Is Your Voter Data Secure?

Election security is a three-legged stool: voter registration security, voting security, and vote tabulation security. Each of those “legs” must be secure for us to say with confidence that our elections are secure. In this series, we will look at each leg in turn to see just how secure it is.

Voter Registration Data

In order to vote in an election, you must first register to vote. That registration is sent to Frankfort, where is it entered into our state’s voter registration database. The voter databases contain the information necessary to make sure that a voter is registered, that they vote in only one precinct, and that they vote in only those elections for which they are eligible to vote (such as primaries or small-city elections).

Voter registration data is also valuable to candidates and their campaigns. Everyday citizens are sometimes surprised to learn that the voter data that candidates are given includes which elections a voter has voted in, including which primaries, as well as their registration. Candidates use this data to target certain voters, as well as to refine their approach to the election.

Combining voter data with social media profiles has opened up a “new frontier” of microtargeting of voters, as we saw in 2016 – and not just for candidates. Outside forces, allegedly tied to the Russian government, used this microtargeting to spread misinformation and outright lies, and to further polarize the U.S. electorate.

How did these outside forces obtain the voter data? At this point, the answer is unclear – but hacking of state voter registration systems is certainly one of the possibilities. In September, news reports revealed that the Department of Homeland Security had contacted 21 states to notify them of attempted breaches by “Russian government actors.” Whether those attempts were successful is unknown to the public; no state has admitted that their voter data systems were compromised.

The Role of the Secretary of State

Protecting voter registration data is the responsibility of each state’s election officials and staff. In Kentucky, that service is provided through the Secretary of State’s office. Therefore, we contacted that office to see what we could learn about voter data security in the Commonwealth.

In response to our initial inquiry, Bradford Queen, the Director of Communications for Secretary of State Alison Lundergan Grimes, sent us this statement:

Because election systems are considered critical infrastructure and out of abundance of safety, we do not discuss particulars of our voter registration system security. I can tell you we monitor our servers on a 24-hour/7-day basis, employ firewalls, and log traffic.

The Secretary of State and the State Board of Elections continue to work with our election integrity partners, including DHS, and a first-class cybersecurity firm to audit our systems and ensure we are safeguarded from potential threats.

While we appreciated this summary statement, we wanted to get into the details a little more. So, we followed up with a series of questions. Mr. Queen said that he would forward them to the SoS IT department, and would send back their answers.

Follow-Up Questions on Voter Registration Security

Here are the follow-up questions we sent, wherein we attempted to flesh out the security picture without asking about things that might compromise our state’s systems.

1. Do you have external companies do penetration testing? If so, whom do you use? What do you do with their report? Obviously, the details are confidential; however, can we get a copy of the summary?
2. What human beings have access to the voter registration databases? Do they have complete CRUD (create-retrieve-update-delete) access, or limited access?
3. What systems have access to the voter registration databases? How many of them have WRITE access?
4. How do you handle segregation of duties in regard to voter registration data? Are those approaches set by statute, by formal internal policy, or by internal process alone? Can we get a copy of the segregation of duties policies and procedures?
5. What is the relationship between county election offices and/or county clerks and your office? When a voter turns in a new or changed registration, do the local officials mail the card to you to be entered, or do they enter it themselves into some sort of system?
6. If the voter data is accessible by local officials, what is done to prevent them from editing it incorrectly, or harming it intentionally?
7. If local officials use systems on their local computers to access the voter registration databases, what is done to protect that local access from hacking of some kind?

These questions deal with items that any large and/or secure enterprise would do as a matter of course. In addition, some of them would be actual formal policies, especially the “segregation of duties” items, which refer to segregating duties across multiple people or roles, so that one person cannot take significant action alone.

Other questions address the question of shared security between the election systems and people in Frankfort and the local election officials across the state who have to interact with the state systems in various ways.

Unfortunately, even though we followed up multiple times, we never received any answers to these questions. As of the publication of this article, the only information we can share as to the security of our voter registration data is the initial statement from the Secretary of State’s office.

We wish there was more to share, but for now the only answer we have to our questions about the security of our voter registration data is “No response; we don’t know.”

–30–

Thoughts? Comments? Add yours in the comment section at the bottom of the page!