The Register Citizen (Torrington, CT)
Americans’ voter data must be kept safe
If sensitive data is to be collected by the government, it must ensure the data is not stolen by hackers.
The Trump administration’s Presidential Advisory Commission on Election Integrity is asking states for voter-registration data from as far back as 2006. This would include names, dates of birth, voting histories, party registrations and the last four digits of voters’ Social Security numbers. The request has engendered controversy, to put it mildly, including refusals by many states and a caustic presidential tweet.
But whatever the political, legal and constitutional issues raised by this data request, one issue has barely been part of the public discussion: national security. If this sensitive data is to be collected and aggregated by the federal government, then the administration should honor its own recent cybersecurity executive order and ensure that the data is not stolen by hackers or insiders.
We know that voting information has been the target of hackers. News reports indicate that election-related systems in as many as 39 states were penetrated, focusing on campaign finance, registration and even personal data of the type being sought by the election integrity commission. Ironically, although many of these individual databases are vulnerable, there is some protection in the fact that U.S. voting systems are distributed among thousands of jurisdictions. As data-security experts will tell you, widespread distribution of individual data elements in multiple separate repositories is one way to reduce the vulnerability of the overall database.
That’s why the commission’s call to assemble all this voter data in federal hands raises the question: What is the plan to protect it? We know that a database of personal information from all voting Americans would be attractive not only to adversaries seeking to affect voting but to criminals who could use the identifying information as a wedge into identity theft. We also know that foreign intelligence agencies seek large databases on Americans for intelligence and counterintelligence purposes. That is why the theft of more than 20 million personnel files from the U.S. Office of Personnel Management and the hacking of more than half a billion Yahoo accounts were such troubling incidents.
Congress and the states need to be advised on how any data would be housed and where. Would it be encrypted? Who would have administrative access to the data, and what restrictions would be placed on its use? Would those granted access be subject to security background investigations, and would their behavior be supervised to prevent the kind of insider theft that we saw with Edward Snowden or others who have released or sold sensitive data? What kinds of audit procedures would be in place? Finally, can the security risk of assembling so much tempting data in one place be mitigated by reducing and anonymizing the individual voter information being sought?
In May, President Donald Trump signed the executive order on cybersecurity to instill tough security in federal offices that handle critical government data. That order is a commendable initiative to hold officials accountable for safeguarding sensitive personal information, such as voter information. The president’s election integrity commission should live up to the president’s own directive. Courtesy of The Washington Post. Chertoff was U.S. homeland security secretary from 2005 to 2009.