Georgia Secretary of State says bug in new web voter portal briefly spilled personal data

At the beginning of Monday’s rollout, that page briefly auto-populated that information – so if you got past the first step of entering a name, county and birth date, the page would have displayed the drivers’ license number or the last four social security number digits of the person whose name was entered.

“What it was doing, instead of generating a fillable form, it was generating it with (personal identifiable information) already filled in,” said Mike Hassinger, spokesman for Georgia Secretary of State Brad Raffensperger’s office. “So yes, that data should have been masked, but it wasn’t like all voters were exposed. On your screen, if you’re canceling yourself, on your screen you would have seen your own data. That’s it.”

Hassinger said the problem was quickly fixed, and the office recorded 33 attempts to use the site on Monday. He said about 15 were internal tests of the system.

“Nobody’s voter data was exposed to the general public or leaked out on the internet,” he said. “It was available on their screen for about an hour, hour and a half.”

The Current reported on a separate but related privacy problem that could have exposed the information within the website’s code.

“It was the same root cause that showed up in two places, one visible to anyone, and the other visible inside the HTML code – but only if somebody (like a web developer) knew how to inspect the HTML,” Hassinger said.

Both issues have been resolved, but the flaws have highlighted complaints from Democrats and voting rights advocates about the service.

The Georgia Legislature, following former President Donald Trump’s 2020 loss and false allegations of election fraud, has introduced new measures intended to make challenging mass numbers of voter rolls online easier.

A 2021 Associated Press review of every potential case of voter fraud across six battleground states in the 2020 election found fewer than 475 cases, including just 64 in Georgia, too few to have affected the election’s outcome. President Joe Biden defeated Trump in Georgia in 2020 by nearly 12,000 votes.

Republicans largely argue that states should do a better job of quickly removing the voter registrations of dead people and those who move out of state to prevent potential fraud, while Democrats tend to say election fraud is rare and governments should focus more on ensuring anyone who wants to vote can do so.

Tamieka Atkins, Executive Director of ProGeorgia, a left-leaning organization with a goal of increasing access to the ballot, said the website attempts to solve a problem that is not real.

“I am unclear about what the added value is of this type of website and how it promotes the administration of our election and how it protects vital and critical information that belongs to George voters,” she added.

Democrats characterized the site as an easy way to file frivolous voter challenges.

“This ‘voter cancellation’ portal was already ripe for abuse by the very people submitting mass voter challenges meant to shrink the electorate by disenfranchising Georgians,” said Democratic Party of Georgia Executive Director Tolulope Kevin Olasanoye. “On top of that, its botched rollout has now jeopardized the voting rights and the personal identifying information of Georgians across the state. Rushing to implement election system updates to appease weird conspiracy theorists raising unfounded concerns about non-existing voter fraud – because they still can’t accept their candidate lost in 2020 – makes this situation both unacceptable and all too predictable.”

Hassinger said those kinds of complaints are overblown, arguing that canceling one’s voter registration using the website is more secure than submitting forms by mail or email.

“This portal is protected and encrypted and is designed to let voters cancel their own registration or that of a recently deceased loved one quickly, conveniently, 24 hours a day over the internet,” he said. “If you wanted to cancel me, you’d have to know my name, the county I live in, and either my driver’s license number or the last four of my social.”

Completed requests go to the local county election office of the requested cancelee. The local official’s job is to send out a postcard to the voter’s registered address telling them that their cancelation request was received and to contact the office if the request was made in error.

Hassinger said Georgians using the site to fraudulently cancel another voter could be convicted of a felony and sentenced to up to ten years and fined up to $100,000.

Atkins said those assurances don’t comfort her. She said voters routinely throw away communications from the Secretary of State’s office as junk mail, and the ability to cast a provisional ballot is no substitute.

“A lot of folks walk in and don’t know that that is an option,” she said. “They are looked up on the voter rolls and if a poll worker is not trained to check, they are turned away. That happens a lot, it’s miscommunication. That’s why we do so much voter education and voter information. So voting provisionally is not the answer. Adding additional barriers and making it more difficult for Georgia voters to have their ballots counted is not the answer.”

This story was provided by WABE content partner Georgia Recorder.