Voter privacy caught in the World Wide Web
IN the time it takes you to read this article, a hacker could have downloaded a digital copy of Jamaica’s Official Voters’ List, complete with the name, date of birth, occupation and current or former home address of every registered voter in the island.
This information is available on the Electoral Commission of Jamaica’s (ECJ) website. The ECJ is trying to keep pace with the Digital Age by having a website from which anyone can query whether they are registered to vote and at which polling division they should present themselves. The problem is with our laws and regulations and the fact that privacy was not, at the time of its passage, a priority like it is today.
The Electoral Commission’s website isn’t new. It’s been around for a few years now. In order to check whether a person is on the voters’ list, you simply need to go to www.eoj.com.jm and click on the link in the middle of the page that says “Are you on the Voters’ List?” Then, enter the person’s first and last name and his or her date of birth.
The voter’s home address, as per the Voters’ List, will be displayed. The only information necessary to find out someone’s current or past home address is his or her date of birth. That information is not at all hard to find out, ladies (and gentlemen), for anyone who has a desire to know.
Under The Representation of the People (Official Lists) Regulations of 1965, the official voting list for each polling division is a public document, available for inspection at the offices of the Returning Officer and the Chief Electoral Officer. The Chief Electoral Officer may supply a copy of any official list to anyone, upon payment of such fee per copy as he determines from time to time. By law, the voters’ list is required to include home addresses.
There is no law, however, that requires the data to be published, in whole or in part, on the internet.
Putting the list online creates a tangled web of privacy and personal security issues. Firstly, there is the risk of wide-scale identity theft. The ECJ’s site is not hosted on a secure server. There is no maximum number of incorrect queries that one can make before you’re blocked. If a website like Ashley Madison, that contains the account details for people looking to cheat on their spouses, can be hacked, one can only imagine how easy it would be to illegally download a public document from an unsecured website.
Many of those addresses on the voters’ list are also the billing addresses on the voters’ credit cards. That piece of the puzzle puts a “scammer” one step closer to getting his hands on your money.
Secondly, the fact that the list is in a digital format means that it is now that much easier to locate a specific person’s details by doing a simple text search. In contrast, the printed copy of the voters’ list is divided into numerous sections based on the constituencies, and must be manually searched. This can be done at any post office, which will allow people to view, but not copy, the voters’ list for that constituency. It’s significantly harder for a scammer to locate any particular individual in that situation.
Thirdly, there is the possible security risk to normal citizens who live in homes formerly occupied by well-known figures, whose old addresses are still showing on the public record. We all should know, for example, that Andrew Holness is no longer a Finance Controller residing at Mona Great House, but that’s what his public record says.
Finally, assuming it’s correct that the list can be easily and illegally downloaded, the online voters’ list is susceptible to hackers located anywhere in the world. The printed copy, on the other hand, can only be obtained from the ECJ’s offices on Duke Street and only after paying the considerable sum of $315,000.
This issue of voter privacy is by no means unique to Jamaica. In the United States: Florida, Washington, New Jersey and several others states only require input of the voters’ dates of birth to display their home addresses. Other states might also require a zip code or the county of residence.
Last year, lawmakers in Utah amended their laws to restrict the use of a voters’ list to “political, scholarly, journalistic, or governmental purposes.” Utah’s voters’ lists show a voter’s name, address, date of birth, party affiliation, and a list of the dates that the voter cast a ballot. A citizen bought the public document, posted it online for free and made money off Internet traffic and advertisements. The law was quickly changed to prohibit anyone from posting a voters’ list online, reproducing it in print or any other format, using it for commercial purposes or using it to harass someone.
In Alaska, a group who called themselves the Alaska State Voter Program, used the voters’ list to name and shame people who had not voted in recent elections as a type of bullying tactic. The director of elections responded that the matter was out of his control until the legislature changed the laws.
The situation in Alaska adds a new dimension to voter privacy by raising the issue of whether the fact that an individual is not registered to vote is a detail that is worthy of protection by the State. The campaign to get people registered has intensified in recent weeks, particularly on social media platforms. Some campaigners go as far as to suggest that people who choose not to vote are failing in their civic duty, or are somehow less deserving of good governance.
Some of us could be faced with the dilemma of choosing between privacy and patriotism. That’s an election no-one should be called on to make.
Gavin Goffe is a partner at Myers, Fletcher & Gordon and a member of the firm’s Litigation Department. He may be contacted at gavin.goffe@mfg.com.jm or through www.myersfletcher.com This article is for general information purposes only and does not constitute legal advice.