You’re an honest person. You follow the letter of the law. When it comes to law-abiding citizens, you top the list. What happens when you follow the law but someone ends up getting hurt?
Does following the law legitimize what you are doing, even if it puts people at risk? If you’re adhering to the law, you can’t be held accountable, can you? Of course you can.
Earlier today I wrote about voter registration information and the dissemination of that information online. Before writing about it, I contacted the Elections Division of the Georgia Secretary of State’s office. In my initial inquiry I wrote,
I have a serious concern with the “My Voter Page” on the Sec. of State website.
All a person needs to do is enter their first initial, their last name, the county they live in, and their birthday in order to view their voter registration information.
Once viewing the voter registration information they can click to “change their address”.
All someone has to do is find another person’s birthday and make a lucky guess on the county they live in, to view their voter registration information AND CHANGE IT.
This needs to be addressed immediately, as this opens up every citizen in Georgia to the possibility of voter registration tampering as well as revealing their home address information to complete strangers.
I would like to know if something will be done about this obviously overlooked security issue.
Michael T. Barrett
This morning, just after 9, I received the following response from Rhonda Brown, the Operations Coordinator for the Secretary of State, Elections Division.
Thank you for your email.
The link that you’re referring to only brings up the Voter Registration Application that has to be printed and mailed. Before the any changes can be processed to your voter registration, a new application has to be submitted and it has to contain an original signature. As a registered voter, the signature on the application submitted to change an address is compared against the signature on the current application on file with your county registrars’ office.
I hope this has addressed your concerns; however, should you need further assistance, please let us know.
SOS Elections Division
While my initial inquiry included the link to change voter registration, her reply fell far short of answering my concern about address information being so readily available. It was nice of her to respond so quickly, but she didn’t address the second issue at all. The reason for this, as I will demonstrate, is because the Secretary of State’s office is following the letter of the law, and therefore is not too concerned with the release of address information on the Internet. I also wrote the following in response:
Good afternoon Rhonda,
I realized, after sending that email, the change link only provided for a PDF file download, which was good to see, but I still have serious issues about the readily accessible voter registration information being released on an individual basis on the website.
Although intended for inquiries to check voter registration, the tool can be used to obtain personal address information for any citizen in the state of Georgia. I know that voter registration records are part of the public record, but so are birth certificates, death certificates, bankruptcy filings, and any number of other documents, none of which are freely available on the Internet.
My main concern is that there is no added layer of security to make sure the people reviewing the information are the ones the tool is intended for. I reviewed many other state websites overnight and found a few of them require additional information such as part of the SSN, a house number, and in some cases a driver’s license number.
Adding just one more piece to the security layer would eliminate the possibility that information was freely given to someone with a nefarious goal in mind (think abuser, stalker, etc). Making the information so easily accessible places an additional burden on specific segments of our society, and I know that was not intended.
Just my two cents,
Michael T. Barrett
By now I should have expected the response I was about to get, but for some reason I thought it might actually be important to add one extra piece of information to the existing page. You see, in my review of the different state election websites, I found that 18 states don’t currently offer online access to statewide voter registration information, one state (North Dakota) doesn’t even require voter registration, and 7 states offer online access but they require additional information from the user, such as social security number, driver’s license number, house number, street name, or Voter ID number.
That leaves 24 states and the District of Columbia which have very loose standards for releasing their voter registration information online. Many of these states require first name, last name, county or zip code, and birthday. Some, however, allow access simply by entering the first name, last name, and birthday of the person being researched.
Here is the response I received, pointing out the letter of the law (for my benefit I am sure).
Please know that the Secretary of State takes the privacy of your personal information very seriously.
Under current state law, the Secretary of State must make certain of your information available. With respect to your voter registration information, O.C.G.A. § 21-2-225 provides that “all data collected and maintained on electors whose names appear on the list of electors maintained by the Secretary of State pursuant to [Georgia law] shall be available for public inspection.” The statute does provide for certain information to be kept confidential: bank statements, month and day of dates of birth, social security numbers, driver’s license numbers, and locations where electors registered to vote. Only that information which must be made public under current Georgia law is included within the My Voter Page on our website. The information is included to help voters determine whether the local elections offices have voters registered at their correct home address; by doing so, we hope to prevent votes from not being counted because a voter has not properly updated an address change. Last year, the Secretary of State worked with the Georgia General Assembly to pass a statute allowing this office to maintain the confidentiality of the residential address for those individuals who are victims of violence and have obtained a restraining order or protective order or are currently residing in a family violence shelter. See O.C.G.A. § 21-2-225.1.
Thank you for your response email.
SOS Elections Division
As stated above, the Secretary of State’s office must make certain information available. The law does not state that the Secretary of State’s office is required to make the information publicly available without any security measures over the Internet.
In fact, Georgia Code, Title 21, section 2-225 states,
(a) Neither the original applications for voter registration nor any copies thereof shall be open for public inspection except upon order of a court of competent jurisdiction.
(b) All data collected and maintained on electors whose names appear on the list of electors maintained by the Secretary of State pursuant to this article shall be available for public inspection with the exception of bank statements submitted pursuant to subsection (c) of Code Section 21-2-220 and subsection (c) of Code Section 21-2-417 and the social security numbers of the electors and the locations at which the electors applied to register to vote which shall remain confidential and be used only for voter registration purposes; provided, however, that social security numbers of electors may be made available to other state agencies if the agency is authorized to maintain information by social security number and the information is used only to identify the elector on the receiving agency?s data base and is not disseminated further and remains confidential.
(c) It shall be the duty of the Secretary of State to furnish copies of such data as may be collected and maintained on electors whose names appear on the list of electors maintained by the Secretary of State pursuant to this article, within the limitations provided in this article, on electronic media or computer run list or both. Notwithstanding any other provision of law to the contrary, the Secretary of State shall establish the cost to be charged for such data. The Secretary of State may contract with private vendors to make such data available in accordance with this subsection. Such data may not be used by any person for commercial purposes.
The law also states that it is the Secretary of State’s responsibility to furnish copies of such data on electronic media (such as discs) or computer run list or both. The Secretary of State is required to make voter registration information available on voter lists, not necessarily on an individual basis via the Secretary of State website.
Of course, at this point I realized any further conversation on the matter would simply be splitting hairs because the Secretary of States’s office sees nothing wrong with providing this information freely on their website. As long as they are following the letter of the law, they obviously feel they can absolve themselves of any responsibility if something were to happen.
In reference to Georgia Code, Title 21-2-225.1, mentioned above, I applaud our Secretary of State’s office and the Georgia General Assembly for passing such legislation. The amendment states,
(a) Any registered elector in this state who has obtained a protective order under Code Section 19-13-4 or under a similar provision of law in another state or who has obtained a restraining order or protective order under Code Section 16-5-94 or under a similar provision of law in another state may request the board of registrars of such elector’s county of residence to make such elector’s residence address confidential. An elector who is
a bona fide resident of a family violence shelter, as defined in Code Section 19-13-20, may request to have his or her address made confidential without having to obtain a restraining order or protective order.
(b) Upon the filing of a request with an affidavit under oath with the board of registrars by a registered elector stating that the elector has obtained a protective order under Code Section 19-13-4 or similar provision of law from another state or a restraining order or protective order under Code Section 16-5-94 or a similar provision of law of another state or, if the elector is a resident of a family violence shelter, a certification by the operators of such family violence shelter that such elector is a bona fide resident of such shelter, the registrars shall immediately review such request and supporting documents and, if such request and documentation is sufficient, shall approve the request and immediately take such steps as necessary to make the residence address of the elector confidential.
(c) A request under this Code section, once approved, shall be effective for a period of four years following its approval by the registrars and may be renewed for additional four-year periods by the filing of a new request with the supporting documentation required by subsection (b) of this Code section prior to the end of each four-year period. If the elector registers to vote in another county in this state or another state, a new request for confidentiality of the elector’s residence address with the supporting documentation required in subsection (b) of this Code section shall be filed with the new county in order to continue the confidentiality of the elector’s residence address or the confidentiality shall terminate.
(d) The Secretary of State shall provide by procedure, rule, or regulation for the mechanism by which such information shall be made confidential on the voter registration data base and may provide for forms for use in making such requests and for the use of alternate addresses for electors who file requests for the confidentiality of their residence addresses.
(e) Information made confidential pursuant to this Code section shall not be subject to disclosure under Article 4 of Chapter 18 of Title 50.
This amendment to Title 21, section 21-2-225 will protect those who are already “in the system” as victims of abuse and/or stalking, but what about those persons who haven’t been victimized yet? Doesn’t this unrestricted access to their voter information leave them even more susceptible to being victimized in the future? It’s nice that we’re protecting those who have been victimized and who are already in the system, but wouldn’t it be prudent to start protecting those who may otherwise become victims from entering the system in the first place?
In society we have unlisted phone numbers and we sign up for “Do Not Call” lists, but we’re not afforded the option of keeping our voter registration information out of the hands of those who might be dangerous? It’s ridiculous.
At this point I decided to make my concern clear one more time and call it a day.
I understand that all data collected, etc, shall be made available for public inspection. Public inspection is one thing, offering unrestricted access via the online tool seems a bit dangerous to me.
You mention that the information is provided online “to help voters determine whether the local elections offices have voters registered at their correct home address”, and I think it’s a great tool, I just think there should be one more layer of security before displaying that information online for anyone to see. Requiring one more piece of information would not restrict access to those who are legitimately requesting voter information, and it would deter those who have ulterior motives in mind.
I think it’s great the SOS office and the General Assembly worked to protect those who currently have a restraining order or protective order. It’s important to protect our citizens from the type of danger imposed by those who might use tool in an effort to locate and harm others. Of course, I feel this protection should apply to everyone, not just the citizens already “in the system” so to speak. One extra layer would provide enough protection to keep additional victims from entering the system in the first place.
Have a great day and thank you for your responses. I appreciate it.
Michael T. Barrett
I feel the Secretary of State’s office can offer the same service they are currently providing, yet make it much more secure by simply adding ONE piece of required information to the ‘My Voter Page’ login. The last four digits of your Social Security Number, your house number or street name, your Driver’s License number or your Voter ID number. Any of those pieces of information would add another layer of security to help eliminate the possibility that someone out to do harm could obtain information so easily. A little deterrent goes a heck of a long way.
As I was informed today, releasing voter registration information through electronic means such as the Internet is completely legal, but what happens when that information is used to harm someone? What if that information has already been used to harm someone? We have no way of knowing. As long as we keep the door wide open, we have no way to know who passes through it.