A guide for the anxious technological illiterate

It’s all wrong! Now even the people who run Fayerwayer are getting lost about what happened, judging by what they’ve been saying on radio and television.

To keep the ideas from scattering and mistakes from being made, I’m going to list a few points I think you should be clear on, so you don’t end up losing your marbles and go from technological illiterates to digital ignoramuses. ;)

1. People are talking about a hack of government sites. That is not what happened! What happened is that a commenter posted some addresses from which the data of several million Chileans could be downloaded.
2. Many lawyers and “experts” say the worst that can happen is that people get more spam and unsolicited ads, or get bothered with phone calls at inconvenient hours. The truth is that the information from DEMRE (the office that runs the university admission test) includes socioeconomic data.
3. A few years ago a gang of thieves used a similar list to classify their victims.
4. The leaked information is enough to put together a fake digital identity, even to forge contracts, obtain certificates, and so on.
5. A while ago the people at seguridad informática published a proof of concept of what can be done with this kind of lost information. I suggest you look at it (the example obtains the data of President Bachelet’s daughter).
6. The database of SERVEL, the electoral service, can be bought, but it is so widely distributed that it isn’t worth buying; it’s easy to get on IRC or on some warez site. There are many databases that have been circulating for years! I’ve seen databases containing checking account numbers, and even the passwords for bank websites. Some time ago a database of Transbank customers leaked; fortunately it seems only one person got access to that information.
7. They say this isn’t serious because the information is public. Gentlemen, your address, your phone number, even your RUT (the national ID number) is private data! The law isn’t clear about this, but why should just anyone get to know my phone number or where I live? The fact that you can access people’s information through services like DICOM (the credit bureau) or others doesn’t mean that’s right!
8. NO, Microsoft has nothing to do with this case.

The digital Chernobyl

In November 2007 a disc with data on 25 million British citizens was lost. It’s something similar to what happened here: besides personal data, the information included social benefit records for 7 million families (the DEMRE information is of a similar nature).

Kim Cameron, one of the world’s leading experts on digital identity, called it a Digital Chernobyl.

According to Kim, we live in an age in which security has to be designed from the lowest levels up. At the very least, information like this should be encrypted. It’s like putting all the dynamite in the center of town, assuming that a well-thought-out procedure will keep those explosives from being set off! The problem is systemic!

All of Cameron’s reflections on the British case apply to our own national reality.
The terrible part is that in Chile you can get almost the same kind of information as in the British case, and legally.

It’s enough to make you anxious, but they say the innocent and the ignorant are the only ones who can always sleep soundly.