Give send go freedom convoy 2022

[1/3] People carry canoe paddles with Canadian flags, as truckers and supporters continue to protest the coronavirus disease (COVID-19) vaccine mandates, in Ottawa, Ontario, Canada, February 14, 2022. REUTERS/Lars Hagberg/File Photo

WASHINGTON/TORONTO, Feb 15 (Reuters) - The leak website Distributed Denial of Secrets on Tuesday said it has posted more donor files from the fundraising platform GiveSendGo relating to the Canadian movement of people opposed to pandemic health measures, including COVID-19 vaccine mandates.

On Sunday, the DDoS website, which is devoted to disseminating leaked data, said it was releasing donor information relating to the "Freedom Convoy 2022" campaign, which raised more than $2 million in donations. It includes funds raised from several Canadian business owners.

Tuesday's leak contains donor information about a similar “Adopt-a-Trucker” campaign, which says it is operating “in partnership with the Freedom Convoy." The Adopt-a-Trucker effort appeared to raise less money and involved fewer donors.

The funding of the Canadian protests has emerged as a key point of interest as authorities in Ottawa and elsewhere try to get a grip on rallies led by truckers since late January that have blockaded cities and border crossings across Canada with demands that include deposing Prime Minister Justin Trudeau. read more

GiveSendGo did not immediately respond to a request for comment about any hack or the status of its campaigns.

The Sunday data from the U.S.-based Christian fundraising site included names, email addresses, ZIP codes and internet protocol addresses. Tuesday's leak offered similar material in addition to payment details, based on a review of the data.

The new GiveSendGo data also came from a "hack" according to DDoS, which did not provide further information. The Adopt-a-Trucker campaign has pulled in nearly $600,000, according to GiveSendGo.

DDoS said that because the donor information contained sensitive personal information, it would not be making the data available publicly but would instead be offering it to journalists and researchers.

DDoS describes itself as a nonprofit devoted to enabling the free transmission of data in the public interest.

GiveSendGo became a prime conduit for money to the protesters after mainstream crowdfunding platform GoFundMe blocked donations to the self-declared Freedom Convoy. Earlier this month the group said it had raised $8 million for the protests.

The Ontario government obtained an injunction last week freezing GiveSendGo's "Freedom Convoy 2022" and "Adopt-A-Trucker" campaign funds. L1N2UL3GW GiveSendGo said at the time it was not subject to Canadian law and continued to fundraise.

Brad Howland, president of EasyKleen Pressure Systems Ltd, which is headquartered in New Brunswick and manufactures high-pressure cleaning systems, donated $75,000 to GiveSendGo's "Freedom Convoy" on Feb. 9, according to leaked information confirmed by Reuters.

In a statement sent by a company spokesperson, Howland confirmed his support for the convoy, saying he wants the government to remove mandates "to restore all our freedoms."

"We drove to Ottawa this weekend and witnessed the protest for ourselves," the statement reads in part. "They have a beautiful, legal, peaceful protest that overwhelmed us with emotion. To see the love, peace, and unity that many of us

have longed for, for a long time – It was an experience of a lifetime."

Holden Rhodes, a London, Ontario-based lawyer and mountain resort owner, confirmed in an email to Reuters that he and his wife donated $25,000 to the Freedom Convoy. It was the among the highest value donations from Canada.

"Without freedom, we have nothing. ... That is why I am doing what I am doing," said Rhodes, adding Ontario's decision on Monday to remove proof-of-vaccination requirements and other restrictions early is proof the movement has succeeded. read more

Reporting by Christopher Bing in Washington, Anna Mehler Paperney in Toronto and Julie Gordon in Ottawa; Writing by Chris Sanders; Editing by Franklin Paul, Jonathan Oatis and Marguerita Choy

Our Standards: The Thomson Reuters Trust Principles.

Christopher Bing

Thomson Reuters

Award-winning reporter covering the intersection between technology and national security with a focus on how the evolving cybersecurity landscape affects government and business.

Anna Mehler Paperny

Thomson Reuters

Toronto-based correspondent covering among other topics migration and health.

The donation site used by truckers in Ottawa who are currently protesting against national vaccine mandates has fixed a security lapse that exposed passports and driver licenses of donors.

The Boston, Massachusetts-based donation service GiveSendGo became the primary donation service for the so-called “Freedom Convoy” last week after GoFundMe froze millions of dollars in donations, citing police reports of violence and harassment in the city.

The protest, which began in January, saw thousands of protesters and truckers descend on Canada’s capital to oppose mandatory COVID-19 vaccinations, paralyzing the streets with snarling traffic. A fundraising page on GoFundMe reached about $7.9 million in donations before the crowdsourcing giant stepped in to block the campaign, prompting the fundraising effort to move to GiveSendGo, which publicly declared its support for the protest. According to a press release, GiveSendGo said it had processed more than $4.5 million in donations for the Freedom Convoy protesters during its first day of the company hosting the campaign.

TechCrunch was tipped off to the data lapse after a person working in the security space found an exposed Amazon-hosted S3 bucket containing over 50 gigabytes of files, including passports and driver licenses that were collected during the donation process.

The researcher said they found the web address for the exposed bucket by viewing the source code of the Freedom Convoy’s webpage on GiveSendGo.

S3 buckets are used for storing files, documents or even entire websites in Amazon’s cloud but are set to private by default, and require a multi-step process before a bucket’s contents can be made public for anyone to access.

The exposed bucket had over a thousand photos and scans of passports and driver licenses uploaded since February 4, when the Freedom Convoy’s page was first set up on GiveSendGo. The filenames suggest that the identity documents were uploaded during the payments process, which some financial institutions require before they can process a person’s payment or donation.

TechCrunch contacted GiveSendGo co-founder Jacob Wells with details of the exposed bucket on Tuesday. The bucket was secured a short time later, but Wells did not respond to our questions, including if GiveSendGo planned on informing about the security lapse those whose information was exposed.

It’s not known for exactly how long the bucket was left exposed, but a text file left behind by an unnamed security researcher, dated September 2018, warned that the bucket was “not properly configured” which can have “dangerous security implications.”

Read more:

  • U.K. Foreign Office calls in ‘urgent support’ after cyber incident
  • Flaws in third-party software exposed dozens of Teslas to remote access
  • Locations and contact data on 515,000 vulnerable people stolen in Red Cross data breach