Illegal Data Release Massachusetts

[Broc]

I'm not thrilled about this data being released, but now that the cat is out of the bag there is no putting it back. To get a better understanding of the data and make it more searchable, I deployed it to a data exploration tool. (Link deleted)

Nice phishing attempt.

Reported.

 

[Broc]

WTF are you talking about? I literally just spent the last few hours putting this all together. No good deed goes unpunished. I reported your post.

Report this one and f*ck off.

 

[Optimator]

will a boomer who clicked on the link tell us what malware got installed as a result?

 

[Broc]

The link goes to a Google Cloud application that is hosting a Datasette (phishing) repo of the Firearms Data i loaded into a sqlite database. The URL is janky because I didn't want to spend my own money on something free that I thought people would find useful. Glad I spent a few hours of my time to get a bunch of boomers accusing me of phishing.

Reported.

 

[Reptile]

I'm not thrilled about this data being released, but now that the cat is out of the bag there is no putting it back. To get a better understanding of the data and make it more searchable, I deployed it to a data exploration tool.

This website is awesome that you made.

How do I search by license number? Or the designated number?

 

[headednorth]

For the love of God, will someone please tell me if I should click on that link or not? (please dont report me)

 

[OMM 0000]

and everyone ragged on me when I said move this thread to the Members area

 

[Reptile]

The license number is the dealer license number (I think), not yours. I initially thought they were publishing our FID/LTC numbers but that doesn't appear to be the case. You can drill down by selecting "LICENSE_NUMBER" then a value.

View attachment 722425

How do I find my own transactions?

 

[Reptile]

One of the reasons I built this was to see if it was possible to correlate transactions to individuals and it does not appear to be possible. You can drill down by zip-code and find transactions by date/make/model that you already know about BUT there is no ID that you could use to group them or tie them back to a specific person, which is a good thing.

You need to find the original data sets that were released first.

Those have ID's.

Now, that would be a fun database!

 

[spt_1955]

Great!

Even fewer people will register their AR builds.

FYI. You should look at the records. You may be surprised AS I WAS to find that MA FFL's may actually be filing EFA-10's with the state and your UNBUILT AR LOWERS that were sold to you on a 4473 as "other" are already registered to you as AR's. Although in my case apparently the dealer was confused as to what to put for barrel length on an unbuilt lower so it is listed as a pistol.

 

[Reptile]

If anyone would like to share them, I will add them. If they came from mass.gov site it is public information.

Lots of NES folks saved the files.

You might be signing your own death warrant though if you post them!

LOL.

 

[Reptile]

I just noticed Archive.org has a snapshot of the page when it was first released on 2022/1/11 (Data about firearms licensing and transactions). The CSV files from that date are in the archive as well and they don't seem to contain any ID's.

If that was the original data set - there is an ID.

It's not the LTC number.

It's a code number.

If you go to your town and look up your expiration day - your Birthday and the year of your expired LTC - it will show you that code number ID.

Once you have that code number ID you can search for all transactions from personal or dealer that have that ID.

Any gun not found - the gov doesn't know you have!

EDIT:

I just downloaded and analyzed the data from Archive.org.

The application sets (there are 2) have a ID code.

I just looked up my ID on there.

It was there.

I had 2 dealer transactions.


You can't put the toothpaste back into the tube.

This data is out there forever.

The Archive.org data is unredacted.

EDIT #2:

The more recent dealer sale file has the serial numbers.

 

[Reptile]

I found publicly available archive that contains the `BUYER PERSON ID` column which does allow one to group transactions to an entity. That is absolutely horrifying from a data privacy perspective and I'm not going to take this any further. Without divulging any more info, it would be fairly trivial to de-anonymize this data set with a minimal amount of code. WTF.

Well that is very nice of you.

The cat is out of the bag though.

All anyone needs to do is load the file into Excel and use the search tool to look things up.

A skilled person can also find folks with large collections and rob them.

I can't even rob myself efficiently as all my guns are buried in the ground in 4 states.

Anyone breaking into my apartment will find that I'm a garbage hoarder and that my place is one giant mess...

An anti-gunner could do just what you did to include the ID's.

That may actually help our cause because nobody would trust the state and register anymore. They'll never find all those unregistered AR's now!

 

[namedpipes]

For the love of God, will someone please tell me if I should click on that link or not? (please dont report me)

No. He's a troll at best.

 

[JoseyWales]

Just 2 more weeks ... until we find out what happens to the State workers who released this information.

 

[Optimator]

Well, you may not be a troll, but with how often forums are spammed with malicious links by new users, it's generally risky to click through. Remember: you have 8 posts, all in this thread, with a February join date.

I don't know when you started using the internet, but I believe a good number of folks were either traumatized or turned on by being maliciously sent shock sites like 2g1c or lem0nparty. If you're a relative newcomer, my apologies. Lem0nparty was a shock site that showed a few elderly men succin each other off. Come to think of it that's exactly what this website is, but I digress.

 

[whatluck]

@nimalto if you know basic database admin stuff you should also know what a risky click is. next time please just release your code. we do appreciate it and we're really happy to have another person on NES who'se into technology. you're just new, and NES due to recent raids by the AGs office and Globe is (probably unfairly) biased against new members. Just engage with these haters in a manner consistent with common internet decorum.

ETA maura is a prolapsed cow anus with alien teeth

 

[ThePreBanMan]

Where can I download the data. OP didn’t include the linky.

NM, found the archive page.

Wow, they are missing quite a few of my personal transactions and a few of my dealer transactions.

 

[namedpipes]

Why are you reporting me? I built a tool to run queries on the dataset released by the MA Firearms records bureau because I found inaccurate information on this thread regarding what fields were present in the dataset.

Screenshot of the application. These are tables from the CSV files.

I think it's because you're an a**h***.

 

[Admin]

Why am I a troll at best? I built a search interface for the data set that some members found useful. Who or what am I trolling?

You literally created an account just to post in this thread and show everyone how you're drilling down in to the data. Now you're upset that people are questioning your intent?

This clearly can't be your first time on the internet. This is a firearms forum with tens of thousands of gun owners on it, what the F did you think the reaction was going to be?

 

[OMM 0000]

Maybe it’s obvious, but you can search for someone’s name and town on Google/DDgo and 14 public record sites come up with their birthday. From there it’s easy to filter the applications list. Women, forget about it. Small town easy. Boston or large town you get a a few dozen hits so not as trivial.

Of course the public record sites also include address, so it’s nice and easy to rob them.

—

Why are you reporting me? I built a tool to run queries on the dataset released by the MA Firearms records bureau because I found inaccurate information on this thread regarding what fields were present in the dataset.

Screenshot of the application. These are tables from the CSV files.

I think it's because you're an a**h***.

I love the fact you built an SQL app and are hosting it, bravo. Fun project and great skills to have and share. But I would have never done it with a data set that the 20 page thread debates is doxing gun owner on a board with a bunch of boomer luddites.

 

[Admin]

This website is awesome that you made.

How do I search by license number? Or the designated number?

 

[Admin]

I love the fact you built an SQL app and are hosting it, bravo. Fun project and great skills to have and share. But I would have never done it with a data set that the 20 page thread debates is doxing gun owner on a board with a bunch of boomer luddites.

Lets not forget he created an account just to post it in this thread.

 

[namedpipes]

Lets not forget he created an account just to post it in this thread.

It almost suggests he doesn't want to be doxed himself, just doesn't mind doxing others.

 

[Picton]

How do I find my own transactions?

Look in your safe?

 

[Reptile]

Look in your safe?

99% is buried.

 

[Yosemite Sam]

you can’t put the toothpaste back in the tube..

 

[Mesatchornug]

you can’t put the toothpaste back in the tube..

 

[Optimator]

My question is, can nimalo reduce the computational brute force needed to crack the coded LTC IDs by a phishing exercise like this? Not by default, but certainly it could be an endpoint. The catalyzing information could easily be divulged by dumbass boomers. While I rarely wear a tinfoil hat, there's literally no reason to volunteer information to a zero post newcomer. It's just bad policy..

 

[EddieZoom]

Maybe it’s obvious, but you can search for someone’s name and town on Google/DDgo and 14 public record sites come up with their birthday. From there it’s easy to filter the applications list. Women, forget about it. Small town easy. Boston or large town you get a a few dozen hits so not as trivial.

Of course the public record sites also include address, so it’s nice and easy to rob them.

—


I love the fact you built an SQL app and are hosting it, bravo. Fun project and great skills to have and share. But I would have never done it with a data set that the 20 page thread debates is doxing gun owner on a board with a bunch of boomer luddites.

We really are our own worst enemy....