Letter indicates attempted extortion of board exec

Scheme involved ‘flirtatious’ messages, demand for $3,000 from election official

Illinois’ top elections official told board members he became the victim of an internet extortion scheme after he exchanged “flirtatious” messages and sent a picture to a person he met online.

Steven Sandvoss, who is on administrative leave until his resignation takes effect at the end of June, detailed his encounters in a letter to the State Board of Elections in which he said a threat was made to “ruin” him if he didn’t pay $3,000.

Sandvoss said he did not make any payments and the online threats stopped, according to the letter, which the Tribune obtained.

Sandvoss, 55, the board’s executive director, has had high-level federal security clearance following a Russian hacking incident in the 2016 election cycle that compromised personal data of 76,000 Illinois voters.

Sandvoss told board members that “at no time did I indicate (to the person online) that I worked” for the elections board.

Sandvoss initially was placed on paid administrative leave for two weeks as a precaution given the sensitivity to his ranking position at the agency, but few specifics had been given about the incident. He is paid $162,000 a year.

A retirement agreement Sandvoss signed indicated he will remain on administrative leave through June 30 unless the board votes to restore him to active duty. His previous employment agreement would have allowed him to work a year longer, according to the document released Thursday.

Some board members were annoyed that Sandvoss put himself in that position, particularly by sending a picture of himself, according to a source familiar with the situation.

An elections board official told the Tribune that Sandvoss had no comment.

Board spokesman Matt Dietrich said he could vouch that Sandvoss made a report to the board, but could not comment about the two-page, single-spaced narrative because he had not seen it.

In the letter, Sandvoss explained the extortion threat came from a person using a female name after he started conversing with her Saturday, March 27.

By the following Monday, she sent a picture, though Sandvoss didn’t know if it was really her, the letter said. She asked for a picture of Sandvoss, and he sent one, he wrote.

“We continued to engage in more conversation, which started to become a little flirtatious,” Sandvoss wrote, noting she referred to him as “babe” and said she wanted to “get together, etc.”

Sandvoss indicated he became uncomfortable with how the conversation progressed and he blocked her connections to him on the social media sites they used to communicate: Words With Friends, a Scrabble-type game, and then Google Hangout, where they chatted and sent pictures.

At that point, he received an email message saying that she would post a nude picture depicting him, though he said he’d never sent one, along with a damaging narrative that she claimed would “ruin me,” he wrote.

He said he unblocked her “to see if it was something to be worried about.”

He soon received a message that, “if I wanted to ‘get out of this mess,’ ” he would have to buy a card that people use to play internet games that comes with a cash value of $3,000, Sandvoss wrote.

Sandvoss said his response was: “No deal.”

When she repeated the threats, Sandvoss refused again, saying, “I will never yield to blackmail,” his letter said.

Sandvoss said he told the person he would post a Facebook message telling people he was the “victim of an extortion attempt and to disregard and not believe” any damaging accusations. Sandvoss also told the person he was going to the police.

“I received no further communication from her and to my knowledge the screenshot was never posted,” Sandvoss wrote.

Once he posted a note on Facebook, Sandvoss received a call from an elections board staffer, who suggested he alert board officials and the Illinois State Police because “this extortion attempt could be considered a cybersecurity situation.” He said he met with FBI and state police officials, who also examined his phone.

In putting him on paid administrative leave April 5, the board released a statement saying Sandvoss reported the extortion attempt to state police and that, based on his description, it “appeared typical of many such online scams.”

The board said it put Sandvoss on leave “out of an abundance of caution” because he had access to various board of elections security systems.

An internal investigation found no data or systems had been compromised in the incident. State police officials could not be reached on Thursday but have said the incident remains under investigation.