ID NUMBERS: Taiwan Go Go said a financial disclosure Web site exposed personal data of 1,573 candidates, but the CEC said that the data were not easy to access
- By Hsu Yung-ching and Lin Yuan-che / Staff reporters
A candidate data disclosure Web site was temporarily taken offline on Tuesday to execute a security patch and a formal investigation is under way to determine the cause of a leak, the Central Election Commission (CEC) said yesterday after an alliance of small parties said that the national ID numbers of 1,573 candidates had been exposed.
The ID numbers of candidates — including those of Taipei Mayor Chiang Wan-an (蔣萬安) of the Chinese Nationalist Party (KMT) and his main rival, Democratic Progressive Party Legislator Puma Shen (沈伯洋) — were exposed on Oct. 16 when the CEC published financial disclosure data of mayoral and councilor candidates in the Nov. 28 local elections, members of the Taiwan Go Go alliance said.
The alliance is a coalition of the New Power Party, the Taiwan Obasang Political Equality Party, the Green Party Taiwan and the Taiwan Statebuilding Party.
Members of the Taiwan Go Go political alliance hold placards at a news conference outside the Legislative Yuan in Taipei yesterday.Photo: CNA
New Power Party Taipei City councilor candidate Hsieh Min-hung (謝閔弘) said that when people visited the CEC’s financial disclosure Web site, the personal data of 1,573 candidates — including their ID numbers — were automatically transmitted to the computers of the visitors to the site.
The personal data were accessible to the public for 11 days before the alliance notified the CEC of the issue, when the data were removed, Hsieh said.
However, it is uncertain how many times the information was downloaded, he said.
Taiwan Statebuilding Party Taipei City councilor candidate Wu Hsin-tai (吳欣岱) said that if a candidate’s national ID number is combined with their name, birthdate, electoral district and other data, it would leave them vulnerable to identity theft and scams.
Wu linked the risk of scammers using personal data to the public’s right to know whether candidates have criminal records.
“Election regulations do not require candidates to disclose any criminal records they have, while the government has potentially exposed their national ID numbers,” she said.
The government has once again failed to notify the people who were affected, similar to a 2022 breach in which 23 million household registration records were uploaded to forums by hackers, she said.
Taiwan Obasang Political Equality Party Taipei City councilor candidate Lee Hui-hsuan (李惠暄) said that the CEC’s failure to redact national ID numbers from the candidates’ data might be in contravention of Article 16 of the Personal Data Protection Act (個人資料保護法).
Green Party Taiwan New Taipei City councilor candidate Kan Chung-wei (甘崇緯) said that the alliance calls on the government to take immediate action.
It should look into who is responsible for the data being exposed, conduct comprehensive cybersecurity checks across all government Web sites and establish strict guidelines to prevent similar errors in the future, Kan said.
The CEC later yesterday said it took the site offline to run checks and patch the system on Tuesday.
The portal was restored at 7pm after data exposure risks were mitigated, while the incident was reported to the authorities, it said.
The financial disclosure data released on Oct. 16 for mayoral and councilor candidates were uploaded as PDFs with sensitive personal data redacted, it said.
Downloading the files would not have revealed candidates’ national ID numbers, it added.
The site’s default view and query parameters did not display national ID numbers, meaning that a typical visitor to the portal would not have accessed them, it said.
A preliminary inquiry found that the issue was due to a contractor inadvertently including national ID numbers in files not intended for public viewing during data generation, the commission said, adding that the numbers were stored as garbled text strings, making them unreadable to the general public.
A formal investigation is under way to determine the root cause and full scope of the error, it said, adding that further action would be in line with the act.