SMALLPACKAGE, BIG DATA: This disk contains personal information on 1.7 million Arkansans. Mother Jones reports it's for sale on the web.

Any worry about Kris Kobach’s misuse of Arkansas voter information sent to his “election integrity” commission yesterday by Secretary of State Mark Martin is to some degree irrelevant. The data is already for sale cheap, on the “dark web,” Mother Jones reports.

We reported yesterday that Martin had again sent the file on 1.7 million Arkansans to Kobach. It includes names, voter identification number, birth date, address, phone number, email, election voting history and party identification. (Some elements are not provided for all voters, such as emails and phones.) An Arkansas citizen can purchase the same information on a computer disk for $2. So it’s not surprising that the information has popped up elsewhere. From Mother Jones:


More than 40 million voter records from at least nine states [including Arkansas] are being offered for sale on a dark web forum, and the seller claims to have records for an additional 20 to 25 states, according to Dark Reading, a news organization focused on information security.

…Tomek told Dark Reading that the seller, known only as “Logan,” had already sold at least two copies of the databases earlier this week—the ones in Arkansas and Ohio—for only $2 each, although the identity of the purchaser is unclear. The low price indicates that “financial gain is not the primary reason for the activity,” Dark Reading wrote. “Logan” likely obtained the databases through open records requests to states or pulling data directly from state election websites. Another strategy is known as social engineering, in which someone is talked into providing access to otherwise restricted material by an individual who pretends to be someone they are not—in this case a candidate, election official, or representative from a political party.

“Logan’s” interests are not restricted to voting data, but he is “actively trading this information for other stolen items such as credit cards and login credentials,” Tomek said. Based on his research, Logan was not affiliated with any particular group and is likely acting alone. “I can say he is over 18, travels a bit internationally, and works for a cybersecurity company,” he told Dark Reading.