Aug 03, 2020

Privacy concerns shadow popular voter registration website

Posted Aug 03, 2020 7:23 PM
The ksvotes.org website offers the best platform for registering to vote online, but language in the privacy policy raises concerns about the data being collected and whether it could ever be used for political purposes. (Sherman Smith/Kansas Reflector)
The ksvotes.org website offers the best platform for registering to vote online, but language in the privacy policy raises concerns about the data being collected and whether it could ever be used for political purposes. (Sherman Smith/Kansas Reflector)

At Democrat-backed ksvotes.org, voters agree to let lease personal information in exchange for better platform

By SHERMAN SMITH
Kansas Reflector

The 41,700 people who have turned to ksvotes.org as a superior alternative to the state’s primitive online platform for voter registration probably don’t realize they signed away their personal information to be used in targeted advertisements.

Language in the site’s privacy policy gives permission to Blueprint Kansas, the organization that operates ksvotes.org, to collect contact information, website usage, details about your phone or laptop, and all the elements of a voter registration form — and use this personal data to send direct texts, or give the data to other entities, such as Facebook.

A data security expert says the privacy policy should be revised, but Blueprint Kansas’ Democratic officers deny using the data they collect for political purposes. Republicans fear the platform could be used as a tool for Democrats to bolster their ranks.

“We’re in a strange time right now in the state of Kansas,” said Mike Kuckelman, chairman of the Kansas Republican Party. “We’re seeing millions of dollars come in from out of state trying to influence the Republican primary in the U.S. Senate race. If you think that people won’t undertake underhanded efforts to affect elections, that’s a pretty naive view.

“So I’m skeptical of sites like this, of what they’re really going to do with the data and what kind of an unfair advantage they’re going to give.”

As a 501(c)(3) nonprofit, Blueprint Kansas is prohibited from partisan activity.

Brian McClendon, the former Google executive and 2018 Democratic candidate for secretary of state, said he and the three others involved with Blueprint Kansas never have harvested data for political purposes. The organization only sends messages reminding people to vote, he said, and has never made the information available for campaigns to use.

Other officers for Blueprint Kansas are Jamie Shew, a Democrat who oversees elections as Douglas County clerk; Kate Davis, a legislative liaison in Democratic Gov. Laura Kelly’s office; and Patrick Miller, a registered Republican and political science professor at the University of Kansas.

“We have never sat down and said, ‘Well, what can we do to screw Republicans or benefit Democrats?’ â€ Miller said. “We don’t talk about partisan things. We don’t have partisan goals. We just want a tool that’s going to make registration and ballot access easy for as many people as possible.”

‘Commit to it’

A link to the ksvotes.org privacy policy can be found at the bottom of the website, below the form that asks for name, date of birth, zip code, email and phone number.

Language in the ksvotes.org privacy policy allows the site to collect more personal data than what voters enter into their registration forms, and turn that data over to third parties for advertising. (Illustration by Sherman Smith/Kansas Reflector)
Language in the ksvotes.org privacy policy allows the site to collect more personal data than what voters enter into their registration forms, and turn that data over to third parties for advertising. (Illustration by Sherman Smith/Kansas Reflector)

From the policy: “We may disclose personal information that we collect or you provide as described in this policy to third parties we use to support our business, including advertising.”

Lorrie Cranor, director of the CyLab Security and Privacy Institute at Carnegie Mellon University, said her hunch is the operators of ksvotes.org only want to use the information to support the site, but the privacy policy is written too broadly to be sure.

“They didn’t make me completely convinced that the data wouldn’t be used for reasons that the users don’t want,” Cranor said.

Because the privacy policy allows Blueprint Kansas to partner with third parties, Cranor said, the group could obtain personal information from Google or any of the “gazillion advertising companies” that track the types of websites individuals visit and search terms they use.

In skilled hands, as a hypothetical example, the pairing of a marketing profile and voter registration data could allow someone to target messages to registered voters of a particular party who have visited websites affiliated with the Catholic church.

All of the individuals associated with Blueprint Kansas deny using the data in this way. Sam Coleman, a spokesman for the governor, said Davis’ duties for the governor involve working with legislators, stakeholders and advocates. He said Davis hasn’t provided data from ksvotes.org to the governor’s office, campaign or political allies.

“Unequivocally no,” Coleman said.

Even if that is true, Cranor said, the language of the privacy policy indicates the operators of ksvotes.org eventually want to use the data for additional purposes.

“If they are not actually doing any of that tracking, then they should put it in writing and commit to it,” Cranor said. “Because otherwise, OK, so you’re not doing it today. And then tomorrow, you start. I’ll never know when you’re gonna start doing it because you’ve put it in your policy that you could do it.”

Kuckelman, the GOP chairman, said as an attorney, he advises clients when they sign an agreement, “read what it says they can do and assume that they will, because they have every right to do that.”

“When you go to this site, by agreeing to their terms, you agree they can give that information they collect to the third parties — including advertising, including businesses,” Kuckelman said. “They can do it, so I’m not sure what difference it makes what they say.”

‘Incredibly valuable’

McClendon oversaw construction of ksvotes.org, which launched in 2017 in direct response to a proof of citizenship law favored by former Secretary of State Kris Kobach.

Before a federal judge struct down the law as unconstitutional, Kansas required prospective voters to produce a copy of their birth certificate when they registered to vote.

As a result, McClendon said, online voter registrations dropped considerably.

He seized an opportunity to use the less restrictive federal voter registration form and bypass Kansas law. The ksvotes.org platform delivers a PDF to county clerks and sends verification to the voter that the registration was received. In 2018, a Spanish language version of the form was added to the site, as well as a function to request advanced ballots.

This year, starting in April, more than 29,000 people have requested an advanced ballot through ksvotes.org — including more than 14,000 in the month of July, according to numbers published directly through the site. McClendon, whose technological aptitude includes creating Google Maps, said he can determine who has requested a ballot but not yet turned it in, and send the individual a reminder to do so.

“The fact of the matter is people who ask for an advance ballot are going to vote 90% of the time,” McClendon said. “So getting folks to request an advanced ballot is just like getting them out to vote, and I think that’s incredibly valuable.”

The state’s official online voter registration platform, offered by the Secretary of State’s office and Kansas Department of Revenue, doesn’t respond to smartphone screens or other mobile devices. (Screenshot)
The state’s official online voter registration platform, offered by the Secretary of State’s office and Kansas Department of Revenue, doesn’t respond to smartphone screens or other mobile devices. (Screenshot)

By comparison, the Secretary of State’s voter registration platform isn’t responsive to the small screens on mobile devices and doesn’t notify a voter if there is a problem with the registration. Because it relies on a Kansas Department of Revenue database, the state platform requires prospective voters to have a driver’s license, which isn’t required at ksvotes.org.

Katie Koupal, a spokeswoman for Secretary of State’s office, said the department is working with the Kansas Department of Revenue to modernize the platform, but there is no timetable for the overhaul.

The current state platform is actually an improvement over the one that existed when Kobach was in office. Shew, the Douglas County clerk, said the previous system was full of bugs. He said he would get lengthy error reports from the state a day before the election with hundreds of registrations from months before that had to be manually entered into the poll book.

“I didn’t get involved in this project because I’m a Democrat,” Shew said of ksvotes.org. “I got involved because I’m a county clerk that saw that voters weren’t getting registered to vote through the system that was available to them and they were being denied their right to vote.”

‘Driven by Democrats’

Lauren Bonds, legal director for the American Civil Liberties Union of Kansas, said any concerns with ksvotes.org should be considered in relation to the Secretary of State’s cumbersome process and track record.

Lauren Bonds, legal director for the American Civil Liberties Union of Kansas, says the Secretary of State’s office has a history of not providing a secure environment, or a reliable voter registration platform. (Submitted)
Lauren Bonds, legal director for the American Civil Liberties Union of Kansas, says the Secretary of State’s office has a history of not providing a secure environment, or a reliable voter registration platform. (Submitted)

The ACLU successfully sued Kobach over his unfounded claims of voter fraud and the proof of citizenship law, which blocked more than 30,000 eligible Kansans from voting. The ACLU also forced discontinuation of the Interstate Voter Registration Crosscheck Program, a tool used to find duplicate voter registrations but which produced false positives 99% of the time.

The ACLU’s class action lawsuit over the Crosscheck program was filed after a security failing in which passwords and partial Social Security numbers of 945 Kansas voters were exposed, and a Homeland Security audit confirmed vulnerabilities with the program.

“It’s not a particularly secure environment to begin with,” Bonds said, “and so I think that’s got to be part of the conversation, too, when we’re saying, ‘Where’s the best place for people to register?'”

Former Secretary of State Kris Kobach says he isn’t concerned with ksvotes.org registering people to vote, but not if the site is collecting data without telling people. (Sherman Smith/Kansas Reflector)
Former Secretary of State Kris Kobach says he isn’t concerned with ksvotes.org registering people to vote, but not if the site is collecting data without telling people. (Sherman Smith/Kansas Reflector)

Kobach, now a Republican candidate for U.S. Senate, said most people who go to ksvotes.org probably think of it as “just a handy registration website.”

“It’s not concerning that they’re registering people, but if you’re collecting data about somebody and not informing them, or people don’t know the full scope of the data, that does concern me,” Kobach said.

The Secretary of State’s office recommends prospective voters use its application to avoid security concerns.

Kuckelman said he was concerned that people who use ksvotes.org may mistakenly believe they are dealing directly with the state of Kansas.

“In the Republican Party, we’ve always felt that ksvotes.org is a mechanism driven by Democrats to try to sign up folks, and I’ve always been concerned about the data they’re capturing,” Kuckelman said.

Miller, the political science professor, said nobody has ever expressed concerns to him about the privacy policy before, and that he would be willing to consider recommendations to change it.

“Any implication that this is a partisan thing, or that voters’ data is being improperly used or shared, I just roundly reject that,” Miller said.

Sherman Smith has written award-winning news stories about the instability of the Kansas foster care system, misconduct by government officials, sexual abuse, technology, education, and the Legislature. He spent 16 years at the Topeka Capital-Journal, where he started on the copy desk, then oversaw digital operations, was the managing editor and reported from the Statehouse. A lifelong Kansan, he graduated from Emporia State University in 2004 as a Shepherd Scholar with a degree in English.