Delegate info breach

[Susan Hogarth]

Thanks to Tim Hagan for bringing this to my attention. 

Delegate lists - including addresses in many cases - were published for conventions going back to at least 2004, on the LPedia wiki. 

This information is freely available to Party members who request it, but it is not intended for publication of this sort. I contacted a member of the HPC, who shared my concern and is pursuing correction. 

--

Susan Hogarth
919-906-2106
Region 5 Representative

[Susan Hogarth]

Members of the HPC assert that the information is public so doesn’t need to be removed. 

I honestly don’t know. Delegate names and state they are serving as a delegate for, perhaps. But publicly posting the addresses seems a bit much.  I’m not sure why we require membership status checks to release that very information if we’re posting it on the web. 

Any thoughts on this?

Susan Hogarth

[Richard Longstreth]

I think it inappropriate to dox hundreds of members every year as they serve an important national duty. To me there is a clear compromise that makes a lot of sense and protects privacy:

List the names and states of each delegate publicly. That's it. No phone numbers, email addresses, or physical addresses. That information should never be public. Even where our rules say a member can request the delegate list, personal information should always be protected information and not made public in any way. I'm glad I've moved after being a delegate for each of the last several conventions and am appalled at how this party, on a party resource, has doxxed hundreds of volunteers.

I'm prepared to write or sponsor a motion to instruct the HPC to remove the private information if they will not do it voluntarily.

Richard Longstreth
At Large Representative
Libertarian National Committee
richard.l...@lp.org
931.538.9300

Sent from my Mobile Device

[Laura Ebke]

I agree with Mr. Longstreth, and would co-sponsor that motion if it isn't addressed. those addresses and phone numbers and emails can easily be redacted.

Laura Ebke, PhD
LNC At-Large

Former NE State Senator
laura...@lp.org
Cell: 402-540-6510

[Ken Moellman]

Names and states makes sense.  Even members aren't entitled to phone numbers or email addresses.  There should be a requirement to sign an NDA in order to receive any PII about any person.  Protecting PII is a legal obligation, and therefore overrides our bylaws on the matter.

Ken Moellman

Libertarian National Committee

Vice Chair

[Susan Hogarth]

The HPC Chair emailed that this is on their agenda for Wednesday and likely the addresses will be removed from the lists. 

Susan

On Fri, Oct 15, 2021 at 12:22 AM Susan Hogarth <susan....@lp.org> wrote:

[Susan Hogarth]

For confidential list disclosure: a link to these lists from lpedia was posted to the confidential list (presumably to not draw attention to the info on this public list). 

No emails or phone, only addresses. 

Susan

On Fri, Oct 15, 2021 at 12:22 AM Susan Hogarth <susan....@lp.org> wrote:

[TJ Ferreira]

Thanks Susan, I was just coming out here to mention the same.

I provided a link and attachment to the LNC members on the internal list to provide further information about what data is currently available on the LPedia wiki and what data I was not able to find as I saw the discussion in this chain was making reference to emails and phone numbers which I was unable to find. While the data I found is currently posted on a public site and therefore it is technically no longer private data, I did not want to further propagate the exposure of that data by making the location part of a public email chain.

In Liberty,

Tim "TJ" Ferreira

LNC Region 4 Alternate Representative

[Richard Longstreth]

Thank you both for clarifying the phone number and email but. I had not been to LPedia to review myself and was more.concerned about any personal data. I am glad it is only addresses. Having this data exposed now, I would like the HPC chair to consider temporarily taking the doxxing info down now as an interim step, since we have publicly discussed it and anyone that is curious now knows it exists, rather than waiting another 5 days.

Richard Longstreth
At Large Representative
Libertarian National Committee
richard.l...@lp.org
931.538.9300

Sent from my Mobile Device

[Richard Longstreth]

Ms Harlos, chair of the Historical Preservation Committee, has confirmed to myself and several others that all lists have been pulled from LPedia at this time.

Richard Longstreth
At Large Representative
Libertarian National Committee
richard.l...@lp.org
931.538.9300

Sent from my Mobile Device

[Erin Adams]

I want to know if the CiviCRM NDA was violated.

Erin Adams region 7 Representative

[Richard Longstreth]

I would like to know that also and would like us to write policy or issue guidance to put guardrails in place to ensure nothing like this happens again.

We also need to let membership know of the possible exposure after consulting with Oliver.

Richard Longstreth
At Large Representative
Libertarian National Committee
richard.l...@lp.org
931.538.9300

Sent from my Mobile Device

[Ken Moellman]

From what I've put together quickly (not a lot of investigation), it looks like this is a case of legacy actions being continued forward without modernization.  PII is relatively new as compared to our long-standing practices, so we could apply NDA provisions to all-the-things and go from there.  This has caused a discussion within the bylaws committee as well (as some on here know) so I do think we can and will address this for the long-term. Good stuff for the long-term. In the short-term, legal requirements around PII override our bylaws as written (per RONR), so we likely need to get input from Oliver Hall on that front.

Ken Moellman

Libertarian National Committee

Vice Chair

[Whitney Bilyeu]

Oliver has been made aware.

Whitney Bilyeu
LNC | Chair
LP.org