US Voter Registration for 6 States - clean - declass marked Redacted

Page OCR text

DECLASSIFIED BY COUNSEL TO THE PRESIDENT WARRINGTON ON 10 JULY 2026

nt a Voter registration information from at least 2013 through 2021 is publicly available for download
from the commercial websites and it appears the PRC CNE actor downloaded the full repositories. This activity
represents newly-identified interest by this PRC CNE actor in U.S. elections, and the Pll information obtained

- to include names, party affiliations, email addresses, physical addresses, and phone numbers - could,

in theory, be leveraged to carry out anything from future CNE operations to election influence operations,
although the actual motivations for collecting this information is unknown.

ee victim information was passed to the appropriate agencies for CND response actions fill

BE © olorado, Connecticut, Florida, Michigan, Oklahoma, and Rhode Island States’ historical U.S. voter
registration information from 2013 to 2021 was downloaded by a PRC CNE actor on 14 January 2022 from
U.S. commercial websites, and a U.S. IP address hosting, among other things, U.S. state voter registration

information. (T1 504 fl On the same day, an Ohio voter registration application was also of interest to the PRC
CNE actor, but failed to download from the U.S. State Government's website .

a '- the PRC government has historically demonstrated interest in U.S. elections, this is a
newly-identified interest for this individual actor. The U.S. voter registration information is available for public
download, with 2021 voter registration information available for some states. The PRC actors could, in
theory, leverage the PII information obtained - to include names, party affiliations, email addresses, physical

1. [BI C’SA and the NCIJTF CYWATCH have established a Victim Notification process that provides a systematic way
to contact organizations during cyber incidents. Before anyone outside of the Federal Cybersecurity Centers contacts a U.S.

victim, the notification should be deconflicted through CISA and NCIJTF CYWATCH, using the contact information below:

2. BB According to the MITRE ATT&CK framework, T1594 describes how adversaries may search websites owned by potential

victims for information that can be used during targeting. Victim-owned websites may contain a variety of details, including names
of departmentsidivisions, physical locations, and data about key employees such as names, roles, and contact info. These sites

may also have details highlighting business operations and relationships.
Page 2

DECLASSIFIED BY COUNSEL TO THE PRESIDENT WARRINGTON ON 10 JULY 2026