Voter Records Exposed

The current edition of Lauren Weinstein's PRIVACY Forum has a cautionary tale about online voter registration in one Texas county. It seems your username is your first and last name, and your password is your year of birth. Not many bits of security there. Guess that information and you can learn any Denton County voter's home address and some trivia -- but at least not their credit card numbers ... yet. michael : A silly privacy overreaction, IMHO. I believe voter records are public in every state and county in the U.S., and they are routinely used by police, journalists, political bulk mailers, etc. If the objection is that they're now "on the Web", that seems like a silly hair-splitting, since for a few dollars you can get the records for an entire county on CD-ROM anyway. Behind the scenes, the voter registration records of the entire country are used by the major political parties to coordinate mailings - this information is not and has never been private.

Comments

Republican spam

[Roblimo]

Yup. Voter records are public. I was registered Republican for a while, and because of that I get a constant stream of mail from Republican candidates -- along with some *vile* attacks on Gore and other Democrats from local and state Republican organizations.

Maybe the campaign is high-minded (hah!) at the national level, but here in the local trenches, at least in Maryland, it seems like Republicans are using voter lists as a way to irritate everyone they can in the most Gingrichlike way possible.

- Robin

Re:Republican spam

[the eric conspiracy]

Have you ever read or seen any of Gingrich's educational output?

Mr. Gingrich is an individual with a long history of a complete lack of ethics in both his personal and public life.

Re:Republican spam

[the eric conspiracy]

Do you care to back up your claims about his ethics?

Mr. Gingrich was fined $300,000 by a republican led House Ethics Committee.

He admitted these violations in a signed statement to the aforesaid committee on December 21, 1996.

In addition, Mr. Gingrich has been involved in a very public divorce case where he acknowledged concealing a 6-year long affair from his wife.

Re:Republican spam

[Wellspring]

Yup. Voter records are public. I was registered Republican for a while, and because of that I get a constant stream of mail from Republican candidates -- along with some *vile* attacks on Gore and other Democrats from local and state Republican organizations.

I've had something similar happen to me. As a member of my local synagogue, they had my family's name/address. Apparantly, the synagogue shared its mailing list with the local Democrats. I got a letter during our state's Senate campaign which all but called the Republican an enemy of the jewish people. Problem: the Republican was jewish himself.

This is like Amazon's privacy policy, MS's plan not to let you reinstall Windows (effectively), etc. They are clever sounding ideas to score a minor, marginal advantage. People always feel like they can pull off some kind of sneaky deal-- it almost never works.

The problem is that it is difficult to ensure that an election is run fairly. Public voting rolls is one way to verify that the right number of people are voting. It isn't perfect, but there really isn't a corruption-proof voting system.

For instance, there are some precincts which have 'technical difficulties' or other problems which mean that they are kept open past the deadline. Year after year. Reason? They wait until the exit poll results so they know how much to pad their precinct.

Re:Republican spam

[G Neric]

Republicans are using voter lists as a way to irritate everyone they can in the most Gingrichlike way possible

I'm constantly astounded by the juvenile level of political sophistication displayed by members of the "government" of Slashdot. Thank God it's a website, and not a country.

Do you really think there is some correlation between the political parties and fairness? The very reason you would use a word like "Gingrichlike" is because Gingrich was the victim of a steady stream of negative propaganda from Democrat spin doctors, and you've swallowed it hook line and sinker. Politically vicious and cynical people like Democrats James Carville and Dick Morris exist all across the spectrum. Al Gore's campaign savaged Bill Bradley just last year in the Democratic primary, accusing him of being racist. Anyone with a passing knowledge of Gore's versus Bradley's records as Democratic officeholders would think Bradley would be immune from such a vicious lie... of course, "anyone with passing knowledge" would pretty much rule out anyone who works on Slashdot.

Have you ever read or seen any of Gingrich's educational output? He was a college professor and educator, and is quite knowledgeable, non-partisan, and downright charming when he talks about the history of American democracy. Catch him on CSPAN if you ever get the chance. If he were to post to Slashdot (under a false name) his posts would be +4 Informative every time.

Could the Slashdot editors please grow up.

Re:Republican spam

[swinge]

Picasso didn't make a career out of attacking other people's ethics and advocating a more ethical society in general

give up. Gingrich made a career as a college professor, a whole entire career: it was being pointed out that he is a multidimensional person. People like you make a whole career out of being incapable of following a thread: a number of questions are at hand and you seem incapable of grasping them. Gingrich did make it in his political career (after having an entirely separate career as a college professor) by attacking the Democrats leading the Congress on their ethics. They were actually corrupt, and they paid for it. So, we can see there is nothing inherently less corrupt about Democrats than Republicans. That's the thread of this discussion.

As for your point about manipulating people: yes, on both sides of the aisle there are unsophisticated people who can be manipulated, and some Democrats make a career of it as well. That's what prompted Congressman J. C. Watts to call Jesse Jackson a "race-hustling poverty pimp," referring to the point that if Jesse Jackson were to actually do anything to eradicate poverty and racism, there'd be nobody to live on the welfare plantation that he oversees. Other examples of political upperclasses manipulating people in the trenches is the way politicians like Clinton and Packwood develop reputations as being pro-woman, but in their offices use their power and influence to grope and fondle women in positions of weakness, or politicians like the Kennedies or Kerry of Massachusetts who have vast wealth, and speak constantly about the disparity between the rich and the poor and the workingman, but who don't seem to wish to put their own vast wealth to work directly helping the poor and the workingman.

As has been said, fairly a few times: people like you are the problem, people who politicize every issue rather than pointing out that human frailty extends to all humans, not just those of one party.

This is much ado about nothing.

[talks_to_birds]

This is one more "article" -- breathless and agitated in it's tone -- that gets put up on /. mainly because of "editors" who, through their Youth and Inexperience®" don't know whether something is a big deal, or not...

The accessibility of voter records is *ancient* news.

Years ago I ran for School Board.

I purchased voter records including name, mailing address, and voting history for about 6,000 registered voters in the precincts that made up the local school district.

When I bought these, I had perhaps six different companies in metro Seattle to choose from.

I paid about $25.00 for five floppies-full, ASCII, comma-delimited.

If I'd wanted to pay more, I could have had the data set up for various software.

This is no big deal, except this is stupider because you have to know the name and birthdate to get one record.

One at a time.

What a pain in the ass.

Twenty-five bucks got me 6,000.

t_t_b
--
I think not; therefore I ain't®

UK voter details are public, but is your vote?

[caveman]

In the UK, the electoral register is a public document which is compiled by the local authority every year around this time. (The final version is supposed to be published on November 1st).

Anyone can inspect the electoral register, and copies are available (for a fee) for any company wanting it, in machine readable form, so that they can, for instance, check you are not giving them dud details on a credit application. It contains your full name, house address, and also date of birth for persons between 16 and 18 years of age.

As your date of birth is one of the standard security questions asked by credit card companies when calling in to their telephone service lines, that strikes me as a security risk.

Each voter gets a number in the register, such as J 4572. This is printed on your poll card which you take to the polling station to cast your vote (you don't need it, they have printed copies of the register there, and can look up your voter number there).

Most people assume that elections are private matters between the voters and the ballot box. The totals are obviously public information, but can you tell how a particular person voted?

The answer in most cases is no, however the polling station staff write on their register the number of the ballot paper you are given, which means it is, in theory atleast, possible to trace who voted for which candidate.

At this time it isn't a crime to vote for any candidate, and anyone who has sufficient support and pays their election deposit can be a candidate, hence the number of crazy candidates from parties such as The Official Monster Raving Loony Party and other less than serious candidates.

Kind of makes you wish there was an official monster raving loony running for the US presidency eh? [They are both fully paid up members - Ed]

Re:UK voter details are public, but is your vote?

[GigsVT]

In the US, in all the places where I have voted, they use mechanical booths, and once you get checked off the register, to make sure you can't vote twice, you go to any booth, and vote anonymously. The is no easy way to track any particular vote to any person.

Online voting will change all that...
-

Re:Now I'm mad

[clifyt]

Heh...opt out of being in a phone book? I guess spammers are now going to ask ya for $25 not to be listed in their database, but still give yer address out to a select number of fine folks that payed a lot more than you did to get rid it removed.

The Phone company has nothing Opt about this...it is a private company and they do what they want.

Now the gov't on the other hand, I think should publish anything and everything about who voted and how they voted. Fuck this Anonymous Coward thing in the Polls. If you want to participate in gov't, and I think everyone should be forced to - at gun point if neccessary, you should be forced to justify your decision. I don't care if the justification is that George Bush seems to be a Nice Guy and you really hate that Nasty Intellectual and I add Morally Corrupt Al Gore that thinks he's going to save the country by taking my hard earned money and spending it on the environment. I don't care if its because Nader is the snazziest dresser or Haiglen thinks some Raja can give us all Crystal Power but then backs it up with scientific claims.

Votes should not be private. If you want to participate in the gov't there are certain freedoms you must give up. I mean would we vote for candidates that want to conduct congress in secrecy?

Anywho, other than information that is already public, you ain't loosing by the systems thats in place. Other information, such as yer Party of choice, are only recorded when you vote in the primaries and these really have no influence over the real elections except what the dumbasses that seem to think that ya have to vote in a binary system anyways...heh, I'm pretty sure that I voted for the opposing political party in the last primary because I really hated one of the guys running and thought the other was a much better candidate who has given his life for the service of us little people. I know others that did the same thing with their parties, be it Voting for McCain who is a far better candidate than Bush or Bradley whom would have made a far better candidate on the Dem side.

blah blah blah

clif

Two issues

[phred]

There are two issues here. One is the public nature of voter registration records. This is essential to democracy; how could you effectively have fair elections and representative government if only the government knew who the registered voters were?

There is an exception. Under Oregon state law, voters who feel that publishing their addresses would constitute a hazard (for example, those who have been subjected to stalking by acquaintances) can request that their addresses be suppressed in the public file.

The second issue is voter registration data security. Changing one's registration should be simple and easy, but it shouldn't make it easy for fraud to occur. We have well-established routines for fraud checking with paper documents. Weak online security defeats that purpose.

There are still some concerns. I saw a file layout for the voter file data that the state of Florida provides for a fee. It included Social Security number! Now anyone who has tried to get credit recently (for example, starting up a cell phone account) knows that there is no way around the increasing use of the SSN for credit verification. But having a public agency spread these around is a really bad idea and is unnecessary, to boot. Most voter registrars provide their own affidavit ("voter ID") number that us database types recognize as a Primary Key (or at least a "production key in a Slowly Changing Monster Dimension" :).
So there is no reason to disseminate the SSN even if the state collects it as part of your registration. (See Simson Garfinkel's comments about the dangers of SSN overuse and exposure in his excellent book Database Nation.)

Oregon now has all-vote-by-mail elections. In fact, about 40% of Oregonians have already sent in their ballots for the current election. But we are not moving fast at all toward online voting, for all the good reasons that Bruce Schneier and others have pointed out.

Oregon also has the first and to my knowledge only online interactive voter file system, which my business partner and I designed and implemented (it's a subscription service we provide to progressive organizations). We track ballot returns day by day (not perfectly, given the shortcomings of the "legacy systems" our counties use to manage the voter rolls) to remove voters from the active list so that our cooperating campaigns stop bothering people who have already voted. This reduces the cost of campaigning and provides an incentive for electoral participation.

--------

Definitely not news ...

[wesmills]

Denton County actually keeps more bits of information private than other counties, say Dallas and Tarrant (home to Dallas and Fort Worth, respectively). Take a quick look at PublicData, their original market was being able to search a lot of public records about residents of Texas, Dallas County primarily.

Note that the actual records of how you vote are not exposed, as they can't be. Ballots have no identifying markings on them (unless we're using paper markings ) and they go into a locked box with every other anonymous ballot.

/me will go back to munching on a delicious burger from The Denton County Hamburger Factory and listen to reports of the horrible traffic over the Lake Lewisville bridge .. there's nothing to see here.

---

Interesting comparison to Australia

[RavenDuck]

It's interesting to read some people posting that in some US counties you can buy data files of voter details all ready to go into a mail merge package. Earlier this year the Australain people had a Goods and Services Tax (GST) imposed upon them. The Prime Minister intended to send a personalised letter to each adult Australian (in Australia it's compulsory to vote, so every person over 18 should be on the electoral role) using a mass mail merge. The federal privacy comissioner (yes, there is such a person, but most of the time he seems pretty useless) eventually stepped in and stopped the plan, saying that the laws concerning the electoral role prevented it from being used in an electronic fashion. In other words, it would have been alright if someone typed them in all by hand, but importing them into Word (am I the only one who thinks using Word to generate over 10 million documets is a terrifying proposition!?) wasn't allowed.

Of course, this only came to light after someone (can't remember who, the opposition maybe) kicked up a stink and took it to the comissioner.

Privacy

[kressb]

Slashdot overreacting to privacy considerations?
That would never happen.

The converse is worse

[georgeha]

Can you imagine what the political scene would be like if voter registration records weren't public?

Does Chicago under Daley the 1st familiar? How many thousands of voters would come from cemetaries?

At least this, you can look up every voter in a district. IF you start finding registered voters living in a vacant lot, you know you have some voter fraud.

More opportunity for fraud.

[Ungrounded Lightning]

I don't see what the problem is. It just means that the parties are able to tailor their policies to the individual, and thats what democracy is all about, isn't it?

I think a point is being missed. Consider:

It seems your username is your first and last name, and your password is your year of birth.

Why is there a password? To let you CHANGE your info, right?

So if somebody knows your birthday and age, they can deregister you, or change your address and request an absentee ballot in your name. Maybe that's not too likely for active voters (and likely to be detected). But those who rarely or never vote become a rich source of fraudulent ballots.

As do the recently dead. How many berieved relatives are going even THINK of logging in and killing the registration. Once the mailing address is changed nothing will arrive to show the registration wasn't automatically canceled.

Worse, it automates the creation and administration of phantom voters - a form of fraud that has ballooned since the federal motor-voter law.

What's especially dangerous about voter fraud is that the stability of a republic depends on the perceived accuracy of the elections. The election models a civil war closely enough to convince the loser that they'd lose the war, too - so they don't try to reverse it by violence. Break the faith in the election process and you may "destabilize" the society. And the surest way to break that faith is to destroy the reality behind it, by institutionalizing massive election fraud.

This has happened repeatedly in the history of republics, including the US. Fortunately, in the US the normal response is for a committee of vigilance to run the rascals out of town, maybe lynching a couple kingpins [San Francisco], publicly and repeatedly spank them until they go elsewhere [Portland OR], or capture the ballot box and count the ballots publicly [I forget which town]. Elsewhere in the world it has gotten much bloodier.

Re:You cant change anything

[Ungrounded Lightning]

Everything there is static info. no, the 'password' is not so you can change info. it is just used to access the info. ... There is no real chance for fraud here, just a chance for people to get your address, which there are about 1000 other ways to do.

Thanks. It's nice to know that Denton didn't open that security hole.

evil dot-commers

[kevin805]

The funniest junk mail I'm getting is about Berkeley's measure Y, which would prohibit apartment owners from evicting tenants because they want to live in the apartment themselves.

One piece of mail talks about some evil dot com millionaire who's been living in an apartment since college, and isn't about to give up his $550/month rent control, and his poor, elderly landlord, who wants to move into the apartment.

The other piece of mail I got about it talk about the poor elderly lady and the evil dot com businessman who bought the apartment building and wants to kick her out because he wants to live in the apartment. It doesn't explain why someone who made their money in tech would do something as stupid as buying an apartment house in Berkeley.

You get the feeling Berkeley doesn't like new money?

Threat or Tool?

[InfoVore]

As a resident of Denton County, Texas I find this particular Slashdot piece and its timing very interesting.

Two days ago I realized that I could not find my voter registration card. I needed the precinct information to find out my polling place for the elections on Tuesday. No problem, just go online and do a few searches and voila! I found the Denton County Voter Registration Database. I put in my name and date of birth and quickly got my voter information. I then skipped over and looked up the precinct map and found my polling place. Total elapsed time 5 minutes. Result: happy voter.

This morning I was shocked to read the Slashdot post about Dr. Evil and his diabolical plan to destroy the privacy rights of Denton County residents! After all, I had innocently used that SAME site to find information that I needed to be a responsible citizen, and I didn't even realize how exposed I was! My privacy was shattered! How dare anyone make my home address and gender easily available to ANYONE who knows the year I was born (yet another reason to lie about your age!) Yesterday I felt safe and secure. Today I feel... vulnerable.

After all, someone might use this fiendish web site in combination with the Phone Book (another devilish anti-privacy device) to actually obtain my telephone number! The horror!

In all seriousness, yes I am concerned about my both my online and offline privacy. I fully intend to contact my county officials and talk to them about Denton County's privacy policies, and about the web site in particular. The site could be more secure without limiting legitimate use. As a test, I did a search on "John Smith, 1950" and got instant access to a couple of voters' registration information. Should I have the ability to get that information about someone else? Probably not. Is having that information harmful to them? Probably not.

The bottom line is that we are still in "untamed frontier" days of the information age. People (government people included) are not always aware of the full consequences of their public actions. Vigilence and Courtesy are our best weapons to protect our interests and to keep society healthy.

IV

Re:Public records

[KahunaBurger]

Somebody cuts me off on the road, I get their license plate, look it up on my handy CD-ROM, and well, if I weren't such a nice guy, that person might start getting strange phone calls in the night, or have even worse things happen.

Worse indeed. I remember hearing recently about a proposal (nationwide, in one state?) to severly limit that sort of public access to liscense plate information. One of the biggest proponents was a local reproductive rights group, because protesters had taken to writing down liscense plate numbers of women coming to local clinics and launching harrassment campaigns against them.

Have we been so busy focusing on "Internet" privacy and controlling our information in corporate databases that we forgot about all the information in GOVERNMENT databases that's accessible to anyone just for the asking?

I share your concern about "just for the asking" but the two databases mentioned here are IMHO totally legitiamate records for government or law enforcement use. But once I believe that, we run into a catch 22 between privacy and buracracy. If you are doing a legitamate search for information and have to jump through a lot of hoops to prove your worthyness, theres annoyance at "government bloat" and "useless drones being paid out of MY tax dollars". But if you find that someone else has illegitamately accessed your info, you are understandably mad.

Personally I am all in favor of stronger controlls on plate information, which I think in most cases is only the business of law enforcement. Voter registration info on the other hand, in my state only tells you name adress, age, party affiliation and if they voted in the last election. It doesn't do much for a harrasser etc that the phone book wouldn't, but can be invaluable for a candidate for local election, or other political organizers. It does not ever tell anyone how you voted, which is the truely private and protected part of a democracy.

-Kahuna Burger

Public records

[IO ERROR]

The problem that PRIVACY Forum is trying to illustrate here is not that the records are available on the Web, but that they're public record in the first place.

In this state I can not only get a CD-ROM with the driver's license and vehicle registration for every licensed driver and vehicle in the state, I can get a subscription with quarterly updates!

Somebody cuts me off on the road, I get their license plate, look it up on my handy CD-ROM, and well, if I weren't such a nice guy, that person might start getting strange phone calls in the night, or have even worse things happen.

The only reason there isn't more of this kind of stuff happening is most people don't realize these things are public record, and so don't bother to go pick up a copy of the records!

Have we been so busy focusing on "Internet" privacy and controlling our information in corporate databases that we forgot about all the information in GOVERNMENT databases that's accessible to anyone just for the asking?
---

You cant change anything

[TotallyUseless]

Ok, im assuming you either didnt read the article linked, or that you didnt follow the link to the denton county registration site. I live in denton, and was very interested to see what info was available. it appears to be down now, so Ill go ahead and tell you. Everything there is static info. no, the 'password' is not so you can change info. it is just used to access the info. You couldn't go in there and 'deregister' someone as you claim. There is no real chance for fraud here, just a chance for people to get your address, which there are about 1000 other ways to do. I just thought someone needed to let everyone know what can be done at the site, since most of you prolly dont know someone registered in denton that you can plug their name and DOB into the site. Adios

Now I'm mad

[John Jorsett]

Michael: A silly privacy overreaction, IMHO. I believe voter records are public in every state and county in the U.S., and they are routinely used by police, journalists, political bulk mailers, etc.

You know, this really pisses me off. In fact, I'm so enraged that I think I'll come over to your house and have a word with you in person. What county did you say you lived in again?

Re:Why do you have to register?

[metis]

Yes, that the traditional explanation and it is correct. But it is also the case that voter registration is one of the mechanisms that keep voters tournout low. First, you cannot just decide to vote in the last moment. So a lot of people, especially the poor, and the young, are discouraged from voting. Likewise recent immigrants are discouraged by the requirement to register, because they are often fearful of the government. People who don't own their own home (again the young and the poor) are more mobile and less likely to go through a registration that depends on residence.

In addition, registration requires you to state your political affiliation. This is extremely important because it allows the two parties to draw the boundaries between districts in a way that protects their incumbents, making most congressional elections pretty meaningless and further depressing voters turnout.

Low voters turnout benefits the two parties because it makes politics easier to manipulate and undermines challengers, and it particularly benefits Republicans because it deppresses voters that are less likely to vote for them.

All in all, it is a beautiful and ingenious system.

Sustaining privacy isn't easy

[Vassily Overveight]

If you want to maintain privacy in this world, sometimes you have to go to great lengths. Recommended reading: How to be Invisible, by J. J. Luna. It isn't perfect, and some of its suggestions are probably more trouble than you want to go to, but it's an interesting read. Did you know that there's a national registry of new hires to which all employers have to submit the names of people they've just given jobs? I sure didn't.

So what?

[Kiss the Blade]

I don't see what the problem is. It just means that the parties are able to tailor their policies to the individual, and thats what democracy is all about, isn't it?

Increased data for the governers makes for better government. How are they supposed to govern without information about those they are governing, after all?

KTB:Lover, Poet, Artiste, Aesthete, Programmer.