More Legally Obtained Voter Records for Sale Online

A director of threat research at a cybersecurity firm spoke to Dark Reading about an entity on the RaidForums selling voter records. This is not a new occurrence or even a particularly surprising one, despite the notion that vendors only sell such information on darknet marketplaces or forums. (The RaidForums website is completely accessible on the clearnet. The threat researcher, Jonathan Tomek, reported that he had found 40 million records for sale on the RaidForums.)

Logan, the particular forum member in question, listed only two voter databases this year, both from 2017. The remaining databases on the forums are from 2015 or 2013. According to the site’s database directory, the most recent voter database listings are as follows:

1. Alabama Voter Database – 132,788 Records – 2015;
2. Alaska Voter Database – 487,415 Records – 2015;
3. Colorado Voter Database – 3,525,885 Records – 2015;
4. Connecticut Voter Database – 2,391,357 Records – 2015;
5. Delaware Voter Database – 600,000 Records – 2015;
6. Florida Voter Database – 12,539,780 Records – 2013;
7. Michigan Voter Database – 7,408,330 Records – 2015;
8. North Carolina Voter Database – 7,444,748 Records – 2015;
9. Ohio Voter Database – 7,509,310 Records – 2015;
10. Oklahoma Voter Database – 2,158,410 Records – 2015;
11. Pennsylvania Voter Database – 620,201 Records – 2015;
12. Utah Voter Database – 731,639 Records – 2015;
13. Washington Voter Database – 4,411,385 Records – 2015;
14. Texas Voter Database – 657,695 Records – 2015;
15. Nevada Voter Database – 1,160,839 Records – 2015

The only records from 2017 come from the Ohio Voter Database and Arkansas Voter Database—both of which came from Logan. They have 7,893,338 Records and 1,746,067 Records, respectively. Incidentally, both Ohio and Arkansas are readily available elsewhere as public records. One of said sites is a political research tool known as VoterRecords.com. The site exists for the study of political data. “We offer researchers and political organizations an easier method to research public records data,” the site’s FAQ page explains.

Even better are the states that host voter records in an easily accessible format. One state that fits this criteria is the state of North Carolina. The North Carolina board of elections website allows anyone to search voter records. There is a danger associated with records—even previously available records—hitting forums or marketplaces where the intent is inherently criminal. Most state’s voter records contain a trove of identity information, and when combined with data from other sources or beaches, entities can easily create “fullz.” This can be accomplished with any source of information, however, and is far from exclusive to voter records.

Logan’s dumps, for instance, contain “voter IDs, full names, physical addresses, previous addresses, date of birth, genders, phone numbers, [and] citizen status.”

Voter records are a current topic of interest for a host of reasons—most of which, understandably, involve ongoing political issues. However, as Tomek explained, Logan likely obtained the information from “Freedom of Information Act (FOIA) requests, website requests, and also through social engineering…” No hacking government servers required. Regardless, Logan’s use of the public information is very likely in direct violation of dozens of laws; it is not inherently legal even if he obtained the information through entirely legal channels. The possible uses for a database full of voter information are endless, but news surrounding voter database records rarely paints an accurate picture.

On an unrelated note, while they are available for purchase, Logan’s uploads are technically available for free.