Free Lectures" 1,573 pieces of personal information leaked, systemic loopholes in government information security management

As the nine-in-one election entered its countdown, a personal information leak occurred in the property declaration system of the Central Election Committee candidates. The ID card numbers of 1,573 candidates were exposed, and 32 IPs entered the system to download information. This incident not only exposed candidates’ personal information to risks, but also highlighted the shortcomings of the government’s information security management system.

The Central Election Commission leaked the personal information of 1,573 candidates for county and city chiefs and parliamentarians. Representative You Yinglong, chairman of the Central Election Commission, bowed and apologized. The picture shows You Yinglong. (File photo)

Faced with doubts from the outside world, the chairman of the election committee publicly bowed and apologized, and attributed the incident to the unintentional negligence of the outsourced manufacturer's engineers. However, if the government outsources its information systems, can it also outsource its information security responsibilities?

Candidates' property declaration information involves important personal information. From system design, program development to official launch, there should be a rigorous information security inspection mechanism. If even the basic ID card number can be disclosed, the problem may not only be the negligence of the individual engineer, but also reflect the government's loopholes in outsourced supervision and information security management.

In addition, although the Selection Committee has learned that 32 IPs have entered the system to download data, it has not yet been able to confirm the source and subsequent flow of the data. Just because no actual damage has occurred yet does not mean that the risk does not exist. Leakage of personal information may lead to fraud, impersonation and social engineering attacks. The government should also clarify the scope of the breach, the number of downloads and whether it has been distributed, and proactively notify those affected, rather than just stating that the damage has not been discovered yet.

A leak of personal information from the candidate's property declaration system occurred during the election conference. What this incident really deserves to be reviewed is whether the government has sufficient supervision and management capabilities. The picture shows the voting situation. (File photo)

The winning committee proposed to adopt the "Four Eyes Principle" in the future to repeatedly check the program and system security through different personnel. The direction is worthy of recognition, but the system reform cannot only stop at remedial measures after the fact. The government should establish a complete outsourced asset security management mechanism and clearly establish a system of responsibility attribution and accountability.

Elections are an important cornerstone of the democratic system. The Central Election Commission is responsible not only for the execution of election affairs, but also for maintaining the people's trust in the electoral system. What really deserves review in this incident is not just what mistakes the manufacturer made, but whether the government has sufficient supervision and management capabilities.

Only by facing up to the system's shortcomings, implementing accountability and proposing specific reforms can similar incidents be avoided from happening again.

(The author is a student)