Merrill: The privacy of Connecticut’s voters must be protected

It should come as no surprise that my office is frequently asked to protect voters’ personal information. Voters are aghast when they learn that Connecticut’s voter file contains full address and full dates of birth. They are uniformly against my office sharing this much personal information, but, unlike the DMV, we are required to do so by law. There are plenty of causes for concern: Russian hackers, the growing influence of Big Data, concerns about identity theft, the end of dangerous and abusive relationships, and more.

I believe the voters are right. It is long past time to stop giving out so much personal information of Connecticut voters and allowing the voter file to contribute to this large, and growing, problem.

In October it was acknowledged that the personal information, including names, birth dates, Social Security numbers, and addresses, of more than 140 million Americans were hacked from Equifax, one of the three main credit rating agencies. This comes on the heels of data breach scandals from Target (70 million customers) and Home Depot (56 million). And there were similar scandals from Yahoo (twice –1.5 billion people), eBay (145 million), JP Morgan Chase (76 million), Anthem (80 million), and on and on. In many cases hackers were able to get bits of data that are the building blocks to identity theft.

According to Frank Abagnale, former identity thief and subject of the film Catch Me if You Can, “If you happen to tell me where you were born, your date of birth … then I’m 98 percent of the way to stealing your identity.” Brett Shannon Johnson, a convicted identity thief and once one of the Secret Service’s Most Wanted criminals, explained how easy it is to use personal information like birthdates and Social Security numbers to fraudulently obtain a background check, and ultimately credit cards and bank accounts.

John Sileo, author of Stolen Lives: Identity Theft Prevention Made Simple, called the birthdate the most dangerous bit of data that can fall into the wrong hands. And Alessandro Acquisti, a professor of IT and Public Policy at Carnegie Mellon University, demonstrated that the first five digits of a person’s Social Security number can be guessed with greater than 90 percent accuracy from a birthdate and a home state.

Connecticut shouldn’t be giving out the names, addresses, and birthdates of every registered voter to anyone who has $300 to buy the voter file. We should be making it harder for identity thieves to get full birthdates, not easier. We shouldn’t make it so our voter file is a $300 investment in future profits for commercial enterprises. We can’t let $300 be the only barrier between a stalker and the personal information of his or her victim. And we definitely shouldn’t allow our voter file to be weaponized to facilitate voter suppression.

When Connecticut residents register to vote, they should only be concerned about which candidates to choose, they shouldn’t have to worry that their personal information will be compromised.

This is why I am proposing An Act Protecting The Privacy Of Connecticut Voters, which will protect the personal information of Connecticut voters, while still allowing election officials and others involved in the practice of democracy, reporters and researchers, and state agencies to have the access they need. My bill will leave birth year in the voter file that is provided, but withhold the month and day, so that ages are available, but identity thieves can’t get usable information. My bill will also allow individual people to opt-out of publicly-released voter files to protect against safety concerns, as well as outlaw the use of the voter file for personal or corporate profit, or for voter suppression efforts. At the same time, all legitimate uses of the voter file, from the press, to researchers, to the jury pool, will be unaffected.

The days of our voter file being a potential tool of big data, voter suppression, and identity thieves are over. Connecticut voters deserve to know that registering to vote will not, under any circumstances, open them up to identity fraud, voter suppression, or harassment.

Denise Merrill is Connecticut’s Secretary of the State.