Numbered Memo 2022-01: Protecting Certain Voter and Elections Security Information

(Updated)

This numbered memo provides guidance about responding to public records requests that involve sensitive voter or elections-related information. It addresses many questions that county elections directors have raised with the State Board in responding to requests for such records.

This memorandum is not intended to provide comprehensive guidance about responding to public records requests or to address all information that may need to be withheld from a public records request. There are other important exceptions to disclosure — including those covering vendor trade secrets,¹ personnel information,² attorney-client communications and trial preparation materials,³ records of criminal investigations,⁴ and campaign finance investigations.⁵

¹ G.S. § 132-1.2(1).

² G.S. §§ 126-22(a), 153A-98.

³ G.S. §§ 132-1.1(a), 132-1.9.

⁴ G.S. § 132-1.4.

⁵ G.S. § 163-278.22(7).

General Obligations Under the Public Records Act

The North Carolina Public Records Act (Chapter 132 of the North Carolina General Statutes) generally requires public agencies like county boards of elections to provide copies of public records upon request.⁶

In responding to public records requests, county boards should keep in mind their core public mission of administering elections. In doing so, please remember the following general guidelines:

1. When responding to requests for public records, a county board is not required to create or compile any records that do not already exist.⁷ Some county boards voluntarily compile or create records — for example, by running complex queries of voter registration data that a member of the public could do on their own with publicly available data. This service is helpful to the public, but it is not required and may not be feasible for offices that lack extra resources to devote to such requests.
2. To protect the proper functioning of government offices, public records may only be examined “at reasonable times” and should be provided “as promptly as possible.”⁸ North Carolina law recognizes that a public agency’s duty is to make “reasonable accommodations to allow...access to documents in a timely manner,” depending on “the limitations of the...[o]ffice and the availability of its employees.”⁹
3. If public records are to be reviewed in person (for example, absentee return envelopes where the voter’s signature has not been redacted), county boards may require “reasonable supervision” to ensure the integrity of their records,¹⁰ in which case scheduling access to the records may depend on the availability of staff to supervise the review.
4. The Public Records Act does not require agencies to respond to requests for public records outside of their usual business hours.¹¹

Subject to these ground rules, documents and other records that are not otherwise exempt from public disclosure must be provided, upon request. The time needed to apply redactions to public records, as required by the exceptions to public disclosure discussed below, will also factor into when the county board is able to reasonably respond to a public records request. Public agencies are not permitted to charge for the cost of applying redactions.¹²

⁶ G.S. §§ 132-6, 132-6.2.

⁷ G.S. § 132-6.2(e).

⁸ G.S. § 132.6(a) (emphasis added).

⁹ Brooksby v. N.C. Admin. Off. of Cts., 248 N.C. App. 471, 475, 789 S.E.2d 540, 543 (2016). The court in this case examined a request for a massive amount of records and explained,

[t]he need for the records custodian to maintain the integrity of the records for its own use and the use of others, the custodian’s fiscal responsibility in maintaining the records, the duty to the public, the protection of public resources, and the exigency of the public’s need for the information are some, but not all, of the factors that shape a court’s inquiry in a records request.

Id.

¹⁰ G.S. § 132-6(a).

¹¹ G.S. § 132-6.2(d).

¹² G.S. § 132-6(c):

No request to inspect, examine, or obtain copies of public records shall be denied on the grounds that confidential information is commingled with the requested nonconfidential information. If it is necessary to separate confidential from nonconfidential information in order to permit the inspection, examination, or copying of the public records, the public agency shall bear the cost of such separation.

Voter Information That May Not Be Provided

North Carolina law forbids the disclosure of certain information in voter records. County boards must redact the following items prior to releasing public records:¹³

• Voter’s date of birth. Year of birth may be provided. Counties may, but are not required to, fulfill requests for all voters who turned a certain age within a range of no fewer than three months. Shorter time ranges risk revealing date of birth.¹⁴
  • If a request includes a voter’s date of birth, the county board must not provide confirmation of that date of birth — only confirm year of birth. The State Board suggests responding to such requests with the following language: “Date of birth is a confidential voter record. We cannot confirm that the birthdate you’ve provided corresponds with any particular voter. We did search for the voter’s name and birth year that you provided, and were able to obtain and provide you with the attached record(s).”
• Voter’s Social Security number (partial or full).
• Voter’s driver’s license or non-operator ID number.
• Voter’s email address, if provided in connection with voter registration, absentee voting, or military or overseas (UOCAVA) voting. This includes email addresses provided through the Democracy Live portal.
• The identity of the public agency where the voter registered.¹⁵ This includes, for example, information that would reveal that the voter registered at the DMV, a public assistance office like county DSS, a public library or high school, or an office that provides services to disabled persons. For this reason, certain voter registration form codes must be redacted from records provided for specific voters. These codes include 01, 02, 03, 05, 08, 10, 11, 12, 13, 15, and 21. County boards must also redact the “DMV Agency Form” language at the top of forms generated through a DMV transaction.
• Photocopies of identification provided for voting. This includes copies of HAVA ID documents.
• Voter’s signature. A voter’s signature may be viewed in person but may not be copied or traced except by election officials for election administration purposes.  Do not redact the signature of the voter’s near relative or legal guardian on the absentee request form or the signatures of witnesses on the absentee envelope.
• “Confidential” voters’ residential addresses. These are voters whose addresses are protected by court order or by the Address Confidentiality Program for certain victims of crimes.
• Retrievable ballot ID number (this includes the CIV, OS, MIL, and OVR numbers). Since this number could be used to identify a voter to a particular voted ballot, this number is confidential and may not be viewed by the public where the number is associated with the identity of a voter.¹⁶

Cumulative data based on these items of information may be publicly disclosed, as long as information about any individual voter cannot be discerned from the disclosed data. For example, records that show how many North Carolinians registered at the DMV in a particular year may be disclosed.¹⁷ But the identities of the specific voters who registered at the DMV may not be disclosed.

[Sample redacted voter documents are appended to this memorandum.]

¹³ These restrictions are found in G.S. § 163-82.10, except as otherwise noted.

¹⁴ G.S. § 163-82.10B provides exceptions when date of birth may be released, including when a voter files for candidacy, is serving in elective office, has been challenged, or provides written consent.

¹⁵ 52 U.S.C. §§ 20504(c)(D)(iii), 20506(a)(6)(A)(ii), 20507(i)(1); G.S. §§ 163-82.4(c)(3), 82.10(a1).

¹⁶ Voter Signatures & Provisional Supplementation: Numbered Memo 2016-25; Absentee Board Meetings: Numbered Memo 2020-25; see also G.S. § 163-165.1(e).

¹⁷ E.g., NVRA Registration Statistics.

Requests for Voted Ballots

Voted ballots and paper and electronic records of individual voted ballots (e.g., “cast-vote records”) are confidential and may not be provided to anyone other than elections officials performing their duties, except as ordered by a court or an elections board adjudicating an election protest or investigation of an alleged election irregularity or violation. Voted ballots and paper and electronic records of individual voted ballots that disclose how a particular voter voted (for example, those that contain an unredacted CIV number) may not be disclosed without a court order.¹⁸

¹⁸ G.S. § 163-165.1(e).

Requests for Absentee Envelopes

Copies: Prior to providing a copy of the envelope to the requestor, the voter signature and CIV number must be redacted, as the number links the envelope to a particular voter’s ballot. Witness or assistant information may not be redacted. To redact the voter signature and CIV number, you may copy the envelope, mark through the confidential information on the copy, and then copy it again. Some counties have used a cardboard or other thick paper cutout to cover the confidential information when making a copy. Digital copies may also be provided using a template redaction tool in Adobe.

Viewing: Unredacted envelopes may be viewed by the public in your office, though no copy, photo, or tracing may be made. A county board must ensure that the requestor is monitored while reviewing the envelopes in the office to ensure the voter’s signature is not retained. Absentee ballot return envelopes contain the CIV number that is linked to the ballot, so this identifier must also be redacted from public view to protect the secrecy of the ballot.

Requests for Absentee Register

County boards of elections must keep a register of absentee ballot requests that includes information about the request, the address to which the ballot should be sent, the date of the request, the voter’s precinct, and other information. The absentee request register is confidential and not a public record until Election Day.¹⁹ Prior to the opening of the polls on Election Day, county boards of elections are not permitted to release copies of absentee request forms or identifying information that could be used to determine that a voter requested an absentee ballot.

Absentee request data is no longer confidential when the ballot is returned to the county board of elections office. Therefore, names of absentee voters may be read aloud during the absentee board meetings, as the ballot has been returned to the county board office at that point. Reading from lists of voters who have requested absentee ballots or otherwise releasing the names of voters with outstanding requests is prohibited until the ballot is returned or until Election Day. It is a Class G felony for a person to “steal[], release[], or possess[] the official register of absentee requests for mail-in absentee ballots as provided in G.S. § 163-228 prior to the opening of the voting place.”²⁰

¹⁹ G.S. § 163-228(c).

²⁰ G.S. § 163-237(d6).

Elections Security Information That May Not Be Provided

The Public Records Act also exempts from disclosure information that could compromise the ability of public agencies to protect themselves from security threats, including cybersecurity threats. We are routinely reminded by our federal and state security partners about the importance of being vigilant against threats to our nation’s elections infrastructure. We have a duty to mitigate these threats, including by protecting information that could be used to compromise the integrity of our elections.

There are three key provisions of the Public Records Act that provide overlapping protection for security-related records:

• A county board should not disclose “specific security information or detailed plans, patterns, or practices to prevent or respond to criminal, gang, or organized illegal activity.”²¹
• A county board should not disclose “plans to prevent or respond to terrorist activity, to the extent such records set forth vulnerability and risk assessments, potential targets, specific tactics, or specific security or emergency procedures, the disclosure of which would jeopardize the safety of governmental personnel or the general public or the security of any governmental facility, building, structure, or information storage system.”²²
• A county board should not disclose “security features of its electronic data processing systems, information technology systems, telecommunications networks, or electronic security systems, including hardware or software security, passwords, or security standards, procedures, processes, configurations, software, and codes.”²³

In accordance with these exemptions, do not release:

• Records displaying security features of voting systems, electronic pollbooks, or the Statewide Elections Information Management System (SEIMS). This includes, but is not limited to, administrator user manuals for voting systems and SEIMS manuals;
• Physical security and cybersecurity vulnerability assessments;
• Information revealing access controls to elections databases and equipment, including SEIMS usernames, passwords, and login procedures;
• File paths for network folders; or
• Network information such as IP addresses, system or computer names, or network ports.

This is not an exhaustive list. Please contact the State Board with specific questions about whether a record, or information contained on a record, may fall within one of the security-related exceptions to disclosure.

When determining whether a public record includes such information, the key question should be whether releasing this information could make it easier for a malicious actor to attempt to compromise election equipment, voter records, election results, or other systems or practices of the county board that are necessary to administering accurate elections.

* * *

If you have any questions regarding information that may fall within any of the disclosure exceptions, please consult your county attorney. State Board legal and communications staff can also assist with general guidance on compliance with public records laws.

²¹ G.S. § 132-1.7(a2).

²² G.S. § 132-1.7(b).

²³ G.S. § 132-6.1(c).

[Download the PDF below for Sample Redacted Voter Forms attachment.]

↓ Protecting Certain Voter and Elections Security Information: Numbered Memo 2022-01 (PDF)

← Return to Memo Search