The software vendor's audit revealed, with regard to the DNC data breach,

[pnwmom]

"'at this point that no campaigns have access to or have retained any voter file data of any other clients, with one possible exception, which is the Sanders campaign,' he said."

but that seems to conflict with this statement by the same vendor spokesman:

"He tried to minimize the effect of the bug, saying that only for a brief window were some data for one campaign viewable by others but that they couldn't export, save or act on it."

which seems to conflict with Josh Uretsky's statement that he went into the system to "create a record" showing how he improperly had access to the material.

So it makes sense that the DNC needs to get to the bottom of this and to make sure that no voter file data or modeling has been retained.

http://www.latimes.com/nation/politics/la-na-sanders-campaign-data-breach-20151218-story.html

More on Josh Uretsky's statement here:

http://www.democraticunderground.com/1251909206

[VanillaRhapsody]

1. I would like to see him prove that they couldn't!

[Scuba]

3. One can't prove a negative.

It's like asking someone to prove they've never eaten any kittens.

[pnwmom]

7. The DNC is merely asking for "assurances" that the campaign hasn't retained the files.

That shouldn't be a problem, should it?

[Scuba]

9. Source please. The word I've read in multiple threads here is "prove." Including the post ...

... to which I replied.

[pnwmom]

11. Here:

https://www.washingtonpost.com/politics/dnc-sanders-campaign-improperly-accessed-clinton-voter-data/2015/12/17/a2e2e14e-a522-11e5-b53d-972e2751f433_story.html?hpid=hp_hp-top-table-main_sandersdnc-1155pm%3Ahomepage%2Fstory

The DNC has told the Sanders campaign that it will not be allowed access to the data again until it provides an explanation as well as assurances that all Clinton data has been destroyed.

[MohRokTah]

2. prt sc

Yes, I've seen data stolen with that simple keystroke. That's how you save unsaveable data.

And they had FOUR USERS accessing the data.

[LiberalArkie]

4. Or more, if one can access data that is not secure then 10,000 can.

[JonLeibowitz]

5. The software company has not yet completed the requested audit and your quote is incomplete

The correct quote is

We are confident at this point that no campaigns have access to or have retained any voter file data of any other clients, with one possible exception, which is the Sanders campaign

This makes a real difference because "we are confident" is just them saying what they believe.
Please consider deleting this OP as it contains misquotations which materially change how the facts are viewed.

[pnwmom]

6. How do the words "we are confident" from the software vendor, whom I noted was the speaker,

make any material difference?

And you are incorrect about the audit. The vendor has completed theirs.

The company conducted an audit once it realized data had been unprotected, Trevelyan said, and discovered the breach by the Sanders campaign.

"This bug was a brief isolated issue," Trevelyan said. "… We have thousands of automated tests and extensive code review and release procedures in place to prevent these types of issues and will add more.”

The DNC is also considering an audit by an independent firm, a party official said.

[JonLeibowitz]

8. It makes a difference. It is blundering confidence from an organization with zero credibility

Their "audit" is anything but, and audits are typically done by outside parties.

[pnwmom]

10. But the quoted sentence contains the words, "he said," referring to the vendor.

So it is obvious that this is just his assertion.

[JonLeibowitz]

12. It is not obvious.

"'we are confident X', he said" is different from saying "the audit revealed X".

But if we can't agree on that then perhaps it is best to end this conversation.

[questionseverything]

13. about the vender

http://www.democraticunderground.com/128083684

[pnwmom]

14. So they have the same last name. And they have different parents,

different birth states, and are 17 years apart in age.

According to Wikipedia, which doesn't indicate any connection.

[questionseverything]

15. keep reading

"Turns out that Nathaniel Pearlman, the CEO of NGP-VAN, the company that is responsible for the data leak that got Sander's campaign banned by the DNC from seeing Democratic party voter roles, was the chief technology officer of the Clinton 2008 campaign."


https://en.wikipedia.org/wiki/Nathaniel_Pearlman

[pnwmom]

16. What does that have to do with Wasserman?

And so what?

If you leave a door unlocked that doesn't give a thief a right to go through it. No one is disputing that Uretsky improperly accessed the data. He has been interviewed and acknowledges having done it. On purpose. To
"create a record" to show that he could improperly access the data.

[questionseverything]

17. the point is since the IT guy worked for hc's campaign in 08

he is probably still "working" for her now..so anything the IT company says is questionable

whole thing is much ado about nothing,except that bernies campaign has lost a good IT guy, lost access to important info

personally i think the entire debase should be made public, i would love to see the notes by my name

[pnwmom]

19. This is no longer dependent on anything the vendor says. Uretsky himself has admitted it

and the Sanders campaign has fired him for it.

It doesn't matter one iota what the vendor says now -- it's all been confirmed by the guy who did it.

Who is not, by the way, named Wasserman either.

[ViseGrip]

26. An incompetent vendor worker hired by DWS left the firewall down during maintenance.

Did DWS fire him? And, he worked for Clinton in 08.

Tactics to get rid of Bernie, that is what this smacks of.

It may derail him, but Hillary will lose all of their support when the general election comes. So the comments here, reflecting Bernie is toast and rightfully so are wrong. His campaign is not the one who DID anything. There info was in the open to for Hillary's camp. The fact they are not complaining is telling.

[pnwmom]

32. I haven't seen anyone blame Bernie personally or say he is toast.

I don't know where you're getting that.

But Bernie's National Data Director most certainly did something wrong. That's why he got fired. Hhe's admitted that he purposely went into the system in order to, as he put it, "create a record" showing that he could improperly access the system.

That's what Uretsky himself said.

[misterhighwasted]

33. Omg. It just can't possible that bernie's top data guy was a corrupt little shit.

Blame him.
He did the dirty deed.

[jeff47]

18. When doors keep appearing in your house, and the vendor won't fix it

you're going to need to see what can be done with those doors to find out how much danger you are in.

The Sanders campaign reported these security issues months ago. How long should the Sanders campaign have let the holes remain before finding out just how bad the breaches are?

[pnwmom]

20. Nobody working in IT would ever think that was a legit thing to do.

Never ever ever. That would be a fire-able offense and -- what do you know -- he got fired.

[jeff47]

21. Yes, they would. And we do it all the time.

We break into computer systems all the time when vendors will not patch their security holes, in order to find out what can be done with those flaws.

In fact, there's an entire IT industry in penetration testing.

If I was the Sanders guy, I'd have called the equivalent Clinton and O'Malley people and schedule such a test with everyone present to avoid the political problems. With the vendor failing to do their job, an assessment has to be made.

[pnwmom]

23. You wouldn't break into a competitor's system to fix its flaws.

[jeff47]

24. Not at all what I said. But you lying about what I said is not exactly uncommon. (nt)

[pnwmom]

25. Oh, excuse me. You said:

"We break into computer systems all the time when vendors will not patch their security holes, in order to find out what can be done with those flaws."

And I still say you wouldn't be breaking into a COMPETITOR's system for any legit reason -- though you certainly might be doing so in order to see "what can be done with those flaws."

[jeff47]

27. Who inserted the word competitor? That would be you.

To test these flaws, you have to use an account that should not have access. In most situations, you can create your own "unauthorized" account. In this situation, that isn't possible.

Again, he should have had his equivalent from the Clinton campaign involved for the assessment to avoid the political issues he caused, but the assessment needed to be done since the vendor had failed to close the holes for months.

[pnwmom]

29. That is what happened here. The Sanders guy broke into the COMPETITOR"s data,

knowing full well what he was doing.

An assessment needed to be done. By the vendor or neutral outsider. Not by Mr. Uretsky.

[jeff47]

31. The vendor lied about fixing it, and left the holes open.

And you are calling for the vendor to assess it, while also claiming to be well informed about IT.

Yeah. Entirely believable.

[pnwmom]

35. No, the hole was only open for short time -- minutes, not months. What the Sanders

campaign said was that there had been multiple occasions of these breaches and that they had reported this months ago. But as you know, glitches and bugs are not uncommon, unfortunately.

That doesn't mean the Sanders guy can just go in and "create a record" of whatever he wants.

[jeff47]

37. Sorry, no. The same issue came up months ago and the Sanders campaign complained.

To now say "It was only minutes!!" is damage control by a vendor that has refused to fix their software.

But as you know, glitches and bugs are not uncommon, unfortunately.

When the same security holes remain in place for months after they are reported, it either shows massive incompetence or ill intent.

That doesn't mean the Sanders guy can just go in and "create a record" of whatever he wants.

The vendor has failed to fix the holes. They told the Sanders campaign they would. Since it's obvious those holes are not getting fixed, either through incompetence or ill intent, then a vulnerability assessment is called for.

As I keep saying, this assessment should have involved the other campaigns to avoid the political issue the assessment creates, but that assessment still must be done.

[arcane1]

36. Playing their role.

Playing it poorly, yes, but they're playing it nonetheless.

[NurseJackie]

22. The word "audit" is used in many different ways...

... and internal audits and ongoing continuous data access auditing is much more "typical" (to use your word) than the type of external (typically bookkeeping) audits about which you appear to be referring.


https://en.wikipedia.org/wiki/Audit_trail

In information or communications security, information audit means a chronological record of system activities to enable the reconstruction and examination of the sequence of events and/or changes in an event.

[jeff47]

28. When it comes to security, external audits are the norm. (nt)

[NurseJackie]

34. And they very well may do that.

Using the same info that has already been created from the systems currently in place. I would welcome additional scrutiny, in addition to the analysis we're currently seeing.

[misterhighwasted]

30. Jezus this is some crooked scandal worthy shit!

Good luck bernie.

Most trustworthy status deserves to be revoked.
OMalley & Clinton run on their DEM policy plans.
Sanders??
Hmm.