miércoles, febrero 04, 2009

Data Leakage from Voting Sites

OK, so I finally got some minutes to publish this "finding".

Some of you may know that on January 18th, 2009, El Salvador had elections for mayors in all districts, and for parliament representatives. Aside from other questionable aspects of operations (personal IDs not being exhaustively checked for falsification, and others), one thing caught my attention: how easy it was to "steal" citizen information from boards near voting booths, where one was supposed to look for one's ID and photo.

I actually took some pictures of some boards with my cell phone. I was expecting to be asked to hand them over, but this was not the case. I just walked away. Here are a couple of photos (the phone camera is actually 2.0 MP, and it doesn't have any image stabilization technology, so no need to defocus or alter them to make data illegible).

 


Government entities that handle this kind of information, should be more cautious about it. Information security does not necessarily refer to IT controls and countermeasures; it really means information governance, as the valuable asset it is. Extortion cases and identity theft are common in some cities in the country, so it should make perfect sense to protect pictures and IDs.

sábado, enero 17, 2009

With just a few hours from the beginning of elections, the Tribunal Supremo Electoral website is down. Many citizens who waited for the last minute to check their designated voting booth, will have to recur to other means of knowing where to go tomorrow.



This is just to show how important stress tests are when putting Web services online. Hopefully, this post won't affect any voter's decision for tomorrow.