Bits Blog: Romney and Obama Campaigns Leaking Web Site Visitor Data

Some pages titles on Mitt Romney’s campaign site included a user’s name, giving third parties the opportunity to collect identifying data.

The presidential campaign sites BarackObama.com and MittRomney.com have recently ratcheted up their use of third-party Web trackers. These are companies, like ad networks and data brokers working on behalf of the campaigns, that collect information about users’ online activities to show political ads to people tailored to their own interests and beliefs.

Spokesmen for each campaign have separately said that their own campaign had put safeguards in place to protect that user data, as Charles Duhigg and I reported in an article published in The New York Times on Oct. 28.

But now a new study by Jonathan Mayer, a graduate student in computer science and law at Stanford University, reports that both sites are leaking information about site visitors to a number of third-party trackers operating on their pages.

Several pages on the Obama site included a user’s personal information in the page title at the top of the page or in the URL address, Mr. Mayer said, thereby giving third parties operating on the site the opportunity to collect identifying data. The information flowing to third parties, he said, variously included the username; the proper name under which a person registered; and their street address and ZIP code.

On the Romney site, Mr. Mayer said, he found that a number of pages included the user’s name in the page title. Many pages also included a unique numerical ID number in the URL, which flowed to third parties, he said.

“Are the campaigns identifying their supporters to third-party trackers? Are they directly undermining the anonymity properties that they are so quick to invoke?” Mr. Mayer wrote in a blog post published on Thursday morning. “Yes, they are.”

Several pages on President Obama’s campaign site include personal information, like a user’s home address, in the URL.

In an e-mail, Adam Fetcher, a spokesman for the Obama campaign, wrote that, regardless of the kinds of data that flows from the site to its third-party partners, the campaign does not allow those trackers to use the voter data collected on the site for any other clients or purposes.

“We do not provide any personal information to outside entities for their commercial use or for reasons other than what’s related to the work they do with us,” Mr. Fetcher wrote, “and we stipulate that third party partners not use data collected on the site for other purposes.”

A spokesman for the Romney campaign did not return an e-mail request seeking comment.

Mr. Mayer tested the Obama and Romney sites by registering as a user and examining the page codes and layouts that resulted as he visited the sites.

In registering for the Obama site with his e-mail address, for example, Mr. Mayer found that the site by default assigned him a username that was the first part of his e-mail address. On certain pages on the site, he reported, that username appeared in the URL, thereby sharing part of his e-mail address with ten tracking companies operating on the page. Because many consumers tend to use the same e-mail address or username on many sites, leaking such data could allow third parties to link other public accounts on the Web to individual users, Mr. Mayer said.

Meanwhile, after Mr. Mayer found that the Romney site leaked his member ID number in the URL, he logged out and then immediately tried to access his own information on the site using that ID number — a tactic a third party who collected that data could hypothetically use. When he used that ID number on the site without being logged in, the site showed a message that said “Access Denied.” At the same time, he said, the very same “access denied” page leaked more information on that page: the name under which he had registered.

I registered on both campaign sites on Wednesday night and had a similar experience.

The Obama site automatically assigned me a user name —nsinger — taken from my e-mail address that was visible in the URL on various pages. Using a tracker identification program called Ghostery, I found four different trackers that could collect that information.

On the Romney site, certain pages leaked the ID number I had been assigned in the URL. Other pages, I noted, leaked my ZIP code or state in the URL.

Advertising industry executives have long argued that third-party tracking is beneficial to online consumers because it helps brands show relevant digital ads. They also argue the data collection about online consumers is “anonymous” because the third parties do not collect identifying information like people’s names and home addresses.

But Mr. Mayer said his study, and previous research by other computer experts, indicated that many sites leak users’ personal information to third parties — challenging the claims about “anonymous” data.

“I think that for both campaigns this leakage is likely totally inadvertent,” Mr. Mayer said in a phone interview. “But claiming this tracking data is anonymous just ignores the reality.”

He also took a reporter to task for failing to sufficiently investigate the campaigns’ claims about their data protection practices.

“The Gray Lady also deserves a light rap on the knuckles for insufficiently scrutinizing the campaigns’ anonymity assertions,” Mr. Mayer wrote.

Point taken.

Campaigns Mine Personal Lives to Get Out Vote

In the weeks before Election Day, millions of voters will hear from callers with surprisingly detailed knowledge of their lives. These callers — friends of friends or long-lost work colleagues — will identify themselves as volunteers for the campaigns or independent political groups.

The callers will be guided by scripts and call lists compiled by people — or computers — with access to details like whether voters may have visited pornography Web sites, have homes in foreclosure, are more prone to drink Michelob Ultra than Corona or have gay friends or enjoy expensive vacations.

The callers are likely to ask detailed questions about how the voters plan to spend Election Day, according to professionals with both presidential campaigns. What time will they vote? What route will they drive to the polls? Simply asking such questions, experiments show, is likely to increase turnout.

After these conversations, when those targeted voters open their mailboxes or check their Facebook profiles, they may find that someone has divulged specifics about how frequently they and their neighbors have voted in the past. Calling out people for not voting, what experts term “public shaming,” can prod someone to cast a ballot.

Even as campaigns embrace this ability to know so much more about voters, they recognize the risks associated with intruding into the lives of people who have long expected that the privacy of the voting booth extends to their homes.

“You don’t want your analytical efforts to be obvious because voters get creeped out,” said a Romney campaign official who was not authorized to speak to a reporter. “A lot of what we’re doing is behind the scenes.”

In statements, both campaigns emphasized their dedication to voters’ privacy.

“We are committed to protecting individual privacy at every turn — adhering to industry best practices on privacy and going above and beyond what’s required by law,” said Adam Fetcher, an Obama campaign spokesman.

Ryan Williams, a spokesman for the Romney campaign, said: “The Romney campaign respects the privacy rights of all Americans. We are committed to ensuring that all of our voter outreach is governed by the highest ethical standards.”

In interviews, however, consultants to both campaigns said they had bought demographic data from companies that study details like voters’ shopping histories, gambling tendencies, interest in get-rich-quick schemes, dating preferences and financial problems. The campaigns themselves, according to campaign employees, have examined voters’ online exchanges and social networks to see what they care about and whom they know. They have also authorized tests to see if, say, a phone call from a distant cousin or a new friend would be more likely to prompt the urge to cast a ballot.

The campaigns have planted software known as cookies on voters’ computers to see if they frequent evangelical or erotic Web sites for clues to their moral perspectives. Voters who visit religious Web sites might be greeted with religion-friendly messages when they return to mittromney.com or barackobama.com. The campaigns’ consultants have run experiments to determine if embarrassing someone for not voting by sending letters to their neighbors or posting their voting histories online is effective.

“I’ve had half-a-dozen conversations with third parties who are wondering if this is the year to start shaming,” said one consultant who works closely with Democratic organizations. “Obama can’t do it. But the ‘super PACs’ are anonymous. They don’t have to put anything on the flier to let the voter know who to blame.”

While the campaigns say they do not buy data that they consider intrusive, the Democratic and Republican National Committees combined have spent at least $13 million this year on data acquisition and related services. The parties have paid companies like Acxiom, Experian or Equifax, which are currently subjects of Congressional scrutiny over privacy concerns.

Vendors affiliated with the presidential campaigns or the parties said in interviews that their businesses had bought data from Rapleaf or Intelius, companies that have been sued over alleged privacy or consumer protection violations.

Officials at both campaigns say the most insightful data remains the basics: a voter’s party affiliation, voting history, basic information like age and race, and preferences gleaned from one-on-one conversations with volunteers. But more subtle data mining has helped the Obama campaign learn that their supporters often eat at Red Lobster, shop at Burlington Coat Factory and listen to smooth jazz. Romney backers are more likely to drink Samuel Adams beer, eat at Olive Garden and watch college football.

Jo Craven McGinty contributed reporting.

Campaigns Use Social Media to Lure In Younger Voters

If the presidential campaigns of 2008 were dipping a toe into social media like Facebook and Twitter, their 2012 versions are well into the deep end. They are taking to fields of online battle that might seem obscure to the non-Internet-obsessed — sharing song playlists on Spotify, adding frosted pumpkin bread recipes to Pinterest and posting the candidates’ moments at home with the children on Instagram.

At stake, the campaigns say they believe, are votes from citizens, particularly younger ones, who may not watch television or read the paper but spend plenty of time on the social Web. The campaigns want to inject themselves into the conversation on services like Tumblr, where political dialogue often takes the form of remixed photos and quirky videos.

To remind Tumblr users about the first presidential debate on Wednesday, Mr. Obama’s team used an obscure clip of Lindsay Lohan saying “It’s October 3” in the comedy “Mean Girls.” And on Twitter, Mitt Romney’s bodyguard posted a picture of the candidate’s family playing Jenga before the debate.

The techniques may be relatively new, but they are based on some old-fashioned political principles, according to Zachary Moffatt, the digital director for the Romney campaign.

“The more people you talk to, the more likely you are to win,” said Mr. Moffatt, who oversees about 120 staff members and volunteers. “The more people who interact with Mitt, the more likely he is to win. Social extends and amplifies that.”

But as is the way of the Web, a well-intended post or picture on social networks can quickly morph into a disaster. And the slightest gaffe on the campaign trail can become a “Groundhog Day” moment, repeated endlessly.

“Even a typo is a big deal,” Mr. Moffatt said.

In July, when Mr. Obama told a crowd of supporters “You didn’t build that” while talking about the importance of public infrastructure, the Romney campaign pounced, uploading photos of hot-dog-joint owners and others displaying signs with variations on the slogan “I built this.”

And Clint Eastwood’s mock interview with the president at the Republican convention sent the Web into a frenzy. Within minutes, images of Mr. Eastwood on stage, plastered with cutting captions, hit Tumblr, and Twitter was flooded with parodies. Mr. Obama’s team joined in, sharing on Twitter a photo of him in a chair marked “The President,” with the caption, “This seat’s taken.”

That retort is in line with the overall social media presence of the Obama campaign, which tends to be sharper and more attitude-laden than the Republican efforts, particularly on Tumblr. The morning after the debate, the Obama Tumblr followed up on Mr. Romney’s reference to cutting financing for PBS by posting something that was circulating on Twitter: a picture of Big Bird from Sesame Street with the caption “Mitt Romney’s Plan to Cut the Deficit: Fire This Guy.” (Laura Olin, who previously worked at a digital strategy agency, helps lend a savvy tone to the campaign’s Tumblr efforts.)

Both camps tend to rely heavily on photos, slogans and the like that have been generated by their supporters. The Obama team, in particular, is fond of posting GIFs, or short looping video clips, that have been made by others. These might show the president high-fiving children or hugging his wife and daughters. Other clips poke fun at rivals or give knowing nods to hip television shows like “Parks and Recreation.”

At times the campaign’s freer-wheeling tone can get it into trouble: an image it shared on Tumblr that urged followers to “vote like your lady parts depend on it” drew criticism from conservative bloggers and others who thought it was in poor taste. The campaign quickly took down the image, saying it had not been properly vetted.

Those who keep up with the Obama campaign on Tumblr seem to approve of the approach — with some posts attracting close to 70,000 “notes,” or likes and reposts from users.

“It’s about authentic, two-way communication,” said Adam Fetcher, deputy press secretary for the Obama campaign. “Social media is a natural extension of our massive grass-roots organization.”

By comparison, the Romney campaign’s presence on Tumblr is more subdued, sticking largely to posterlike photos with slogans like “No, we can’t.” Its posts rarely get more than 400 responses.

Both campaigns have teams of Internet-adept staff members who try to coordinate their strategy and message across many social sites. They declined to specify how this works, saying they did not want to tip off the competition. But both rely heavily on Facebook and Twitter to solicit donations, blast out reminders of events and share articles and videos conveying their stances.

Flickr and Instagram serve as scrapbooks from the campaign trail, showing the candidates trying the pie at small-town restaurants. On Tumblr and Pinterest, the campaigns often highlight photos and other material from supporters.

As important as the campaigns say these efforts are, the candidates themselves are not actually doing the posting. But sometimes their wives are. While Mr. Romney has a campaign-run Pinterest board, his wife, Ann, has her own, showcasing her favorite crafts projects and books. When Michelle Obama posts a message on Twitter or shares an image on the campaign’s Pinterest board, her posts bear her initials — “mo” — so they stand out among those generated by campaign staff.

Twitter and Facebook are still the biggest avenues for online canvassing, with their broad demographic reach and user numbers that have grown tenfold from four years ago. It may be hard to fathom what posting video clips or music playlists on less mainstream sites has to do with the election. Does it really matter to voters if Mr. Obama has Stevie Wonder on his list, while Mr. Romney prefers Johnny Cash?

Though the returns on such efforts are not easily quantifiable, neither party is taking any chances.

“What’s the return on putting your pants on in the morning? We don’t know,” said Jan Rezab, the chief executive of Socialbakers, a social media analytics firm. “But we just know it’s bad if you don’t do it.”

Coye Cheshire, an associate professor at the School of Information at the University of California at Berkeley, pointed to another motivation for such seemingly trivial online updates.

“It is important for people to know whether or not a huge political figure shares the same taste as me,” said Dr. Cheshire, who studies behavior and trust online. “And creating a playlist on Spotify is part of what makes them seem more human.”