Fallout

Posted at 11:58 AM on March 1, 2006 by Bob Collins (12 Comments)

Striking all previous and subbing Scheck's story.

GOP peers into voters' data with CD

* * *

Talking with Mark Drake at the Republican Party this morning, it's probably going to say that it was always the company's intention to secure the data at the time the CD was released. That the CD that was provided to the media at Monday's news conference was a BETA version and the "security" will be installed -- and was intended to be installed -- before the program will be sent out.

The Party hopes to get the CDs from the vendor on Friday and hopes to mail them out on Friday.

Here's what happened as has been explained to me by the folks who took the program apart.

CH Consulting used a program called DotNetNuke at the Internet data repository for their survey results. But they neglected to secure their DotNetNuke site. We don't think this was intentional, especially since the entire mailing list with the assigned codes was posted.

As for securing the CD, I haven't seen the final copy yet, but the security problem we found wasn't on the CD, it was the server.

The Republican Party is not happy with me and I understand their frustration. I also understand the frustration of the people who wanted -- desperately -- to get the destination IP and I understand it sounded last night like I was saying "ha, ha, I know something you don't."

I accept that and there's nothing I can do about it except to point out I don't think CH Consulting needed to be put out of business today by denial-of-service attacks. Nor can I legitimately talk about the importance of protecting data, and then give you the address of where you can get it.

As bad a day as the Republican Party and CH Consulting may (or may not) be having today, believe me, it could have been a lot worse. Any nefarious individual could have mined the information.

Some of the blogs I read last night seemed to suggest that when you answer a question, you should know that information is being sent somewhere. And when you go to a Web site and click SUBMIT, I think that's reasonable.

But this is a Flash presentation about a political issue featuring cool video. And in Flash, interactivity is accomplished with the presentation. If you, for example, were to answer that you are a "sometimes Republican," there's actually every expectation by the user that this could lead to a somewhat, shall we say, softer video than if you had selected another choice. So saying "people should just know" their answers are being sent isn't necessarily true.

And in that case, all of that could be eliminated as a concern, just by telling them in the first place. The subject didn't come up at Monday's news conference for a simple reason: nobody asked.

We don't yet know what the "final CD" is going to have on it or what the wording is going to be to make clear to the participant what and how the data is being used. The Republican Party spokesman said he would "look into it."

Sometimes the best response is "whoops." And move on.

Here let me show you. You know how I said the server had the questions the presentation asked and we could've changed them. It's true the questions are on the server, but they're in the Flash document as text too. So I was wrong about that. Whoops.

(Update 1:04 p.m.) Here's the packaging. Methinks this will boil down to a question of what "interactivity" means.

(Update 1:15 p.m.) GOP says this is draft.

Comments (12)

Bob - Did you attend the press conference and ask these important questions?

Posted by Michael B. Brodkorb | March 1, 2006 1:11 PM

The Republican party should not be happy with themselves... it is irrevelant if they are unhappy with you. Sloppiness with identity information like this should be reported, no matter the party.

You are doing a great job, and this has become a favorite blog to read. Thank you Bob and keep up the good work.

Posted by gml4 | March 1, 2006 1:28 PM

// Did you attend the press conference and ask these important questions.

Hi, Michael. Good to hear from you. No, I wasn't at the news conference (you're talking about the one Monday, right?). And I didn't have the questions then.

I didn't even know what was going on until Scheck came back and gave Mike Mulcahy the CD and it was actually a funny story. Tom had put a Post-It Note on the CD itself that had the access code, so Mike shoved the whole thing in the CD-Rom drive which -- of course -- immediately went belly-up...causing lots of laughter and subsequent frustration.

When I finally got the CD (I was gonna pull a picture of it or something) later in the day, I was mostly taken by the brilliance of the presentation and then I said, "hey, what do I need this access code for?" That was pretty much posted on the original item I posted on it.

I enjoyed your posts belittling the last couple of days; I mean that. But one interesting note is NONE of the presentation given to the media contained any screenshots with a privacy notice. So other than the access code, there was nothing to suspect this CD was more than a presentation about the marriage amendment.

And, no, the Republican Party did not have a press conference or distribute the "secret polling device." They unveiled a marvelous tool to communicate their views on the marriage amendment. The "secret polling device" was...well... secret. I didn't make that up. That's just the way it is.

Posted by Bob Collins | March 1, 2006 1:39 PM

In fact there was a press conference.

Posted by Michael B. Brodkorb | March 1, 2006 2:30 PM

Bob: Since you weren't at the press conference, how can you say "Nothing was said nor indicated regarding data collection"

(B: I asked Scheck and we saved the audio. I also asked Drake this morning if there was any mention of the data mining aspect at the news conference.)

I have another question.
According to your website, "you must be 13 or older to submit information to Minnesota Public Radio."
How do you confirm this?

(B: No clue. I'll pass it along.)

Posted by Michael B. Brodkorb | March 1, 2006 3:24 PM

Bob, I felt it important to clarify your post. CH Consulting is obviously responding to media inquiries since Christa Heibel just did an interview with Mr. Scheck. Wax Marketing is handling all media inquiries for CH Consulting at this time. We have no plans to issue any releases on this subject, although we reserve the right to do so if we feel information regarding the ProCard or CH Consulting needs to be clarified to the public.

Posted by Bonnie Harris | March 1, 2006 3:37 PM

Thought you guys might be interested in reading the responses on another forum regarding the same topic - Pay particular attention to the comment post, 115, it's sort of brilliant.
http://thinkprogress.org/2006/02/28/the-minnesota-gops-stealth-attack-on-privacy/

Posted by Jameson Anderson | March 1, 2006 7:48 PM

Hi Michael,

The statement appears in interactive spaces in regards to the Children's Online Privacy Protection Act. In the very rare cases when we do have online activities for those under 13, the users/visitors (under 13) must obtain permission from their parents/guardians before submitting or sending their information to MPR. We clearly state that then and include fields for the parent/guardian's contact information for verification & confirmation purposes.

If didn't cover a personal concern in that question, know your privacy rights are covered in the site's privacy policy:

http://minnesota.publicradio.org/about/site/privacy/

which I can't make clickable in this comment, but is available in the page footers and near the post button. Don't hesitate to contact us at mail@mpr.org if you have questions.

-Julia Schrenkler
Interactive Producer, MPR New Media

Posted by Julia Schrenkler | March 1, 2006 10:19 PM

I'm a little late to this issue, obviously, but IMHO, the statement about interactivity hardly even qualifies as a statement. It's just a single adjective.

Conduct a survey asking people to define "informative, interactive CD-ROM." I doubt many respondents will define it as "collects my responses and saves them in a database for use by others."

Not to put too fine a point on it, but the CD-ROM is not actually interactive, is it? The CD-ROM merely connects users to an interactive survey.

Posted by Jill | March 2, 2006 2:01 AM

Just an observation...I certainly like the way this CD is targeted only at Windows users...I guess If I'm a Republican and use a Macintosh they just don't want my opinion.

Posted by Darren B. | March 2, 2006 7:53 AM

As an AP Statistics student (a semester and a bit through the class), I couldn't help but jump up and down and point at my radio when I heard Gov. Pawlenty extolling the virtues of the voluntary nature of the CD-ROM's responses.

The first thing we were taught in deigning experiments/surveys was that voluntary response yields flawed data.

Posted by Korla M. | March 2, 2006 4:42 PM

the Republican party is very fond of gathering info. without permission, just as they are fond of taking rights from certain folks, like their nasty little divisive marriage amendment being used to garner votes. Thank goodness majority didn't rule when it came to the women's right to vote issue or segregation and slavery. There are times when people of conscience must not let the majority have their way and those times invariably have to do with equal rights. Imagine if the majority would have decided in southern states that slavery was their constitutional right? Where would we be now? We also saw how the majority ruled in Nazi Germany and that lead to the persecution and murder of not only Jews, but also of homosexuals and the Romany peoples.

Posted by Sanda | March 3, 2006 2:21 PM

Services

• Hourly Newscast
• HD Radio
• iPhone App / Mobile
• E-mail newsletters
• RSS feeds
• Podcasts
• Submit your photos
• Videos
• Weather
• Most e-mailed stories