Data breach: NGP VAN "played no part in the October data issue that has been mentioned"

[pnwmom]

That statement is from NGP VAN's website.

Has anyone heard what other system was involved?

http://blog.ngpvan.com/data-security-and-privacy

For clarification, NGP VAN played no part in the October data issue that has been mentioned.

SNIP

Second, there has been independent confirmation that NGP VAN has not received previous notice of a data breach regarding NGP VAN. Josh Uretsky, the former National Data Director for the Sanders campaign confirmed on MSNBC (at 5:47), and also on CNN, regarding the previous incident: “it wasn’t actually within the VAN VoteBuilder system, it was another system.”

[hobbit709]

1. Here we go again.

[pnwmom]

2. If there is an answer, will you please tell me?

[hobbit709]

3. Would you listen any more than you haven't before?

[pnwmom]

4. if you actually provide an answer. Apparently there isn't one. n/t

[IllinoisBirdWatcher]

5. Another NGP SUB-system???

NGP advertises and provides a total turn-key "system" to campaigns.

In his public apology, the NGP CEO very carefully said "another system" and NOT "another vendor's system."

Campaigns use NGP for donor prospects, donor files, FEC compliance, broadcast email, website hosting, volunteer tracking and more. Most of these sub-systems, like The VAN, were developed by other third-parties and "integrated" to some degree in the NGP total campaign solution.

So if one or more sub-systems of the NGP provided software went down in October, it is most likely that the first staffer to notice and report would say something more like "NGP is down" or "NGP is acting weird" rather than saying "Gee, I'm getting too much information from the highly positive list in NH. There must be a bug in The VAN voter file."

No one seems to deny there was an NGP software problem in October. Where and what that problem was still remains a mystery. Still many questions to answer.

[pnwmom]

6. And was it a system owned by Bernie or by the DNC? This seems unclear, too.

[madfloridian]

8. From 2014...about Catalist and others who relay info to and from NGP VAN

This mentions other companies involved in the databases used by the DNC.

http://www.epolitics.com/2014/08/21/ngp-van-opens-door-for-a-democratic-community-of-innovation/

From August 2014

Last night, NGP VAN moved Democratic political technology into a new phase — one of solidarity and maturity. Long criticized for having somewhat of a monopoly in the space, potentially hampering innovation, NGP VAN’s Next event instead rather proved that there’s still plenty of new ground to be broken. In a space where showcase events like this have often heralded the mundane (or worse yet, vaporware), NGP VAN announced some exciting new products and projects.

Let’s dive into the deeper implications of some of what they announced:
Upgraded Product Suite

The most tangible of their announcements were the least interesting (to me, anyway). A new version of VAN, and a new version of NGP, both products made to look and feel more like each other — definitely a positive step since it’s been 3 years since the companies merged. However, because of the extensive field training people have on both products, NGP VAN is constrained as to how much they can modify the actual user experience and workflow. Expect that to change, but slowly and deliberately.
Innovation Platform

The truly innovative stuff came in the form of the appropriately-named Innovation Platform. They’ve put a lot of work into overhauling their infrastructure, and Relay and Pipeline are the result. Relay efficiently matches data across NGP VAN’s various products, while Pipeline creates a realtime data sync to several of the most-used analytics services — namely Blue Labs, Civis, Clarity, and Catalist. These changes might seem small, but they’re technically challenging, and they’re critically important to the data and analytics folks on campaigns. It was also nice to see NGP VAN unifying logins under ActionID and taking the next step on portability with embeddable forms (what they’re calling ActionTag).
APIs: Opportunities for Grassroots Creativity

But to me, that was all either must-haves or behind-the-scenes work. What got me excited was the announcement of NGP VAN’s partnership with the DNC to make all of this open via a set of APIs (available at http://developers.democrats.org). In conjunction with the ProgressUI library — a set of interface patterns, reusable code snippets, styles, and art — these APIs have the potential to turn every field office into the country into an app-building shop. Got a great idea for how to use your field data? Now you can build the app! If you’ve ever worked in a campaign office, you know how many great ideas pop up and then disappear with a dismissive “it would be great if VAN did that.” Well, now you and your developers can build the app yourselves.

[Hiraeth]

12. ^^^ thanks for this, madfloridian ^^^

[IllinoisBirdWatcher]

17. Yes, all sorts of sub-systems and third-parties

Thanks for posting this. Everything described in your 2014 article is clear and describes the evolution of NGP as I understand it.

and I guess I misspoke. Rather than call NGP VAN a "turn-key system" I guess they want to be an "Upgraded Product Suite" to make their individual sub-systems "look and feel more like each other..."

So in NGP's development of "either must-haves or behind-the-scenes" enhancements, does the donor file sub-system (and the required FEC reports) interact behind-the-scenes with the voter file? The volunteer file? The target email lists?

NGP says The VAN (containing the voter file in question) was not compromised in October. But they don't deny they were made aware of a data failure in October. The question remains as to what "system," either integrated or stand-alone actually did fail in October. Was it a part of the Upgraded Product Suite? If so, which part and did it have any integration with the voter file?

[ViseGrip]

16. If it was not them in October as Bernie was paying for, who the hell was it?

[madfloridian]

7. Catalist also has been connected with the DNC...

May still be.

Don't know the status now.

I did some searching on it, but all I get is from right wing websites. I believe it was started or led by Harold Ickes.

[ljm2002]

9. Ultimately, though, the onus is on the DNC...

...to take proper care of campaign data, no matter what company they hire to do it or what database is used.

So that doesn't let them off the hook.

[pnwmom]

11. Assuming this wasn't part of a Bernie Sanders system. nt

[ljm2002]

13. If it had been "part of a Sanders system"...

...then it is unlikely they would have (a) complained about a data breach in October, and (b) referred to the incident when this latest breach occurred.

Next?

[pnwmom]

14. Weavers said that the data breach was done by a "low level staffer."

So I don't trust any excuses he makes at this point.

[ljm2002]

15. My comments have nothing to do with trust...

...just common sense logic.

TTFN

[pnwmom]

18. Based on what facts? All we have from Weaver and Briggs are insinuations

with no evidence.

They are basically saying that since they took advantage of the breach, then others must have too. Yet they haven't shown one iota of evidence, much less proof.

[sufrommich]

10. That's why the Sanders campaign used weasel words when describing the

October data breach. As I said before,it would be very easy for them to provide proof of their warning if it had actually happened.

[madfloridian]

19. You need to read this. It's not just NGP VAN involved....

http://www.democraticunderground.com/?com=view_post&forum=1251&pid=957580