Following The Letter Of The Law

You’re an honest person. You follow the letter of the law. When it comes to law-abiding citizens, you top the list. What happens when you follow the law but someone ends up getting hurt?

Does following the law legitimize what you are doing, even if it puts people at risk? If you’re adhering to the law, you can’t be held accountable, can you? Of course you can.

Earlier today I wrote about voter registration information and the dissemination of that information online. Before writing about it, I contacted the Elections Division of the Georgia Secretary of State’s office. In my initial inquiry I wrote,

I have a serious concern with the “My Voter Page” on the Sec. of State website.

All a person needs to do is enter their first initial, their last name, the county they live in, and their birthday in order to view their voter registration information.

Once viewing the voter registration information they can click to “change their address”.

All someone has to do is find another person’s birthday and make a lucky guess on the county they live in, to view their voter registration information AND CHANGE IT.

This needs to be addressed immediately, as this opens up every citizen in Georgia to the possibility of voter registration tampering as well as revealing their home address information to complete strangers.

I would like to know if something will be done about this obviously overlooked security issue.

Thank you,

Michael T. Barrett

This morning, just after 9, I received the following response from Rhonda Brown, the Operations Coordinator for the Secretary of State, Elections Division.

Mr. Barrett,

Thank you for your email.

The link that you’re referring to only brings up the Voter Registration Application that has to be printed and mailed. Before the any changes can be processed to your voter registration, a new application has to be submitted and it has to contain an original signature. As a registered voter, the signature on the application submitted to change an address is compared against the signature on the current application on file with your county registrars’ office.

I hope this has addressed your concerns; however, should you need further assistance, please let us know.

Rhonda Brown
Operations Coordinator
SOS Elections Division

While my initial inquiry included the link to change voter registration, her reply fell far short of answering my concern about address information being so readily available. It was nice of her to respond so quickly, but she didn’t address the second issue at all. The reason for this, as I will demonstrate, is because the Secretary of State’s office is following the letter of the law, and therefore is not too concerned with the release of address information on the Internet. I also wrote the following in response:

Good afternoon Rhonda,

I realized, after sending that email, the change link only provided for a PDF file download, which was good to see, but I still have serious issues about the readily accessible voter registration information being released on an individual basis on the website.

Although intended for inquiries to check voter registration, the tool can be used to obtain personal address information for any citizen in the state of Georgia. I know that voter registration records are part of the public record, but so are birth certificates, death certificates, bankruptcy filings, and any number of other documents, none of which are freely available on the Internet.

My main concern is that there is no added layer of security to make sure the people reviewing the information are the ones the tool is intended for. I reviewed many other state websites overnight and found a few of them require additional information such as part of the SSN, a house number, and in some cases a driver’s license number.

Adding just one more piece to the security layer would eliminate the possibility that information was freely given to someone with a nefarious goal in mind (think abuser, stalker, etc). Making the information so easily accessible places an additional burden on specific segments of our society, and I know that was not intended.

Just my two cents,

Michael T. Barrett

By now I should have expected the response I was about to get, but for some reason I thought it might actually be important to add one extra piece of information to the existing page. You see, in my review of the different state election websites, I found that 18 states don’t currently offer online access to statewide voter registration information, one state (North Dakota) doesn’t even require voter registration, and 7 states offer online access but they require additional information from the user, such as social security number, driver’s license number, house number, street name, or Voter ID number.

That leaves 24 states and the District of Columbia which have very loose standards for releasing their voter registration information online. Many of these states require first name, last name, county or zip code, and birthday. Some, however, allow access simply by entering the first name, last name, and birthday of the person being researched.

Here is the response I received, pointing out the letter of the law (for my benefit I am sure).

Mr. Barrett,

Please know that the Secretary of State takes the privacy of your personal information very seriously.

Under current state law, the Secretary of State must make certain of your information available. With respect to your voter registration information, O.C.G.A. § 21-2-225 provides that “all data collected and maintained on electors whose names appear on the list of electors maintained by the Secretary of State pursuant to [Georgia law] shall be available for public inspection.” The statute does provide for certain information to be kept confidential: bank statements, month and day of dates of birth, social security numbers, driver’s license numbers, and locations where electors registered to vote. Only that information which must be made public under current Georgia law is included within the My Voter Page on our website. The information is included to help voters determine whether the local elections offices have voters registered at their correct home address; by doing so, we hope to prevent votes from not being counted because a voter has not properly updated an address change. Last year, the Secretary of State worked with the Georgia General Assembly to pass a statute allowing this office to maintain the confidentiality of the residential address for those individuals who are victims of violence and have obtained a restraining order or protective order or are currently residing in a family violence shelter. See O.C.G.A. § 21-2-225.1.

Thank you for your response email.

Rhonda Brown
Operations Coordinator
SOS Elections Division

As stated above, the Secretary of State’s office must make certain information available. The law does not state that the Secretary of State’s office is required to make the information publicly available without any security measures over the Internet.

In fact, Georgia Code, Title 21, section 2-225 states,

(a) Neither the original applications for voter registration nor any copies thereof shall be open for public inspection except upon order of a court of competent jurisdiction.

(b) All data collected and maintained on electors whose names appear on the list of electors maintained by the Secretary of State pursuant to this article shall be available for public inspection with the exception of bank statements submitted pursuant to subsection (c) of Code Section 21-2-220 and subsection (c) of Code Section 21-2-417 and the social security numbers of the electors and the locations at which the electors applied to register to vote which shall remain confidential and be used only for voter registration purposes; provided, however, that social security numbers of electors may be made available to other state agencies if the agency is authorized to maintain information by social security number and the information is used only to identify the elector on the receiving agency?s data base and is not disseminated further and remains confidential.

(c) It shall be the duty of the Secretary of State to furnish copies of such data as may be collected and maintained on electors whose names appear on the list of electors maintained by the Secretary of State pursuant to this article, within the limitations provided in this article, on electronic media or computer run list or both. Notwithstanding any other provision of law to the contrary, the Secretary of State shall establish the cost to be charged for such data. The Secretary of State may contract with private vendors to make such data available in accordance with this subsection. Such data may not be used by any person for commercial purposes.

The law also states that it is the Secretary of State’s responsibility to furnish copies of such data on electronic media (such as discs) or computer run list or both. The Secretary of State is required to make voter registration information available on voter lists, not necessarily on an individual basis via the Secretary of State website.

Of course, at this point I realized any further conversation on the matter would simply be splitting hairs because the Secretary of States’s office sees nothing wrong with providing this information freely on their website. As long as they are following the letter of the law, they obviously feel they can absolve themselves of any responsibility if something were to happen.

In reference to Georgia Code, Title 21-2-225.1, mentioned above, I applaud our Secretary of State’s office and the Georgia General Assembly for passing such legislation. The amendment states,

(a) Any registered elector in this state who has obtained a protective order under Code Section 19-13-4 or under a similar provision of law in another state or who has obtained a restraining order or protective order under Code Section 16-5-94 or under a similar provision of law in another state may request the board of registrars of such elector’s county of residence to make such elector’s residence address confidential. An elector who is
a bona fide resident of a family violence shelter, as defined in Code Section 19-13-20, may request to have his or her address made confidential without having to obtain a restraining order or protective order.

(b) Upon the filing of a request with an affidavit under oath with the board of registrars by a registered elector stating that the elector has obtained a protective order under Code Section 19-13-4 or similar provision of law from another state or a restraining order or protective order under Code Section 16-5-94 or a similar provision of law of another state or, if the elector is a resident of a family violence shelter, a certification by the operators of such family violence shelter that such elector is a bona fide resident of such shelter, the registrars shall immediately review such request and supporting documents and, if such request and documentation is sufficient, shall approve the request and immediately take such steps as necessary to make the residence address of the elector confidential.

(c) A request under this Code section, once approved, shall be effective for a period of four years following its approval by the registrars and may be renewed for additional four-year periods by the filing of a new request with the supporting documentation required by subsection (b) of this Code section prior to the end of each four-year period. If the elector registers to vote in another county in this state or another state, a new request for confidentiality of the elector’s residence address with the supporting documentation required in subsection (b) of this Code section shall be filed with the new county in order to continue the confidentiality of the elector’s residence address or the confidentiality shall terminate.

(d) The Secretary of State shall provide by procedure, rule, or regulation for the mechanism by which such information shall be made confidential on the voter registration data base and may provide for forms for use in making such requests and for the use of alternate addresses for electors who file requests for the confidentiality of their residence addresses.

(e) Information made confidential pursuant to this Code section shall not be subject to disclosure under Article 4 of Chapter 18 of Title 50.

This amendment to Title 21, section 21-2-225 will protect those who are already “in the system” as victims of abuse and/or stalking, but what about those persons who haven’t been victimized yet? Doesn’t this unrestricted access to their voter information leave them even more susceptible to being victimized in the future? It’s nice that we’re protecting those who have been victimized and who are already in the system, but wouldn’t it be prudent to start protecting those who may otherwise become victims from entering the system in the first place?

In society we have unlisted phone numbers and we sign up for “Do Not Call” lists, but we’re not afforded the option of keeping our voter registration information out of the hands of those who might be dangerous? It’s ridiculous.

At this point I decided to make my concern clear one more time and call it a day.

Hi Rhonda,

I understand that all data collected, etc, shall be made available for public inspection. Public inspection is one thing, offering unrestricted access via the online tool seems a bit dangerous to me.

You mention that the information is provided online “to help voters determine whether the local elections offices have voters registered at their correct home address”, and I think it’s a great tool, I just think there should be one more layer of security before displaying that information online for anyone to see. Requiring one more piece of information would not restrict access to those who are legitimately requesting voter information, and it would deter those who have ulterior motives in mind.

I think it’s great the SOS office and the General Assembly worked to protect those who currently have a restraining order or protective order. It’s important to protect our citizens from the type of danger imposed by those who might use tool in an effort to locate and harm others. Of course, I feel this protection should apply to everyone, not just the citizens already “in the system” so to speak. One extra layer would provide enough protection to keep additional victims from entering the system in the first place.

Have a great day and thank you for your responses. I appreciate it.

Michael T. Barrett

I feel the Secretary of State’s office can offer the same service they are currently providing, yet make it much more secure by simply adding ONE piece of required information to the ‘My Voter Page’ login. The last four digits of your Social Security Number, your house number or street name, your Driver’s License number or your Voter ID number. Any of those pieces of information would add another layer of security to help eliminate the possibility that someone out to do harm could obtain information so easily. A little deterrent goes a heck of a long way.

As I was informed today, releasing voter registration information through electronic means such as the Internet is completely legal, but what happens when that information is used to harm someone? What if that information has already been used to harm someone? We have no way of knowing. As long as we keep the door wide open, we have no way to know who passes through it.

When Does Accessibility Become Too Intrusive?

Have you registered to vote? With the upcoming mid-term election just around the corner, you really need to make sure your voter registration information is up to date.

Did you know many states offer the ability to check your voter registration information online? Did you know those same states make it easy for anyone, anywhere, to view your voter registration information?

Last night I mentioned I had found a serious security issue on a local website. In the past 8 hours I have found that many states have the same security issue on their websites offering you the chance to “check your voter registration information”.

We all know that our voter registration information is public record, but with the Internet, how accessible should individual information be?

Before these online tools were made available to literally anyone in the world, there was a process in obtaining voter registration information. The process varied a bit from state to state, but in most cases you had to visit the county clerk or registrars office, make a request for the state or county voter roll information, and obtain the printout (or in some cases a disc with the information). In many states, those requests have to be made in writing and obtaining the voter registration of one individual is usually not permitted.

Political candidates obtain voter registration lists all the time, why do you think we get all of those political mailers this time of year? It’s not Earth shattering news to know your voter registration information is out there for anyone to see. What might shock you, however, is how easy it is to find individual information for just about anyone.

While catching up on Twitter last night, I noticed a link to a local news website. The link referred to a new tool, My Voter Page, on our Secretary of State’s website which allows citizens to look up their voter registration information online.

Just seconds later I was looking at my own information. I quickly realized how easy it was to obtain my information. All I needed was my first initial, my last name, my birthday, and the county I reside in. Pretty easy huh? It’s so easy you can do it too, and so can anyone else who might want to spend five minutes looking up information about you on the Internet. They could have titled the website, “My Stalker Page”.

For many people, this will not be an issue. It’s public information, so who cares, right? But this could be a huge issue for some people.

For example, let’s say you are a woman who has been battered and abused and you are attempting to remain hidden from the person responsible for the beatings. With or without a restraining order, that person can use the online tools from their state to find you.

Sure, it may take them a few tries if they don’t know which county you are living in (or in some cases, your zip code), but they can find you after a few attempts. Although your voter registration information is part of the public record, it isn’t likely that your abuser is going to walk into the local county clerk’s office and make a written request (and pay) for the entire voter registration list in order to obtain your address information. There is nothing stopping him from doing it on the internet. No checks, no balances, just information free flowing on the information superhighway.

Here is the information I pulled up from the New York State Board of Elections website after performing two quick searches on Google for some information beforehand.

 

Granted, former President Bill Clinton is a public figure, blah blah blah, do you really think I was going to use the information from a battered or abused woman in my example?

Some states have an added layer of security, such as requiring your Social Security Number, Driver’s License number, or house number, but many do not.

The easy accessibility of this information could have huge ramifications on the voting public. If a battered or abused woman has serious concerns about her safety and the safety of her children, she must now seriously consider whether or not she wants to register to vote. Doing so could put all of her information in the hands of the person responsible for that abuse in the first place.

What if someone is stalking you? Your stalker now has easy, immediate access to your current residential information at their fingertips.

Here is another example. A young woman is constantly being harassed by a former co-worker at the building where she works. She gets a restraining order requiring him to stay 500 feet away from her and the property. How long do you think it will take until he finds her home address? In many cases, it wouldn’t take more than five minutes.

Like I said before, many people are not going to see this as an issue, but I don’t think people realize just how easy it is to find this information for just about anyone using nothing but the online tools provided for reviewing your own voter registration information.

I spent 30 minutes looking up elected officials from many different states, local news reporters and anchors, and a variety of other public figures. One Google search, one news article, and two guesses on the county information. That’s all it took to find the address for Monica Kaufman Pearson, longtime anchorwoman for WSB-TV.

It didn’t take much work at all to find any of the information for these people, but what about private citizens?

Believe it or not, it didn’t take much to find records for several random people I found on Facebook. Within minutes I was looking at voter registration information of a friend in South Carolina, a classmate I haven’t seen in almost 30 years who lives in South Dakota, family members in Georgia and Kentucky, and acquaintances in three other states.

Other than my family members, I did not have direct access to most of the pertinent information for the people I looked up. I found all of the information needed for the online tools using Google and Facebook.

Battered women, stalking victims, people worried about identity theft, and everyone else, should be concerned about the accessibility of this information. Many of these websites have no security check in place before the dissemination of this individual information is permitted.

In fact, in most states if you want to obtain voter information “the old fashioned way” you have to request the voter information list for your county or the entire state. Most states do not offer single record inquiries for voter information, and those same states charge a fee for the lists they do provide.

So why is it so easy to look up individual voter information on the Internet? Many items and documents are part of the public record, but they aren’t necessarily available freely without concern for security, on the Internet.

In many states, vehicle registration information is part of the public record. I receive my vehicle registration renewal in the mail every year. That renewal notice contains a special code I have to enter if I want to lookup, change, or renew my vehicle registration online. The special code provides a layer of security to make sure access to my information online is somewhat protected.

The public record contains birth certificates, death certificates, bankruptcy filings, and much, much, more. Imagine if they let you look up anyone’s birth certificate information simply based on their name, birthday, and birth location? Checking police records online from LexisNexis makes it easy and is extremely helpful.

Why isn’t there some layer of security when viewing individual voter registration information, especially when personal address information is included in the record?

Needless to say, it’s not honest people like you and me that will be using these tools in a nefarious way to obtain address information on individuals.

So, is this really a big deal?

It definitely is if you’re a victim of abuse, the subject of a stalker, or if you have legitimate concerns about readily accessible voter registration information that is not available on an individual one record basis anywhere else, online or otherwise.