a google drive link to every voter in Ghana

"TF is this!?"

I scrolled faster, hoping I'd get to the end, but the list just kept on going. I clicked around the directory, folders upon folders of…

That's when I understood the gravity of the situation. I was staring at the Ghana 2020 voters register: full names, ages, districts.

"Oh God!…Millions in here!"

And this wasn't even from a data breach or anything. Some government official(s) from the Electoral Commission thought it was a great idea to post a Google Drive link to this zip file…on Facebook! ^[1]

I started texting my friends—anyone who worked or had links to the government—about what I was looking at, how severe, and weird it was that no one seemed to notice the issue in the comments.

The post was scrubbed the next day. I take it someone finally noticed. Too late if you ask me^[2], chances are this unintentional dataset is still sitting in some data broker's collection by now.

I don't think they were trying to be malicious by posting the link online. Usually, people go to their nearest polling station to register to vote. And later, the Electoral Commission prints reels of paper with the list of registered voters at each station for people to verify they're on it.

That time around, it was in the thickets of the covid pandemic. They probably thought that posting online was an 'ultramodern'^[3] way for people to verify without causing more crowding outside (the lockdown wasn't exactly airtight).

The only problem is that checking is usually done at the community scale. But they posted not just one community centre's list but all of them, across the country, in one public Google Drive directory. By aggregating all that data and sharing it on Facebook, they put 11 million citizens at risk^[4].

There's a reason voter verification was decentralised. You can't just copy-paste techniques that worked locally at scale without acknowledging the trade-offs ^[5].