The recent request from President Donald Trump’s vote fraud commission for a mountain of sensitive data from the states sparked a backlash and baffled many officials — not only because of concerns about privacy and security but because an organization already exists doing much of the same work.
“There’s no reason to re-invent the wheel when we’re already here…and we do it very well,” said Shane Hamlin, executive director of the Election Registration Information Center, also known as ERIC.
ERIC is a non-profit group currently made up of 20 states — both red and blue — and the District of Columbia that shares large amounts of sensitive voter data to root out possible fraud, ensure more accurate voter rolls and encourage registration.
Hamlin, a former election official in Washington State, said he was stunned when he read the letter from Trump's commission seeking voter information from all 50 states.
"It wasn’t clear how they were going to protect the data and generate results that were actually going to be usable,” he said. “If you have garbage in, you’re going to get garbage out."
Marc Lotter, a spokesman for the panel’s co chair, Vice President Mike Pence, has said the letter was the start of a “fact-finding process.”
The Presidential Commission on Election Integrity was formed by Trump in May through executive order to study “vulnerabilities” in the election system. It was born of the unfounded claim by the president that “millions” voted illegally in the 2016 election, costing him the popular vote against Democratic rival Hillary Clinton.
The letter asked for publicly available data, as well what some state officials consider confidential and personal information, including partial Social Security numbers, felony convictions and military status. So far, 48 states — including Kansas, where panel co-chair Kris Kobach serves as secretary of state — are not fully complying with the request.
The effort was especially galling to Hamlin since he was a part of a core group, which included privacy, technology and data experts, as well as state election officials, that spent more than three years building intricate and extensive security protocols, agreements and methodologies for ERIC before it was officially launched in 2012, with seven participating states.
“None of those frameworks seem to be in place by the commission,” Hamlin said.
By comparison, the Trump panel gave states two weeks to turn over millions of voter files before several lawsuits filed this month by privacy and civil liberties groups halted the work of the commission, which will hold its first public meeting in Washington, D.C., on Wednesday.
David Becker, the executive director and founder of the Center for Election Innovation & Research, was also a part of the team that helped set up ERIC.
“Every chance they had, they went the wrong way,” Becker said of the Trump commission. “This is a textbook study on how not to use data.”
“There is no comprehensive security plan, no detailed methodology or outline,” he added about the commission’s data request.
By sharing data, ERIC can allow a state to identify a voter who is registered in another member's state and the group also uses federal data to track deaths so that voter rolls can be purged and kept up to date. Other information helps identify potential voters so residents can be encouraged to register if they aren't already.
ERIC has access to a wide array of federal and state data: Voter registrations; driver's licenses; national change of address information and Social Security records of deaths.
Hamlin said his organization takes great care to "anonymize" data before it is shared so there is little danger any personal information about voters could be compromised. That works by masking sensitive data like Social Security numbers when it is transmitted with only the receiving state being able to understand the information.
For instance, if a Social Security number is transmitted to check a case of possible double registration, it is first transformed into a set of unique characters. The receiving state can match those unique characters with what would be the same unique characters of that Social Security number — but the actual number itself is never shared among states or known to the states.
Hamlin said he had to ensure the “technical structure was in place” to convince states to agree to join ERIC and to recruit additional states which he is now trying to do. Some states may be hesitant to take part because of lingering security concerns, and the effort to put in place the required legal agreements and the technical infrastructure, as well as the $25,000 ERIC membership fee.
ERIC has detailed data-sharing, technological and compliance agreements with local, state and federal agencies. It also required that some states, such as Alabama, enact legislation to give election officials the authority to share and collect certain information.
The data is exchanged using a system set-up by ERIC and the servers have “multiple layers of physical security” and cyber protections to thwart hacking, Hamlin said. Also, the raw data is never stored in a central location or shared publicly, contrary to what the Trump panel said it planned to do.
There have been no major instances of any unauthorized disclosure of voter info since ERIC was founded, Hamlin said.
John Merrill, the Alabama secretary of state said ERIC, along with other efforts pushed by his office, has helped register more than 700,000 voters in the state since 2015, when he took office. With info gleaned with the help of ERIC, Merrill's office reaches out to eligible but unenrolled voters to get them signed up.
In Alabama, ERIC also has prompted the removal of more than a quarter million names from the voter rolls in the state after determining that many had died, moved to other states or committed crimes that made them ineligible.
"That has worked very well for us,” said Merrill, a Republican.
Merrill said he had concerns before joining ERIC about the safeguarding of confidential information.
"The main thing that we wanted to make sure that any list was going to protected for integrity, that it was safe and secure and that it would protect the people of Alabama from having their records modified or having their records manipulated,” he told NBC News.
He said the Trump panel’s request troubled him and he declined to release sensitive data and will only hand over public data if the panel pays the $30,000 price tag that is required for anyone who wants to buy that info.
“What benefit are you going to provide member states?" he asked of the Trump panel's efforts. "That was one of the questions that I had that I don’t have an answer to.”
ERIC is routinely audited, Hamlin noted, to make sure the organization is in compliance with federal and state laws.
“You don’t need a Ph.D. to figure this out,” Becker said. “Define the problem you’re trying to solve, figure out how you might identify this problem, then you get into issues of methodology and the type of data you want.”
“You want to get the right answer to this,” he added. “You don’t want to create hysteria.”
