Reported leak of voter data raises questions

March 30 report of a news website ZDnet about leak of personal details of Georgian voters raises a number of questions.  

According to the news website, on March 28, a database of 4,934,863 Georgian citizens was shared on a hacker forum, containing full names, home addresses, dates of birth, ID numbers, mobile phone numbers and other data. ZDnet reported that the leaked data also contained personal information of deceased citizens and the individual who leaked it said it came from the official portal of the united voters’ list of Georgia (voters.cec.gov.ge), where a voter can verify information about himself/herself and other voters registered at his/her address.

Notably, average number of voters in the unified voters’ list of Georgia was no more than 3.5 million for elections held in the last 15 years, and the highest number of voters had been registered for the 2012 elections - 3,613,851 people. In addition, according to Geostat, average number of deceased population was 48,757 per year (a total of 341,296 in 2012-2018). Therefore, it is unlikely that the leaked database is the voters’ list.

The report is accompanied by a screenshot of the database, containing information that differs from the unified voters’ list both in terms of format as well as the type of information processed by the CEC. In particular, the CEC does not process voters’ phone numbers and number of their ID documents, which further substantiates suspicions that the leaked database is not the voters’ list.

Nevertheless, the report on possible leak of personal details of Georgian citizens is alarming. If the personal data was so comprehensive, they may have been leaked from another public agency or may have been created by processing several different databases that contain personal information. 

The report on mass leak of voters’ personal information 7 months prior to the 2020 parliamentary elections may aim to undermine trust in the voters’ list and election processes.

Therefore, it is important that the possible large-scale leak of personal data is investigated in a timely and comprehensive manner, in order to determine if such leak actually took place, if the information shared contains real data of Georgian citizens, which databases were leaked, how they were accessed and by whom.