Hacker News Reader

Comment by wyldfire | Hacker News Reader

I hate to be in the position of defending a leak such as this. But if what they've done is "merely" compiling data that was available from our public profiles, are they obligated to secure that compilation? I'm asking -- I don't know for sure how the data was gathered, it just sounds like it was from scraping public records + public web sites.

Also, can someone ask Troy Hunt whether he has or can get access to this data so he can let us all know if we're on it? (But will it even matter if they don't have an email address field?)

View on HN

Voter files being public data depends on which state you're talking about -- you're looking at ~50 different sets of laws and regulations. Some states restrict access to only political parties using it for political uses and prohibit distribution to non-parties/candidates. Some states (Florida, for example) will let anyone just apply to get it.

To your latter question, some states, like California, do include email addresses on their voter file, but the coverage tends to be poor.

You can probably assume that, if you're a registered voter in the United States, you're on this dataset, as is your age, gender, party affiliation if applicable, and race/ethnicity info if your state collects that, as well as modeled information projecting things like party support, race, age, and likelihood to turnout.

https://en.wikipedia.org/wiki/Secret_ballot All 50 states have some form of secret ballot. Only WV has an open ballot.

This is voter registration data, not ballot data.

May I ask, where have you seen a voter file with email addresses? I haven't seen something like that myself.

It's an interesting question, because there is a comparable in the intelligence community called aggregation.

Effectively two pieces of information when separate, might not be classified, but if they are linked with a third or combined they become classified. Add more and it changes the classification further.

I wonder if there should be something similar for data aggregation companies. Like what we see with HIPAA.

That's not a bad idea, but the specifics would be pretty hard to nail down.

Personally, while I understand that this is nothing illegal, I think it's terribly wrong.

We just handed everyone, including the 5% of society who tend towards sociopathy, a nicely tagged, collated (and yet probably slightly inaccurate) list of minorities.

Hate women? You have a nice list which includes the names, addresses, and telephone numbers of all those women.

Hate muslims? Boy do I have just the list for you. Blacks? Republicans? White muslim men who live in the same neighborhood as you?

Let's omit the sociopaths for just a moment, and let's look at the ad networks. Can you picture how much more accurate a picture those companies have of you now? They no longer have to guess at your age, ethnicity or religion - they now know. What could go wrong when that list of "legally" collated data gets combined with the RNC leak, and is subsequently itself leaked?

So no. It's probably not illegal to compile these lists. It's probably not even illegal that it was released. But it was, for certain, a damned immoral thing to do, and there will be consequences.

One of the weird effects of the internet is that stuff that used to be considered obvious and self-evident is now treated as very sensitive. For example, no one used to consider their gender or race "private" information; rather, it was nearly impossible to interact with another human without these things being self-evident.

Not many years ago, there used to be a book distributed far and wide with the names, address, and phone number of virtually everyone that lived in your city. This was accepted as normal and routine, and you had to specifically opt out of being included.

The difference is in the scope. Back when phonebooks were widely used, there was no automated way to correlate those records with other records to create a highly specific list of all Asian women who live in a four block radius of a specific address.

You could walk around and find some of them, but that would take a significant amount of time and effort.

Phones were also not capable of interrupting you while you were out of the home, nor were they capable of receiving short messages on your dime.

I don't really disagree that this is a shitty data breach, but on the consequences, I'll point out that the 5% of society who tends to sociopathy already have much lower-effort means to target minorities:

Hate women? Look for boobs.

Hate muslims? Look for brown skin.

Hate Republicans? Look for MAGA hats.

That these are inaccurate signals is irrelevant: haters gonna hate, and I really don't think they care whether the brown-skinned person they're harassing is actually a Muslim, they just want a target for their anger.

As for ad networks - they already have much more accurate models of age, ethnicity, and religion than the RNC has. There's a lot more money involved in targeting ads, and so they've put a lot more effort into it than political consultancies. Worrying about them is like closing the barn door after the horse is out.

> lower-effort means to target minorities

It doesn't get much lower effort than downloading a list, popping it into Excel, and sorting on a column (I'm willing to bet that some hate groups are already doing this and will release very specific lists to their membership). And with phone numbers and a couple of bucks, you don't even have to leave your house to send them hate messages by the thousands.

Haters gonna hate - far too flippant a phrase to describe those who emotionally and physically assault their targets.

As for the ad models - the RNC release has a very specific DOB, location, gender, and phone number. Some of these the ad network could guess at, but this provides concrete data.

It gets a lot lower effort than downloading a list, popping it into Excel, and sorting on a column (really, how many non-techies would do that?). Get on the subway, find girls with brown skin, start screaming obscenities, pull knife when confronted, murder.

Look, I don't want to minimize the impact of hate or harassment on victims. It really is terrible, and should be challenged whenever possible. I do want to inject some realism into the discussion of the likely consequences of this breach. The people who would go out and harm other people because of their ethnicity or religion don't particularly care if they get the ethnicity or religion right. (I'm reminded of a time when I was carrying my wife's purse while she went shopping in a nearby store, I walk by a pickup truck, and the guy inside is loudly muttering "Fucking faggots" over and over again. And then I met my wife in the parking lot, give her a kiss, hand her back her handbag, and he laughs a big "Ha-ha!" of relief and drives off.)

And the people who would do mass harassment over the phone have much easier ways to get this data, like e-mailing their state voter registry and asking for it.

Certainly, it makes it easier to call SWAT on the home of a person in Georgia while being in Alabama; this is much lower effort than shouting hate slogans at some random group of people in the street. This is scary nasty.

Why do you assume sociopaths just want to pick on individuals? There are ambitious sociopaths that draw up plans for things like ethnic cleansing, genocide and so forth. We have abundant examples of such behavior within recent history.

I think your concept of sociopathy qua serial killer is uninformed and stereotypical. Most sociopaths are not stabby weirdos blinded by hatred, they're just self-centred people with different levels of emotional affect/susceptibility than the general population.

It seems not to have occurred to you that (depending on record quality) a database like this would be great resource with which to find and recruit sociopaths of various stripes.

I don't assume that sociopaths just want to pick on individuals. I assume that the ambitious sociopaths drawing up plans for ethnic cleansing are the people who compiled this database in the first place.

Someone with the resources to perform ethnic cleansing could easily pony up the few thousand dollars that is required to buy this data in the first place:

http://aristotle.com/voterlists/

http://nationbuilder.com/voterfile

http://www.l2political.com/products/data/

I see, I misunderstood the point you were making in your earlier post, sorry.

Voter registration information is public. It doesn't seem like any of the information "leaked" is actually private.

I missed where it was all public; couldn't you share information with your political party you wouldn't want shared with others? And wouldn't the accumulation of all that data be valuable?

Many states have very loose control over their voter database. The control is mostly exerted through the force of the law prohibiting certain uses of the data. For example, I can order the voter database for the state of New York and receive it on a CD in a few weeks. Other states will simply email you a link to a big bundle of CSV files.

There is other information besides what is on the voter database in this disclosure, it appears, but the voter data itself is mostly not a secret and can be trivially accessed by any citizen. They just have to promise not to break the law around what they do with it.

Most data in there isn't public; voter files is only one part.

Reply on news.ycombinator.com