Image copyright Getty Images Image caption The personal details and political biases of almost 200 million US citizens have been leaked online

Sensitive personal details relating to almost 200 million US citizens have been accidentally exposed by a marketing firm contracted by the Republican National Committee.

The 1.1 terabytes of data includes birthdates, home addresses, telephone numbers and political views of nearly 62% of the entire US population.

The data was available on a publicly accessible Amazon cloud server.

Anyone could access the data as long as they had a link to it.

Political biases exposed

The huge cache of data was discovered last week by Chris Vickery, a cyber-risk analyst with security firm UpGuard. The information seems to have been collected from a wide range of sources - from posts on controversial banned threads on the social network Reddit, to committees that raised funds for the Republican Party.

The information was stored in spreadsheets uploaded to a server owned by Deep Root Analytics. It had last been updated in January when President Donald Trump was inaugurated and had been online for an unknown period of time.

"We take full responsibility for this situation. Based on the information we have gathered thus far, we do not believe that our systems have been hacked," Deep Root Analytics' founder Alex Lundry told technology website Gizmodo.

"Since this event has come to our attention, we have updated the access settings and put protocols in place to prevent further access."

Apart from personal details, the data also contained citizens' suspected religious affiliations, ethnicities and political biases, such as where they stood on controversial topics like gun control, the right to abortion and stem cell research.

The file names and directories indicated that the data was meant to be used by influential Republican political organisations. The idea was to try to create a profile on as many voters as possible using all available data, so some of the fields in the spreadsheets were left left empty if an answer could not be found.

"That such an enormous national database could be created and hosted online, missing even the simplest of protections against the data being publicly accessible, is troubling," Dan O'Sullivan wrote in a blog post on Upguard's website.

"The ability to collect such information and store it insecurely further calls into question the responsibilities owed by private corporations and political campaigns to those citizens targeted by increasingly high-powered data analytics operations."

Privacy concerns

Although it is known that political parties routinely gather data on voters, this is the largest breach of electoral data in the US to date and privacy experts are concerned about the sheer scale of the data gathered.

"This is deeply troubling. This is not just sensitive, it's intimate information, predictions about people's behaviour, opinions and beliefs that people have never decided to disclose to anyone," Privacy International's policy officer Frederike Kaltheuner told the BBC News website.

However, the issue of data collection and using computer models to predict voter behaviour is not just limited to marketing firms - Privacy International says that the entire online advertising ecosystem operates in the same way.

"It is a threat to the way democracy works. The GOP [Republican Party] relied on publicly-collected, commercially-provided information. Nobody would have realised that the data they entrusted to one organisation would end up in a database used to target them politically.

"You should be in charge of what is happening to your data, who can use it and for what purposes," Ms Kaltheuner added.

There are fears that leaked data can easily be used for nefarious purposes, from identity fraud to harassment of people under protection orders, or to intimidate people who hold an opposing political view.

"The potential for this type of data being made available publicly and on the dark web is extremely high," Paul Fletcher, a cyber-security evangelist at security firm Alert Logic told the BBC.</s>A Republican data firm — one of three contracted to work on Donald Trump’s presidential campaign — inadvertently exposed personal information on nearly 200 million American voters to the entire internet.

For purposes of comparison, consider the fact that 128 million Americans voted in the last election.

Advertisement:

A California-based security researcher discovered the exposed information, which formed the backbone for Trump’s data operation. Chris Vickery, a cyberrisk analyst for UpGuard, found the database that, according to UpGuard, contained records from the presidential campaigns of 2008, 2012 and 2016. Vickery also discovered in 2015 a trove of voter data related to 191 million people that was released publicly online.

Data that included home addresses, birthdates, religious backgrounds, ethnic identities, party affiliations, Reddit usage history was stored on a server belonging to Deep Root Analytics, which compiled the information with two other Republican National Committee contractors, TargetPoint Consulting and Data Trust.

With data combined from the two other contractors Deep Root created a “proprietary analysis to help inform local television ad buying,” Gizmodo reported. Deep Root's predictive model used that data to pinpoint a voter's position on 46 different issues, including how likely he or she was to have supported Obama in 2012 or to agree with Trump's "America first" slogan. (Citizenship can be gleaned from public sources, but this model involves combining it with other types of information to create profiles of individual voters.)

But as UpGuard discovered, the Republican-linked election database was stored on an Amazon cloud server without any password protection. Anyone who knew where to look could have accessed the data simply by navigating to the specific Amazon domain and downloading the sensitive information.

On its website, Deep Root says it "prides itself on presenting large-linked data sets in a useful, easy-to-use and compelling way" and that the team is "the most experienced group of targeters in Republican politics."

A data scientist for Deep Root, Alex Lundry, worked on Gov. Jeb Bush’s presidential campaign. During his failed 2015 presidential bid, Bush released hundreds of thousands of voter emails, many of which contained social security numbers and home addresses.

Advertisement:

From 2015 t0 2016, the RNC paid Lundry’s firm $983,000.

"We take full responsibility for this situation," Deep Root said in a statement on Monday.

“This is valuable for people who have nefarious purposes,” the Center for Democracy and Technology’s chief technologist, Joseph Lorenzo Hall, told Gizmodo.

Vickery, who first discovered the UpGuard breach and called it “largest U.S. voter data leak,” also noted thatDeep Root also houses the files of Kantar Group, a major media and market research company with offices in Beijing and Moscow. UpGuard's Dan O’Sullivan further explained on his company's website:</s>Detailed information on nearly every U.S. voter — including in some cases their ethnicity, religion and views on political issues — was left exposed online for two weeks by a political consultancy that works for the Republican National Committee and other GOP clients.

The data offered a strikingly complete picture of the voting histories and political leanings of the American electorate laid out on an easily downloadable format, said cyber-security researcher Chris Vickery. He discovered the unprotected files of 198 million voters in a routine scan of the Internet last week and alerted law enforcement officials.

The precision and volume of the information, including dozens of data points on individual Republicans, Democrats and independent voters, highlights the rising sophistication of the data-mining efforts that have become central to modern political campaigns.

In some cases, that included which voters are suspicious of Wall Street and pharmaceutical firms, or who reluctantly voted for Hillary Clinton or support the Affordable Care Act, Vickery said.

"They're using this information to create political dossiers on individuals that are now available for anyone," said Jeffrey Chester, executive director of the Center for Digital Democracy. "These political data firms might as well be working for the Russians."

The data found by Vickery, who studies cyber-security risk for the Silicon Valley startup UpGuard, was compiled by GOP political consultant Deep Root Analytics, based on voter lists maintained by the RNC and augmented by other sources.

Deep Root did not disclose those sources but political research firms for years have been collecting information on voters from data brokers, social media postings, polling and other contacts with voters.

The company also kept information on Americans' voting histories and their reported enthusiasm for Trump, Vickery said. Some of the files assigned voters a score based on their views of 46 different issues ranging from immigration to trade. Nearly 170 gigabytes of the exposed data consisted of social media posts scraped from Reddit, he added.

Among the data are unique RNC identifiers for each voter, Vickery said. The files also potentially offered insight into party strategy for tracking and organizing voters.

"What is alarming about this now is that I believe it's the first time RNC IDs and model data have been exposed," said Matt Oszcowski, a veteran GOP political data strategist who recently started his own political fundraising company, Campaign Inbox. "This is not just a list of people; this is unique proprietary information which gives away [Republican] strategy and informs on targeting and methodology."

The files do not appear to include Social Security or credit card information, as has leaked in some major commercial data breaches. Nor is it clear if anyone other than Vickery gained unauthorized access to the files during the two weeks they were left without a password or other security before the problem was discovered on June 12.

But malicious hackers routinely conduct such scans of the Internet looking for unprotected files they can exploit. And to those who may have found them, the files painted a detailed portrait of virtually all of America's roughly 200 million voters — revealing their names, addresses, birth dates and phone numbers. The information was being stored by Amazon Web Services.

The voter files found by Vickery, he said, added up to "billions of data points" that, in the wrong hands, could easily be abused.

"With this data you can target neighborhoods, individuals, people of all sorts of persuasions," Vickery said in an interview. "I could give you the home address of every person the RNC believes voted for Trump."

In a statement, Deep Root blamed the lapse in security on a settings change, and said it had hired an outside firm to conduct an independent investigation. "We accept full responsibility, will continue with our investigation, and based on the information we have gathered thus far, we do not believe that our systems have been hacked," Deep Root said.

Lundry said the data, which included proprietary information as well as publicly available voter data provided by state government officials, has been secure since new protocols were put into place on June 14. The exposure began on June 1, when Deep Roots Analytics adopted updates that accidentally stripped away the password protections on the files.

"The RNC has halted any further work with the company pending the conclusion of their investigation into security procedures," the RNC said in a statement. "While Deep Root has confirmed the information accessed did not contain any proprietary RNC information, the RNC takes the security of voter information very seriously and we require vendors to do the same."

Amazon Web Services declined to comment about the security problem.

The RNC poured more than $20 million into data services in the 2016 cycle, according to Federal Election Commission records. Of that, $6.2 million went to Data Trust, a data management firm that has an exclusive list-sharing agreement with the national party.

That allows the company to swap RNC voter data with independent big-money groups such as American Crossroads, American Action Network and the Koch political network, helping grow the party's master voter file.

For its part, Deep Root Analytics worked for at least 14 GOP political committees in the 2016 cycle, FEC records show. Among its clients: House Speaker Paul Ryan's campaign committee and his allied House super PAC; the Senate Leadership Fund, a super PAC aligned with American Crossroads and Senate Majority Leader Mitch McConnell; and former Florida governor Jeb Bush's presidential campaign and allied super PAC.

There are no reported payments from the RNC to Deep Root. However, the party spent $983,000 on "polling services/consulting" with a company called Needle Drop, which is a subsidiary of Deep Root, according to AdvertisingAge.

Both parties, as well as independent political groups, have been increasing their data-collection efforts for several campaign cycles. Privacy experts have warned for years that this has happened with little oversight from federal or state officials.

"Perhaps the biggest privacy problem here is the fact that the Republicans have all this information about voters in the first place," said Peter Eckersley, chief computer scientist for the Electronic Frontier Foundation, a civil liberties group. "At some point in the past, parties picked a platform and voters decided on it. But with these databases, political operations can promise very different and increasingly contradictory things to different people, and that may be turning into a serious problem for democracy."</s>The personal details of more than 198 million United States citizens were accidentally exposed last week by a firm contracted by the Republican National Committee to gather data on voters, BBC reported on Monday. The information – home addresses, birth dates and phone numbers, as well as people’s views on subjects such as gun control, abortion and religious tolerance – was publicly accessible on an Amazon server to anyone with the link and included details.

The 1.1 TB data leak exposed sensitive information of nearly 62% of the entire US population. Deep Root Analytics – the data firm hired by the Republican campaign – had confirmed the leak to Gizmodo on Friday after a cyber risk analyst at UpGuard security firm, Chris Vickery, had discovered the data stock last week. The files were available on the Amazon cloud server without any form of password protection.

“We take full responsibility for this situation,” Founder of Deep Root Analytics Alex Lundry told Gizmodo. “Based on the information we have gathered thus far, we do not believe that our systems have been hacked...We have updated the access settings and put protocols in place to prevent further access.”

The information appears to have been collected from multiple sources, including social media threads and committees formed to raise funds for the Republican Party. The RNC had paid Deep Root $983,000 last year (around Rs 6.34 crore), according to Federal Election Commission data.</s>​Bad news if you're a participant in democracy: The personal information of potentially every single registered American voter was exposed by an extremely careless Republican data firm. The breach was discovered by an analyst working for the cyber resilience firm UpGuard, who found voters' "names, dates of birth, home addresses, phone numbers, and voter registration details, as well as data described as 'modeled' voter ethnicities and religions" on a publicly accessible Amazon server.



The server belonged to a Republican data firm called Deep Root Analytics, which contracted with the Republican National Committee to work for Donald Trump's campaign. UpGuard first stumbled across it a week ago.

In the early evening of June 12th, UpGuard Cyber Risk Analyst Chris Vickery discovered an open cloud repository while searching for misconfigured data sources on behalf of the Cyber Risk Team, a research unit of UpGuard devoted to finding, securing, and raising public awareness of such exposures. The data repository, an Amazon Web Services S3 bucket, lacked any protection against access. As such, anyone with an internet connection could have accessed the Republican data operation used to power Donald Trump’s presidential victory, simply by navigating to a six-character Amazon subdomain: "dra-dw".



Alex Lundry, a co-founder of Deep Root Analytics, told Gizmodo that the "data was exposed after the company updated its security settings on June 1." Vickery says the server was secured shortly after he reported the unsecured server to federal authorities on June 14, which means that the data was publicly available for a period of 14 days.

Lundry told ZDNet that the firm takes "full responsibility" for the exposed data but also emphasized that a portion of the data was "publicly available."

"Deep Root Analytics has become aware that a number of files within our online storage system were accessed without our knowledge," said Lundry. "The data that was accessed was, to the best of our knowledge proprietary information as well as voter data that is publicly available and readily provided by state government offices. Since this event has come to our attention, we have updated the access settings and put protocols in place to prevent further access. "We accept full responsibility, will continue with our investigation, and based on the information we have gathered thus far, we do not believe that our systems have been hacked," he said.

Gizmodo points out that even publicly available information can be used for nefarious purposes.

Even though voter rolls are public record and are easy to access — Ohio, for instance, makes its voter rolls available to download online — their exposure can still be harmful. Voter registration records include ZIP codes, birthdates, and other personal information that have been crucial in research efforts to re-identify anonymous medical data. Latanya Sweeney, a professor of government and technology at Harvard University, famously used voter data to re-identify Massachusetts Governor William Weld from information in anonymous hospital discharge records.

What's more, the "proprietary information" in the breach includes predictions about what voters believe about particular issues, and Deep Root Analytics may even have attempted to match Reddit users to their voter registration records.

[T]he records include advanced sentiment analyses used by political groups to predict where individual voters fall on hot-button issues such as gun ownership, stem cell research, and the right to abortion, as well as suspected religious affiliation and ethnicity. The data was amassed from a variety of sources—from the banned subreddit r/fatpeoplehate to American Crossroads, the super PAC co-founded by former White House strategist Karl Rove.



The breach isn't the first time data about American voters has been exposed, but it is the biggest known voter-related breach, affecting 61% of the entire US population.</s>Detailed information on nearly every U.S. voter – including in some cases their ethnicity, religion and views on political issues – was left exposed online for two weeks by a political consultancy which works for the Republican National Committee and other GOP clients.

The data offered a strikingly complete picture of the voting histories and political leanings of the American electorate laid out on an easily downloadable format, said cyber-security researcher Chris Vickery. He discovered the unprotected files of 198 million voters in a routine scan of the Internet last week and alerted law enforcement officials.

The precision and volume of the information, including dozens of data points on individual Republicans, Democrats and independent voters, highlights the rising sophistication of the data-mining efforts that have become central to modern political campaigns.

In some cases, that included which voters are suspicious of Wall Street and pharmaceutical firms, or who reluctantly voted for Hillary Clinton or supports Obamacare, Vickery said.

“They’re using this information to create political dossiers on individuals that are now available for anyone,” said Jeffrey Chester, executive director of the Center for Digital Democracy. “These political data firms might as well be working for the Russians.”

The data found by Vickery, who studies cyber-security risk for the Silicon Valley startup UpGuard, was compiled by GOP political consultant Deep Root Analytics, based on voter lists maintained by the RNC and augmented by other sources.

Deep Root did not disclose those sources but political research firms for years have been collecting information on voters from data brokers, social media postings, polling and other contacts with voters.

The company also kept information on Americans’ voting histories and their reported enthusiasm for Trump, Vickery said. Some of the files assigned voters a score based on their views of 46 different issues ranging from immigration to trade. Nearly 170 gigabytes of the exposed data consisted of social media posts scraped from Reddit, he added.

Among the data are unique RNC identifiers for each voter, Vickery said. The files also potentially offered insight into party strategy for tracking and organizing voters.

“What is alarming about this now is that I believe it’s the first time RNC IDs and model data have been exposed,” said Matt Oszcowski, a veteran GOP political data strategist who recently started his own political fundraising company, Campaign Inbox. “This is not just a list of people; this is unique proprietary information which gives away Republican strategy and informs on targeting and methodology.”

The files do not appear to include Social Security or credit card information, as has leaked in some major commercial data breaches. Nor is it clear if anyone other than Vickery gained unauthorized access to the files during the two weeks they were left without a password or other security before the problem was discovered on June 12.

But malicious hackers routinely conduct such scans of the Internet looking for unprotected files they can exploit. And to those who may have found them, the files painted a detailed portrait of virtually all of America’s roughly 200 million voters – revealing their names, addresses, birth dates and phone numbers. The information was being stored by Amazon Web Services.

The voter files found by Vickery, he said, added up to “billions of data points” that, in the wrong hands, could easily be abused.

“With this data you can target neighborhoods, individuals, people of all sorts of persuasions,” Vickery said.</s>A Republican National Committee database of nearly every registered American voter was left vulnerable to theft on a public server for 12 days this month, according to a cybersecurity researcher who found and downloaded the trove of data.

The lapse in security was striking for putting at risk the identities, voting histories and views of voters across the political spectrum, with data drawn from a wide range of sources including social media, public government records and proprietary polling by political groups.

Chris Vickery, a risk analyst at cybersecurity firm UpGuard, said he found a spreadsheet of nearly 200 million Americans on a server run by Amazon's cloud-hosting business that was left without a password or any other protection. Anyone with Internet access who found the server could also have downloaded the entire file.

The server contained data from Deep Root Analytics, a contractor to the Republican National Committee, which used Amazon Web Services for server storage. Vickery said he came upon the server's address as he scanned the Internet for unsecured databases.

"With this data you can target neighborhoods, individuals, people of all sorts of persuasions," Vickery said in an interview. "I could give you the home address of every person the RNC believes voted for [President Donald] Trump."

It is not known whether the information has been accessed by any one but Vickery. Gizmodo was first to report details of the data vulnerability Monday. The Washington Post has not reviewed the file.

The RNC did not immediately comment. In a statement, Deep Root founder Alex Lundry told Gizmodo, "We take full responsibility for this situation." He said the data included proprietary information as well as publicly available voter data provided by state government officials. "Since this event has come to our attention, we have updated the access settings and put protocols in place to prevent further access," Lundry said.

In all, the leaked files amount to more than 1,000 gigabytes of data -- more than four times the size of any previous breach of this type, according to Vickery. The data fields included views on specific issues including abortion, gun rights and environmental issues, he said.

The detailed file does not stop at Trump supporters, but likely includes Democrats, independents and many voters in between, he said. At a time when even many Americans protect their most basic emails and photos using passwords and two-step authentication, the security missteps by Deep Root Analytics, the contractor behind the breach, represent a form of gross negligence, he added.

The file has been secured now for several days, Vickery said, adding that he informed law enforcement of the vulnerability after discovering it.

"What is alarming about this now is that I believe it's the first time RNC IDs and model data have been exposed," said Matt Oszcowski, a veteran GOP political data strategist. "This is not just a list of people; this is unique proprietary information which gives away [Republican] strategy and informs on targeting and methodology."

Privacy experts expressed alarm over the breach, which they said shows how deeply personal data has become integrated into the modern political campaign.

"They're using this information to create political dossiers on individuals that are now available for anyone," said Jeffrey Chester, executive director of the Center for Digital Democracy. "These political data firms might as well be working for the Russians."

Information for this article was contributed by Matea Gold of The Washington Post.</s>A contractor for the Republican Party has accidentally exposed personal data on more than 198 million citizens

The US has been hit by its largest-ever breach of voter data after a contractor for the Republican party exposed personal information on more than 198 million citizens, or about 61 percent of the country’s population.

The data, in the form of about 1.1 terabytes of spreadsheets, was stored in an Amazon Web Services S3 storage repository that was accessible to anyone who knew its online address, according to security firm UpGuard.

UpGuard risk analyst Chris Vickery discovered the trove on 12 June while scanning for publicly accessible data.

The spreadsheets contain data compiled by Deep Root Analytics, a firm contracted by the Republican National Committee (RNC) to analyse audiences for political campaign advertisements, with the information apparently being drawn from various sources.

This includes publicly accessible voter records, Republican Party canvassing activities and information scraped from social media websites including Reddit.

The records list personal information such as home addresses, birthdates and phone numbers, as well as predictions around where users stand on sensitive issues and their suspected religious affiliation and ethnicity.

The data was used during election campaigns, including last year’s presidential campaign, and as such covers nearly all of the US’ 200 million registered voters. It was last updated in January at the time of the presidential inauguration, according to UpGuard.

Deep Root took responsibility for the exposure, saying the data was left accessible to the public due to a configuration change that occurred on 1 June and which was corrected on 14 June.

“Since this event has come to our attention, we have updated the access settings and put protocols in place to prevent further access,” said Deep Root founder Alex Lundry in a statement.

He said the firm didn’t believe any unauthorised parties had accessed the spreadsheets.

UpGuard said the scale of the breach was disturbing. “That such an enormous national database could be created and hosted online, missing even the simplest of protections against the data being publicly accessible, is troubling,” wrote UpGuard’s Dan O’Sullivan in an advisory.

“The ability to collect such information and store it insecurely further calls into question the responsibilities owed by private corporations and political campaigns to those citizens targeted by increasingly high-powered data analytics operations.”

O’Sullivan said the breach may be the largest known exposure of voter information in history, roughly double the size of a breach last year that included data on 93 million Mexican voters.

Large-scale data analytics has played an increasingly controversial role in recent elections, including last year’s presidential election in the US and the recent EU referendum and general elections in the UK, as well as being used more broadly to shape public opinion.

In March the Information Commissioner’s Office (ICO) said it would investigate the use of analytics and personal data to sway voters ahead of last year’s EU referendum.

The data-protection watchdog said it is also looking into the broader use of data analytics techniques to influence public opinion and how they capture and use citizens’ data.

The use of certain types of personal data for campaign purposes, such as Facebook “likes,” is permitted in the US, but in the UK and the EU it requires explicit consent by those involved.

A series of studies published on Monday by the University of Oxford found propaganda on social media was being used to manipulate public opinion around the world.

Do you know all about security in 2017? Try our quiz!</s>Personal information belonging to more than 198 million registered U.S. voters was exposed in what security researchers at UpGuard are calling the largest known data exposure of its kind.

Republican data firm Deep Root Analytics, who was working on behalf of the Republican National Committee (RNC), is taking full responsibility for the disclosure, which was possible through an unsecured Amazon Web Services S3 bucket. The data was exposed after the company updated its security settings on June 1, according to Deep Root founder Alex Lundry.

The misconfigured database contained 1.1 terabytes of downloadable personal information compiled by the DRA and at least two other Republican contractors, TargetPoint Consulting, Inc. and Data Trust. An additional 24 terabytes of data was stored in the warehouse, but had been configured to prevent public access. According to UpGuard, these firms were paid in excess of $5 million, and “were among the RNC-hired outfits working as the core of the Trump campaign’s 2016 general election data team, relied upon in the GOP effort to influence potential voters and accurately predict their behavior.”

The data included names, dates of birth, home addresses, phone numbers, and voter registration details, but perhaps more troubling, data on their “likely political preferences using advanced algorithmic modeling across forty-eight different categories” was also among the downloadable files, UpGuard said. The data is current, too, having been last updated around January 2017, when Trump was inaugurated.

UpGuard cyber risk analyst Chris Vickery discovered the data on June 12 while searching for misconfigured data sources on behalf of the research unit of UpGuard. The data was secured on June 14 after Vickery notified federal authorities.

According to a blog post by UpGuard, “anyone with an internet connection could have accessed the Republican data operation used to power Donald Trump’s presidential victory, simply by navigating to a six-character Amazon subdomain: ‘dra-dw.’”

“Upon inspection of the contents, ‘dra-dw’ is shown to stand for ‘Deep Root Analytics Data Warehouse.’ The concept of a ‘data warehouse’ is common in modern business— essentially, it is a massive collection of data prepared specifically for complex analysis,” UpGuard said.

The absence of basic security best practices in this case is troubling, particularly with an organization that deals with this volume of data. Before contracting a third-party consultant, particularly one that is going to be handling any type of personally identifiable data, it is imperative that an organization understands what safeguards they have in place, and if necessary, what additional measures will need to be taken to ensure the data is secured.

The publicly accessible files included two directories called “data_trust” and “target_point.”

This is what was found in the first folder:

Within “data_trust” are two massive stores of personal information collectively representing up to 198 million potential voters. Consisting primarily of two file repositories, a 256 GB folder for the 2008 presidential election and a 233 GB folder for 2012, each containing fifty-one files - one for every state, as well as the District of Columbia. Each file, formatted as a comma separated value (.csv), lists an internal, 32-character alphanumeric “RNC ID”—such as, for example, 530C2598-6EF4-4A56-9A7X-2FCA466FX2E2—used to uniquely identify every potential voter in the database. These RNC IDS uniquely link disparate data sets together, combining dozens of sensitive and personally identifying data points, making it possible to piece together a striking amount of detail on individual Americans specified by name.

In the second folder, here’s what the researchers found:

The contents of the “target_point” folder were even more intrusive than those of the Data Trust repository, if less obviously intimidating at first glance: fourteen files saved in the Alteryx Database format (.yxdb), a file format designed specifically for large-scale data analysis. Most of the files were last updated in mid to late-January 2017, with several labeled as “Contact File,” with different dates signifying when they were updated.

Contained within these “Contact File” spreadsheets are the aforementioned 32-character alphanumeric RNC IDs for 198 million potential American voters, as well as the corresponding names and addresses of the voters. The clear linkage between every RNC ID and the name and identifying personal details of all 198 million people ensures all data using the RNC ID as an identifier can be tied back to the person’s real name.

Dan O'Sullivan, an analyst with UpGuard, said, "Beyond the almost limitless criminal applications of the exposed data for purposes of identity theft, fraud, and resale on the black market, the heft of the data and analytical power of the modeling could be applied to even more ambitious efforts - corporate marketing, spam, advanced political targeting. Any of these potential misuses of private information can be prevented, provided stakeholders obey a few simple precepts in collecting and storing data."

Deep Root has hired a third-party cybersecurity and forensics firm Stroz Friedberg to investigate. Deep Root does not believe the data was accessed by malicious third parties in the 13 days it was publicly accessible, but the investigation will answer that definitively.</s>Since November, the Trump campaign’s possibly brilliant, maybe-just-lucky data strategy launched a thousand thinkpieces. Now, we’ve got a more intimate look at that data than we were ever meant to have.

As discovered by Chris Vickery, a cyber risk analyst at UpGuard, and reported by Gizmodo, an analytics firm hired by the Republican National Committee left the data of 198 million U.S. voters sitting out in the open on a public server. The more than a terabyte of data, owned by Deep Root Analytics, included personal identifying information like birth dates, home addresses and phone numbers as well as demographic info like ethnicity and religion.

UpGuard’s blog explains how the firm came across the unprotected data:

“In the early evening of June 12th, UpGuard Cyber Risk Analyst Chris Vickery discovered an open cloud repository while searching for misconfigured data sources on behalf of the Cyber Risk Team, a research unit of UpGuard devoted to finding, securing, and raising public awareness of such exposures. The data repository, an Amazon Web Services S3 bucket, lacked any protection against access. As such, anyone with an internet connection could have accessed the Republican data operation used to power Donald Trump’s presidential victory, simply by navigating to a six-character Amazon subdomain: “dra-dw”.”

In 2016, Deep Root earned more than $900,000 from the RNC for campaign year data and analysis on potential voters. The unprotected Deep Root database also contained data from other firms with RNC contracts, including Americans for Prosperity and the Data Trust, both well-funded conservative groups with massive data troves.

It is not fully clear if anyone made off with the exposed data during the 12 days it sat out in the open, but Deep Root doesn’t seem to think so. In a security statement, the company admitted to its big data self-own:

“Deep Root Analytics has become aware that a number of files within our online storage system were accessed without our knowledge… We are conducting an internal review and have retained cyber security firm Stroz Friedberg to conduct a thorough investigation. Through this process, which is currently underway, we have learned that access was gained through a recent change in access settings since June 1. We accept full responsibility, will continue with our investigation, and based on the information we have gathered thus far, we do not believe that our systems have been hacked.”

Deep Root’s open data stash notably included raw text scraped from Reddit, including the now-banned subreddit r/fatpeoplehate, a popular forum with Trump’s r/The_Donald Reddit base, some Spanish-speaking subreddits and at least one about mountain biking. Where that data fit into the GOP’s strategy remains unclear, but it shows that social sites well beyond real identity-obsessed Facebook have evolved into rich sources for political campaigns seeking to understand and predict voter behavior.

As valuable as this kind of dataset might be, Deep Root’s carelessness shows that when the race has come and gone, keeping all of that aggregate data safe must not be quite as lucrative as scooping it all up in the first place.
Personal information of about 200 million U.S. citizens has been exposed on the Internet since January when unsecured files were uploaded by Republican contractor Deep Root Analytics. The data, available via publicly accessible providers such as Amazon Web Services, included birth dates, home addresses, telephone numbers, religious affiliations, ethnicities, and political views. The problem was discovered by an UpGuard analyst.