A security assessment of how US voter portals verify identity, built only from public sources, with Maricopa County as the deep dive.
What it is
Every state runs a portal where a voter can look up registrations and request materials. The question was simple and uncomfortable: how does each one decide who you are and what data it accepts as proof?
The answer is a fifty-state survey with Maricopa County examined line by line. What follows is the finding and the impact it carries, then the path from a county office to a federal ballot.
The finding
Maricopa County's voter dashboard asks for four things: date of birth, last name, house number, plus either the last four of a Social Security number or a driver's license number. The public voter file supplies two and a fraction of those for free. The 2024 National Public Data breach completes the set, with full dates of birth and SSNs for roughly 272 million people.
Nothing exotic is required. No insider, no exploit, no zero-day. Two datasets that already exist, joined on a name and an address.
The chain, with Maricopa as the exemplar: two existing datasets complete the portal's entire authentication set
The scale
Maricopa is not the story by itself. It is one instance of a national convention. Dashboard after county dashboard runs the same design, across nearly every state and territory. The statutory pass over all 51 jurisdictions found that twenty-nine of them authenticate with a date-of-birth factor drawn from a field the state does not publish at all: nineteen publish the birth year only; ten keep the date confidential outright. Arizona is not an outlier here. It is the pattern, measured.
One jurisdiction is the exception. It proves the fix is not hypothetical. North Carolina is the only place in the survey where the statute, the published list and the portal all agree. Its lookup asks for a year of birth, a public quantity. The law keeps the date of birth confidential by default. The state has been through the same disputes as Arizona. It simply chose a different answer.
The breach corpus is only one path to the same place. This is where the finding expands past it. In the sixteen jurisdictions that publish full dates of birth, a portal authenticating on that date is asking for something anyone can look up, no breach required. Florida goes furthest: its public file carries dates of birth, phone numbers and email addresses, three of the fields a portal could consume. Where the data is confidential, a breach corpus supplies it. Where the state publishes it, nothing has to be supplied at all. Either way, the set completes.
The demand side for this data is already national: thirty-one lawsuits against thirty states plus DC, each seeking the full registration list including the non-public tier.
The national pattern: 29 jurisdictions, one aligned exception
The impact
The dashboards are not read-only. They offer self-service changes. When authentication can be met from public and breached data, those services become the target. One person, no organization required, can run a mass campaign: change a voter's address so their polling place moves, request a mail ballot redirected to an arbitrary third-party address, cancel a ballot request, unregister a voter, switch a party affiliation.
Run at scale, that stops being a privacy problem. It is the machinery of an election, reachable by anyone with a dataset and a script.
From one operator to five self-service actions and the machinery they reach
From local to federal
This is a county-level portal, which is exactly why it matters beyond the county. Polling places, mail ballots and registration rolls are all administered locally, but they do not stay local: the rolls feed state certification. The same ballot a voter casts for county offices carries federal races. A change made at the county layer propagates upward through the system that decides federal contests. Fixing the portal is local work with federal stakes.
A county-layer change and the ladder it climbs
How it was established
Everything in the assessment comes from public sources. Fifty states plus DC were surveyed against a common checklist. Maricopa County was examined against a roll of 2.59 million voters. Every claim is graded by evidence quality, [VERIFIED] or [INFERRED] or [NOT ESTABLISHED]. All 543 cited sources were verified against the live documents.
The output includes eight ready-to-send advocacy letters addressed to the people who can act: the county recorder, the state, CISA, the EAC, the DOJ, Congress and the press.
Under the hood
Fifty states plus DC, each portal assessed against a common authentication checklist.
A Maricopa County deep dive against a voter roll of 2.59 million, examining what the portal accepts as identity proof.
Evidence grading on every claim: [VERIFIED], [INFERRED] or [NOT ESTABLISHED], with nothing blurred in between.
543 verified citations in a source-verification file, each one checked against the live document.
Breach-corpus mapping: the 2024 National Public Data breach alone supplies complete names, addresses, SSNs and full dates of birth for roughly 272 million people.
Eight advocacy letters addressed to the people who can act: county recorder, state, CISA, EAC, DOJ, Congress and press.
Why it was built
A voter-facing portal is a security product whose users cannot opt out. If its authentication is weak, the burden lands on the voters themselves, not on a company. And the burden is not local: the pattern repeats across nearly every state and territory, one county panel at a time. In the twenty-nine jurisdictions where the login factor is a field the state does not publish, a breach corpus already sitting in public circulation completes the set. In the sixteen that publish the very field they ask for, nothing has to be obtained at all. The one exception found across 51 jurisdictions is North Carolina.
