Contractor Exposes Personal Information Of 1.8 Million Chicago Voters On AWS

from the oops dept

At some point, it seems clear that if Chris Vickery comes a-callin’, you’ve screwed up when it comes to keeping the private information of customers/voters secure. Vickery works for Upguard, a cyber-security consulting firm that regularly seeks out insecure sites and works with their owners to secure them. Vickery’s fingerprints have been on discoveries such as Verizon’s exposure of the personal information of 6 million of its customers and a firm contracted by the GOP exposing the personal data of roughly every American voter everywhere.

And now Vickery and Upguard have found that a contractor managing the city of Chicago’s voter rolls appears to have exposed more personal information on an AWS server.

The acknowledgment came days after a data security researcher alerted officials to the existence of the unsecured files. The researcher found the files while conducting a search of items uploaded to Amazon Web Services, a cloud system that allows users to rent storage space and share files with certain people or the general public. The files had been uploaded by Election Systems & Software, a contractor that helps maintain Chicago’s electronic poll books.

Election Systems said in a statement that the files “did not include any ballot information or vote totals and were not in any way connected to Chicago’s voting or tabulation systems.” The company said it had “promptly secured” the files on Saturday evening and had launched “a full investigation, with the assistance of a third-party firm, to perform thorough forensic analyses of the AWS server.”

So, a couple of things to note here. First, while it’s true no voting information was exposed, a good deal of personal information certainly was. Names, addresses, last four digits of social security numbers; you know, all of the things one would need to wreak havoc on a person using their identifying information. Second, it appears that “promptly securing” the files mostly had to do with actually having a password needed to access them. There was no hacking required for Vickery to get to these files, because there was no password protecting them. Great.

Now, where I will give ES&S credit is that they are working with Upguard, rather than trying to vilify it, as we’ve seen done to so many other security researchers. That’s a good thing. Still, Chicago officials are pretty pissed off.

“We were deeply troubled to learn of this incident, and very relieved to have it contained quickly,” Chicago Election Board Chairwoman Marisel A. Hernandez said in a statement. “We have been in steady contact with ES&S to order and review the steps that must be taken, including the investigation of ES&S’ AWS server. We will continue reviewing our contract, policies and practices with ES&S. We are taking steps to make certain this can never happen again.”

Allen added that the board is considering how to notify and potentially offer remedies to those whose information was exposed.

“The expense for that is going to be borne by ES&S,” Allen said. “This was a violation of the contract terms that explicitly lay out the requirement to safeguard the voters’ data.”

It’s a wonder to this writer that the constant calls for things like e-voting machines continue when those in charge of securing voter data can’t even do that right.

Filed Under: , , ,
Companies: upguard

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Contractor Exposes Personal Information Of 1.8 Million Chicago Voters On AWS”

Subscribe: RSS Leave a comment
Anonymous Coward says:

“The expense for that is going to be borne by ES&S,” Allen said. “This was a violation of the contract terms that explicitly lay out the requirement to safeguard the voters’ data.”

What?! Government isn’t going to pay for this mistake? And the actual party that messed up, is going to foot the bill?

orbitalinsertion (profile) says:

It’s a wonder to this commenter that organizations still bork the simplest security measures and have these poorly secured systems connected to the internet.

OK i lie, it isn’t a wonder to me at all. The only thing i find mildly astonishing is that these organizations, or those who hire them, are surprised when it is brought to their attention. Although, that surprise may be feigned as well.

Bergman (profile) says:

Re: Re:

Doesn’t surprise me at all. Far too many people, especially in positions of authority, look to Hollywood movies for their education on how computers work.

The Holly wood approach to defeating hackers:

Step 1: Connect vital systems to the internet because reasons.

Step 2: Get hacked, causing immense, irrevocable harm.

Step 3: Dashing action heroes leads team of amusingly dysfunctional ‘computer security’ experts in daring last minute fight to protect data. Gratuitous car chase scenes, SWAT raids and pointing of gun at people armed only with laptops ensues.

Step 4: Good guys win and hackers never try again despite no one ever patching the security flaw.

How a real computer security professional defeats hackers:

Step 1: Never connect stuff like that to the internet in the first place.

tom (profile) says:

How else are folks in Chicago supposed to vote early and often if they don’t have a list of names to use?

What TFA didn’t mention was how much of that info was already public knowledge. In most states, voter information like name, party affiliation, address, recent voting history is publicly releasable and often made available to anyone who asks. Guessing that drivers license number shouldn’t have been in the file but the rules vary from state to state.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...