The data is not a well-kept secret, but there are restrictions on its use, and for some locations criminal laws about misuse. See http://nationbuilder.com/voterdata for state by state rules.

Note in particular, "Placing on the internet so anyone can find out where anyone else lives" is not exactly an approved use in locations like California and Hawaii. Which is why there are going to be consequences once the database owner is tracked down.

Further, some records may never be public, depending on local rules. Witness protection, victims of domestic violence, judges, etc.

Rant: The state run VRDB's are a mess.

HAVA improved the situation, but 50+ separate systems leads to data quality issues. Which then trigger alarms. False positives are "voter fraud". False negatives are "caging" and "purging".

Made worse by the requirement that only eligible (active & inactive) voters appear in each database. Versus a master list of everyone with an eligibility flag, backed by an audit log.

The optimal solution is automatic, universal voter registration, maintained by each jurisdiction and hosted by the feds (perhaps http://eac.gov). Which is exactly what both parties are doing in-house. Then we can put a stop to the recurring food fight every election cycle.

Thanks for listening. My work on this issue has made me grumpy.

What sort of work have you done?

Primarily election integrity and voter privacy. As an activist, lobbyist, and candidate. I've dabbled in public financing. And I contribute to causes I support.

I've been working on legislation information systems, as best able, to help future persons like myself be more effective. (Tools I wish we had when I got started.)

Thanks for asking. From your profile's links, it looks like we'd be allies.

As the article notes, a good portion of the information is already public like you've said. However, as I see it, there are two types of "exposure" at play here. I took the "exposure" in the headline to mean "a publicly accessible database is serving up information that the owner might not have intended to reveal," rather than "sensitive personal/private information has become public." In my opinion, the "exposure" being described does not have to be the latter type to be unsettling or worthy of mention.

Pretty sure it is 100% already public. And not that hard to access. See e.g. https://elections.nationbuilder.com

Came here to emphasize the difference between taking public manually retrievable data and public programmatically accessible data, but it appears the API has no rate limiting in place.

Is it public information in which elections a person votes?

Yes.

There have actually been some interesting social science experiments to shame people into voting more often by using their turnout record http://www.usatoday.com/story/news/politics/2014/10/30/inter...

But eliminating the jumps you go through to get that info isn't a good thing either

Are you saying that accessing public data should be possible, but require a willingness to jump through hoops?

What's your thinking behind that?

I'm not the person you asked, but to play devil's advocate...

I think law enforcement agencies should be able to wiretap suspects of crimes to listen to their phone calls, subject to judicial oversight. I do not think they should have unrestricted, unlogged access to a database of recordings of every phone call ever made by every citizen.

Same line of thinking IMO. There's a difference between an individual identifying themselves and signing a usage agreement before requesting public records from an individual county, versus dumping online a public database that lets you query the personal details of 191 million people. The same data is available, but the extra hoops you have to jump through change the potential for abuse.

I appreciate your thoughtful comment.

With respect to the law enforcement example, the access there is to non-public data. That seems like an essential difference to me, but perhaps you're citing this situation in preparation for your third paragraph.

In your third paragraph, I think I'm seeing a dilemma. I don't understand how jumping through the hoops changes the potential for abuse.

Let's say 30 people go to the county records office and get the data. They all sign an agreement of some kind. 30 people now have (presumably) exactly the same data set. One of the 30 violates the agreement and publishes it anonymously on the Internet. The data is now "in the wild" and any potential for abuse that it held is now up for grabs.

I recognize that I may be missing something, but if I am, I'm not able to see it. I might need more coffee. ;-)

I agree that there's a difference between public and non-public data.

With respect to the public data though, this is an issue which we've been wrestling with (and largely punting on) since various public records became readily available in electronic form. The fact is that, in the US, there's quite a bit of public information available about individuals. Much of this information (think home sales, past addresses, any court records) is public for historically sound reasons. However, there is a huge difference between scouring dusty town, county, and state records at considerable cost of time and money and making a few quick queries on the Internet, possibly paying a nominal fee if you really want to go deep.

But, to your point, we effectively implement privacy through obscurity/bureaucracy to shield ostensibly public information that we don't feel comfortable about anyone having access to it. But it probably works about as well as security through obscurity.

Not really true, see: http://www.emerges.com/assets/images/docs/Restricted-State-V...