Voters cry data breach after calls, WhatsApp messages from campaigners

Editor's Note: This article has been updated to include messages sent by Pakatan Harapan.

GE15 | Already hounded by phishing scams and marketing spam, mobile phone users are now met with a different kind of nuisance during this general election period.

Since the campaign period kicked off on Nov 5, voters have received calls or messages via WhatsApp from political party campaigners, prompting questions on personal data protection.

On social media, voters have shared screenshots of WhatsApp messages they received from campaigners urging them to vote.

The messages contain details, including their polling centre and identity card numbers.

Some of these details are accessible to political parties through the electoral roll, however, it is not clear how the campaigners could access voters' telephone numbers.

To date, those who complained said they received messages from BN, Pakatan Harapan and Perikatan Nasional.

Voters are terrified, angry

The practice of sending handbills containing a voter's name and that of their polling station has been a feature in general elections for decades now.

Political party branches do so as a form of service to the constituents, so they need not have to take their own initiative to check where they have to vote.

The handbills are often dropped off in mailboxes, with the political party's logo attached.

While this bid to provide convenience to the voter may be appreciated in the pre-internet age, such information is now easily obtained by voters through the Election Commission website.

A social media user who goes by the Twitter handle @anamarysha told Malaysiakini she was "terrified" to receive such a "reminder to vote".

"I’m so curious (about how they have access) and yet terrified by the fact that they could get our own personal mobile numbers, which are not in the electoral roll," she said.

On Nov 7, she posted a screenshot of a message she received, ostensibly from a BN campaigner giving her "a first reminder" to go out to vote.

"We want to inform you of where you are voting," the campaigner told her when she asked why they had sent her a photograph of a handbill with her voter details.

The photograph of the handbill which the campaigner sent to her via WhatsApp also included the Johor voter's address and identity card number.

Text messages appearing like they're from EC

Malaysiakini also sighted similar messages received by voters from other parties, including one sent to a Terengganu voter by a PAS campaigner.

"I was so angry about this. How can they easily have my data like that?" one voter said when sharing a screenshot of the message she received.

A Kedah voter told Malaysiakini she received a text message with the header "InfoPRU" (Election Information), informing her that she is a voter and to check her details at a link provided.

The website not only showed her personal details and voter information, but it also told her to vote for the PN candidate.

"I sincerely thought (the text message) was a reminder from the EC. Who knew it was a reminder from PN to vote for them?

"This is so wrong. They used our personal data to get our electoral info, and then get it texted to our phone number," the voter said.

Malaysiakini's checks found the InfoPRU website redirects to PN's website. The EC had previously used the tag "Info PRU" for its GE14 information packages.

Other voters who received the physical handbills, expressed unhappiness over the decades-old practice.

Some said the bills were not placed in secure mailboxes and had scattered in the wind, exposing their identity card numbers to strangers.

On Cista, the mobile application created by PKR-linked company Invoke, volunteers are recruited for campaigning via phone calls.

This includes one campaign for the Simpang Renggam and Layang-Layang constituencies.

"This campaign is to approach voters through phone calls to identify supporters and increase votes.

"By joining this activity as a volunteer, you will be given a list of on-the-fence voters to contact," the campaign description reads.

Malaysiakini has also sighted WhatsApp messages sent by Harapan campaigners to voters in Kuala Selangor and Shah Alam.

The message to a Kuala Selangor voter identified the recipient as a first-time voter, while the message sent to the Shah Alam constituent identified the voter by name.

The Personal Data Protection Act 2010 covers the processing of personal data in regard to commercial transactions, but it does not cover data collected by political parties for the purposes of campaigning.

It also doesn't cover the collection of personal information by the government.

Party workers accessing government data

It was earlier reported that BN had access to personal data collected by the government and had used it in the 2018 general election.

This includes data provided by Bantuan Rakyat 1Malaysia (BR1M) cash aid recipients and data from district education offices and the People's Volunteer Corps (Rela).

"A leader from Umno (said) the party used personal data acquired from government agencies to convince individuals to re-elect BN by reminding them exactly how much government aid they received under the then-ruling party," the research report commissioned by German organisation Tactical Tech states.

Since the PDPA was passed in 2010, there have been multiple serious data breaches involving both commercial and government databases.

In 2017, the personal details of 46.3 million mobile phone users, including their identity card numbers, were leaked from a telecommunications company database.

In April, millions of records from Putrajaya's MyIdentity database were sold on a hacker forum for US$10,000.

Part of that data dump were 800,000 pictures of voters and their MyKad from the EC's MySPR Daftar website.

The EC said it is working with the National Cyber Security Agency to investigate the matter.

DAY 10 | PN supporters attend ceramah despite downpour

Personal data: Potential gold mine for hackers, says experts

Govt has lead on alleged civil servant e-payslip data theft

April data leak makes rounds again, with EC breach in focus

TI-M wants progress report of data leak probe