Beyond the Norm: Coleman's data leak disaster

Cringely unravels the ugly mess around ex-Minnesota Senator Norm Coleman's data spill and asks, Should this man be handling sharp implements?

Later that evening, the Independent reported Richards' findings that an unsecured donor database was stored on the Coleman site. A few hours after that, the page containing that database was suddenly password protected.

But the Coleman campaign didn't bother notifying any of its supporters that their data had been exposed on the Net. (Which, as this Wikileaks page notes, may be a violation of Minnesota state law.)

Fast-forward six weeks. Wikileaks.org receives copies of the databases from an anonymous whistle-blower. The site sends an e-mail to everyone in those databases, warning them it's about to spill the beans. Two days later, the databases, with most of the credit card digits removed but everything else intact, go online.

The Coleman crew immediately begins shrieking about being hacked, political dirty tricks, and federal investigations into nefarious acts of espionage. (Though, as Richards notes, the only "hacking" tool she needed to find all this information was Google.) Their official response also included this gem: "We take the privacy and confidentiality of our donors and supporters extremely seriously."

But not quite seriously enough to a) keep their unprotected confidential data off the Net, or 2) tell anyone after they knew the data was exposed.

Why didn't they contact anyone back in January? According to Sheehan:

We contacted federal authorities at that time, and they reviewed logs from the server in question as well as additional firewall logs. They indicated that, after reviewing those logs, they did not find evidence that our database was downloaded by any unauthorized party.

Well, guess again, Sherlock. Richards was able to gain administrative access to the site, and she says the log files were missing. If anyone could become an administrator, how would they know who or wasn't authorized? Without a log file, how would they know how many times this data was downloaded?

Bottom line: It's now Christmas in March for identity thieves.

Canceling and replacing your credit cards is a hassle (I know, I just had to do this myself recently after I lost my wallet). Good luck canceling your street address, phone number, e-mail, passwords, and any other information contained in those databases.