While the data contained in the electoral registers is limited, and much of it is already in the public domain
What is not generally in the public domain is the National Insurance number, mandatory on electoral registration since 2015, very useful for impersonation purposes. I wonder if they got those?
Afaik that is not correct. It is a criminal offence to refuse to complete the registration form or to give false information. But if you're not asked ro register then no offence is committed.
Which is rather amusing, as my partner, a Chinese national, is regularly hounded to register, despite not being eligible to do so (and in fact, would be committing an offense if she tried).
I'm registered to vote, but because I don't live at my last UK address since leaving the country over 10 years ago, I can confirm: it's a factor in a bad credit rating.
I dont care, I closed my bank accounts because I dont like the way the banks share data with credit agencies. One of the reasons why I stopped using crypto.
I'm glad you're in a position to not need a bank account. Unfortunately the vast majority of us rely on having a bank account and a credit record to exist in society.
You can argue that it sucks, and I'd partly agree, but that is how society works right now.
Privacy is undervalued, I agree. But I also like having a roof over my head and a way for my employer to give me money each month.
I would live on the streets but everything is owned by someone or something so you become incarcerated by different entities against your will. Violence always wins. And we can only suicide for free, euthanasia costs money.
Life is intelligent slavery now, more psychological than physical, and way more stealth than most people realise.
Anyway don't worry about me you have yours and your loved ones backs to watch and your grown up toys to worry about. Nothing has changed in thousands of years.
The UK down plays its surveillance as its best to not wake the population up plus its a stealth form on entrapment, illegal in the UK and it also provides a facility for deniable ops like murders.
It doesnt look like it is a criminal offence but when I tried to remove myself the option wasnt there, so I changed the name. I could remove other people on the system.
I can't find any reports of people actually receiving the penalty. It'd certainly be useful if the Electoral Commission collected these statistics, but they don't. It seems fairly rare, and it's likely to be one of those things that's there to encourage people to register to vote rather than something to be actively enforced.
I'd also note that given there is a requirement for an in-person home visit to encourage registration before service a formal notice, it's pretty likely that COVID restrictions and guidance meant quite a lot of the home visits didn't happen over the last few years.
This is another good case for security-by-minimisation. I struggle to see why NI numbers were required on the electoral register — particularly when democracy in the UK had been functioning for over a century without them.
The best way to ensure valuable data doesn’t leak into the public realm is to minimise the amount of unnecessary data collection.
Best way here would have been to only collect the information at the constituency level. Why is there even a need for a national database? If you're concerned about fraud then periodically cross-check hashed NI numbers or something like that.
While officially they serve a similar purpose, NI numbers aren't used like SSNs are for identification, so the impersonation impact is more limited than an equivalent leak of US SSNs would be.
Thus providing an example of why we should stick with our pencil and paper, manually counted voting system, and not computerise it.
Most of the info lost is already publicly available (if one is willing to visit libraries in each electoral ward), so could be collated. Despite that, the manual process of the polls means that it is very difficult to corrupt, and even more so to corrupt without being detected.
In a completely electronic system, it would be so much easier to cheat, and get away with it. It would also be difficult to convince folks that the systems are robust.
That’s the beauty of turning up and putting an x on a piece of paper. You can of course slip in the occasional fraudulent vote (pretend to be someone who isn’t going to vote). You can register a false person in the address. It’s quite easy to swing dozens of votes across the country, with an increasing risk of being caught
But the effort it takes would be better spent getting the vote out for your candidate. You can pretend to be your neighbour once or twice, but if you turn up at the voting station several times you’re going to be noticed.
Better to offer a lift to your identified voters to make sure they legitimately vote for you even though it’s raining.
I think he literally means dozens of individual votes, not dozens of elections.
7AM-10PM, I could do... what... 30 votes, if I planned meticulously? With the risk of a collision going up with each attempt, and the chances of swinging an election very close to nil. Like OP said, it's more effective to campaign.
To me the report seems very vague as to whether the details were exposed by accident or as the result of an attack. Like, the organisation is trying to make it _sound_ like it was the result of an attack, but they seem to know very little about it so that makes me suspicious.
> It said the attack had “used a sophisticated infiltration method, intended to evade our checks”, which was why it had taken so long to detect.
They seem pretty clear that it was an attack rather than accident, but I agree the details seem intentionally vague. Maybe it wasn't quite that sophisticated after all...
> McNally [Chief Executive] said: “We regret that sufficient protections were not in place to prevent this cyber-attack. Since identifying it, we have taken significant steps with the support of specialists to improve the security, resilience and reliability of our IT systems.
Finding out nearly 2 years after a breach is really poor considering the potential for phishing given someone full name and address.
The Electoral Commission should really be pressed to give a proper post mortem and not get away with "sufficient protections" and "significant steps".
40 comments
[ 2.5 ms ] story [ 72.0 ms ] threadWhat is not generally in the public domain is the National Insurance number, mandatory on electoral registration since 2015, very useful for impersonation purposes. I wonder if they got those?
Dont see the point of being on it, I wont be voting ever again!
Afaik that is not correct. It is a criminal offence to refuse to complete the registration form or to give false information. But if you're not asked ro register then no offence is committed.
Not being on the electoral register is a huge pain too. It affects your credit quite significantly.
[1] https://www.manchester.gov.uk/info/500328/voting/6470/regist...
I dont care, I closed my bank accounts because I dont like the way the banks share data with credit agencies. One of the reasons why I stopped using crypto.
Privacy is massively undervalued. :)
You can argue that it sucks, and I'd partly agree, but that is how society works right now.
Privacy is undervalued, I agree. But I also like having a roof over my head and a way for my employer to give me money each month.
Life is intelligent slavery now, more psychological than physical, and way more stealth than most people realise.
Anyway don't worry about me you have yours and your loved ones backs to watch and your grown up toys to worry about. Nothing has changed in thousands of years.
The UK down plays its surveillance as its best to not wake the population up plus its a stealth form on entrapment, illegal in the UK and it also provides a facility for deniable ops like murders.
https://www.legislation.gov.uk/ukpga/2013/6/section/5/enacte...
Maintenance of registers: invitations to register in Great Britain
(1)A registration officer in Great Britain must give a person an invitation to apply for registration in a register maintained by the officer if—
(a)the officer is aware of the person’s name and address,
(b)the person is not registered in the register, and
(c)the officer has reason to believe that the person may be entitled to be registered in the register.
The legislative text (it's an amending regulation—think a diff—but the underlying statute hasn't been updated on Legislation.gov.uk yet) is here: https://www.legislation.gov.uk/en/uksi/2013/3198/regulation/...
The Electoral Commission's guidance - https://www.electoralcommission.org.uk/running-electoral-reg...
I can't find any reports of people actually receiving the penalty. It'd certainly be useful if the Electoral Commission collected these statistics, but they don't. It seems fairly rare, and it's likely to be one of those things that's there to encourage people to register to vote rather than something to be actively enforced.
I'd also note that given there is a requirement for an in-person home visit to encourage registration before service a formal notice, it's pretty likely that COVID restrictions and guidance meant quite a lot of the home visits didn't happen over the last few years.
Ireland is close, and would probably suffice.
I've a vague memory of it being 7 years, but on checking it seems to be 15.
The best way to ensure valuable data doesn’t leak into the public realm is to minimise the amount of unnecessary data collection.
I don't, they were introduced shortly after the plans for an ID card died out. It's simply a proxy ID register.
HMG
https://www.gov.uk/national-insurance/your-national-insuranc...
Typical late stage Tory victim blaming coms.
That said I'm sure it'll be a factor in credit card applications.
If the UK govt operated in the private sector, they would have been fired several times over
A fine is a fee you pay for wrongdoing that makes you think twice next time.
So the headline may as well read “ALL UK voter’s data since 2014 leaked”
I’m angry about this. Our technology strategy in this country is completely backwards.
Most of the info lost is already publicly available (if one is willing to visit libraries in each electoral ward), so could be collated. Despite that, the manual process of the polls means that it is very difficult to corrupt, and even more so to corrupt without being detected.
In a completely electronic system, it would be so much easier to cheat, and get away with it. It would also be difficult to convince folks that the systems are robust.
In that sense Estonia is 'brave'.
That’s the beauty of turning up and putting an x on a piece of paper. You can of course slip in the occasional fraudulent vote (pretend to be someone who isn’t going to vote). You can register a false person in the address. It’s quite easy to swing dozens of votes across the country, with an increasing risk of being caught
But the effort it takes would be better spent getting the vote out for your candidate. You can pretend to be your neighbour once or twice, but if you turn up at the voting station several times you’re going to be noticed.
Better to offer a lift to your identified voters to make sure they legitimately vote for you even though it’s raining.
the best liars believe what they say
7AM-10PM, I could do... what... 30 votes, if I planned meticulously? With the risk of a collision going up with each attempt, and the chances of swinging an election very close to nil. Like OP said, it's more effective to campaign.
They seem pretty clear that it was an attack rather than accident, but I agree the details seem intentionally vague. Maybe it wasn't quite that sophisticated after all...
> McNally [Chief Executive] said: “We regret that sufficient protections were not in place to prevent this cyber-attack. Since identifying it, we have taken significant steps with the support of specialists to improve the security, resilience and reliability of our IT systems.
Finding out nearly 2 years after a breach is really poor considering the potential for phishing given someone full name and address.
The Electoral Commission should really be pressed to give a proper post mortem and not get away with "sufficient protections" and "significant steps".