Hacker News Reader

Comment by benja123 | Hacker News Reader

I am pretty disgusted by this. First of all they basically leaked every single citizens who is of voting age PII. It sounds like the admin username and password was visible for all to see inside the HTML source.

Although I should be, I am not actually surprised by the lack of security in a political parties application.

What I don't understand is why the interior ministry is providing political parties with the entire voter registry, which includes PII. I never gave my consent for this. It probably explains why I am getting spam SMS's from different parties on a daily basis(which is extremely annoying), but worse than that, soon we will all be forced to join the biometric database and I have zero confidence in the ability of the interior ministry to protect that.

Personally I am no fan of GDPR, but I am starting to see why it's necessary.

View on HN

In much of the US, voter registrations are considered public record by state law. For example: https://apps.leg.wa.gov/rcw/default.aspx?cite=29A.08.710

Israel may have a similar law but I don't speak Hebrew and I suspect any searches I do for this will get buried by the news of the leak, so I don't think I'll be successful in finding it.

That's pretty bad IMO. What information is available?

In this case the information included first name, last name, ID number, phone number, address and parents names

> name, address, political jurisdiction, gender, date of birth, voting record, date of registration, and registration number

Voting record in this case means which elections you voted in, not who you voted for.

It is explicitly illegal to use these records to send advertisements, but who knows how well that works

These are most of the details that you get asked on the phone when you are asked to verify yourself in a lot of contexts (not banking, but say getting medical records from your health provided over the phone, etc).

The information is not public record in Israel.

Apparently, the parties voted themselves the right to that data when the election cycle starts (6 months or so before the actual elections, or something like that), under the promise that "they will keep it safe, and delete it afterwards, and only use it themselves". Needless to say, it has leaked out to marketers/private-investigators/bittorrent in basically every election cycle so far.

"Never gave my consent for this" - You do realize that the state does not govern by consent of the governed, right? ...

More specifically - did you ever give your consent for everybody's biometric data to start being collected as well? They went ahead with this despite the pilot having established there are security concerns and despite public outcry against it.

I should inform other readers about the icing on the cake as well: The Minister of the Interior is a convicted criminal - Arye Der'i - who served time for corruption in this exact position. He is also currently under criminal investigation for corrupt dealings involving embezzlement of charitable organization funds in favor of some real-estate purchases. He was also implicated in the "Bar'-On-Hebron" affair during his last trial, where he was trying to get a convenient attorney general appointed in exchange for agreeing on the army withdrawing from occupied Palestinian city Al-Khaleel/Hebron. He wasn't indicted on that one because he had supposedly "quit politics" and was in jail when the investigation concluded.

Even at the state level I should have to give my consent before they release my data to any third party. At a minimum I would expect all of those third parties to be audited regularly. Don't get me started on Der'i..

Of course, they are audited every night:

https://youtu.be/yEPSJF7BYOo?t=115

This is the same in the UK. Pay a £5,000 registration free [as a political party] and you get a full and un-redacted copy of the electoral roll [for the ward you're standing in]. I only realised after trying to find out how UKIP were addressing marketing with my name on it.

edit: made it clear it was only on a per-ward basis.

This doesn't seem to be quite true; the Electoral Commission have a PDF explaining who is allowed copies of the full, un-redacted register be it for free or for money: https://www.electoralcommission.org.uk/sites/default/files/2...

UKIP would be allowed a copy for free, being a registered political party. Those entitled to a copy for money are limited, rather than just "anyone who pays five grand". OTOH, the open, edited register is more widely available, but it has been possible to remove yourself from that and has been for some years. https://ico.org.uk/your-data-matters/electoral-register/

Apologies for the confusion; I've edited my comment to make it more clear. My understanding is that it costs £5k to register as a political party which is then entitled a copy for free.

So no, you can't buy a copy of your local ward, but every few years you can spend a small amount of money and do a little paperwork to get a copy.

... which is not surprising, given that the Israeli law is still "We follow British laws of 1948 unless we've since overridden them; and if nothing in the new ones or British ones cover it, we defer to the Turkish ones of 1917" (which reflects the conqueror/occupier legacy)

Fun fact: political messages are explicitly exempt under Israeli law that bans unsolicited SMS spam

> Personally I am no fan of GDPR, but I am starting to see why it's necessary.

Am not a fan either (but likely for different reasons), but would this be solved by Israel adopting GDPR? I'd assume they already have data privacy laws in place, and this still happens. I also don't think that it's a question of increased fines - those just become part of the business plan.

Israeli privacy laws are from 1981. They don't really cover PII by itself, only in certain cases, and they consequences are insufficient.

Israel could probably do with something like the GDPR or CCPA.

There are more recent ones, and they explicitly exempt privacy violations for political canvassing purposes.

GDPR would have required the app provider to encrypt our personal data and in addition it would have required the government (or who ever is working with them) to make sure either through audit or legal agreement that this is happening. At a minimum it would guarantee legal consequences for those companies that are not protecting PII

The issue is that "requiring best practice" doesn't really help a lot when people/companies/institutions are simply breaking the law. If I understand correctly from the article: Political parties in Israel receive the information of Israeli voters before the elections and have to protect their privacy and cannot copy, erase or transfer the registry.

But they did, because reasons. It would be nice if they committed their extralegal activities with more care so they create less collateral damage, sure, but the issue is that people/companies/institutions who don't care about law ... don't care about the law.

> At a minimum it would guarantee legal consequences for those companies that are not protecting PII

I understand the sentiment, and I wish that was true. Alas, my experience is that it is not.

out of curiosity, what's wrong with gdpr?

Reply on news.ycombinator.com