“Financial gain is not the primary reason for the activity.”
Bill Clark/Zuma
More than 40 million voter records from at least nine states are being offered for sale on a dark web forum, and the seller claims to have records for an additional 20 to 25 states, according to Dark Reading, a news organization focused on information security.
The data was discovered by Jonathan Tomek, the director of threat research at LookingGlass Cyber Solutions, a cybersecurity services firm. The “dark web” refers to a part of the internet accessible only via a special internet browser that allows for semi-anonymity. The voter data for sale includes first, last, and middle names, voter ID numbers, birthdates, voter status, party affiliation, and addresses for some voters in Arkansas, Colorado, Connecticut, Delaware, Florida, Michigan, Ohio, Oklahoma, and Washington state.
Voter data is available in most states for a fee, but only for registered political parties, candidates, and their committees, and there is no standardized approach for accessing it. Each state treats the information differently and charges fees based on rates set by that state’s legislature, which range from $20 to more than $12,000.
Tomek told Dark Reading that the seller, known only as “Logan,” had already sold at least two copies of the databases earlier this week—the ones in Arkansas and Ohio—for only $2 each, although the identity of the purchaser is unclear. The low price indicates that “financial gain is not the primary reason for the activity,” Dark Reading wrote. “Logan” likely obtained the databases through open records requests to states or pulling data directly from state election websites. Another strategy is known as social engineering, in which someone is talked into providing access to otherwise restricted material by an individual who pretends to be someone they are not—in this case a candidate, election official, or representative from a political party.
“Logan’s” interests are not restricted to voting data, but he is “actively trading this information for other stolen items such as credit cards and login credentials,” Tomek said. Based on his research, Logan was not affiliated with any particular group and is likely acting alone. “I can say he is over 18, travels a bit internationally, and works for a cybersecurity company,” he told Dark Reading.
Dark Reading notes that this revelation of the sale of voter information comes amid the controversy over the creation of President Trump’s voter fraud commission, a group designed to bolster his unfounded claim that 3 to 5 million ineligible voters cast ballots in the 2016 US presidential election. The commission is run by Vice President Mike Pence and Kansas Secretary of State Kris Kobach, a man with a history of battling civil rights groups like the ACLU over voter access to the polls.