Personal data routinely leaked from Obama and Romney websites

Mitt Romney (R) and Barack Obama (AFP Photo / Michael Reynolds)

Both the Barack Obama and Mitt Romney campaigns swear that their websites don’t collect personally identifiable information from visitors, but a new report reveals that neither candidate can really back that claim up.

Responding to the New York Times for an article published just this week, representatives from both presidential contenders say no private information that could reveal their website visitors’ identity is offered to third-parties, with the paper even reporting, “both campaigns emphasize that such data collection is ‘anonymous’” since companies use code numbers — not names — to track site visitors. Jonathan Mayer of the Stanford Center for Internet Society didn’t seem convinced, though, and took it upon himself to investigate the truth.

“The Times coverage piqued my curiosity,” Mayer writes on his blog at WebPolicy.org. “Are the campaigns identifying their supporters to third-party trackers? Are they directly undermining the anonymity properties that they are so quick to invoke?”

The answer, says Mayer, is a resounding yes. He says he tested the websites of both Pres. Obama and Gov. Romney against a methodology he developed previously to examine personally identifiable information that could be disclosed, and according to him both candidate’s campaigns are guilty of leaking sensitive data to third-parties, despite claims made to the Times.

“The campaigns are wrong,” Mayer writes. “Tracking data is very often identified or identifiable…Even a little identifying information leakage thoroughly undermines the privacy properties of web tracking: once a user’s identity leaks to a tracker, all of the tracker’s past, present, and future data about the user becomes identifiable.”

Although the campaigns are largely correct by saying data collected off their sites are never directly linked to a specific person, the alleged anonymity that they swear by hardly protects any identities. While the data is tied to a code number in lieu of a name, the data that is collected could easily be used to find out almost anything about a visitor of the site, Mayer writes.

Through his researcher, Mayer found that usernames entered on the official campaign site of Barack Obama was leaked to ten different companies. And while those user names might not necessarily single out a person, it often can.

“A username is often personally identifying.It might simply be a user’s name, or it could enable linking other public accounts and information about the user,” he writes. Additionally, Mayer claims that the sites are guilty of security flaws that let street addresses, zip codes and even parts of email addresses get leaked to third-parties.

“The major presidential campaigns both fell short of best practices in their website design and testing, and they both misrepresented their privacy practices to the Times,” he writes. “My hope is that this episode serves as a learning opportunity and a reminder: there is no such thing as anonymous web tracking.”