Alabama's AVID: A Closer Look at Voter Data Security

David Levine is the senior elections integrity fellow at the German Marshall Fund's Alliance for Securing Democracy, where he assesses vulnerabilities in electoral infrastructure, administration, and policies. Previously, he worked as the Ada County, Idaho Elections Director, managing the administration of all federal, state, county, and local district elections.

Last month, Alabama Secretary of State Wes Allen announced a new system, the Alabama Voter Integrity Database (AVID) that he said would improve the accuracy of the state’s voter rolls by comparing the state’s voter registration information to the state’s driver’s license database, the National Change of Address File, the Social Security Death Index, and voter lists of five other states. Sound like a product worth building? The good news is that someone has already tested the concept and shown it works. The bad news -- that same entity is the interstate compact for sharing voter registration that Allen left immediately upon assuming office – the Electronic Registration Information Center (ERIC).

Allen touted the security of AVID by stressing that voter information would be housed on a server in Alabama, and that the state would get information directly from its own agencies and other states directly, rather than through a third party. While noteworthy, neither of these measures offers strong assurances about the security of AVID.

More important for AVID is how Alabama’s voter information will be stored and transmitted.

When Alabama was part of ERIC, its voter information was kept in one central location with all the other ERIC member states. Now, Alabama has memorandums of understanding to share voter information with Arkansas, Florida, Georgia, Mississippi and Tennessee, and is looking to make similar agreements with more states. That means that there will be many more connections for Alabama to monitor to ensure that its voters’ information is not compromised, a potential threat that is not merely abstract.

In 2005, the Kansas Secretary of State initiated a voter registration program called the Interstate Voter Registration Crosscheck (IVRC) with Iowa, Missouri and Nebraska that combined each state’s voter rolls into a database and sought to identify whether voters in different states voted in the same election. By 2014, the program had expanded to twenty-nine states. Unfortunately, IVRC had inadequate data security protocols in place that contributed to the accidental disclosure of sensitive, personal information for 1,000 Kansas voters in 2018, raising potential concerns about these voters being subjected to identity theft, foreign interference, and other forms of tampering.

Close attention will also need to be paid to how Alabama’s voter information is stored, particularly since data storage practices vary from state to state. ERIC addresses data storage by not possessing the raw data of sensitive, personally identifiable information, such as date of birth, social security numbers, or driver’s license numbers. Instead, that information is “hashed” by states before it is sent to ERIC as a string of characters that is not human readable or decodable. Then ERIC hashes it again, so that even the states cannot reconstitute the records. Alabama isn’t naïve to preparing and securely transmitting data, but neither were other states who recently engaged in similar efforts without success.

Another potential concern with AVID is whether it will be as helpful as ERIC. For example, when Alabama was part of ERIC from 2016 through early 2022, ERIC identified more than 19,000 voter records of potentially deceased Alabama voters, and 98% of those voter records were subsequently removed from Alabama’s voter rolls. One big reason for this success was because Alabama’s voter list was compared to the voter lists of more than half of the other states, along with those states’ driver’s licensing data, the National Change of Address File, and the Social Security Death Index. It is hard to see how a system with five states can provide the same quality of information as one with twenty-five.

AVID will hopefully help improve the accuracy of Alabama’s voter rolls, but it is far from a certainty, particularly ahead of 2024.