House Dems say voter data request poses serious cybersecurity concerns

Ranking members of the House Committees on Oversight and Government Reform, Judiciary, Homeland Security and House Administration, told Vice President Mike Pence in a July 18 letter that they want Kris Kobach to resign his position as vice chair of the Presidential Advisory Commission on Election Integrity and for Pence to void Kobach’s request for states to submit sensitive voter information.

Kobach, who is also Kansas' secretary of state, in late June asked election officials in all 50 states to submit publicly available voter roll information to the commission, including voters' full first, last and middle names; dates of birth; political party affiliations; last four digits of Social Security numbers; voting history dating back to 2006; and  a variety of other personal information.

State election officials have dug in their heels against submitting the data, and privacy advocates have filed lawsuits to block the action.

The 11-page letter from Reps. Elijah Cummings, (D-Md.), John Conyers, Jr., (D-Mich.), Bennie Thompson, (D-Miss.) and Robert Brady (D-Pa.) said that Kobach appeared to violate the Hatch Act by leveraging his role on the commission to pump up donations for his 2018 campaign to become governor of Kansas.

In early July, the Lawyers’ Committee for Civil Rights Under Law filed a federal lawsuit against the commission because it wasn’t operating transparently as required by Federal Advisory Committee Act. It also filed a Hatch Act complaint against Kobach.

In their letter, the congressmen said the commission’s “unprecedented” request also could expose voters’ personally identifiable information and put them at risk of cyber exploitation.

The letter also quoted a warning from former Department of Homeland Security Secretary Michael Chertoff’s July 5 Washington Post op-ed.  Chertoff said the order “risks running afoul” of President Donald Trump’s May 11 cybersecurity executive order because of inadequate protection for the data if it’s sent to the commission.

Kobach’s order, the democratic lawmakers said, directs state officials to send the personal information of “hundreds of millions” of voters via a “highly insecure means,” by emailing it to ElectionIntegrityStaff@ovp.eop.gov or transmitting it via a Safe Access File Exchange.

Both options’ cybersecurity protections, the legislators said, are woefully inadequate. Despite Kobach’s assurance that SAFE was secure, the letter said it uses Transport Layer Security protocols to upload or download files. That capability, they said, is email-enabled using a personal identification number, so “the PIN is only as secure as the email system.”

Additionally, the lawmakers said they were troubled by the commission’s attempt to “amass extensive voter data in a single, centralized database” without describing a plan to protect that database.

They also said the commission failed to show how it was following best practices for protecting private data as stipulated by the E-Government Act and that it has “refused to develop a Privacy Impact Statement” to describe in technical detail how it plans to guard the data from exposure.

The Democrats said that while White House lawyers have explained the commission is not legally required to file the Privacy Impact Statement because it is not an ‘agency’ under the E-gov Act, the commission still hasn’t told the public how it will protect the data.