Accusations Fly Over Democratic Database Breach
We have what appears to be a bit of circular firing squad today in the Democratic Party, as the Democratic National Committee cuts off the Bernie Sanders campaign’s access to an important voter database, following reports that a bug in the database sofware enabled the Sanders campaign to inappropriately access the Clinton campaign’s voter information.
Sanders campaign manager Jeff Weaver is accusing the DNC of trying to help the Clinton campaign, and threatening immediate legal action if their access to the database isn’t restored.
The Sanders camp, under fire for what it called an accidental data breach that permitted brief access to Clinton’s voter data, reacted with outrage at how the DNC was handling the case.
“In this case it looks like they are trying to help the Clinton campaign,” said Sanders campaign manager Jeff Weaver.
The breach of Democratic National Committee files led to the firing of a top Sanders data staffer and prompted the DNC to cut off the Sanders campaign’s access to its voter data.
[…]
Weaver said if the DNC does not allow Sanders access to its own data swiftly, it will seek relief in federal court as early as Friday afternoon.
So what happened? Here’s the statement from the company that controls the databases, NGP VAN: Data Security and Privacy.
On Wednesday morning, there was a release of VAN code. Unfortunately, it contained a bug. For a brief window, the voter data that is always searchable across campaigns in VoteBuilder included client scores it should not have, on a specific part of the VAN system. So for voters that a user already had access to, that user was able to search by and view (but not export or save or act on) some attributes that came from another campaign.
As soon as we realized that there was an issue, we immediately mobilized our engineers to investigate the source of the issue. While we investigated the issue, we restricted access to affected areas of the VAN product for all users and limited access to data exports. Engineers quickly discovered the problem, and developed a fix.
We immediately began an audit to determine if any users had intentionally or unintentionally gained access to data they normally would not have access to within the limited timeframe when the bug was live. Our team removed access to the affected data, and determined that only one campaign took actions that could possibly have led to it retaining data to which it should not have had access.
The Sanders team has fired their national data director, but he denies deliberately accessing the Clinton data; he says they were investigating the security problem:
[Josh] Uretsky, the fired Sanders staffer, told CNN Friday morning that he was not trying to access Clinton voter data.
Instead, he said he was just trying to “understand how badly the Sanders campaign’s data was exposed” by the software error.
“We knew there was a security breach in the data, and we were just trying to understand it and what was happening,” Uretsky said.
He added that to the best of his knowledge, “nobody took anything that would have given the (Sanders) campaign any benefit.”
This looks like a real screw-up on his part; instead of “trying to understand” the security breach, he should have immediately shut down his end of the system and reported it to NGP VAN.
