LA County refuses to plug in DOJ USB drive with voter data

Los Angeles County election officials have refused to connect a USB drive sent by the Department of Justice, citing significant security and privacy concerns. The federal agency claims the device contains names of noncitizens who may have received mail ballots. County Clerk Dean Logan stated that accessing the drive would violate established information security protocols. Officials consider the physical medium insecure and note the accompanying letter lacks specifics about the data volume or content.

The risk

The primary risk involves handling unsolicited physical media from an external entity. Connecting an unknown USB device can expose systems to malware or data exfiltration. Furthermore, the lack of transparency regarding the drive's contents creates compliance ambiguity. Officials cannot verify the legitimacy or accuracy of the data without accessing it, which itself poses a security threat. This creates a dilemma between federal demands and local security standards.

Who is exposed

Los Angeles County election infrastructure is the immediate target of this demand. The Department of Justice specifically addressed the letter to California Secretary of State Shirley Weber and the Los Angeles County registrar. The scope of the alleged data breach is unclear, as the DOJ did not specify how many individuals are on the list. The exposure is limited to the administrative handling of the device rather than a confirmed compromise of voter records.

Cost and compliance

The Department of Justice issued a 48-hour deadline for compliance, threatening emergency legal relief if ignored. According to CBS, officials have not explicitly refused the demand but have not acted on it. A federal judge recently ruled against similar DOJ efforts to purge voter rolls in 18 states, citing inaccurate data. The Trump administration has lost 26 of 30 related lawsuits. This legal context suggests the DOJ's demands may lack standing.

What should you do?

Managers receiving unsolicited physical media should treat it as a potential threat. Do not connect the device to any networked system. Consult legal and security teams before taking any action. Verify the sender and the legitimacy of the request through independent channels. Document all communications and decisions regarding the device.

The background in plain language

Teams usually isolate unknown hardware to prevent malware infection. Check whether the sender has a verified identity and a clear reason for sending the device. Verify that the data format matches expected standards. Ensure that any data processing complies with local privacy laws. Do not assume federal demands override local security protocols. Maintain detailed logs of all interactions. Consult legal counsel before taking action on unverified data.

What to do and how to stay safe: Department of Justice

• Isolate any unsolicited physical media from networked systems immediately.
• Verify the sender's identity and the legitimacy of the request through independent channels.
• Consult legal and security teams before accessing or processing unknown data.
• Document all communications and decisions regarding the device for audit purposes.

Step-by-step guide: Mobile Security Architecture: 8 Practices for Device Integrity

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Why did LA County refuse to plug in the USB drive?

Officials cited established data privacy and information security protocols, stating the device is not a secure medium.

What did the Department of Justice demand?

The DOJ demanded that officials verify the citizenship of individuals on the list and set aside or withhold their ballots.

What is the legal context of this demand?

The Trump administration has lost 26 of 30 lawsuits related to similar voter data efforts, with courts citing inaccurate data.