The Independent View: Maryland Election Board Put Voters’ Personal Data at Risk

A report released by Legislative Auditors Friday says the Maryland State Board of Elections (BOE) needlessly exposed the full Social Security numbers of almost 600,000 voters to potential hacking, risking theft of those voters' identities.

The determination that Election Officials did not fully protect voters' personal information was one of several highly critical findings in the report. The Audit also faulted State Election officials' handling of issues including Ballot Security, Disaster Preparedness, Contracting, and Balancing its Books.

State Lawmakers called for a hearing in response to the Office of Legislative Audits report, which prompted strong reaction from critics of the Board and its longtime Administrator, Linda H. Lamone.

"This audit is an A-to-Z criticism of the way the board operates," said Michael Greenberger, Director of the Center for Health and Homeland Security at the University of Maryland School of Law. He said the "damning" findings call for the establishment of an Independent, Bipartisan Commission of Computer Experts to examine the Board's handling of Information Technology issues.

Doug Mayer, a spokesman for Gov. Larry Hogan, said the Report underscores some of the Republican Governor's longtime concerns about a "lack of executive oversight" at the Board, where the Day-to-Day Management is outside the Administration's control. "This is a perfect example of why those concerns are valid," Mayer said. "Properly securing Maryland's election data is critically important and needs to be given the utmost priority."

Lamone said she agreed with most of the Auditor's findings, but "virtually everything" they identified has already been addressed. "We were working on a lot of these things even before the auditors came in," she said.

The Audit found that the Board needlessly retained the full nine-digit Social Security numbers of about 592,000 Active and Inactive voters in its data base, or almost 15% of the State's 4.1 million Registered Voters, when only the last four digits were needed. The Report said the Board then shared voters' Personal Information, including Driver's License Numbers and the last four digits of Social Security numbers, with a Third-Party organization without ensuring that the Data was safeguarded.

The organization that received the data is the Electronic Registration Information Center (ERIC), a Nonprofit that helps State Election officials around the Country Identify Ineligible Voters. While Auditors did not question the Board's Cooperation with ERIC, they said State officials had not received sufficient assurances that ERIC and its Outside Contractor were adequately Protecting Data. Auditors warned that such information is frequently the target of criminals attempting Identity Theft.

Aviel Rubin, a Computer Science Professor at Johns Hopkins University who has frequently sounded alarms about Election Security, said the Report "exposes a lack of best practices in the area of securing personal voter data and protecting the information in their databases. This report tells me that the [elections board] is way behind the high-tech industry in maintaining the availability and security of their information," Rubin said. He said the Board "needs to get its act together and catch up with best practices in the industry."

Lamone said she's confident in the Protections her Agency has adopted to prevent Hacking. She said officials do not ask for Voters' full nine-digit Social Security numbers, but sometimes people voluntarily provide that information on Registration Forms.

The information the State provides to ERIC doesn't include full Social Security numbers and is Encrypted before it is sent, Lamone said. "You can't get into ERIC data. There's no way" she said. Lamone rejected Greenberger's call for an Independent Commission as unnecessary. "I think we're doing everything we can here," she said.

Lamone was appointed Elections Administrator under Democratic Gov. Parris N. Glendening in 1997. Under current Law, the Administrator is appointed by the five-member state Board, which the Governor is allowed to fill with three members of his own Party. Hogan's Board has a 3-2 Republican Majority, but State Law requires a 4-1 vote for the Board to take action. Lamone has kept her job with the support of the the General Assembly's Democratic Leaders.

In addition to the finding on Social Security Numbers, the Audit identified several other lapses in the State Elections process and in Board operations. According to Auditors:

- The Board did not ensure the Accuracy of its Voter Registration Rolls and allowed too many people, its Employees and those of Local Election Boards, as well as Contractors, to have Access to that Database when they did not need it for their job duties.

- Officials allowed Voters to receive Ballots solely by providing Publicly available information such as Name, Address, and Date of Birth. Auditors recommended they also require information such as the last four digits of the Social Security number to guard against Voter Fraud.

- The Board could not Document why it awarded two contracts worth $18.8 million without Competition. Auditors also found other Violations of State Procurement Rules.

- The Agency ended its 2015 Budget year with a deficit of $3.4 million that it could not explain.

Greenberger said the Report's findings are consistent with his dealings with the Board over the years. He said Lamone has run the Board as a "Personal Fiefdom" and has dismissed criticism by outside Information Technology Experts as Partisan attacks by Republicans. The Board's problems have less to do with dishonesty than with defensiveness and incompetence, Greenberger said. "It is one day going to play out during an election where the results will be called into question and there will be no adequate audit trail to determine who the winner of the election is," he said.

Two senators, one from each Party and both critics of Lamone, called for the Legislature's Joint Audit Committee to meet this summer to delve more deeply into the findings. "There are certainly things [in the report] I'd think would be troublesome to our voters," said Sen. Gail Bates, a Howard County Republican.

Sen. Cheryl Kagan, a Montgomery County Democrat, said the Agency has long been Mismanaged. "We've got a big election next year and voters have to have confidence that our State Board of Elections is performing in tip-top shape," she said. "This audit is clear evidence we're not there yet."