About those discs…

Cross posted from ICPR's blog, The Race is On:

The news that the Chicago Board of Elections released information "ideal …for identity theft" on as many as 1.3 million voters has gotten a lot of coverage in the traditional media and on-line. Most of the coverage has focused on the personal privacy aspects of the release. There's another angle to it, though, as related to election law, and that hasn't gotten covered. These are just questions; we aren't saying conclusively that mistakes were made. And yet the current explanation leave open a series of concerns.

First about the scope of the release. Press reports suggest that data on about 1.3 million voters were on the files, which were initially released in late 2003 and early 2004. The Chicago Board of Elections website notes that there were 1,334,909 voters registered for the March, 2004 General Primary Election. So is it accurate to say that data on all registered voters was on those discs? As a mitigating factor, it's worth noting that not all voters gave their full Social Security numbers when they registered; many, especially those who registered with motor voter forms, gave only the last four digits of their social security numbers or their drivers license numbers, which may mean that identify theft is less of a concern for them than for others. But still, do the discs include every voter in the City of Chicago in late 2003?

If, indeed, the file includes every voter in the City of Chicago, then it's got some interesting names. Just to give a sense of the scope: the mayor and all of the sitting aldermen are probably listed. The Speaker of the House and the Senate President, among other legislators, who now may want to change the laws to prevent this from happening again. All of the statewide constitutional officers, and about a third of our congressional delegation would be there. Press reports suggest that lawsuits have been filed in state and federal court; if the discs included all voters, then it's likely that most of the Circuit's trial judges, and also most of the District's appellate judges, are on these discs. Heck, three-fourths of the state Supreme Court are likely included.

Press reports also suggest that about a hundred copies of the discs were distributed in "late 2003 or early 2004" and the Tribune notes that another half dozen or dozen were distributed recently. If that's accurate, was the Chicago Board of Elections giving out three-year-old data recently? Last October, they announced (PDF) new voter registration totals, including 61,875 new registrations since the 2006 March Primary. Were those not included in the "recently distributed" file? If not, that's lucky for the voters who weren't included, but why were some candidates and campaigns given old data? Were other candidates and campaigns given newer data? Or was the same mistake repeated in all discs distributed over the last three years?

An amendment to Illinois election law, PA 93-574, which took effect in August, 2003, said that Boards of Election could give electronic data files only to candidates and committees. We assume, then, that the 100 or so discs that were distributed in late 2003 and early 2004 went to the campaigns of sitting aldermen and city-wide officials, and some ward committees. In July, 2004, PA 93-847 changed the law to allow distribution of electronic data to governmental entities for governmental purposes. Did anybody else get this data? If so, were they also given the older 2003 version of the data or did they get newer data? Did any of their discs include social security data?

Finally, the stories suggest this but don't say explicitly, so it bears asking: did discs distributed to any of the 264 candidates who filed for Chicago office in December all contain the same current data, without social security numbers?

The release of voter files that include social security records is troubling on many levels. Privacy is certainly one of them. But there are other aspects to the release of this data that deserve explanation.