As someone involved in IT work. The whole DNC "breach" thing is a cover for political gain.

[newthinking]

Think about this a moment outside of the media brewhaa.

Imagine that Amazon; while upgrading their system, exposed customer credit cards and other personal data and customers were able to get other people's private information by doing a search. The press would not be going after customers who noticed the issue and and ran some searches to see how much came up. Everyone would be up in arms that Amazon allowed this to happen. They might well be seen to be open to a serious lawsuit and possibly government fines or worse.

Imagine if they went and tried to blame it on their customers?

As one who works in IT and is trained on data security there are so many things wrong with the picture that are *not* being covered.

It is incredibly simple and there are many ways to remove public access to such applications while you patch. Which is the least that should have happened and would have in most organizations. Then you do not return access until you have... TESTED!

And that is only one facet. There were so many security standards and practices that were obviously not in place that in the least it shows incredible incompetence. They easily may have broken Privacy laws and certainly are exposed to liabilities.

The Sanders campaign acted appropriately and did what they should.

With the press coverage, the DNC response, and the vendor blaming the customer for their massive failure, it is hard to see this as much other than political gamesmanship.

My 2 cents.

[arcane1]

1. Last I heard, the vendor still has the job. That's fucked up. n/t

[Ferd Berfel]

6. Kinda dosen't look like an accident?

[99th_Monkey]

7. The vendor is an old Clinton friend & long-time supporter

I wouldn't hold your breath. The vendor is in on this, up to his
eyeballs.

[arcane1]

10. Exactly. if not fired for failing, then retained for doing what they were hired to do.

[Mnpaul]

37. The vendor is....

Ready for Hillary
https://www.facebook.com/photo.php?fbid=10152093250975723&set=pb.587125722.-2207520000.1450483614.&type=3&theater

[hedda_foil]

44. And his business partner is Debbie's nephew... her brother's son.

Something that's been bothering me is that a senior IT staffer on Bernie's campaign previously worked for NGP VAN. It could mean any of a number of things but I'm uncomfortable about it.

[notadmblnd]

8. I heard the vendor is connected to DWS and worked on HRC's 2008 campaign.

But they insist that it's all Sander's campaign's doing.

[tecelote]

16. DNC had a data breech. Vendor broke security protocol. Bernie is to blame.

Wasserman Schultz was campaign co-chair for Hillary Clinton's 2008 presidential campaign.

Nathaniel Pearlman (the vendor) was chief technology officer for Hillary Clinton's 2008 presidential campaign.

These two should be fired.

[notadmblnd]

17. I totlly agree, but then the playing field would be even

and the DNC and HRC can't risk that now, can they?

[tecelote]

18. No they can't.

So they called the media and said "Bernie did it".

So transparent.

Hey... it's getting Bernie attention. Something they were trying to avoid.

Maybe they evened the field a bit unintentionally.

[notadmblnd]

20. Well it's definately got his base angry ans stirred up

and media attention galore. It has even knocked Donald Trump of the screen 24/7. Today msm is only talking about him 12/7

[tecelote]

21. They expected him to back down and instead he attacked.

Did you see this on MSNBC - pro-Bernie all the way!

http://www.democraticunderground.com/?com=view_post&forum=1017&pid=315875

This is who America needs for a President.

[notadmblnd]

23. Yes, I did see it

This does not make the Sander's campaign look bad. This makes the DNC, Wasserman-Schultz and now (because her spokesperson essentially declared war by accusing Sander's of stealing millions) HRC look bad.

They look more desperate now than ever and Wasserman-Schultz looks like the villian.

[SusanCalvin]

45. If they really expected him to back down, they are very stupid,

certainly in a political sense. Aren't high-level politicos supposed to understand human nature in general and individuals in particular?

[newthinking]

38. Sure it does. Because this is an example of what people are sick of

.
I know for me it is not just about the way they are attempting to paint Sander's campaign, but the same bullshit negative and manipulative crap that I consider corruption and am tired of.

[notadmblnd]

41. I know right?

nt

[Fantastic Anarchist]

59. Show your pissed off by donating to Bernie.

I did and it felt great.

Also, call the DNC and let them know what you did and why.

That felt even better.

[ViseGrip]

60. Second breach! First one Bernie's camp found in October and notified the DNC.

They were not stealing anything. And why would the firewall be removed a SECOND TIME???

[tecelote]

62. Exactly.

And, why would they call the media?

[peacebird]

9. One of the Vendor owners was tech guy in Clinton 2008, so, no surprise. DWS was also Clinton 2008

[mindwalker_i]

13. That's not a bug...

It's a feature.

How many people have gotten in trouble for noifying software makers that they had bugs?

[Fawke Em]

50. None.

It's called "responsible disclosure" and most vendors welcome it.

https://en.wikipedia.org/wiki/Responsible_disclosure

[LiberalArkie]

2. Yep, add a me too..

[randys1]

3. I am no longer allowed to discuss election politics, so let me just say this

[notadmblnd]

19. Hey I was kicked out of the HRC group too. didn't even know I was in it.

I rarely pay any attention to what forum I'm reading when it comes up on the latest page. You can still post in GDP, going to any ones "safe place" is for the birds if you ask me. Safe place, what a freaking 5 year old term. Poor victims "

[7962]

55. THAT is very aggravating too. Same thing happened to me

The story was listed in the "trending" or "top stories". So you post in it and are immediately banned from a group you didnt even know you were in.
Childish and ridiculous.

[notadmblnd]

56. well, the poor delicate flowers need their safe place

I guess Personally, I can't imagine being afraid of anonymous people on the world wide web disagreeing with me. That's just how I roll though

[7962]

64. Right there with you.

[erronis]

49. Careful, DU may make this part of their TOS!

Just kidding, DUMasters.

[Ferd Berfel]

4. 2 additional notes

1: As reported elswhere in DU: Report: Sanders campaign told DNC of data issue months ago

http://thehill.com/blogs/ballot-box/presidential-races/263730-report-sanders-campaign-told-dnc-of-data-issue-months-ago


2: I worked on the DNC IT Department(db specialist) during the 2004 election. My opinion on the breach:
http://www.democraticunderground.com/?com=view_post&forum=1251&pid=912740

[progressoid]

61. Thanks Ferd.

[VanillaRhapsody]

5. Last I heard 4 more criminals are still working

For Sanders...

[Segami]

11. kick!

[justiceischeap]

12. I agree with some of your points

Specifically about how the software patch was handled. It's obvious that the testing environment (if they have one) isn't an exact duplicate of their production environment (which, as you know, can cause issues). This should have been caught before being placed into production. That said, mistakes like this happen all too often. If I were the VAN company, I would fire whomever was in charge of QA (or hire someone if they don't have someone already).

I disagree that the Sanders campaign acted appropriately because they didn't. They signed a contract with the DNC/VAN that they would not look at other campaign's information yet they did. They should have immediately gotten on the phone with their attorney's, then on the phone with someone from VAN and talked to them about what they discovered. Instead of actually poking around in the data (which their signed contract says they aren't allowed to do), they should have taken a screenshot for proof and sent that to customer support. Involving the attorney would have let them know they couldn't do the searches they were doing.

Instead, this guy did something that may have been harmless on its face but it's become this huge scandal for Bernie (and it makes some Bernie supporters look like lunatics for starting HRC conspiracy theories) and did something that, in the contract, stated they would lose access to the system if they did this.

[SusanCalvin]

46. Thanks for adding to my understanding of this mess.

And I got a much-needed, if sardonic, laugh from your insinuation that the vendor might not have any QA.

[ejbr]

47. Good points. N/t

[SandersDem]

14. In fact

DU is doing this tonight and taking down the site for a few minutes for updates.

An original OP of much clarity!

[PDittie]

15. One vendor for all campaigns.

I appreciate the fact that merging or comparing databases from more than one vendor would be problematic, but so is the current system.

"It’s a monopoly that’s been created and forced down the throats of all Democrats,” John Phillips, co-founder of the non-partisan political data firm Aristotle, told POLITICO. "Monopolies are notorious for overcharging their customers, screwing their customers. That’s what’s been going on on the Democratic side for quite some time."

Rival vendors like Aristotle have been the most outspoken critics of the current Democratic setup, which gives the nearly 20-year old company NGP VAN sole distribution rights to the party’s valuable voter file. That database includes voting history, address and contact information for registered voters, which both the Clinton and Sanders campaign rent and then supplement with their own collection of information.

Central to the NGP VAN business model is a supposedly secure firewall that keeps any information that one campaign collects away from a rival political player. But that security system was exposed this week, NGP VAN admitted, because of a software error.

http://www.politico.com/story/2015/12/democrats-data-breach-vulnerability-216955

[KoKo]

48. Recommend... Storing all private campaign's data at one source

seems to be very risky.

Back a few years ago it was found that Dems and Repubs (in the US House) were sharing the same computer system and the Repubs had hacked system for the Dems files. Someone resigned over it, but there was little follow up about why they were using the same server to store data for rival parties which could reveal classified and internal information from Select Hearings and Investigations by Committee Chairs plus other private committeee work and discussions

[erronis]

52. There should be no reason that any candidate's data is not kept seperated from others

And partitioned so that no individual or group can access data outside of their Access Control (or whatever.) My reading of this information that there are no Operating System (OS) constraints, just well-intentioned programming ones.

If this is enforced only by some 20+ year-old software written by people that owe their allegiance to the Clinton camp, it is unethical. I would say it is grounds for Clinton to repudiate her ties to the DLS/DWS. In fact, not just in words (which seem to be wildly different at times.

Echoing what another comment made, why is it necessary for the DNC to have access to all of this information in the first place?

When there is someone who's personal connections go to Bill and Hil, why should s/he have any position of administrative privilege? Even as assigning it to her friends/nephews/BF?

[mountain grammy]

22. The DNC has been a miserable failure under DWS,

or a success, if you're a Republican. She has absolutely no credibility, in my opinion.

[CajunBlazer]

24. All of that aside - what a neigbor accidently left my house unlocked...

.... while taking care of it for my while i was on vacation. Then someone else went into my house and stole some of my furniture. Who would I blame - first my neighbor who was careless.

However, my real problem would be with the person who took advantage of the situation and stole my furniture - because that person broke the law, a well know rule.

Well the IT vendor screwed up, and maybe not for the first time, and should accept part of the blame. However, the Sander's campaign broke the rules and stole the data. They admitted as much when they fired one of their staffers over the incident.

The only reason they are suing is to get access to their data as soon as possible.

[newthinking]

31. That is yet to be shown. The media is trying this before it is clear

I used an example before where we would switch this to be Amazon and during their patch customers had access to other customer's credit cards and private info. It is an apt analogy that takes away the political component.

Customers would be considered innocent in intent unless they actually used the data. Authorities would go after someone only if they try to use the information in a real, tangible way. We don't know their motives/intent until they do so.

The DNC doesn't stand a chance in a legal court unless they can prove the intent, destroy a legitimate argument of trying to see what was compromised.

It is the nature of the negligent behavior that changes the dynamics as well. Any court would throw this out because it is completely unreasonable to effectively make data that is understood to not be available available and then assign intent and blame. You just can't do that when the data was implied to be "fire-walled". It won't hold up in court. You can't make a contract component like that stick in a real world situation where the vendor does what it did. That is why those software contracts we all don't fully read are not quite as powerful as they sometimes claim.

[Samantha]

25. I totally agree

Recommended your thread.

Sam

[MyNameGoesHere]

26. I think breaches happen almost on a weekly basis

of cc's, personal information and more. How is this one the exception?

[Thinkingabout]

27. Are you thinking if a hacker gets your personal information it would be okay for the hacker

To use your information, download it to another file to use as the hacker sees fit? It may be okay with you but it I not okay with me. Sanders fired one from his campaign staff, he knows it was wrong and made the move to get rid of the person. Should we now have a law suit filed against Sanders for firing the guy and denying him employment? I doubt if Sanders would agree.

[newthinking]

33. At this point it looks like they fired him for poor judgement, not potential criminal liability

I don't know about you, but in my job I can be fired for making an innocent, but destructive mistake in judgement or in real terms. Just like the person who did not shut down access to the application while patching could, and would be fired by many firms for not securing the data while it was worked on.

[Thinkingabout]

43. And in the positions I have held some "misjudgements" also could

Result in criminal charges, I would be fired and criminally charged.

[Paka]

57. The operative word is USE.

The campaign staff did not use any of the information. The explored to find out out extensive the glitch was.

[Thinkingabout]

58. Tell that to someone else, an audit is going to happen, strange the files which

Was copied to Sanders which was in Hillary's portion. BTW, tell Bernie it was 't anything, he fired the guy. Is Sanders wrong to have fired the guy? The guy violated the rules agreed when access was give to the Sanders campaign. He sure did not help Sanders.

[Metric System]

28. Look at it another way: I'm a hacker who discovers Amazon has a security vulnerability. I access

their system and go fishing for customer information and credit cards. Am I blameless?

[newthinking]

34. That is up to the courts. If that vulnerability was a certain way to search or following

a link that was accidentally placed on the wrong page? You certainly can't be convicted in court for that.

So, to continue this analogy, Amazon would likely be much more concerned about the fact this was available as well. If I created that link or removed that firewall you can be they would fire me before offerring an apology and recompense to yes, even the customer than happened upon (It is called discovered) the issue.

Actually it happens all the time: White hats find vulnerabilities and report them and they do not go to jail. They are seen as helping. People get good paying jobs this way.

[BeanMusical]

29. ...

[Lithos]

30. I'm involved in IT at a Sr. level for a very large retail company

The data we deal with is much larger and even more coveted. I too am incredulous about this series of events.

Either this is a series of events more coincidental and amateur as a Keystone Kops movie, or it was purposeful.

A few sample points which I have issue:

- Whole lack of test coverage for the change.
- The lack of independent pen (penetration) testing and audit controls. i.e., they were never testing their firewalls
- The lack of response when an incident is reported. (Especially when it was back in October).
- And I have a huge issue about the mixture of data. If, as reported, the data was segmented by a firewall, this would imply there were multiple database instances which would have different AAA. (Access, Authorization and Authentication) mechanisms. However, The Sanders people were able to access this data which implies this was shared data and a "firewall" was not in between. Ie, this was a failure of the AAA above which is a much more deliberate change (i.e., not due to a simple firewall change)

L-

[newthinking]

35. Yes. And it looks like the word "firewall" is not being used technically.

It sounds more like the vendor "claiming" a barrier that is not actually a firewall, but more likely some other slight degree of separation. But like you I also see that if this breach happened then obviously the degree of separation is not NIST or any other standard compliant and just pretty much a "cover their ass" argument at best.

[dogknob]

32. K&R

[jalan48]

36. Poor Hillary. If she has to win this way who does she think will support her once she's in office?

Does she seriously think she will get the overwhelming support Obama received from all Democrats when he became President?

[Thespian2]

39. K & R!!!

[bigtree]

40. the info wasn't automatically displayed

...it still needed to be accessed by the campaign as it was available as a mere link indicating it was info from another campaign.

The mistake was going ahead and accessing the info. Are you saying the Sanders campaign's data director didn't know that wasn't allowed?

[blackspade]

42. K&R

[valerief]

51. The biggest mistake was purchasing such a shoddy product. nt

[Bread and Circus]

63. exactly. but u see HRC is special.

[Matariki]

65. An IT friend commented "a firewall in a database?"

And then went on to say "firewalls don't go down, they're taken down".