Hacker News Reader

Comment by DannyBee | Hacker News Reader

Speaking as a guy with a lot of experience with voter data ( I built the first "where do I vote" apps for Google and helped found the voting information project):

This is actually almost entirely public data. Yes, including addresses and phone numbers and political affiliation. There are some states that is not public as part of the voter file, but you can still get it other ways publicly. For example: USPS, etc. Some states/players would make you sign agreements not to use it for commercial purposes.

The modeling info included is not public.

Acquiring 50 state data can be a bit of a pain, but there are at least two major players that will sell it to you. (I remember one of them literally laughed when I told them we would want the databases without any personal info included, because we just wanted the address to various political precinct mapping.)

View on HN

> This is actually almost entirely public data

Birthday is an included item. That's definitely private as it is often used to confirm identity.

"almost public" is meaningless. One data item, like credit card number, or birthday, can make this a dangerous leak.

> Birthday is an included item. That's definitely private as it is often used to confirm identity.

mylife.com publicly posts birthdays so apparently not

No kidding, but I don't want that information out there, and I imagine most people don't.

Just because some skeezy website shares all my personal information does not make it public information. It's private to me and I'd rather it remain undistributed, where possible.

Overall point being, this US voter data leak is bad. That appears to have released information on all of us that we consider private.

> Just because some skeezy website shares all my personal information does not make it public information.

I kinda think it does mean exactly that. Just because you don't want something to be public doesn't mean that it isn't public.

So do you consider your daily schedule, gps locations of where you go, to be public information?

Nothing about the definition of public or private restrict either to being protected by the government. I can consider some information private without it being protected in the legal sense.

That said, I expect that any government entity that released my birthday would be held responsible for a data leak.

> So do you consider your daily schedule, gps locations of where you go, to be public information?

Nope. What's your point?

Your words,

> "Just because you don't want something to be public doesn't mean that it isn't public."

In the future, your location data could be tracked, shared/hacked, analyzed to produce more information, and breached just like this RNC dataset.

My point is, something private doesn't become public when a criminal exposes it. It's still private to you.

What? It isn't public because it isn't public. Not because I don't want it to be public.

If in the future it is no longer public, then I won't consider it private. I may not be happy about it, but that doesn't change the fact that it is public at that point.

If a criminal releases 100,000 credit card numbers, we don't all of the sudden consider credit card numbers to be public. We try to limit the spread of the leak, if possible, and shore up whatever security lapse occurred. Nowhere in that scenario to we begin to consider credit card numbers public.

So it is with birthdays. There isn't any government organization who will distribute that information.

You most certainly do consider stolen credit cards public! You don't just limit the information and hope for the best—you attempt to inform everyone affected of the breach and try to get everyone to change their card number (because it's public at this point).

I think we're using public/private in different ways. You're referring to the data's present and future classification. I'm pointing to the data's past classification because that determines whether the collection of data was theft or not.

If all credit card numbers were stolen and distributed, we would still have considered them private before that.

The same is true for these birthdays. They were private, then stolen and made public. That they are now public doesn't retroactively make the theft okay. Theft is theft.

The lesson here is to tighten security, increase security education and awareness, and increase investigation into the most egregious of these crimes so that violators can be brought to justice.

Birthday is almost certainly public. You can get it easily from the DMV or from any of several dozen commercial providers that resell government data:

https://www.dmv.org/public-records/

That it's used to confirm identity shows how weak identity-theft protections are at most institutions, not what's public information. (For that matter, mother's maiden name is basically public information as well: you can get it from genealogical records.)

How many dark patterns are used by truth-finder.com? Seriously.

The site you linked to is not affiliated with any state DMV. It links to a sketchy background check service that appears to be a scam.

Edit: spelling

That, and, I've never consented to release my birthday publicly. I consider it to be private, therefore it is private. It's mine! I expect the government would not release it since they use it as part of an identifier all the time.

There's no perfect identifier. That's why we need security. This is a major lapse.

Pretty sneaky of the comment above yours to try to pass dmv.org as a government website.

> I've never consented to release my birthday publicly.

Too bad. The government doesn't care about you consenting to things. In fact, making you do things without your consent is literally the entire point of organized government, even if we usually overlook that because it's for a good purpose (for example, taxation to pay for health care or national defense).

You're off topic. The government hasn't released my birthday. I question their data security practices, but any release of such information would be considered a mistake.

I don't care if you think paying for health care or national security is important or not. That's an unrelated issue to whether or not Birthday is private or public data.

How do you know if your birthday isn't in some publicly accessible government database somewhere? Did you try to find it? Did you hire a private investigator (who has quick access to all those databases) and ask them if they can find your birthday?

If it were, I would let the government know that's not okay. Hackers would be one step closer to being able to sign up for a credit card under my name.

If it's true that that information is out in the wild now, then I expect government to tighten their tech security procedures.

"I would let the government know that's not okay" - lol, yeah good luck with that.

How do you think the RNC got birthdays for 200 million Americans in the first place? Public records. 200 million Americans are NOT affiliated with the RNC.

> How do you think the RNC got birthdays for 200 million Americans in the first place?

As I replied elsewhere, there is a market for reselling your information on the internet. In some cases that is legal, and in many it's probably not. As a tech person you should know this.

I think you are confused about what "private" means.

I've never "consented" to "releasing" my address publicly, but real estate records are public information thus the real estate I own is easily queried from my town's website and the real estate transaction was published in all the local newspapers. You can even look up my property tax bills from the towns website and my payment history of said taxes. If you're feeling generous you can also pay my property taxes online too.

You're trying to redefine private.

Is the list of doctors you visit private? I could probably discover such information, but it is considered private.

Your address is usually public unless you go to lengths to obfuscate it. You can go to Hollywood and get a map of where all the movie stars live. And, the white pages list your phone number unless you opt out.

Birthday has never been publicly available until this voter data leak. Not good.

>Is the list of doctors you visit private?

Yes, this is explicitly protected by law.

>I could probably discover such information

No you can't get this information, and certainly not legally.

>Your address is usually public

Exactly but I never "gave my consent to release my address," it just is.

>Birthday has never been publicly available until this voter data leak.

Open up a newspaper or open up yourlocalpaper.com There's a whole birth announcements section!

How do you think the RNC got this information in the first place? Public records. The RNC is NOT the government.

> How do you think the RNC got this information in the first place?

I imagine they used campaign dollars to buy the information from private companies with whom you've done business. Maybe legally, maybe not.

The RNC certainly isn't offering up such information as to where they sourced the data they leaked.

The link was preceded by the words "from any of several dozen commercial providers that resell government data:" so that's how I took it. It would be at a .gov domain if it were state affiliated.

It said from the DMV. No evidence of that here.

Also, "reselling government data" implies that the government explicitly gave permission to a business selling your data. I doubt that's true. More likely, these entities gathered data from whatever entities they could, probably various private companies from which you've made online purchases.

"from the DMV"? no.

> DMV.org is a privately owned website that is not owned or operated by any state government agency.

DMV as in Department of Motor Vehicles. Many states have names like that hence "DMV"

No evidence here that you can get someone's birthday from any state-run DMV

https://www.dmv.ca.gov/portal/dmv/?1dmy&urile=wcm:path:/dmv_...

How is that evidence? Birthday isn't included and it notes,

> "Note: Residence address and SSN are confidential except when the requester is authorized by law to receive it."

>The Department of Motor Vehicles (DMV) maintains information on approximately 32 million vehicles/vessels registration (VR), 27 million driver licenses (DL) and/or identification (ID) cards, and over 437,000 occupational licensing (OL) records.

>Confidential information is not considered public record. This includes certain DMV personnel matters, physical/mental information, residence address, social security number (SSN), incomplete findings from research, results of ongoing investigations, operation plans, and electronic data security controls.

DOB is listed on ID and not considered confidential information.

> DOB is listed on ID and not considered confidential information.

Nowhere does it say that. If you think they mean that by omission, I highly doubt it.

Considering it's listed as public record in the first place, I doubt it. I was just directly attacking your claim.

Birthday is not public record, and there is no evidence that it is. That's the point. There's no government entity that will give you a list of people's names and dates of birth.

You cited California DMV which does not give up that information. They won't even give you someone's address unless you're legally entitled, like the police.

Yes, the only reason that anyone cares about their date of birth is that in recent times it has been something that can be used in identity theft. Back in the pre-internet days, nobody cared. People had their SSNs pre-printed on their personal checks too.

The solution to all of this data privacy hysteria is to change our approach. The possession of common facts about a person should not be sufficient to masquerade as that person.

> The solution to all of this data privacy hysteria is to change our approach. The possession of common facts about a person should not be sufficient to masquerade as that person

I think the solution is better security. We'll only ever have basic facts to uniquely identify people. Biometrics can be hacked/copied too.

I think the problem could be mostly solved by requiring people who are getting credit to apply somewhere in person. Most credit card banks have branches everywhere (USA). The person has to have their face recorded stored along with credit line. This would have many benefits: legitimate people would think more about how serious getting a credit card is, fraudsters would be less likely to try and get fake credit, and it would be much clearer when the bank gave credit to the wrong person and has to eat the loss. Unlike the past, taking and storing pictures is now a trivial task. This is not likely to happen as the credit companies little liability under the current system.

Um, no. Your birthday is certainly not private information. Births are openly published in the local paper and online. Not to mention stuff like this - http://www.wfsb.com/story/26835982/website-displaying-voters...

Um, yes. It certainly is. I don't want it released publicly, nor have I consented to release it to any website.

If there are websites out there sharing that private information, they're doing it without my consent.

You may consider it private, but that doesn't make it legally private. Which is the kind of privacy under discussion in this thread.

Nobody has restricted this conversation to the legal sense.

Is your daily schedule, when you go to work,drop off your kids, what route you take to work protected legally? No, but you probably wouldn't want to share that information publicly either. Yet, in the future, a data breach could reveal such information, and a business could seek to resell it.

Did you read The link I posted? If you are a registered voter in Connecticut your birthday is public information by law.

Yes. One state doesn't mean all states. Also, it's tbd whether this website will be allowed to continue to operate,

> "According to the webmaster, there is a class action lawsuit that is trying to have the site shut down"

The article also argues that many types of workers ought to seek removal of their name from this list in the interest of personal security.

The story is making the case that this should be considered private information.

If you don't want it released publicly, a better chance is to ask you parents didn't do it when gave you birth. No offense, many places, like small towns will list birth of child on local newspaper if parents sign a form after birth in the hospital among a pile of forms.

It may be discoverable in that way, but that doesn't mean government entities are or should be disclosing names with birthdays en masse. Certainly not the entire country's all at once, which is what the RNC appears to have done.

> Birthday is an included item. That's definitely private as it is often used to confirm identity.

Lots of things that are actually not private data are used to confirm identity; “it is used to confirm identity” is not a disproof that a piece of information is public information.

Would you like to share your full name and birthday with the world?

I wouldn't. Therefore it is private.

That would disclose way more information than just my name and age. You would then be able to associate that information with my HN username and all the data associated with it.

I don't follow.

idbehold can't post his or her name and birthday without revealing he or she is the owner of the idbehold hacker news account. Which is more information than name+birthday, it's name+birthday+hacked news posting history.

http://www.dc.state.fl.us/activeinmates/detail.asp?Bookmark=...

This is a random guy. His named ERNEST BELL JR and his birthdate is 10/05/1959.

> dbehold can't post his or her name and birthday..

Not sure why you're replying for someone else..

> This is a random guy. His named ERNEST BELL JR and his birthdate is 10/05/1959. Inmates obviously lose some rights when convicted. Data security is minor compared to losing the freedom of movement.

Also doesn't surprise me that Florida would make all information on its inmates public.

Plot twist: creepydata is my alternate account and I am Ernest Bell Jr. born 10/05/1959.

The modeling info is the real value.

So taking that modeled data, loading it into Cambridge Analytica (which I understand is somewhat of a DMP in this sense), and leveraging it with highly-customized creative targeted against Custom Audience uploads using this modeled data would be insanely valuable to a political player with the capital to deploy this info weapon.

CA offers DMP services as part of their product suite, but they specialize in doing this kind of modeling as a professional service.

It's probably good that a lot of this is public, but one thing I think we're going to reckon with is how "available" all of this data should be, and how much it costs in terms of time or money to retrieve it.

Should I be able to find the public records for any citizen, anywhere in the country, at the snap of a finger? Or should I have to go to e.g. the courthouse and ask for the records in person, deal with a phone system, &c.

Adding this kind of friction only discourages people with good intentions. It doesn't stop people with not so noble intentions (who are most likely backed with a lot of money)

This is how data brokers make money: go through all the labor intensive manual acquisition processes and then resell it through a slick web UI.

where can I get access to this data?

Contact anyone with a voter file (google "voter file purchase")

Trivially: http://nationbuilder.com/voterfile

etc

As for "For free", states are generally required by law to give it to you if you ask. Some charge fees. Only two have crazy fees (5k and 30k) has a crazy fee (though if you challenge them, ...etc)

https://trello.com/b/IlZkwYc0/national-voter-file-states-pip...

There is a github project i'm aware of to put together all of the data: https://github.com/national-voter-file/national-voter-file

FYI, be careful what you do with it. Some of this sort of data--like federal contribution data from the FEC--cannot be legally used for commercial purposes[0]. They do actually enforce it, at least occasionally.

[0] https://transition.fec.gov/pages/brochures/saleuse.shtml#anc... (publication is from 1992, but still accurate per disclaimer at the top)

Reply on news.ycombinator.com