A ballot drop box is pictured outside of the Davis County Library's South Davis Branch in Bountiful on Election Day, Tuesday, Nov. 2, 2021. Problems with ballot tabulators in Maricopa County, Ariz. on Tuesday caused the Republican National Committee to seek a delay of the closure of those polling places. However, a judge overruled. (Kristin Murphy/Deseret News)
SALT LAKE CITY — Election officials in Utah describe Utah’s statewide voter database as the “backbone” of Utah’s election system. The personal information, voter signatures, and unique voter ID numbers of every Utah voter exist in it, and it’s the reason Utahns automatically get mailed a ballot.
“Democracy, and the way we live, is really determined by the way people vote,” said Utah’s Director of Elections Ryan Cowley. “And ballots are the currency through which that’s purchased.”
With more than 1.6 million voters in 29 counties it’s vital that the online database be kept safe and up-to-date because, despite their security features, no one wants that information to end up in the wrong hands.
The database is operated through a program known as VISTA. And VISTA is connected to Utah’s Driver’s License Division of the Department of Motor Vehicles.
When you registered to vote, updated your Utah driver’s license or applied for a new one, information like your current address, your different signatures and your unique nine-digit voter ID all became part of your voter record — which, according to Cowley, updates daily. Unless you opt-out, that information is sent automatically back to your county clerk.
“If it’s a new registration the clerk can review it, make sure that everything’s accurate,” Cowley said.
Those updates account for a big chunk of keeping the rolls clean, or up-to-date, according to Cowley.
Voter records also get created or updated when people register online.
Once a week the state gets a report from the Office of Vital Statistics, according to Cowley.
Family members can also let the state know if someone has died.
That information will be shared with the specific county clerk to update. They receive similar updates from the Department of Public Safety making sure those who are incarcerated are not able to cast a ballot.
The voter registration database connects statewide — allowing clerks and approved staff in any county to access it. So if a voter moves within the state, when they presumably change the address on their license, VISTA would update the voter record.
“So we’re capturing at least 20% of all the people who have driver’s license,” said Cowley. “Plus anybody who moves, you’re required to update that address.”
Cowley also wants it to be the voter’s responsibility to change their information with their county clerk when they move. Though he admits, it’s not always top of mind for people.
To combat that, clerks also check what’s known as the National Change of Address list, or NCOA. The USPS uses that to keep track of changes in addresses.
“Ballots can’t be forwarded by law,” said Cowley. “So [if NCOA says they’ve moved] we’re going to send them a postcard to their new address that they have to sign and return updating their address.”
If they don’t send anything back, Cowley said, they would not continue to get mailed a ballot. Clerks would inactivate that voter, who would then have to vote in person and show ID to vote again.
Those controls are also what prevent Utahns from voting in two counties. Clerks can see your current residence, so if you’re registered in Salt Lake County you must vote in Salt Lake County.
For people who move out of — or into Utah from some other states, it’s less easy to tell if Utah’s voter rolls stay updated.
Utah is a member of ERIC, which stands for Electronic Registration Information Center. It’s a network of 33 states — plus D.C. — that shares with each other when people get a driver’s license or register to vote between the other member states.
“One misconception with ERIC is that it does registration for us, it doesn’t,” said Cowley. “They have absolutely no control over our voter records.”
Cowley said ERIC simply identifies the voters and then the data goes back to county clerks to verify.
But not every state is a member yet. Meaning, there’s no way to know if a new Utahn is still registered in a non-ERIC member state unless a lieutenant governor or secretary of state lets Utah’s Lieutenant Governor’s Office know. Though presumably, when that person gets a new Utah driver’s license, their voter file would also be updated.
Likewise, if someone moves out of Utah until it’s noticed by checking NCOA or clerks are notified, the voter may not be deactivated.
“To register in two states isn’t illegal but to vote in the same election is illegal,” said Cowley.
Cowley also noted that this way of tracking people who move out of state is an “age-old problem” of elections administration.
One measuring stick for just how clean the voter rolls are is looking at just how many ballots get returned to a particular clerk’s office, also known as their undeliverable rate. Every county’s will be different.
Weber County Clerk Ricky Hatch tweeted Thursday evening that in that county, a low rate of ballots got returned to sender.
Another check on the system is a new requirement in state law, an audit of the voter rolls. The LG’s office is now required to audit .02% of all Utah’s registered voters. And there has to be a mixture of what counties those come from.
“We will actually go in and will check to make sure that the documents support the voter registration record, that they live at the address that they say they are, they’re getting the right ballot style, and that there’s a signature on file — those kinds of things,” said Cowley.
The voter database is subjected to hacks just like any other grid online.
“The voter registration database is connected to the internet, which is very different than the vote tabulation equipment, which is never connected to the internet,” said Cowley.
And state networks — including elections — are constantly facing cyber threats.
“Last time I heard the statistic was around 2 billion different probing or attacks per day,” said Cowley.
Online security starts with who can have access. Only certain people within the clerk’s office have access to the program known as VISTA.
“We use two-factor authentication, we use encryption. There’s all sorts of layers of security that I’m not going to go into detail on. But we do protect that with all the assets of the state,” Cowley said.
In Salt Lake County, the elections director uses her phone to gain access and verify her identity. County Clerk Sherry Swenson said there’s also a required security test.
“We all take it annually, but anyone that’s new on board also has to take it we make sure that as soon as anyone is not any longer in our employment, they’re immediately denied rights to it any longer,” she said.
And it appears the security is working.
“We’ve never had a breach of the voter database,” Cowley said.