Voters at the polls (photo: Michael Appleton/Mayor's Office)

Voter data reporting laws must provide for voter privacy. Our elections are some of the most secure in all of the world, and at a time when voter confidence faces threats from false claims of fraud, it’s all the more important that voter data be held in a secure way. As cities and states seek to enhance confidence in their organizational competency and the validity of elections, statutes demanding access to auditable public election records are increasingly commonplace.

Election data is a public good because it allows any interested person to double check ballot tabulations and conduct useful research on voter behavior. But without sufficient data security provisions, releasing voter data risks our protections guaranteeing the right to cast a secret ballot.

New York City just experienced such a lapse. Three researchers used two publicly available data sets and two lines of code to identify how 378 voters voted in the 2021 primary elections. As The New York Times recently reported​​, the disclosure included high-profile voters that expressed their dismay at the invasion of their privacy.

We are those researchers. Our ability to identify these voters and their choices does not rely on any hyper-technical skills, it was based on simply knowing where to look and how to expose data privacy lapses in a straightforward way. Other people, with a variety of reasons in mind, can and will be able to do the same thing in elections moving forward unless governments act to shore up their data practices. Fortunately, the technical solutions are easy to implement. The political solutions, however, must be addressed first. 

On August 18, 2021, the New York City Board of Elections released vote records for the June primary election. The records released from the first ranked-choice voting election in New York City are called the cast vote record (CVR). Each CVR lists the ranked choices each voter cast in the Democratic or Republican primary election as well as the Assembly District (AD) and Election District (ED) for each ballot. To keep voter choices private, a de-identifying step is taken in which CVRs are associated with numerical identifiers rather than voter names before they are released publicly.

But, in some AD/ED voter locations only one person showed up to vote in the election. In those cases, we were able to use the New York State voter file (obtained through a standard Freedom of Information Law request) to check which registered voters participated in the election at all. The voter file contains the data on which voter participates in which election, but nothing about individual choices. However, when there is only one voter who turned out for a particular party in a particular AD/ED, it becomes clear who voted and for which candidates in each election. 

Given this alarming lapse in voter privacy we contacted the New York City Board of Elections hoping to point out the error and suggest a simple-to-implement technical solution. 

We spoke with the BOE and brought this issue to their attention through a phone call with a bipartisan delegation from the board as well as the BOE General Counsel, Hemalee Patel, on September 13, 2021. The BOE was aware that this problem may arise but the representatives noted that we were the first research team to find it and bring it to their attention. They indicated that this voter privacy problem is a result of the reporting requirements that mandate the board makes the data publicly available in a certain format, with no flexibility to group single-voter AD/EDs. According to the BOE, this problem can only be corrected by a change to the New York City Charter or New York State Law.

The solution to this privacy issue is not to restrict the data sources employed in our analysis. These data sources -- both the CVR and the New York State voter file -- are integral to evaluating the performance of elections. The CVR is necessary in order for people to audit the Board of Elections and its tabulations, while the voter file is necessary for voting rights groups to ensure that districts are drawn fairly and equitably to ensure proper representation, among other reasons.

If the voter file is restricted, it will effectively only be available to political parties, super PACs, interest groups, and political campaigns due to their special access and ability to pay. Instead, if data reporting requirements are changed to require very low single-voter AD/EDs to be bundled with neighboring AD/EDs, this identifying operation becomes nearly impossible in cases where pooled voters cast votes for different candidates. Similar measures are taken by the Census Bureau every ten years in order to protect privacy in rural areas and in small city blocks, where random “noise” is injected into the data or entries are swapped between geographies or bundled so that small, singularly identifiable entries are not released. 

Similarly, the solution is not to end the practice of ranked-choice voting. While this came about through the results of the election, there is nothing preventing us from conducting this same operation in an entirely different system, whether it be a traditional plurality system or an alternative system such as approval voting, single transferable vote, or a party-list voting. The issue is the data reporting requirements, not the data itself.

It is our hope that by raising this issue we may better protect the privacy of voters in New York City, and voters around the United States. When issues of voter data and privacy are involved we need more than elected officials and appointed bureaucrats at the table — academic researchers, lawyers, voting scholars, and election administrators must be involved as we formulate and implement government policy on voter privacy. 

This operational fix would be incredibly simple from a technical standpoint and would not cost the New York City Board of Elections any more than a few minutes of staff time. But importantly, it would protect the privacy of these voters, who cast their ballots under the good-faith assumption that their privacy is protected by law. The City Council or the State Legislature needs to act so that boards of elections can implement better data stewardship practices in the future.

***
Lindsey Cormack is an Assistant Professor of Political Science at the Stevens Institute of Technology. Jesse T. Clark is a Postdoctoral Researcher at the Electoral Innovation Lab, Princeton University. On Twitter @DCinbox and @electionclark.