Tirana Prosecution to Investigate Alleged Data Leak of More than 630k Albanians | Hacker News Reader

Tirana Prosecution to Investigate Alleged Data Leak of More than 630k Albanians

exit.al

Albanian prosecutors probe huge suspected leak of personal data - https://news.ycombinator.com/item?id=29651773 - Dec 2021 (115 comments)

In 2011, I blogged this: https://web.archive.org/web/20130501172236/http://www.fernan...

I found the "leak" with a right click in my own data (images), then I changed the params in the URL without being logged in and it worked. Fingerprints, Scanned ID cards, Photos, and Signature, of millions of Argentine citizens. When I changed the ID in the URL, I used the ID (found in public sources) from a guy named like me. When I saw his face, ID card, fingerprint, and signature my jaw dropped. Years later AFIP took over the control on .ar TLDs (NIC.ar) and for strange reasons I could not renew my domain. :) Ten years ago. Its all leaked. Or at least we should asume so.

Just yesterday in the discussion of Internet Archive, a user made this comment https://news.ycombinator.com/item?id=29639814 I truly wonder if Internet archive crawls this and recuses to delete it, whats the implication. Since its public now.

A large number of people mistakenly upload identity documents to AirBnB. They aren't hard to find.

I assume those people were trying to provide the documents for account validation, but they end up making them public.

I don't think "all" is appropriate in the title; a quick search confirms that Albania has far more than 600k citizens.

yeah lol, I was surprised the entire country of Albania fit on a single spreadsheet.

True, the total population is 2.8M though so this is a very significant chunk of the whole country.

The title should not have been rewritten in the first place. (Submitted title was "Data leak of all Albanians 600k+ profiles").

"Please use the original title, unless it is misleading or linkbait; don't editorialize."

https://news.ycombinator.com/newsguidelines.html

This is not a mere leak from some government office, but also includes a lot of "notes" by local Socialist Party staff that are assigned to "watch over" a small section of their local population, such as an apartment block or similar. The database contains details such as did this person vote for the Socialist Party, what kind of leverage do they have on him (govt jobs, business licenses, jobs of parents or kids), are they part of the diaspora, do they have foreign income, etc. There was a huge scandal about it a year or two ago, called the "patronazhist" scandal. You can read more here:

https://balkaninsight.com/2021/04/16/albania-prosecutors-inv...

The big issue is how the Socialist Party essentially organized the whole collection of this data neighborhood by neighborhood in a hierarchical fashion, it's very similar to a mafia franchise. A neighborhood party member reports to the larger district, who reports to the city official, who reports higher up all the way to the Prime Minister.

Yeah, some things about this remind me of the pyramid-scheme fiasco that caused so much chaos in Albania back in the nineties.

> The data provided included their ID number, name, father’s name

I am curious about the "father's name" part. Is it a security thing in Albania, kind of how "mother's maiden name" used to be a security question for my credit card in the US?

"In Albania a complete name usually consists of a given name (Albanian: emri); the given name of the individual's father (Albanian: atësia), which is seldom included except in official documents; and a (most commonly patrilineal) family name or surname (Albanian: mbiemri)."

Not 100% sure its the same in Albania, but in Serbia it's the de facto middle name for most people. So you need it on most documents. Mother's name also works, but most people still default to the father's name.

Seems like a cultural thing where the father's name is part of your own name in official documents.

"a complete name usually consists of a given name; the given name of the individual's father, which is seldom included except in official documents; and a family name"

https://en.wikipedia.org/wiki/Albanian_name

This is also true in Greece - it originates from either Balkan or Orthodox culture I figure.

It’s called a patronymic, and is also part of the legal name in At least Ukraine and Russia . Interestingly in those countries the last name is something which only really shows up in official documents, instead the patronymic is used in much the same way as a last name is in English. For instance the Russian equivalent of John Doe is Ivan Ivanovich which just means Ivan son of Ivan.

I've made a mistake of using my patronymic as my middle name in US docs. It's actually more like a second last name, as you noted.

It’s not unusual: in Israel the names of your parents are written in your ID.

The father's name is used to distinguish people that have the same name. For example you would say Max Webber [of] John. Of course, birthdays are also used.

> Max Webber [of] John

Kind of like Johnson.

https://en.wikipedia.org/wiki/Patronymic

It's more like a middle name, in the sense that it is used in official documents to distinguish people who have the same first and last name.

Other countries have similar mechanisms, I remember when I was living in Brazil I had to provide nome da mãe (name of the mother) and nome do pai (name of the father) to get some documents done.

It's called a patronymic -- it's used in formal address and if you read Dostoyevsky or Tolstoy you'll hear the characters always use the patronymic with each other if they have a formal relationship. They'll say "Sofia Semyonovna" every single time, not just once. You can't say it's a "middle name" or a "second last name" really, it's its own thing.

Aside: Albanian is an amazing language

I’m curious, why?

Mainly because it is not closely related to any other Indo-European language - not an easy feat.

How are we counting? Greek forms its own branch of Indo-European, notable for how easy it is to distinguish from other Indo-European languages.

Being different from "other similar languages" mostly just means a history involving more being conquered than conquering.

I'm not a linguist, so I don't really know.

But, even middle-of-Europe Hungarian is related - somewhat - to Khanty and Mansi, and to a lesser extent to Finnish.

I just think it's kind of incredible when a language exists in the center of Europe in 2021 that isn't quite related to anything.

Armenian and Greek qualify as well, but they're much more prominent than Albanian - so, less mysterious :-)

> it's kind of incredible when a language exists in the center of Europe ... that isn't quite related to anything

Presumably, one factor is being "prisoners of Geography" (expression of Tim Marshall).

See the map https://decolonialatlas.files.wordpress.com/2017/11/raised-r...

from Anton Balazh ( https://www.shutterstock.com/g/antartis?irgwc=1&utm_medium=A... ),

...Hungary is in a way a protected "Inner Carpathia".

Also quite visible on OpenTopoMap, https://opentopomap.org/#map=6/46.800/19.116

> But, even middle-of-Europe Hungarian is related - somewhat - to Khanty and Mansi, and to a lesser extent to Finnish.

> I just think it's kind of incredible when a language exists in the center of Europe in 2021 that isn't quite related to anything.

But we just stipulated that Albanian is an Indo-European language. It's much more closely related to the general run of European languages than Magyar or Finnish is. The language isolate in Europe is Basque.

Yeah, that's true - "not quite related to anything" is definitely wrong word choice here.

Perhaps a better way to say it is "it's so impossible to understand, I can't believe it's actually related to anything" :-)

https://en.wikipedia.org/wiki/Language_isolate

The largest one is likely Korean.

Also, https://en.wikipedia.org/wiki/Albanian_language#Classificati...

For a free market to be efficient, all price information should be public, including the price of wages.

Public price information would greatly benefit workers.

Does anybody have a link of the data? *For research purposes of course...

Can you send a file that big on Whatsapp?

Lovely.

How long until gov't covid passport apps leak

Wouldn’t it make sense for that to be public information from the getgo?

Not at all - imagine you have very specific medical reasons you can't take the vaccine. Do you want the world knowing you're unvaccinated in this political climate? Do you want to explain your condition to anyone who might be judging you for your lack of vaccination status?

There's a reason our medical records are private.

I’m confused about this. Isn’t the possession of a Covid passport a public declaration regarding part of one’s medical record? Let’s say your friends go out to do covid passport things and you always decline—they are going to know you are unvaccinated eventually and not invite you to New Years.

I have no idea how it works, but, the app could just report if someone is vaccinated, or cleared by a doctor that they medially can't have the vaccine, without specifying which one.

Yep, that's one of many reasons these passports are ridiculous - people use the argument that you need that stuff for school and whatnot, but those are all private records. Today people are demanding passports be used in all public places. The minorities and disadvantaged don't seem to be something people care about during a pandemic and honestly I'm not surprised.

Tbh I think we have an opposite problem right now - too few folks getting vaccinated and even somewhat ashamedly asking others to.

I wish we were in a situation where unvaccinated folks were considered "black sheep", but unfortunately we're still far from it.

> The data provided included their ID number, name, father’s name, surname, date of birth, voting center, place of birth, residence code, list number, phone number, birthplace, employer, and whether they are likely to vote for the Socialist Party.

all of that should be public and not be used for "secret" questions

Reminds me of “No Way To Prevent This”, Says Only Industry Where This Regularly Happens:

https://qbix.com/blog/2021/01/25/no-way-to-prevent-this-says...

As if zero-content posting of the Onion links wasn't bad enough, we're going to start posting links to two-bit blogs that rip these places off now too?

I am not sure what you wanted to point out, pc86, there: I checked the linked page and it seems to be a blog post which is informative about this general topic, rhetorically satirizing through The Onion's "No Way To Prevent This" format: it describes and links to

-- https://www.cpomagazine.com/cyber-security/brazils-health-mi...

-- https://www.zdnet.com/article/personal-data-of-16-million-br...

-- https://en.wikipedia.org/wiki/Yahoo!_data_breaches#Late_2014...

-- https://www.trendmicro.com/vinfo/us/security/news/virtualiza...

-- https://www.timesofisrael.com/in-vast-breach-likud-campaign-...

-- https://www.csoonline.com/article/2130877/the-biggest-data-b...

-- https://kinsta.com/wordpress-market-share/#:~:text=WordPress...!

...

...And it is also informative about Qbix, which many may not know:

> Why do we all have to rely on giant corporations mediate our interactions, and trust them with our data, identity and brand? Qbix works to put power back in the hands of the people

https://qbix.com/people

Somehow I don’t expect him to reply

big oof for all the albanians that scammed people before, about to be some resolutions to unresolved quarrels, just like in the breakup.

Reply on news.ycombinator.com