Data Leakage from Voting Sites

OK, so I finally got some minutes to publish this "finding".

Some of you may know that on January 18th, 2009, El Salvador had elections for mayors in all districts, and for parliament representatives. Aside from other questionable aspects of operations (personal IDs not being exhaustively checked for falsification, and others), one thing caught my attention: how easy it was to "steal" citizen information from boards near voting booths, where one was supposed to look for one's ID and photo.

I actually took some pictures of some boards with my cell phone. I was expecting to be asked to hand them over, but this was not the case. I just walked away. Here are a couple of photos (the phone camera is actually 2.0 MP, and it doesn't have any image stabilization technology, so no need to defocus or alter them to make data illegible).

 


Government entities that handle this kind of information, should be more cautious about it. Information security does not necessarily refer to IT controls and countermeasures; it really means information governance, as the valuable asset it is. Extortion cases and identity theft are common in some cities in the country, so it should make perfect sense to protect pictures and IDs.