Questions about the security and integrity of California voter information have surfaced after a Southern California district attorney described online tampering incidents in which residents’ party registration was changed without their knowledge.
On Wednesday, Riverside County District Attorney Mike Hestrin said a preliminary investigation revealed that party affiliations were changed without voters’ knowledge or consent. Whoever did it had access to their private information, such as Social Security numbers, he said.
Because the state website didn’t retain IP addresses — digital fingerprints showing a computer’s location — the trail has gone cold and there are no suspects, Hestrin said.
Having their party registration switched was especially problematic for Republican voters, who needed to be registered with the GOP to vote in the party’s June 7 primary.
California Secretary of State Alex Padilla could not be reached for comment Thursday. A spokesman said Padilla was not available for an interview.
But in a statement issued by his office, Padilla, an elected Democrat, appeared to rebut Hestrin’s claims.
“We have not received any substantiated claims from district attorneys and county registrars of unauthorized political party affiliation changes,” the statement said.
“ … Out of millions of online and paper-based voter registration transactions during this election cycle, we received a minuscule number of allegations of voter registration changes,” the statement said. “Our office looks into each allegation of unauthorized voter registration changes.
“Fortunately, such reports are very rare, and in most cases, the changes are attributable to inadvertent mistakes. In many cases, voters made a mistake while attempting to update their voter registration, simply forgot their registered party affiliation, or could not locate their name on the voter rolls at their polling place. These changes are often made years ago, or on paper voter registration cards.”
Many voters who said their party affiliations weren’t correct ended up using provisional ballots, which take longer to count because the voter’s eligibility has to be verified, or not voting at all.
John Hall, a spokesman for Hestrin’s office, said it’s not clear at this point whether the tampering was the work of one person or a group. The district attorney’s office reported fielding dozens of complaints from voters whose party affiliations were switched, although some switches were chalked up to voter confusion.
Asked how officials know there was tampering, Hall said: “There is information about when someone logged onto the website and a victim or victims said they did not log in on that date and time.”
The tampering “seems to be somewhat random and somewhat unsophisticated,” Hall said.
Riverside County has almost 910,000 registered voters. Hestrin’s office reported receiving a few dozen complaints.
‘Serious problem’
It’s unclear to what extent what happened in Riverside County happened elsewhere. Officials in San Bernardino County did not respond to requests for comment.
Orange County Registrar of Voters Neal Kelley said that periodically, “We will field calls from voters insisting that they didn’t register one way and yet, when we examine the digital paper records and/or online registration audit trail, we can show where they in fact registered, in their own hand, a specific way.”
Brenda Duran, a spokeswoman for the Los Angeles County Registrar of Voters, said her office “did receive inquiries or reports from voters in Los Angeles County that their party preference was listed incorrectly for the June 7 presidential primary.
“We continue to review our records and to look into specific inquiries or referrals where the voter has provided specific information that we can check,” she said. “At this time, we have not identified any pattern or indication of wrongdoing. If, in the course of our review, we identify anything of that nature, we will refer that information to the Secretary of State’s office and the Office of the District Attorney, Public Integrity Unit.”
Online registration
Thirty-one states, including California, have online voter registration, while another seven have passed legislation to create online registration systems but have yet to implement them, according to the National Conference of State Legislatures. California’s system launched in 2012, according to the conference website.
“While no fraud or security breaches are known to date, security for online voter registration is an essential element of system design,” read a summary on the website, which featured an interview with J. Alex Halderman, a computer scientist at the University of Michigan who specializes in election technology.
“There is a wider issue because you’re putting your voter registration database where it can be modified over the Internet,” Halderman is quoted as saying in the interview, which took place at the end of 2012.
“You want to be sure that the system has security testing and engineering to be sure you have the best precautions in place. In any case, when a voter changes the address online, the election officials should make sure to send a card to the old address and the new address, in case the change has been made falsely.”
Firms exist “that do computer security consulting or penetration testing; for them it would not be a massive undertaking to work on a system of this complexity,” Halderman added. “It would be a relatively small project. … This is a necessary expense.”
“There is plenty of room for improvement in the conventional paper-based registration process,” he said. “The worry with the computer-based systems is that it might be easier to conceal large fraud, where it’s hard to trace back.”
In his statement, Padilla said his office “implemented security protocols designed to validate and protect that the person is actually who they are representing themselves to be, by requiring personally identifying information, such as (a) Social Security number, driver’s license number (and) date of birth.
“Additional safeguards exist — when a voter’s registration information is changed, whether it results from a paper-based or online voter registration transaction, county elections officials notify voters, by mail, that changes were made. A sample ballot is sent to every voter by county registrars.
“Also, voters have the ability to check their voter registration status either online (in the majority of counties) or over the phone and monitor at any time whether changes have been made.”
After reading about what happened in Riverside County, Matt Bishop, a professor in the computer science department at UC Davis who specializes in computer security, said it appears that while the state system itself wasn’t compromised, “the mechanisms for identifying people were.”
“I don’t view this as something to get really panicked over,” he said, noting that voters challenging the accuracy of their listed information can vote provisionally. “It’s not like voting machines changing people’s votes.”
No systemic fraud
This election season already has been rife with anger from voters who see a rigged system and a pre-determined outcome.
At least some supporters of Democratic presidential candidate Bernie Sanders believe California’s primary was rigged to favor presumptive Democratic presidential nominee Hillary Clinton, and they lashed out at media outlets that predicted Clinton would secure the nomination before Californians went to the polls.
Ben Bishin, a political science professor at UC Riverside, doesn’t think what Hestrin said this week will have a great effect on perceptions of the political system or elections. There’s no evidence of systemic voter fraud, he said.
Republicans, Bishin said, have long insisted on voter ID and other measures to prevent voter fraud while Democrats view those moves as attempts to suppress their voters.
“The parties have already sent signals on this,” he said. “So people who care about the issue are already polarized.”
John Berry, a cabinet member in the Redlands Tea Party Patriots, said he wasn’t surprised by Hestrin’s statements.
“The only news here is that the media is actually noticing it. This has been going on for quite a while,” Berry said. “It’s nice to see that law enforcement is waking up to a serious problem that’s already been there.”
CHECK YOUR VOTER STATUS
If you’re wondering whether you’re registered to vote in California, or if you want to check the accuracy of your registration, go to: www.sos.ca.gov/elections/registration-status/
If something’s amiss, you can contact your local registrar of voters office.
Think there’s fraud? Go to www.sos.ca.gov and search for “voter complaint.”