As states have pushed back on turning over data to the Presidential Advisory Commission on Election Integrity, officials are modifying their statements about what kind of information will be released to the public and how it will be transmitted.
In a June 28 letter to states requesting voter information, Kansas Secretary of State Kris Kobach (R) advised states that “any documents that are submitted to the full Commission will also be made available to the public.” But in a court filing Wednesday as part of a privacy lawsuit to stop the committee from collecting information, Kobach said he only intends to make public the “narrative” information he gets from states, and that he intends to “de-identify” personal voter data before making it public.
“My letters state that ‘documents’ submitted to the Commission will be made available to the public. That refers only to the narrative responses,” he said in the court filing.
A White House official elaborated on the filing, saying the “narrative responses” refer to seven questions Kobach posed to state officials about election administration, and that the commission “will not release any personally identifiable information to the public.”
Republican and Democratic election officials have expressed skepticism over Kobach’s request for publicly available voter roll data. Some states have outright refused to comply, while others say they will only provide information that is already public. A few officials have said they are barred by state law from sharing any information from the public.
The Kobach filing came in response to a request by the Electronic Privacy Information Center for a federal judge to issue a temporary restraining order against the commission. In justifying their request to stop the committee’s work, EPIC lawyers argued the commission hasn’t conducted a legally required privacy impact assessment. Collecting this kind of information, lawyers argued, could cause “irreparable injury” because the commission does not have a secure way of storing voters’ data.
Bob Gellman, a privacy consultant who worked on Freedom of Information Act issues on Capitol Hill for two decades, said he believed the commission was not subject to FOIA because it was not an agency and its purpose was to advise the president. While Gellman believes the commission has discretion to choose what kind of information to release, it’s less clear what public disclosure obligations they have under the 1972 Federal Advisory Committee Act, a separate law.
Regardless of whether personal details are released, building a massive national database of voter data would raise serious privacy and security concerns, said William McGeveran, a privacy expert and professor at the University of Minnesota Law School.
“One of the reasons that a lot of privacy advocates are concerned is that they keep changing their story about what they’re collecting, what they’re releasing and how they’re storing it,” McGeveran told HuffPost. “As a matter of just sound judgment, information that includes things like [the] last four digits of Social Security needs to be held in a really secure way. And the more information like that you aggregate together, the more attractive a target it is for hackers.”
Michael Chertoff, the former secretary of the Department of Homeland Security, voiced a similar concern in a Washington Post op-ed on Wednesday, arguing that compiling a massive amount of voter information in one place could pose a national security threat.
In his initial letter to states, Kobach said officials could “submit your responses electronically to ElectionIntegrityStaff@ovp.eop.gov or by utilizing the Safe Access File Exchange (‘SAFE’), which is a secure FTP site the federal government uses for transferring large data files.” Some raised concerns that the request to transmit information over email meant the information could be vulnerable to hacking.
But in this week’s filing, Kobach said he only intended for states to submit the eight narrative responses by email. EPIC noted that Kobach offered no explanation for the discrepancy, and said that even the file exchange program Kobach wants to use doesn’t present enough protections for voters’ data.
“The Commission has not provided any evidence that the File Exchange system is designed, or even permitted, to be used to transfer sensitive personal information,” EPIC lawyers wrote in their filing. “The Commission also has not established that it has the authority to use the File Exchange system for this purpose, or that it has the authority to use ‘the White House computer system’ to store the personal data of hundreds of millions of voters.”
The prospect of storing information on White House computers is also notable because the original executive order said the committee would be supported by the General Services Administration. If GSA held the data, Gellman said, it would be subject to additional privacy requirements.
McGeveran said the commission’s cavalier attitude toward storing sensitive voter information is alarming.
“Of course we know the federal government has been hacked for personal information multiple times,” he said. “The fact they are being so flippant about how it’s going to be transmitted and where it’s going to be stored and [changing] their story... I have concerns about this plan not being carefully thought out and presented in advance.”