CEC head Michael You apologizes for national ID leak

The head of the Central Election Commission (CEC) on Thursday apologized after the national ID numbers of more than 1,500 candidates running for office, including those of top politicians, were reportedly exposed on its Web site for 11 days.

“This kind of thing should not have happened,” CEC Chairman Michael You (游盈隆) said during a news conference, blaming the lapse on “negligent” handling by a third-party contractor.

The issue came to light on Wednesday, when an alliance of smaller political parties said the ID numbers of 1,573 candidates running for mayor, commissioner or councilor in the Nov. 28 local elections had been publicly accessible on a CEC financial disclosures database.

Central Election Commission Chairman Michael You, left, bows in apology at a news conference in Taipei on Thursday.

Photo: Chang Chia-ming, Taipei Times

The alliance, known as Taiwan Go Go, consists of the New Power Party (NPP), the Taiwan Obasang Political Equality Party, the Taiwan Statebuilding Party and the Green Party Taiwan.

NPP Chairwoman Claire Wang (王婉諭) said that while compiling a “civil society version” of the official election bulletin, her team accessed the candidate asset declaration Web site made public by the CEC on Oct. 16.

On Tuesday, her team found that, although the site’s public-facing interface displayed only basic personal information, using a browser’s built-in developer tools (such as by pressing the F12 key) freely allowed people to retrieve data such as national ID numbers, she said.

The CEC on Wednesday said an external contractor had inadvertently exposed the ID numbers, but that the text in the files was “scrambled” and “indecipherable” to the general public.

Wang in a post on Facebook wrote that the “scrambled” text was due to “character encoding” settings, which could be rendered into Chinese characters using a browser’s developer tools.

Moreover, national ID numbers are composed of English letters and numbers, and were not scrambled in the files, she said.

You on Thursday said the CEC was notified of the leak on Tuesday evening and fixed the issue within two hours.

So far, the evidence points toward the exposure being an inadvertent oversight by an external contractor, Acer E-Enabling Service Business, which is owned by Acer Inc, he said.

You said his first reaction upon hearing of the leak was that it was “unbelievable” and “unacceptable.”

He acknowledged the “unease” it had caused among candidates and the public, and, along with the other CEC officials present, bowed in apology for the lapse.

Asked if the data leak would affect preparations for elections next month, You said it would not.

Only 32 IP addresses visited the CEC financial disclosures database during the 11 days the sensitive data was accessible, none of which were from overseas, he said.

As for whether the personal data had been copied by those who accessed it, You said the CEC could not be sure, as that information would only be on those users’ computers.

Asked if the commission would seek compensation from the contractor, CEC ethics office head Huang Shang-hsiang (黃尚香) said it would do so following an investigation and in accordance with their contract.

After two days of deliberation on the issue and ways to prevent any recurrence, You said his provisional solution was to “strictly implement the four-eyes principle.”

When the government outsources or commissions a project, the work should be checked by another team, and then verified again by the government itself, he said.