“These political data firms might as well be working for the Russians.”

The data found by Vickery, who studies cyber-security risk for the Silicon Valley startup UpGuard, was compiled by GOP political consultant Deep Root Analytics, based on voter lists maintained by the RNC and augmented by other sources. Nor is it clear if anyone other than Vickery gained unauthorized access to the files during the two weeks they were left without a password or other security before the problem was discovered on June 12. According to UpGuard, these firms were paid in excess of $5 million, and “were among the RNC-hired outfits working as the core of the Trump campaign’s 2016 general election data team, relied upon in the GOP effort to influence potential voters and accurately predict their behavior.”

The data included names, dates of birth, home addresses, phone numbers, and voter registration details, but perhaps more troubling, data on their “likely political preferences using advanced algorithmic modeling across forty-eight different categories” was also among the downloadable files, UpGuard said. Republican data firm Deep Root Analytics, who was working on behalf of the Republican National Committee (RNC), is taking full responsibility for the disclosure, which was possible through an unsecured Amazon Web Services S3 bucket.
Personal information of about 200 million U.S. citizens has been exposed on the Internet since January when unsecured files were uploaded by Republican contractor Deep Root Analytics. The data, available via publicly accessible providers such as Amazon Web Services, included birth dates, home addresses, telephone numbers, religious affiliations, ethnicities, and political views. The problem was discovered by an UpGuard analyst.