A massive database containing the personal information of a staggering 191 million Americans has been discovered online, although no one quite knows how it got there or where it came from.

Discovered by security researcher Chris Vickery, the database appears to be a list compiled on people who vote and includes the voter’s full name (first, middle, last), their home address, mailing address, a unique voter ID, state voter ID, gender, date of birth, date of registration, phone number, a yes/no field for if the number is on the national do-not-call list, political affiliation, and a detailed voting history since 2000.

In addition, the database contains fields for voter prediction scores, that is a score on whether a person is likely to vote and who they are likely to vote for.

Vickery himself found that his own personal details were in the database, writing:

“I needed to know if this was real, so I quickly located the Texas records and ran a search for my own name. I was outraged at the result. Sitting right in front of my eyes, in a strange, random database I had found on the Internet, were details that could lead anyone straight to me. How could someone with 191 million such records be so careless?”

The veracity of the database was subsequently confirmed by Steve Ragan at Salted Hash, who like Vickery can’t ascertain who compiled the data to begin with, but believes it was likely compiled by a “major voting data company” who on-sells the data to political campaigns, lobby groups and Political Action Committees (PACs).

Disclosure

While much of the data available in the database is available on the public record, some states restrict access to this data for not-for-profit purposes and/or whether it can be publicly available, such as in South Dakota where voter registration data obtained from the statewide voter registration database “may not be used or sold for any commercial purpose and may not be placed for unrestricted access on the Internet.”

Perhaps even more disturbingly, the data contains otherwise restricted personal information, such as in the case of a police officer named Sam, who told DataBreaches.net that to protect his family and his own safety neither his phone number or address is publicly available.

“Oh man. … I deal with criminals every day who know my name,” Sam said. “The thought of some vindictive criminal being able to go to this site and get my address makes me uncomfortable.  I’m also annoyed that people can get my voting record. Whether I vote Republican or Democratic should be my private business.”

The fact the data actually exists is of no great surprise here: many companies exist to compile this information for their use in areas such as political campaigning and commercial marketing, but the ability to access those very same, sometimes confidential records for free online is a different matter.

Given the data is online perhaps shouldn’t raise questions so much around security of the said data, but whether it is even ethical to gather that amount of data to begin with.

Image credit: rikkis_refuge/Flickr/CC by 2.0