There is a difference between general voter information that is readily available to the public in voter registration lists; and sensitive personal information that is protected by numerous safeguards.
The Help America Vote Act of 2002 requires the chief election official of each state to implement a “single, uniform, official, centralized, interactive computerized statewide voter registration list.” This list is to be “defined, maintained, and administered at the State level.”[1] The goal is to allow states to have a computerized list of voters. This allows state and local election officials immediate electronic access to check the registration status of a voter. It also allows verification of voter information with other state, local and federal agencies; provides a means for list maintenance; and tracks certain appropriate voting histories.
Historically, these lists have been available for campaign purposes. But different states have different requirements for who can request a list of voters and what information that list includes.[2] Additionally, many states have specific Address Confidentiality Programs (ACP) to keep voter information confidential for certain classes of voters, such as victims of domestic violence, sexual assault or stalking. Some examples of state requirements for requesting a voter registration list include:
- Alaska: Anyone can request a copy of the state voter registration list, which contains the names, addresses and party affiliations of all registered voters in the state. Voters may request in writing to keep their residential address confidential, if they provide a separate mailing address.[3]
- Colorado: Voter registration lists are available to the public upon request and contain a voter’s full name, address, year of birth, political party and vote history. Information remains private for ACP participants and pre-registrants[4] (a procedure that allows individuals under 18 to register to vote so they are eligible to cast a ballot when they reach 18).
- Massachusetts: State party committees, statewide candidate committees, state ballot question committees, the jury commissioner, adjutant general and any other individual, agency, or entity that the Secretary of State designates may request the list, which includes names and addresses. Information on ACP participants remains private.[5]
- Idaho: Any person may request a voter registration list, which include voter name, address and precinct – excluding ACP participants.[6]
Thus far in 2020, there is no evidence that voter registration systems have been penetrated by foreign or domestic actors. The U.S. Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA), in conjunction with the FBI, has released a public alert about false claims of hacked voter information. The agencies believe the intention of these claims is to cast doubt of the legitimacy of U.S. elections.[7]
Importantly, that a voter registration system is experiencing an outage does not necessarily mean a voter registration information or other election system has been compromised.[8] In fact, there are many innocuous reasons such errors occur, including configuration errors and natural disasters. [9] Additionally, foreign and domestic cyber actors may make claims they have “hacked” these databases in order to undermine confidence in the November 3 election and U.S. election institutions. In reality, these actors merely have information that is publicly available.
Voter misinformation (false information) and disinformation (false information designed to mislead) campaigns by foreign and domestic actors have been and will continue to be an issue for U.S. election institutions. It is important that federal, state, and local election officials and voters continue to question the veracity of these campaigns and claims. State and local election officials in collaboration with federal agencies, such as CISA, work and train to conduct elections as safely, fairly and securely as possible.
[1] Help Americans Vote Act §303(a)(1)(A0(i)-§303(a)(1)(A)(viii)
[2] Access To and Use of Voter Registration Lists, National Conference of State Legislatures https://www.ncsl.org/research/elections-and-campaigns/access-to-and-use-of-voter-registration-lists.aspx
[3] AS §15.07.127 and §15.07.195
[4] Colo. Rev. Stat. §1-2-302, §24-30-2108, §1-2-227
[5] Mass. Gen. Laws Ch. 51 §47C, §37, §44
[6] Idaho Code §34-437, §34-437A, §19-5706
[7] False Claims of Hacked Voter Information Likely Intended to Cast Doubt on Legitimacy of U.S. Elections https://www.cisa.gov/publication/false-claims-hacked-voter-information-likely-intended-cast-doubt-legitimacy-us
[8] See CISA Cyber Threats to Voting Processes Could Slow but Not Prevent Voting, https://www.cisa.gov/publication/cyber-threats-voting-processes-could-slow-not-prevent-voting
[9] CISA #Protect2020 Rumor vs. Reality https://www.cisa.gov/rumorcontrol