/ SECURITY WATCH

Multi-State Voter Data Leak - Again!

Popular articles

24 / 10 / 2016

Multi-State Voter Data Leak

If you are a voter in the United States you would expect at least some kind of security of your personal voting data right? Sadly, this election has shown us time and time again just how insecure and unprotected the entire process truly is. It seems to be getting worse, from hacked emails showing the DNC may have tilted the primary elections to multiple misconfigured databases containing millions of voters’ data and voting history. The flow of data this US election is almost overwhelming and just when one news story breaks another one appears before the first one runs the full news cycle.

This week the MacKeeper Security Research Center discovered a publically available database of voter records totalling more than 350K. The records are from multiple states and split among MT / NJ / CA / VA.

California voter_file = 60,744 records

MT voter_file = 50,000 records

NJ voter_file = 72,114 records

VA voter_file = 62,574 records (with party ID, WardCode, VANID)

VA voter_file = 61,995 records

VA voter_file = 46,625 records

354,052 records in total!

The personal information includes names, home address, phone number, gender, date of birth, state voter ID, race, marital status, unique voter ID, date of voter registration, phone number, political affiliation and whether or not they voted in primary elections and more.

Here is the redacted excerpt from one file:

"vf_g2000" : "",
  "vf_g2001" : "",
  "vf_g2002" : "",
  "vf_g2003" : "",
  "vf_g2004" : "",
  "vf_g2005" : "",
  "vf_g2006" : "",
  "tsmart_first_name" : "REDACTED",
  "vf_g2008" : "Y",
  "vf_g2009" : "",
  "vf_p2001" : "",
  "vf_p2000" : "",
  "vf_p2007" : "",
  "vf_p2009" : "",
  "vf_p2005" : "",
  "vf_p2004" : "",
  "vf_registration_date" : "REDACTED",
  "vf_p2007_party" : "",
  "tsmart_city" : "REDACTED",
  "tsmart_township" : "",
  "DistanceInCluster" : 1,
  "vf_g2007" : "",
  "tsmart_last_name" : "REDACTED",
  "vf_p2004_party" : "",
  "vf_p2003" : "",
  "vf_p2002" : "",
  "vf_m2001" : "",
  "tsmart_DMA_Name" : "Norfolk-Portsmouth-Newport News VA",
  "vf_g2012" : "",
  "vf_g2011" : "",
  "vf_g2010" : "Y",
  "tsmart_zip4" : "REDACTED",
  "voterbase_id_original" : "VA-REDACTED",
  "voterbase_phone" : "REDACTED",

  "voterbase_marital_status" : "Married",
  "vf_p2006" : "",
  "tsmart_zip" : "REDACTED",
  "vf_p2011_party" : "",
  "calculated_gender" : "f",
  "vf_p2009_party" : "",
  "combined_strata" : "Age 18-39EastAfrican-AmericanFemale",
  "tsmart_middle_name" : "REDACTED",

  "vf_pp2012" : "",
  "vf_p2010_party" : "",
  "voterbase_gender" : "Female",
  "voterbase_dob" : "REDACTED",

  "race_strata" : "African-American",
  "vf_pp2012_party" : "",
  "vf_pp2008" : "",
  "vf_p2002_party" : "",
  "vf_pp2000" : "",
  "vf_pp2004" : "",
  "tsmart_state" : "VA",
  "vf_pav" : "",
  "age_strata" : "Age 18-39",
  "vf_p2012_party" : "",
  "cluster_quota" : 15,
  "vf_p2003_party" : "",
  "tsmart_HD" : "78",
  "gender_strata" : "Female",
  "voterbase_race" : "African-American",

  "tsmart_ward" : "",
  "tsmart_county_code" : "REDACTED",
  "tsmart_SD" : "5",
  "vf_pp2004_party" : "",
  "vf_p2006_party" : "",
  "region" : "East",
  "voterbase_age" : "24",
  "tsmart_CD" : "4",
  "vf_m2002" : "",
  "vf_m2003" : "",
  "vf_m2000" : "",
  "voterbase_id" : "REDACTED",
  "vf_m2006" : "",
  "vf_m2007" : "",
  "vf_m2004" : "",
  "vf_m2005" : "",
  "phone_strata" : "Landline",
  "tsmart_municipal_district" : "",
  "vf_m2009" : "",
  "voterbase_phone_type" : "Landline",
  "tsmart_place_name" : "REDACTED",
  "vf_p2000_party" : "",
  "cluster_number" : "1",
  "Phone" : "REDACTED",
  "vf_voter_status" : "Active",
  "tsmart_precinct_name" : "REDACTED",
  "vf_m2011" : "",
  "vf_m2010" : "",
  "voterbase_registration_status" : "Registered",
  "tsmart_county_council" : "",
  "tsmart_county_name" : "REDACTED",
  "vf_m2008" : "",
  "tsmart_name_suffix" : "",
  "tsmart_school_district" : "",
  "tsmart_full_address" : REDACTED",
  "vf_pp2000_party" : "",
  "vf_party" : "Unaffiliated",
  "vf_p2008" : "",
  "vf_voterfile_id" : "REDACTED”,
  "vf_m2012" : "",
  "ClusterId" : "1",
  "tsmart_judicial_district" : "",
  "vf_absentee_status" : "",
  "vf_p2010" : "",
  "vf_p2011" : "",
  "vf_p2012" : "",
  "calculated_birthyear" : "REDACTED",
  "tsmart_city_council" : "",
  "tsmart_precinct_id" : "REDACTED",
  "vf_p2001_party" : "",
  "vf_early_voter_status" : "",
  "vf_p2008_party" : "",
  "vf_p2005_party" : "",
  "vf_pp2008_party" : ""

 

Some states restrict how the data may be used and sets restrictions for commercial or charity. Most states require that voter data be used only for political and election related activities, but what if the records are leaked publically and are available to anyone online?

The challenge going forward will be how to secure voter records that are likely already compromised or in some cases for sale by the state election commissions. In September 2015 MacKeeper discovered 2.9 million voter records from the state of Louisiana and discovered a disturbing reality that the state was selling voter records. Louisiana’s system gives you the option of choosing past or present voters and you separate by various demographics (gender, race etc.), specify the party of your choice. The price for buying voter data comes out at $0.01 per name on the list. How or will states and private groups protect voter data or will voter data just become public record similar to court records?

NOTE TO MEDIA
We were not able to identify the owner of this database and seek help from the media or security community to help get the database closed. Please contact us at security@kromtech.com if you have any information or ideas of how to identify the ownership.