Georgia's entire voter file potentially compromised after voting machine theft

https://www.wsbtv.com/news/local/voter-check-in-machines-stolen-before-polls-opened-for-special-election/987281739

by anigbrowl • 7 years ago

111 61 7 years ago

Diamant said this is a huge deal, because the elections director said the machines contained the entire state of Georgia voter file, which includes names, addresses and birthdates for all Georgia voters -- all now potentially compromised.

Hmmmm.....

By law, voter registration lists are available to the public and contain the following information: voter name, residential address, mailing address if different, race, gender, registration date, and last voting date. Pricing is set by the Secretary of State's Office.

https://sos.ga.gov/index.php/Elections/order_voter_registrat...

So I guess now the hackers improperly know everyone's birthday?

smt88• 7 years ago

I get that it seems minor compared to, say, Equifax, but voting is intended to be a particularly private aspect of public life.

You can say someone can buy their privacy by avoiding Gmail, Facebook, etc., but no one should feel like they have to choose between privacy and voting.

lopmotr• 7 years ago

Who people voted for is, but not really the other stuff. In my country, name, address and occupation on the electoral role are public-ish information that anybody can look up in the local library. The law requires it to be made public, though also disallows any bulk copying of it, so theft of the whole database would still be a problem.

BubRoss• 7 years ago

What information do they have that isn't already public? That's what the parent was talking about.

jdavis703• 7 years ago

Voter information is posted publicly on the outside of each voting location (at least in California). Election monitors, journalists and nosey neighbors can check to see who voted and when.

In some states you can even buy all this information on a CDROM. This is how canvassers know your name, especially when there's maybe a parent and adult child living at home (if the old person shows you ask to speak to the elder, otherwise ask for the child). I just don't see this as that big a deal.

thaumasiotes2• 7 years ago

You can say someone can buy their privacy by avoiding Gmail, Facebook, etc., but no one should feel like they have to choose between privacy and voting.

But again,

> By law, voter registration lists are available to the public

Someone may have stolen information they are legally entitled to have. That's not a scandal.

masonic3• 7 years ago

These are voter registration data, not voter history data (showing elections voted in and vote method).

Note that both Obama campaigns illegally distributed voter registration data freely and without qualification or tracking via their volunteer app.

gabrielgrant• 7 years ago

Actually, "Year of Birth" appears to be one of the voter file fields too. Not quite the same as an exact birth date (esp for identity theft purposes), but useful for demographic targeting.

whoopdedo• 7 years ago

Identity fraud is more likely with this information because SSNs are fairly predictable.

https://www.pnas.org/content/106/27/10975

bboygravity• 7 years ago

Naive question from a European here: how do you know and classify "race" and why is it relevant?

Do you get entries like 1 person's race being "25 % native Filipino, 10 % Chinese, 15 % "black", 25 % Arab, 25 % Caucasian"?

How do you even...?

speedplane• 7 years ago

Naive question from a European here: how do you know and classify "race" and why is it relevant?

Very naive, especially considering you're european. Race has much less to do with genetics and biology and more to do with perceived social norms. During the 1800s in the US, person who is 10% black is still often considered black. In Nazi Germany, a person who was 10% jewish was still considered jewish.

Putting people into race buckets is often based on unscientific (and immoral) notions of "purity" and a "natural hierarchy" of disparate societies.

craz8• 7 years ago

Many, many* forms in the US ask this information so they can do later analysis on how they are racially biased in their decision making, so they can Do Better Next Time (Tm)

Since I can answer in the Best Possible Way - old white guy - I don’t mind answering these optional questions. They never ask about how cynical I am though!

* many includes Job Applications, Loan applications, and, it seems, for voting too

snowwrestler2• 7 years ago

Race is self-reported. So if people answer honestly, the form records their own opinion about their own race. The categories on forms have been built up over time by finding commonalities in what people report.

thaumasiotes2• 7 years ago

Do you get entries like 1 person's race being "25 % native Filipino, 10 % Chinese, 15 % "black", 25 % Arab, 25 % Caucasian"?

This isn't really something to worry about. The odds are pretty good that there is no person in the world with the ancestry you describe; if you did get input like this, the sensible thing to do would be to discard it.

(Note also that Arab is a strict subset of Caucasian...)

aloknnikhil2• 7 years ago

The state will soon roll out a new, $100 million voting system which Raffensperger said will have a new iPad-based check-in system, which they can track and delete data remotely if they get stolen.

I'm confused. Why are these records on the device at all? Why not a server? Why spend $100 million just to move it from paper to an iPad?

wtallis• 7 years ago

They need to be able to check in voters on election day even if the polling place's internet connection drops.

aloknnikhil2• 7 years ago

I get that. But you could always fallback onto another way of reaching the server (LTE/4G) or even a direct connect to some central server close by. I mean, this is sensitive data that is essentially being replicated across the whole state onto devices that are not heavily guarded apparently. Surely there are better ways to handle this? And as connectivity gets better, I think there should be a push to adopt client-server architectures for critical infrastructure.

How would remotely wiping an iPad help? What if the stolen iPad is never allowed to connect to a network?

hnaccy• 7 years ago

You can't rig paper.

oh_sigh• 7 years ago

Ballot box stuffing? "Losing" boxes from certain districts?

bdamm• 7 years ago

Oh yes you can. It's in how and what you count.

kabdib• 7 years ago

I am personally in favor of simple, physically based voting systems. The kind that can still work reliably during periods of unrest and mistrust.

erichocean• 7 years ago

Purple finger tech has yet to be improved upon...

an_account2• 7 years ago

Paper ballot, electronic counting. Best of both worlds. You get a quick count, but also if there’s shadiness/hacking going on you can always recount the paper.

Some states seem to be moving towards absentee voting over the internet, which will be a mess when accusations of hacking start flying.

tssva• 7 years ago

They computerized for the same reason most things are, higher efficiency leading to lower cost. It speeds up the check-in process which means each polling location can handle a larger number of voters reducing the cost of elections. After the fact records need to be updated to reflect which voters have actually voted. It is much faster, less labor intensive and less error prone to gather that information electronically from some iPads than pay people to review paper records and enter that information into a computer.

The information is stored locally on the iPads because doing so on a server greatly increases both the potential failure scenarios and the potential attack surface of the system. Think about the impact of that server going down or a DDOS of the server. Also think about the communication infrastructure needed to and within the polling place for those iPads to reliably be able to reach the server.

tunesmith• 7 years ago

Or perhaps it's a "theft" to justify some other effort to further restrict people's voting rights - like, I guess it's time to make everyone re-register, except for those right-thinking folks that they're already sure aren't cheaters...

dralley• 7 years ago

I hope this helps the lawsuit to force Georgia away from using electronic voting. Clearly their security procedures (physical and digital) are lacking.

OrgNet• 7 years ago

digital voting is not an issue only in Georgia... but that would be a start.

Beldin3• 7 years ago

The officials somehow need to verify eligibility. If not with a computer, then on paper... which could also be stolen in exactly this manner.

So I doubt it'll have this impact.

mhh__3• 7 years ago

Or just distribute the verification work to a local level where theft of one set of names is only locally useful.

r0m4n0• 7 years ago

Having spent quite a bit of time requesting voter files from the government, I can say it’s not hard to obtain this data in most states. Many times it’s just a small fee, a pinky promise that you won’t use the data for non political purposes, and a photo of your drivers license. I think they should be more worried about someone reverse engineering the closed source software of the checkin machine in this case...

victor9000• 7 years ago

This is what you do if you want to probe one for weaknesses.

gordaco2• 7 years ago

Sorry to be that guy, but here is the obligatory XKCD: https://xkcd.com/2030/.

As a tech worker, and as someone who knows about computers, I very strongly oppose electronic voting. And the more I know, the more I oppose it. It's slightly more convenient, but in exchange it's way way less secure.

Also, this is not the first time Georgia has had problems related to electronic voting: see https://www.theinquirer.net/inquirer/news/1003966/diebold-in....

pmontra2• 7 years ago

But it's the wet dream of people willing to spend a lot of (not theirs) money and maybe rigging the results.

mhh__3• 7 years ago

I think both practically, theoretically and ethically the only response to electronic voting is to kill it with fire

codedokode5• 7 years ago

The state will soon roll out a new, $100 million voting system which Raffensperger said will have a new iPad-based check-in system, which they can track and delete data remotely if they get stolen.

Will they be able to delete votes for a wrong candidate remotely too?

rovr138• 7 years ago

Pretty sure they mean apple’s remote tools for tracking and deleting.

This does say check in.

Georgia's entire voter file potentially compromised after voting machine theft

Related Stories