After Democratic state Sen. Sam Hunt sent an email to Washington's Public Disclosure Commission over the weekend, the watchdog agency temporarily blocked public online access to financial disclosure statements.
At the request of a powerful Democratic state senator who warned of “foreign intrusion,” Washington’s Public Disclosure Commission (PDC) on Sunday temporarily suspended public, online access to the personal financial statements of elected officials, candidates and other public officials.
The F-1 statements, as they’re known, include information about an individual’s income, assets, property holdings, debt and business associations. They do not, however, include bank account or social security numbers. The F-1 is designed to allow the public to determine if candidates for public office, as well as state and local elected officials and high-level government appointees, have potential conflicts of interest.
The unusual and abrupt decision to block online access to the F-1 reports came after state Sen. Sam Hunt, the Democratic chair of the Senate’s State Government, Tribal Relations and Elections Committee, which has jurisdiction over the PDC, sent an urgent email Sunday to the agency’s Executive Director Peter Lavallee with the subject line “Stop online posting of F1 data.”
In his email, Hunt relayed that fellow Democratic state Sen. Reuven Carlyle, chair of the Senate’s Environment, Energy and Technology Committee, and Jim Weaver, the state’s Chief Information Officer, had both warned that “PDC is being assaulted by international data thieves from China, Russia, and Germany.”
[feedimage: left,300x390,5ecdb8c8c832653ecc5c8902,https://www.nwnewsnetwork.org/sites/northwestnews/files/202005/sam_hunt.png] Weaver’s agency, Washington Technology Solutions (WaTech), said Tuesday evening that it had seen no evidence of a breach or compromise of data on the PDC website. But in an email, a WaTech spokesperson said the agency was recommending the PDC continue to disable online access to F-1 reports out of a concern that "threat actors" could use the information to "create fraudulent accounts to access benefits."
Earlier Tuesday, Carlyle confirmed his high level of concern that F-1 information could be used to create a “financial profile” of an individual, which in turn could be used to commit identity theft or fraud.
“The PDC is not inherently doing anything wrong; it’s a policy question of whether or not that level of information should be distributed on the open internet at a time like this,” Carlyle said.
Hunt's email to the PDC, a copy of which the Northwest News Network obtained, offered no concrete evidence of a threat. But it came on the heels of reports last week that a Nigerian-based criminal syndicate was suspected of defrauding Washington's beleaguered unemployment system to the tune of hundreds of millions of dollars.
“At present, it appears that we are sitting ducks and could be the next big news story,” Hunt wrote in his email.
Fifteen minutes after Hunt sent his email, Lavallee, the PDC’s executive director, responded and promised to seek “immediate input” from the PDC's Commissioners, but added that state cybersecurity officials had “conveyed to me a much lower level of potential threat and urgency.”
Minutes later, Hunt emailed Lavallee back with an even more insistent message.
“This is not a ‘lower level of potential threat and urgency,’” Hunt wrote. “The commission needs to take a hard look and ‘grab [the] bull by the horns.’ Now.”
A little more than an hour after that, Lavallee wrote Hunt to say he had consulted with PDC Chair David Ammons and that online access to F-1 statements was being suspended, according to the email chain reviewed by the Northwest News Network.
A PDC spokesperson, Kim Bradford, said Tuesday the decision over the holiday weekend was made “out of an abundance of caution so that we could hear what the concerns might be.” The issue has now been added to the agenda for the Commission’s regularly scheduled meeting on Thursday.
Asked about Hunt’s assertion that “international data thieves” have been plundering PDC data, Bradford said: “We don’t have evidence of that.”
“Our initial look and analysis [shows] that there’s been no extraordinary traffic on our F-1 data,” Bradford said. A PDC review found that since March 24 about 1,500 of the 4,900 F-1s that were online had been accessed or viewed. Only F-1s filed in 2020 were online.
On Tuesday, the PDC’s vice chair, Russell Lehman, questioned the decision to pull down the F-1 information from the PDC’s website. Without evidence of a specific threat, Lehman said he was concerned it could appear the PDC was “kowtowing to the very people we regulate.”
“My first reaction was it was impetuous and not based on any evidence and it appears to be simply a desire to appease a legislator, and I don’t believe that should ever be our primary motivation,” Lehman said.
Lehman, an attorney and former gubernatorial advisor, added that he’s sensitive to concerns from lawmakers about access to their personal information and noted that he too submits an F-1 form as a member of the PDC.
In a separate interview, Ammons, the PDC’s chair, defended the decision to “pause” online access to F-1 reports. He said it was a judgment call made against the backdrop of the unemployment insurance fraud and in consideration of the fact Gov. Jay Inslee’s office had requested a meeting this week with Lavallee to discuss cybersecurity issues.
“So it was sort of a combination of all of those red flags that caused me to say, ‘Let’s pause it so we can have a fuller discussion with the commission,’” Ammons said.
Ammons, a former Associated Press reporter and columnist who also worked in the Secretary of State’s Office, emphasized that he’s committed to ensuring the public has online access to F-1 filings.
Separately, last week, after reports of widespread unemployment insurance fraud, the state of Washington temporarily disabled online access to the state employee and K-12 employee salary databases.
On Tuesday, Hunt defended his request that the PDC temporarily block online access to F-1s and noted the filings are still available to the public through a public records request.
“It’s just until we make sure that that system has security, so Nigerians and others can’t plunge into it,” Hunt said.
In his email, Hunt also asked the PDC to take steps to block all international access to PDC data – something the agency said it’s not doing at this point.
This isn’t the first time state lawmakers have sounded the alarm over the PDC’s effort, which began in 2018, to make F-1s available online – previously they were available only by request.
Last year, state Sen. Tim Sheldon, a Democrat who caucuses with Republicans, warned that the information on F-1 forms could be used to target the families of public officials.
According to reporting by Crosscut, Sheldon gave a speech on the floor of the Senate during which he told a story about an elected official's wife who was allegedly kidnapped in Mexico by criminals who targeted her based on publicly available information about her husband.
That story was later debunked by Crosscut reporter Melissa Santos. However, the Legislature soon after passed a bill that would have prevented the PDC from posting F-1s online. Gov. Jay Inslee later vetoed that portion of the law at the PDC’s urging. This year, lawmakers considered, but did not pass, legislation that would have prevented the F-1 forms of legislative staff from being posted online.
On Tuesday, Hunt denied any connection between previous efforts to block online access to F-1 forms and his urgent email over the weekend.
“This is not trying to get around what we did not accomplish legislatively,” Hunt said. “I would say this is a whole new issue that has arisen.”
This story has been updated.