– A True ‘Murkin

This release of information is not the only bad part, as it seems the parties involved with the Wikileaks disclosure actually protected the cardholder’s full credit card number. Coleman’s campaign actively violated Payment Card Industry Data Security Standards (PCI DSS) by storing the full card number and expiration date unencrypted, which isn’t permitted. Even worse, they stored the security code on the back of the card, and storage isn’t permitted in any case, for any reason, with or without encryption.

This is complicated by the political nature of the information. Donors who gave an amount small enough to avoid being reported in campaign financial reporting documents will now find that their full name, address, employer, occupation and credit card information has been published by the campaign they donated to!

This is a disgusting example of poor security, and blame needs to lie with the Coleman campaign and their web developers. Blame further lies with the Coleman campaign and their media operations for not notifying their donors that their information had been published. I say published, because the information wasn’t breached, stolen, or otherwise hacked. It was PUBLISHED and DISTRIBUTED via the Coleman website. No “federal authorities” are going to look at firewall logs when the Coleman campaign actively disclosed their own database, so who do you think should be the parties the “federal authorities” investigate? Hopefully they’ll investigate the Coleman campaign itself.

Certainly, if someone were to use the card numbers or actively distribute the card numbers, it would be a illegal and unethical. But at this point, Wikileaks and their source didn’t release full card numbers. Who knows what will happen next in that regard? If “federal authorities” found that nobody had accessed the database, which was again openly published on the Coleman website, how did Wikileaks get an Excel spreadsheet of every single web donation?

Coleman Campaign Manager Cullen Sheehan writes in a press release that there is a “…strong likelihood that these individuals have found a way to
breach private and confidential information.” Well, generally there’s MORE than a “strong likelihood” when the campaign PUBLISHES the said private and confidential information on their website!

So, what’s next? The Coleman campaign needs to admit fault, and tell donors that there’s not a “likelihood” of a breach, but that it actually happened, and that they are at fault. They need to stop blaming “hackers,” and start blaming their web developers.

I further call for the Minnesota Attorney General’s office and state authorities to investigate this matter and charge the Coleman campaign for violations of Minnesota Statute §325E.61, specifically relating to their disclosure of personal information and neglect to notify donors, or more accurately, lie about the reasons behind the disclosure.