Requested voter details may be gold for cybercriminals
When Kris Kobach of the Presidential Advisory Commission on Election Integrity sent out a letter last week asking all 50 states to provide the federal government with detailed information on every voter in the nation in hopes of combatting election fraud, experts say he may have unwittingly opened a new gate for the bad actors of the cyberworld.
By calling for states to provide the names, addresses, birthdays, partial Social Security numbers, driver’s license numbers and other personal information for the more than 200 million people who have been registered to vote since 2006, Kobach could be setting up a one-stop shop of personal information that would be a treasure trove not only for shady online entrepreneurs, but also for identity thieves and criminal hackers.
“If you’re a hacker, if you’re
Vladimir Putin, if you’re someone trying to disrupt elections, now instead of having to break into 50 databases, you have to get into just one,” said Jesse Melgar, a spokesman for California Secretary of State Alex Padilla. “It’s a hacker’s dream and a cybersecurity nightmare.”
California has refused to turn over any voter information. Kobach has stated that 14 states and the District of Columbia are refusing to turn over the information.
In his letter released June 29, Kobach, who is the secretary of state in Kansas, said the commission was looking only for public information from the states.
“Whatever a person on the street can walk in and get, that’s what we would like,” Kobach, the commission’s vice chairman, told CNN’s Anderson Cooper last Friday.
But even basic information like a voter’s name, address and date of birth “is going to be enough to cause problems,” said Matt Bishop, a computer science professor at UC Davis and co-director of the university’s computer security laboratory.
“If hackers want a whole lot of information on a whole lot of people so they can sell it, this is it,” he added. “The federal government is doing most of their job for them.”
Kobach said that the information would be used “to fully analyze vulnerabilities and issues related to voter registration and voting.” President Trump put together the commission after complaining that millions of illegal votes cost him a popular vote victory in November, a view seconded by Kobach.
The one-size-fits-all letter takes an all-encompassing view of what may be considered public, asking for such clearly private information as the last four digits of voters’ Social Security numbers, which not one state so far has agreed to provide.
“It seems unbelievable that anyone would ask for this information,” said Natalie Tennant of the Brennan Center of Justice at New York University School of Law. “Everyone knows you don’t give out your Social Security number, so why insult state officials by asking?”
Kobach has said that even his own state, Kansas, isn’t allowed to provide those Social Security numbers.
It’s not just identity thieves who would be looking for even partial Social Security numbers, Bishop said.
“How many companies confirm your identity by using the last four digits of your Social Security number?” he asked. “If that ever becomes public, people can use that information to impersonate you to your phone company and other groups and do things to mess up your life.”
That public information — and the rules for who gets it and how it may be used — vary widely among the states. California, for example, provides a voter’s name, address, gender, party identification and which elections they have voted in. But that information typically can be used only for political or academic purposes, Melgar said.
“If someone came in off the street and asked for the information, we’d ask why they wanted it,” he added. “And we don’t provide anyone with a Social Security number, driver’s license number, criminal history or date of birth.”
Public Data is a California company that collects voter information from the state, combines it with other publicly available demographic statistics and then sells that information to about 900 different customers, including political campaigns, universities and grassroots organizers. But the company has to follow the state’s rules governing the data, which include no business use.
“If a group of Realtors came by and said they wanted that information to help sell homes, we’d send them away,” said Paul Mitchell, vice president of Public Data.
California and other states are concerned that Kobach plans to use the information from the states to put together national rules making it easier to bar people from voting. A nationwide voter database could open the way to more challenges for people looking to register, which could keep eligible voters from casting ballots, said Tennant, who was West Virginia’s secretary of state from 2009 to 2017.
What also worries election officials is Kobach’s promise that “any documents that are submitted to the full commission will also be made available to the public,” although he said in a new letter Wednesday that those “documents” would not include the raw voting lists, which the commission would “de-identify,” or detach a voter’s identity from the data, before releasing them publicly.
That still leaves problems, though, because the government would continue to store the complete voting lists, Bishop said.
“If they’re not going to make it all public, how do they store it?” he asked. “The federal government doesn’t have a great record of protecting its data.”
If the full voter data the commission has asked for did get out, either by public release or by hacking, Bishop said, “calling that a disaster would be like saying the Titanic bumped into something.”
Access to the most sensitive information that states are being asked to provide would be found money for the bad guys and grifters of the cyberworld.
“A combination of Social Security numbers and dates of birth, along with full names and addresses, could be used to peel apart likely passwords” and other online information by identity thieves, said Mitchell of Public Data.
Those concerns have been enough to persuade many voting officials to move cautiously when it comes to complying with Kobach’s data request.
California is standing by its refusal to provide Kobach and his committee with any voter information, and there doesn’t seem to be anything the federal government can do about it.
“As it stands now, the letter is a request,” said Melgar of the secretary of state’s office. “It’s not a mandate. It’s not a subpoena. And we don’t feel comfortable about providing any information when there’s no statement about what it’s going to be used for.”
“Everyone knows you don’t give out your Social Security number, so why insult state officials by asking?” Natalie Tennant, New York University School of Law