)
revealing what candidates or parties voters chose

.. thereby destroying the integrity of the secret ballot, enabling vote-selling, intimidation, etc.

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by stan_rogers on Monday December 28, 2015 @12:01PM (#10802054)
It's just a consequence of the ridiculous party affiliation declaration of voter registration in the USA. It may or may not have anything at all to do with how a person actually votes, and is not a record of how people have ever voted (except coincidentally, if they both registered, say, as a Republican and voted for all Republican candidates). Elsewhere, party membership/affiliation is completely separate from voter registration; participation in the candidate selection process, etc., is governed internally by the party and its membership.
Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by stefantalpalaru on Monday December 28, 2015 @12:08PM (#10802087)
> revealing what candidates or parties voters chose

Isn't this supposed to be anonymous? Is it just the affiliation declared when registering for voting, or the actual vote itself?

Re:191M US Voters’ Personal Info Exposed by Misconfigured Da... by sixothree on Monday December 28, 2015 @11:07AM (#10801751)
It also seems to include data on when they have voted. Which year and primary versus general. I'm sure this is going to be valuable to someone.