House Dems say voter data request poses serious cybersecurity concerns
- By Mark Rockwell
- Jul 18, 2017
Ranking members of the House Committees on Oversight and Government Reform, Judiciary, Homeland Security and House Administration, told Vice President Mike Pence in a July 18 letter that they want Kris Kobach to resign his position as vice chair of the Presidential Advisory Commission on Election Integrity and for Pence to void Kobach’s request for states to submit sensitive voter information.
Kobach, who is also Kansas' secretary of state, in late June asked election officials in all 50 states to submit publicly available voter roll information to the commission, including voters' full first, last and middle names; dates of birth; political party affiliations; last four digits of Social Security numbers; voting history dating back to 2006; and a variety of other personal information.
State election officials have dug in their heels against submitting the data, and privacy advocates have filed lawsuits to block the action.
The 11-page letter from Reps. Elijah Cummings, (D-Md.), John Conyers, Jr., (D-Mich.), Bennie Thompson, (D-Miss.) and Robert Brady (D-Pa.) said that Kobach appeared to violate the Hatch Act by leveraging his role on the commission to pump up donations for his 2018 campaign to become governor of Kansas.
In early July, the Lawyers’ Committee for Civil Rights Under Law filed a federal lawsuit against the commission because it wasn’t operating transparently as required by Federal Advisory Committee Act. It also filed a Hatch Act complaint against Kobach.
In their letter, the congressmen said the commission’s “unprecedented” request also could expose voters’ personally identifiable information and put them at risk of cyber exploitation.
The letter also quoted a warning from former Department of Homeland Security Secretary Michael Chertoff’s July 5 Washington Post op-ed. Chertoff said the order “risks running afoul” of President Donald Trump’s May 11 cybersecurity executive order because of inadequate protection for the data if it’s sent to the commission.
Kobach’s order, the democratic lawmakers said, directs state officials to send the personal information of “hundreds of millions” of voters via a “highly insecure means,” by emailing it to ElectionIntegrityStaff@ovp.eop.gov or transmitting it via a Safe Access File Exchange.
Both options’ cybersecurity protections, the legislators said, are woefully inadequate. Despite Kobach’s assurance that SAFE was secure, the letter said it uses Transport Layer Security protocols to upload or download files. That capability, they said, is email-enabled using a personal identification number, so “the PIN is only as secure as the email system.”
Additionally, the lawmakers said they were troubled by the commission’s attempt to “amass extensive voter data in a single, centralized database” without describing a plan to protect that database.
They also said the commission failed to show how it was following best practices for protecting private data as stipulated by the E-Government Act and that it has “refused to develop a Privacy Impact Statement” to describe in technical detail how it plans to guard the data from exposure.
The Democrats said that while White House lawyers have explained the commission is not legally required to file the Privacy Impact Statement because it is not an ‘agency’ under the E-gov Act, the commission still hasn’t told the public how it will protect the data.
Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.
Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, tele.com magazine and Wireless Week.
Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.
Click here for previous articles by Rockwell.
Contact him at email@example.com or follow him on Twitter at @MRockwell4.