Cleaning up a few questions about the Great Data Breach of 2015
The campaigns seem to have largely moved on from the episode of last week, in which several Sanders staffers accessed confidential data from the Clinton campaign. I commend them both for doing so. However, the supporters of the candidates seem unwilling to let it go quite yet. For whatever reason, a lot of Sanders supporters on DU and elsewhere are certain that their candidate is the wronged party. I've seen a lot of speculative claims they've made in their opinions, and I wanted to address them one by one. The conclusion, unfortunately, is that these claims are dubious-- they are at best highly exaggerated or distorted, and at worst, simply completely unsupported.
Much of what I write is based on these sources:
An Explanation of What Bernie Sanders Staffers Actually Did and Why It Matters
Here’s what happened with NGP VAN, the Sanders Campaign, and the Clinton Campaign
Audit Logs From NGP VAN
Data breach sets off charges of theft in '16 Democratic race
Fired Sanders aide: I wasn't peeking at Clinton data files
Q: Did the Sanders campaign take any action to retrieve confidential Clinton campaign data, or did it appear to them by accident?
A: Yes, they deliberately took action to get the data.
Sanders campaign staff and supporters have sometimes hinted that the NGP VAN breach caused confidential Clinton campaign data to be revealed to them or sent to them by accident, without them having to request it. Bernie Sanders himself made that claim at the debate:
A few days ago a similar incident happened. There was a breach because the DNC vendor screwed up, information came to our campaign. In this case, our staff did the wrong thing -- they looked a that information. As soon as we learned that they looked at that information - we fired that person. We are now doing an independent internal investigation to see who else was involved.
This is false, and it is disappointing that Sanders would imply something like that. The audit logs show that Sanders campaign officials conducted numerous searches specifically against data from Hillary For America. This was not a case of them retrieving their own data and getting unexpected extra results.
From Amy Dacey's report:
Even though the glitch opened access, users still needed to take deliberate steps to seek out such information.
Further, there was a real purpose to the data illicitly retrieved, as David Atkins reported:
However, the access logs do show that Sanders staff pulled not one but multiple lists—not searches, but lists—a fact that shows intent to export and use. And the lists were highly sensitive material. News reports have indicated that the data was “sent to personal folders” of the campaign staffers—but those refer to personal folders within NGPVAN, which are near useless without the ability to export the data locally.
Even without being able to export, however, merely seeing the topline numbers of, say, how many voters the Clinton campaign had managed to bank as “strong yes” votes would be a valuable piece of oppo. While it’s not the dramatic problem that a data export would have been, it’s undeniable that the Sanders campaign gleaned valuable information from the toplines alone.
So, this was a deliberate attempt to obtain rival campaign data. It was not an accident.
Q: Did the Clinton or O'Malley campaigns access any data they were not supposed to?
A: There is no evidence that they did so, despite insinuations they might have done so by the Sanders campaign, including Bernie Sanders himself.
At the debate, Bernie Sanders suggested that his campaign data have been ended up with the Clinton campaign.
I am not convinced that information from our campaign may not have ended up in her campaign. Don’t know that.
This was a very disappointing and completely unsupported accusation by Bernie Sanders, and a poor attempt at making a false equivalency. When the vulnerability was discovered, NGP VAN checked to see which campaigns may have accessed other campaigns' data, and the Sanders campaign was the only one found to have done so. There is simply no evidence at all of the Clinton or O'Malley campaigns doing anything wrong-- it is an accusation made out of thin air.
Q: Is it plausible that the Sanders campaign was merely trying to figure out the extent of the vulnerability?
A: This is not believable.
The since-fired national data director for Sanders' campaign, Josh Uretsky, has said that he was not actually trying to gain strategic benefit from accessing Clinton's data-- that he was merely trying to assess the scope of the problem.
In fact, the audit logs show the behavior of someone far more interested in finding strategically useful data about Clinton's support in early voting states. From the AP report:
Summaries of data logs provided to the AP show the Sanders team spent nearly an hour in the database reviewing information on Clinton's high-priority voters and other data from nearly a dozen states, including first-to-vote Iowa, New Hampshire and South Carolina.
Some of these voter lists were saved into a folder named "Targets," according to the logs. Uretsky's deputy appeared to focus on pulling data on South Carolina and Iowa voters based on turnout and support — or lack of support — for Clinton.
It is extremely implausible to me that an honest attempt to determine the scope of the vulnerability would require creating lists of persuadable voters into a Targets folder, repeated access by multiple users, and the sharing of the results with others. At the very least, the behavior of the Sanders staffers mimics exactly what someone motivated by strategic gain would do.
Q: Was it in fact the Sanders campaign that told NGP VAN about the vulnerability?
A: No.
There have been numerous claims online that it was the Sanders campaign that notified NGP VAN of the software glitch, as a way of justifying Uretsky's claim that he was innocently trying to determine the nature of the problem. However, this is not the case. Media reports say that it was NGP VAN that discovered its own vulnerability. From the CNN report:
Uretsky and his team notified people within the Sanders campaign of the breach on Wednesday and the news worked its way up the chain of command. After reporting it to the campaign, Uretsky said he intended to call the DNC to inform officials there. But before he could do that, the DNC called him.
Q: Did the same issue crop up in October of this year?
A: No, not with NGP VAN. However, there was a problem with another, unrelated system.
While the relevance of this claim is unclear to me, except as a way of emphasizing the error-prone nature of NGP VAN, it is one that has been made repeatedly. However, Uretsky said the previous issue was with another system. (See 5:25 in the linked interview.)
Q: Did something similar happen in 2008?
A: No. This is another unsupported accusation against the Clinton campaign, with minimal evidence.
Sanders supporters have claimed that the Clinton campaign took data from the Obama campaign in 2008 as a way of impugning Clinton's integrity, and saying that the DNC has acted inconsistently. The primary source for this claim appears to be a secondhand claim from the Sanders campaign's lawsuit against the DNC, which says only that there may have been an unintended transmission of data to the Clinton campaign. This is a far cry from the deliberate access of strategically useful data that was clearly off-limits.
See my earlier post
http://www.democraticunderground.com/1251931208
for more details on this one.
Conclusion:
I'll let Atkins have the final word on this:
Still, the Sanders camp’s reactions have been laughable. It was their team that unethically breached Clinton’s data. It was their comms people who spoke falsely about what happened. The Sanders campaign wasn’t honeypotted into doing it—their people did it of their own accord. NGPVAN isn’t set up to benefit Clinton at Sanders’ expense—and if the violation by the campaigns had been reversed, Sanders supporters would have been claiming a conspiracy from sunrise to sundown. What’s very clear is that the Clinton camp did nothing wrong in any of this. Sanders campaign operatives did, and then Wasserman-Schultz compounded it by overreacting. And in the end, the right thing ended up happening: the lead staffer in question was fired, and the campaign got its data access back.
It’s also another reminder that armchair activists speculating about news stories would do well to actually get involved in campaign field activities. If you want to be involved in politics, there’s no substitute for actually doing the work to gain a real understanding of how and why campaigns and politicians behave as they do. There would be a lot fewer overwrought conspiracy theories, at the very least.
= new reply since forum marked as read
Sanders campaign staffers were wrong. No ifs, ands, or buts. Sanders is running a campaign of being an honest broker, a man of integrity, and a man of strong ethics and morals. This is damaging to all the above, and it's the reason his supporters are in panic mode trying to explain it away any which way they can.
It's not going to work.
and rec'd.
where he speculated or implied that the Clinton campaign had his voter lists, and that would be part of the audit into his campaign's scandal.
Seems like a typical grasping politician to me - welcome to the Major Leagues! 
I truly admire the way you are trying to prevent the continued smearing of both candidates and trying to let the independent audit continue.
I have let it go that way as well.
There is no sense in burning calories on something no one will truly ever know anything about until the audit is done.
We need to save our ammo for after that. 
Just kidding. 
Peace brother. Merry Christmas.
Hillary for Iowa @HillaryforIA Dec 19 Des Moines, IA
One word: presidential. #ImWithHer
