Military voter files exposed deployment locations to America’s adversaries

On Thursday night during his address to the nation from the White House, President Donald Trump revealed that Chinese entities obtained U.S. voter registration files, including data on military members serving overseas, creating heightened security risks, especially in instances of covert operational locations. 

Voter files, maintained by states, are largely public or semi-public, containing names, addresses, party affiliations where tracked and voting histories. They are used for elections, campaigns and research but are not classified information. However, the voter files obtained by China contained more sensitive information like dates of birth.

Access allows correlation with other data sources to build dossiers on service members and families, adding to espionage recruitment, blackmail or harassment

Military and overseas voters are typically registered under the Uniformed and Overseas Citizens Absentee Voting Act through the Federal Voting Assistance Program. Their voting residence is typically their legal domicile or home of record rather than their current deployment location. However, if a service member requests that a ballot be sent to a location outside the U.S. that gives America's adversaries a clue about a potential base of operations. 

For an adversary like China, which has sophisticated data analytics capabilities and a track record of collecting personal information on Americans, the files enhance profiling efforts. Bulk access allows correlation with other data sources to build dossiers on service members and families, aiding espionage recruitment, blackmail or harassment.

Broader potential risks include threats such as customized phishing and targeting of base occupants and efforts to map force posture indirectly. 

Most of America's bases are well-known and are mappable. However, a number of sites' locations and particular unit deployment are not known. Smaller, temporary or contingency sites are often not publicly known simply because they are not intended to be permanent. 

Classified or "black" sites, tied to special operations, intelligence, continuity-of-government (like Raven Rock or Mount Weather) or advanced testing sites are often not known to the public. Even for known bases, precise troop numbers, sub-facilities or sensitive activities are often classified for operational security.