On August 4, 2017, the Linn County Elections department experienced a security lapse. Our office presented updated information to the Board of Supervisors this morning during their public meeting. We provide the following information to the public:
While fulfilling a request for voter information following Iowa law, four email addresses associated with the Linn County Republicans received an email on August 4 with voter data. The voter data incorrectly included the last four digits of voters’ Social Security numbers. We immediately contacted all four individuals, and they were directed, by phone, to permanently delete the email. Since then, our Information technology (IT) department has done one house call. We have another house call scheduled for Thursday night (August 24). We are still communicating with the last two individuals as to their wishes. During the house call, our IT staff does not touch the electronic devices of the individuals. Instead, they watch over the shoulders of the owners and verbally talk them through making sure that all data related to the email in question has been completely deleted.
We believe that this protects both the public and the individuals. Here, our IT staff has seen that the emails are fully deleted and that nothing was downloaded or disseminated. We have asked the four individuals to sign an attestation document saying that they deleted and did not disseminate the information. In return for both the attestation and the IT review, the Linn County Board of Supervisors has authorized an indemnification agreement. This indemnification protects the individuals from any lawsuit that Linn County might face in relation to this situation.
We wish to thank the individuals involved for their patience and cooperation. We know that this was an unfortunate situation, and we appreciate their communication.
The issue that caused the most concern involved one email address that was incorrect. We have been working with Google, the internet provider of the email address, to pursue legal remedies. On Sunday, August 6, we submitted an affidavit to Google explaining the security issue and requesting that the email be ‘escrowed.’ Escrowing is a legal procedure by which an email can be taken out of a person’s email box. However, the person must receive notification that this has been done. We followed this procedure.
Second, Linn County Attorney Jerry Vander Sanden assisted in obtaining a subpoena. This subpoena allowed Google to verify activity on the account. Google Legal Services has now provided a certificate of authenticity along with notice that the account was never used from August 4 - August 9. Specifically, the email address was never accessed, there was no IP address to associate with the email address, and there was no forwarding email set-up. In other words, the email address was ‘dead’ during the time of our security concern.
We know that the email was escrowed or taken out of the email box. We also know that no one accessed the email.
We believe that an appropriate investigation and consultation has occurred. We further believe that there is no reasonable likelihood of financial harm to the consumers.
Auditor Miller is still standing by our office’s request that the voter data export tool be modified so the last four digits of Social Security numbers cannot be exported. He will continue to lobby the Secretary of State’s office to have them make that change.
For additional information, please contact Linn County Election Services. Phone: 319-892-5300, ext. 1. Email: [email protected].