Black Hat USA 2025 | Use and Abuse of Personal Information -- Politics Edition

Why It Matters

The experiment shows that political campaigns harvest and weaponize personal data at massive scale, wasting voter attention and exposing constituents to fraud, prompting calls for tighter privacy regulations and more responsible outreach practices.

Key Takeaways

• Researchers created 1,400 fake voter IDs to test political outreach.
• Democrats sent roughly double the email volume compared to Republicans.
• Over half of voicemails received were unrelated scams, not political.
• Email content focused on self‑promotion, not policy or donor issues.
• Analyzing all emails would require up to 100 hours per campaign.

Summary

The Black Hat USA 2025 presentation revealed a five‑year research project that generated 1,400 realistic fake voter identities to probe how political campaigns collect and use personal data during the 2024 election cycle. By automating sign‑ups for newsletters and phone lines, the team captured every email, voicemail and call sent to these synthetic constituents, exposing the scale and mechanics of political outreach. Key findings show a stark partisan imbalance: Democratic candidates sent nearly twice as many emails as Republicans, with the top sender, President Biden, averaging 10.2 messages per day. In contrast, the phone‑based experiment yielded 34,000 calls and 7,000 voicemails, yet only 203 were genuinely political; over half were unrelated scams exploiting the recycled numbers. The content analysis demonstrated that campaigns largely broadcast self‑referential messaging, with word clouds dominated by candidate names and generic terms like NATO, while policy‑specific or donor‑related language was scarce. Notable data points include the timing spikes aligned with primary results and debates, the labor‑intensive process of handling each fake identity in two to three minutes, and the discovery that reading all campaign emails would demand up to 100 hours for a single office. The researchers also highlighted the vulnerability of phone numbers to spam, urging simple validation mechanisms to eliminate 99 % of unwanted calls. The study underscores how political entities treat personal information as a low‑cost advertising asset, often without meaningful engagement from recipients. It raises urgent questions about data privacy, the ethical limits of automated outreach, and the need for stronger safeguards to prevent both political misuse and opportunistic scams.

Original Description

Over the past 5 years, we have employed active open-source intelligence (OSINT) techniques to test the question of how our personal information is used, shared, or otherwise abused. To do this, we created an automated collection framework with realistic fake identities used in one-time online transactions and then passively collect email, voicemail, and SMS responses from that event.

The key highlight of this talk are the results from 2000+ fake identities signed up to the declared political candidates for the 2024 U.S. elections (U.S. House and Senate pre-primary candidates as of ~Oct 2023; presidential candidates added as announced), tracing how information was used (e.g., numbers and patterns of email, comparison of "hot" races to "in the bag" ones, geographical responses, sentiment analysis) or shared (e.g., routine sharing and overnight/unified shift in Democratic party support of Harris after Biden withdrawal). Additional trends are demonstrated for attempting to predict the outcomes of races based upon their messaging behaviors, coordinated intra-party responses to events, the post-election and post-inauguration phases, the lack of direct mailings, and other fun anecdotes like having one of our fake IDs traced back to us via IP inspection. We will strive to keep the discussion apolitical, as the focus is more about the data/trends and what our expectations should be for our personal privacy when providing our information to political candidates.

As this talk builds on a prior Black Hat USA 2021 talk, we'll also discuss automation techniques for active OSINT frameworks and preliminary results for a fully integrated "interaction engine" that enables generative AI email responses with machine generated personalities, based on the "Big-5" psychometric factors.

By:

Alan Michaels | Northrop Grumman Sr. Faculty Fellow / Professor and Director, Spectrum Dominance, Virginia Tech National Security Institute

Jared Byers | Research Associate, Virginia Tech National Security Institute

Full Presentation Materials Available at:

https://blackhat.com/us-25/briefings/schedule/?#use-and-abuse-of-personal-information----politics-edition-45529