Forgot your password?
typodupeerror
Canada Privacy Security IT Your Rights Online

2.4 Million Ontario Voters' Private Info Compromised 81

Posted by Soulskill
from the only-maple-leafs-fans dept.
An anonymous reader writes "Elections Ontario, an agency tasked with the organization and conduct of general elections and by-elections in Canada's Ontario region, is warning voters about the loss and potential theft of two USB sticks containing private information of 2.4 million voters from approximately 20–25 electoral districts. The information at issue is limited to full name, gender, birth date, address, whether or not an elector voted in the last provincial election and any other personal information updates provided by voters to Elections Ontario during that time, as well as administrative codes used solely for election purposes. The information does not include how an individual voted."
This discussion has been archived. No new comments can be posted.

2.4 Million Ontario Voters' Private Info Compromised

Comments Filter:
  • Doing everything electronically and "on the net" is of such overwhelmingly critical importance that the loss of a few million voter records is of little interest to any civilized human being.
    Just imagine if we had to go back to pencil and paper! The barbarism! *SHUDDER*
    • by Desler (1608317)

      You mean loss of records that anyone could already obtain since they are part of public record?

      • by busyqth (2566075)

        You mean loss of records that anyone could already obtain since they are part of public record?

        Yes I mean those. Exactly those. And no others.

    • by Mashiki (184564)

      In Canada we pretty much do everything by pencil and paper. What this is though is the register of voters of who's eligible to vote by district. There are places where you can vote by electronic machine, but most people don't use them, they don't like them. It's pretty simple and straight forward.

      How it works is like this:
      In Canada when you file your taxes, you get the option of allowing Revenue Canada to send your personal information(DOB, name and address) to Elections Canada and in the regional offic

  • Private? (Score:5, Interesting)

    by Lev13than (581686) on Friday July 20, 2012 @01:04PM (#40714561) Homepage

    Sounds like the same "private" information that every candidate and party has access to during the election campaign and on election day. Not sure about the birth date, but everything else is definitely on the voter registration and tracking printouts used by poll clerks and by party scrutineers during the election.

    • $128 in Maryland:

      http://www.elections.state.md.us/voter_registration/purchase_lists.html [state.md.us]

      (and you can get 'em on CD, rather than printed out ... I seem to recall it being a spreadsheet when I saw one ... don't know if it was a flat file that someone had imported, or if they gave it to you in Excell)

    • That was what I was thinking. When I ran for a local office and did some precinct walking back in 1992, I got a printout (fan-fold, green-lined line printer output) with this information. I don't recall what it cost, but it wasn't that much.
  • by retroworks (652802) on Friday July 20, 2012 @01:06PM (#40714595) Homepage Journal
    I'm almost as alarmed by the sense of alarm. This sounds like harmless information. A ten year old hard drive is not the same as losing your current laptop, and being tagged in a Facebook photo is not as dangerous as having your social security information compromised. Maybe we should distribute useless USB sticks filled with past telephone book listings just to keep identity thieves busy..
    • by Sir_Sri (199544)

      encrypted

      USB sticks

      you missed an important part.

      • by mlts (1038732) *

        From the TFA, the USB stick was not encrypted.

        This in itself is pure stupidity. You can buy USB flash drives with hardware AES encryption on the cheap. Even the more expensive drives that are physically tamper resistant like the IronKey are not that pricy.

        As for software locking, BitLocker comes with Windows 7, and TrueCrypt is available at no charge.

        There is no excuse for unencrypted USB drives, none.

        • The TFA didn't say the stick wasn't encrypted -- it just failed to mention the fact that it was... and yes, it was. Other articles available on google go into much more detail.

          And yes, there is no excuse for unencrypted PII on USB drives.

    • by pluther (647209)

      ...and being tagged in a Facebook photo is not as dangerous as having your social security information compromised.

      It could be worse, depending.

      Having your SSN compromised can be fixed through filling out some forms, paying some fees, and forwarding a few dozen letters to wishful creditors.

      But whenever a new HR department googles you and finds that one picture...

    • by EdIII (1114411)

      While you are attempting to make light of it, there are rather serious concerns:

      The information at issue is limited to full name, gender, birth date, address, whether or not an elector voted in the last provincial election and any other personal information updates provided by voters

      Physical address is concerning. Not everyone wants that listed and has trust that the government, who ostensibly needs that information, will protect it. Yes, it could matter. Plenty of people are harassed, have sensitive jobs (law enforcement, abortion doctors, etc.), and have quite valid reasons to wish for some privacy and anonymity. Both of which are basic human rights that no government should be able to violate in the firs

      • by mcgrew (92797) *

        Physical address is concerning.

        For a hundred years, almost everyone's address was published in a printed book that came out yearly. It was opt-out, and to keep your name off the list you had to pay extra for the unlisted phone number.

        Plenty of people are harassed, have sensitive jobs (law enforcement, abortion doctors, etc.)

        If you're being harrassed, you go to the courthouse and get an order of protection. If you're a cowardly wimp, law enforcement may not be the ideal line of work for you. If you're an abo

  • by santax (1541065) on Friday July 20, 2012 @01:06PM (#40714601)
    What would be a valid reason to put that much info on 2 usb-sticks besides, wanting to sell it or altogether being to darn lazy to even think about security and consequences. Anyone?
    • Re: (Score:3, Insightful)

      by Sir_Sri (199544)

      moving data between computers. Not everyone knows how to do network sharing. they may also physically mail the encrypted USB sticks to people (or pass them around) for whatever reason. Ontario is a big place, and we've got about 13 million people over a large area, so there might be a lot of data moved around snail mail style by people who for whatever reason aren't linked up to a the central physical database.

      They may also have data for static analysis. The 'real' data might be updated constantly as pe

    • by Striek (1811980)

      The laptops were not networked and were not connected to the Elections Ontario network, therefore, two USB drives were to be used for the purpose of transferring information amongst the laptops in the facility.

      http://www.elections.on.ca/en-CA/AboutUs/Privacy_Breach.htm [elections.on.ca]

    • Might be time to require any USB stick used by government officials to be permanently attached to a large iron ball.
      • permanently attached to a large iron ball.

        I've got a better idea. How about attaching it to the two balls in the crotch of the user?

        No idiot would lose them by leaving them around somewhere, and not be able to find them. But then again, nothing can be made foolproof, because fools are so ingenious.

        Once again, humans are the weakest link in the security chain. Now, if you'll excuse me, I need to adjust my shit. My USB stick isn't hanging right . . .

  • by acidfast7 (551610) on Friday July 20, 2012 @01:09PM (#40714643)
    ...versus most corps who do not unless forced to.
  • Ontario region? (Score:4, Informative)

    by Chonnawonga (1025364) on Friday July 20, 2012 @01:14PM (#40714729)

    FYI, Ontario is a province. net-security.org should appreciate the value of precision, and /. editors need to edit.

    Sincerely, an Ontarian. (Yes, that's a word.)

    • by dkleinsc (563838)

      /. editors need to edit

      You must be new here - that's really expecting far too much.

      • /. editors need to edit

        You must be new here - that's really expecting far too much.

        Oh, I don't expect them to DO it. I just want them to lose sleep at night.

    • by DarthVain (724186)

      LOL.... really Ontario Region?

      Its just 1,000,000 square km (400,000+ sq miles). Just a little area really....

      Ontarioish. Brings new meaning to inaccurate, both in word, and in meaning.

  • by Zamphatta (1760346) on Friday July 20, 2012 @01:18PM (#40714805) Homepage
    On USB sticks???? What are they doing on USB sticks?!?!? Whoever put that on there, should be fired immediately, no questions asked.
    • Whoever put that on there, should be fired immediately, no questions asked.

      And additionally, companies with such employees should be fined heavily. Only if it costs them much money, only then will this stupidity end. Protocols need to be in place, taught, checked and enforced with consequences.

  • Encryption (Score:4, Insightful)

    by subreality (157447) on Friday July 20, 2012 @01:21PM (#40714859)

    People think I'm paranoid because I encrypt all my drives... but when I lose a disk I never have to wonder if it potentially ended up in the wrong hands. Too bad it's only done by us loonies and not as standard practice everywhere.

  • by TheSpoom (715771) <slashdot@uberm00. n e t> on Friday July 20, 2012 @01:41PM (#40715203) Homepage Journal

    So congratulations to the thief (or finder) for now knowing my birthday and former address.

  • by game kid (805301) on Friday July 20, 2012 @01:44PM (#40715251) Homepage

    The information contained on the two sticks wasn't encrypted and the sticks themselves weren't password-protected - as they should have. Still, it can only be accessed and read by using internal Elections Ontario proprietary software or specialized commercial software applications.

    ...and the thieves, once they (quickly) figure out how the fields are arranged and stored.

  • I'm going to go out get a bunch of credit, rack it right up, and then claim my identity was stolen. The banks can go after Elections Ontario for the bill.

    • And if they're successful, your tax dollars goes to the bank.

      More importantly, MY tax dollars also go to the bank for your selfishness.

      I'll assume you were joking.

  • Why would anyone be remotely concerned about this?

    *NOBODY* knows how a given individual voted in Canada, unless that individual tells somebody. They might be able to tell if or when you voted... and of course where you were at when you voted, but there is no possible way, short of doing something that *WILL* get you put under arrest (with a likely prison sentence), knowing how somebody else voted in any federal or provincial election is just not going to happen unless you can get them to tell you. And

    • by Pope (17780)

      Really, it's like a lot of information that's technically "publicly" available, but scattered among multiple incomplete sources. This leak compiles a lot of that public info into one easy to digest package.

      It's like how a lot of property ownership information was "publicly" available, but getting off your ass, down to City Hall, and filing the proper information requests. Once it hits the 'net, the effort needed to access that information en masse drops drastically. Then you can do nefarious things with it.

      • by mark-t (151149)
        I know.... I'm just surprised that anyone would have figured that how a person voted could have ever hoped to make it into that kind of list.
  • Why was that info on a USB stick (for one), and why wasn't that info protected?

It is impossible to travel faster than light, and certainly not desirable, as one's hat keeps blowing off. -- Woody Allen

Working...