On Aug. 31, the Illinois state Board of Elections put out a disquieting statement.
Staff became aware of a breach to their Voter Registration System database over a month and a half prior in which approximately 700 voter records were viewed and up to 86,000 others were “strongly suspected to have been viewed.”
The breach exposed voters’ names, addresses and dates of birth at the least. Phone numbers, email addresses, drivers license numbers and the last four digits of Social Security numbers could also have been viewed.
“The cyber-intrusion was a complex attack, involving thousands of lines of encoded inquiries,” the release read.
Illinois wasn’t alone — hackers also struck Arizona, with news organizations reporting that Russia was suspected.
The implications of a foreign cyberattack on the voter registration systems are disturbing, and the scope of the violation feels vast. But even if these web portals that act as gateways to personal information are strengthened against sophisticated attacks, does that make them safe?
In the state of Washington, the answer is: Not very.
Almost every state has an online web portal that allows voters to check whether or not they are registered to vote. Some go further, providing voters the opportunity to check the rest of their voter information for accuracy.
And why not? People expect to be able to keep records and fill out applications online. Certainly finding out if a ballot will arrive at the correct address is critical in a vote-by-mail state like Washington.
“It’s not required under law in Washington state,” said Stuart Holmes, a spokesperson for the Secretary of State’s office, adding that it is, however, expected by voters. “If that information wasn’t available out there, they would wonder where they could find it on the website.”
The question becomes what kind of personal information these portals reveal and what safeguards are in place to ensure that only the registered voter can access them. That’s where Washington and 11 other states fall woefully short.
If you are a registered voter in Washington, try this experiment.
Go to the “Elections & Voting” section of the Secretary of State website. Under the “Voters” dropdown menu, select “Registration Status.”
The browser will go to a new page that prompts users for a name and birthday.
And that’s it. That’s all you need to see what seems like sensitive information including your party affiliation, your voting record and your mailing and residential addresses.
Even the Seattle Public Library requires a card number and a pin to check out a book at one of the self-service stations.
Real Change examined the standards in all 50 states. Some elections officials were trusting, providing Real Change their own personal information and sending screen shots of the process. The process revealed that some states are secure, not providing an address at all or requiring a full address to check in the first place. Others require very specific personal information, such as the last four digits of a social security number or a voter ID number.
It gets less specific from there, with a third category requiring a zip code, a fourth needing a city or a county and the fifth, like Washington, asking for just a birth date.
The biggest outlier: North Dakota. The Roughrider State does not register voters at all.
The ease of access to that information is concerning for people who have good reason to keep their home address private said Ruth Glenn, executive director of the National Coalition Against Domestic Violence.
“What an easy tool to use to find a person you’re stalking,” Glenn said.
Victims of domestic violence may get away from an abuser, but a particularly volatile individual will not let go, even after years, Glenn said. And, they’re quite likely to know their victim’s birthday.
Not that it’s a particularly high bar.
Most celebrities’ and sports stars’ birthdays are one Google search away. Many civilians are no better off — consider how often Facebook sends notifications regarding an acquaintance’s special day and the deluge of annual salutations that follow.
Holmes at the Secretary of State’s office is quick to point out that the database is not, in fact, connected to the voter registration database in any way, unlike some other states. In fact, all of the information available on the website falls under the category of a “public record” in the state of Washington.
Public records are documents about government action, public safety and other information considered to be relevant to the public discourse that can be requested by anyone. Standards for what constitutes a public record, or more generally a document that can be requested by the public or media, vary from state to state.
Unlike the records accessed through the hack in Illinois, which were connected to a voter registration database, information on Washingtonians can be accessed in other ways, including a direct request to the county.
To prove the point, Real Change went to the King County Elections Office, which has a form that asks for up to 10 names (more quantities are available, but it’s a different request procedure and may cost a nominal fee).
For the sake of the experiment, we asked for information on the nine city councilmembers and the mayor. An email came back asking for birth dates to narrow down the list — there are a surprising amount of Robert Johnson’s in King County — but two business days later the records arrived, without our sending additional identifying information.
The records included the names, addresses, when they first registered to vote and a listing of every time that a councilmember voted.
(On a separate note, good job, Tim Burgess. You are an exemplary voter.)
The idea that this information might make people uncomfortable ignores the variety of other ways that it can be accessed, said David Cuillier, director of the University of Arizona’s School of Journalism and past president of the Society of Professional Journalists.
“There was a time when it wasn’t a big deal having your home phone and home address available to everyone — most people wanted that,” Cuillier wrote in an email. “We called that database the phone book!”
Property records, court filings, even pet licenses also have similar information on people. Private companies spend resources hoovering up such information and creating reports available for purchase online.
“The reality is that we cannot hide in this society, even if we want to,” Cuillier wrote.
That doesn’t mean the state has to make it easy, say privacy advocates.
“Voter records are an interesting case study of a bigger issue that I see, which is the largely uncritical push toward open records and open data of all kinds,” said Tamaso Johnson, public policy coordinator for the Washington State Coalition Against Domestic Violence.
The information may not be different today compared to 25 years ago, but other things have changed, such as widespread access to the internet either at home or through public resources like libraries. It removes what is referred to as “obscurity” in academic settings, the idea that there are extra barriers to getting documents. These might include the need to physically go to a place where documents are housed or knowing what county or office might hold that information.
Open government and open records advocates demand transparency, but how much personally identifying information should be subject to that standard is up for debate, especially when people don’t know it’s out there.
There are methods for people worried about their safety to protect their home address information in most states. In Washington, it’s called the Address Confidentiality Program and it applies to crime victims who relocated to avoid further abuse. It allows people to register to vote and apply for marriage licenses without creating public records, according to the website.
That only helps people who know their information is at risk, Johnson said.
“I don’t think that people are aware of the potential misuse,” Johnson said. “This falls into a bucket of things that are either convenient or not really thought about in my experience until someone gets into a situation where it takes on another face.”
If you are a victim of crime and want to take steps to protect your address, visit sos.wa.gov/acp/. Voter registration closes on Oct. 10.
Katherine Luck contributed to this reporting.