Netanyahu's Party Exposed Personal Details, Political Affiliation of Millions of Israelis

Party database, which was shut down after Haaretz query, allowed completely unsecured access to private info including phone and ID numbers ■ All parties in Israel have access to voter rolls, but are required by law to protect the information

Israeli Prime Minister Benjamin Netanyahu voting on Election Day, April 9, 2019
Emil Salman

Who supports Likud? Anyone could have found that out until Sunday afternoon, using the party’s database, which contained information about four million Israelis that appears in the country's voter registration rolls.

The party blocked access to the website just 20 minutes after Haaretz called on Sunday to inquire why these data were accessible to the public and where Likud got the information about support (or lack thereof) for the party.

Haaretz Weekly Ep. 39Haaretz

For each and every person in the registry, the Likud database provided a full name, address, mobile phone number, ID number – and the individual's stance vis-à-vis Likud: for, against or undecided.

In the Likud database, about half a million Israelis were classified as not supporting the party, about 600,000 were deemed supporters and 80,000 were undecided.

Screen capture of Likud's voter database
Screenshot of s.b20

Likud refused to answer Haaretz’s queries as to how information related to support of the party was obtained. The manner in which it was presented suggested that it was based on actual questioning of people – whether by phone polls or face to face.

Even if people supplied the information voluntarily, they probably did not realize it would be made accessible on the web, not only to party insiders but to anybody at all.

The database was not complete: 1.9 million Israelis were categorized as “no answer”; 420,000 were never contacted and 400,000 refused to answer. Most of the public personalities we looked up on the site, before it was blocked, were in those uncertain categories.

While a simple online search wouldn’t have revealed the existence of the database, it wasn’t difficult to find. Last week Likud disseminated instructions for its representatives at polling stations on Election Day. The instructions included a video explaining how to utilize an online application that Likud developed, through which its representatives could update the details of every voter who arrived to cast a ballot.

The video contained an internet link, and clicking on it led to a partial database. A search for the sub-domain led to the entire database – to which the party blocked public access just 20 minutes after Haaretz called to ask about it.

Screen capture of Likud's voter database
Screenshot of s.b20

All political parties in Israel have access to the voter rolls, but they are supposed to protect the information in compliance with strict privacy regulations.

It is not clear how long the information in the Likud database was available to the public.

The multiple ironies of this situation include the fact that Prime Minister Benjamin Netanyahu continually stresses the need for cybersecurity to guard against Israel's enemies and that during the last election campaign (ahead of the April election), he harped on the ostensible hacking of the phone of rival Benny Gantz, head of Kahol Lavan – which the prime minister claimed indicated a lack of responsibility.

The names of members of the Netanyahu family appeared in the party database, with ID numbers and addresses, but for some reason there was no mention of their support, nonsupport or uncertainty regarding Likud. Nor were their phone numbers published, other than that of the prime minister’s cellphone, which was noted as being “disconnected.”

“They [Likud] don’t know how to secure their digital assets, and this is a flagrant violation of the privacy protection law,” said Tehilla Shwartz Altshuler, a senior fellow at the Israel Democracy Institute.

“Anybody maintaining a database of this sort is subject to the obligation to keep such information safe. This shows tremendous digital ignorance about how they protect the information they have about voters. A database that's available online constitute fantastic raw material for any country that seeks to influence our elections,” she added.

Even irrespective of elections, mobile phone numbers are worth their weight in gold to various entities. Theoretically, such data can be abused to unearth even more private information about people. Also, even barring potential abuse of the information, a person could regret revealing their opinion of Likud as it could theoretically affect their chances of getting a job in local government.

In response, Likud stated: “The information you have published constitutes an illegal break-in to the Likud’s activity. The issue has been handled at the level of data security. We will complain to the police.”

The Justice Ministry responded, for its part, that the Privacy Protection Authority does not confirm examinations or investigations it carries out, and it cannot confirm or deny any of the details regarding the particular issue at stake.

“However, without relating to the specific instance," it added, "the voter registry rolls provided to the parties by the Interior Ministry for use during elections contains sensitive personal information derived from the population registry. Under Article 17 of the privacy protection law, the parties are also responsible for security of the information they possess.”