In an appearance on MSNBC in July 2017, Kentucky Secretary of State Alison Lundergan Grimes expressed her vehement opposition to giving voter data to President Donald Trump’s voter fraud commission, which had requested it from election officials in all 50 states. The privacy risks were simply too high, she said.

“There is not enough bourbon here in Kentucky to make this request seem sensible,” Grimes said. “Not on my watch are we going to be releasing sensitive information that relates to the privacy of individuals.”

But beginning months before she made that statement, Grimes’ own staff had been looking up hundreds of voters in the very same registration system. One of her former staffers first revealed the practice last summer but provided little detail.

Now, an investigation by ProPublica and the Lexington Herald-Leader shows that the searches were extensive and targeted prominent state politicians, including gubernatorial candidate Rocky Adkins, who could have been Grimes’ opponent in the Democratic primary. Grimes, who had been considering a bid, announced last week that she has decided not to run for the governorship.

Grimes’ luster has dimmed of late. She was seen as a rising Democratic star when, at age 35, she ran a doomed race against Sen. Mitch McConnell in 2014. Now, three state agencies are pursuing investigations against her office — a result of complaints filed by numerous state employees and officials. At least four have quietly filed complaints with the Executive Branch Ethics Commission; two others have complained publicly. (In addition, Grimes’ father was indicted on federal charges for allegedly making illegal campaign contributions to her 2014 Senate campaign; he has pleaded not guilty.) Grimes has defended her conduct.

Grimes’ staff made questionable use of its unprecedented access to the voter registration system, or VRS. They looked up applicants for non-political positions with the seeming purpose of discovering their party affiliation. State law prohibits inquiring as to whether such applicants are Republicans or Democrats.

Her staff searched for hundreds of voters, mostly state employees outside the secretary of state’s office, for no discernible reason. Documents show they looked up current and former employees, a federal judge, the Kentucky education commissioner and every member of the Kentucky Board of Education.

They even searched for members of the ethics commission who are investigating Grimes herself.

Presented with questions from ProPublica and the Herald-Leader, Grimes took a two-pronged stance: She cast doubt on the accuracy of the logs that revealed the searches while defending her right to engage in such searches.

Grimes asserted that the search logs had “not been verified” despite the fact that similar logs were provided last August to the agencies investigating Grimes’ conduct, including the ethics commission, the state personnel board and a special prosecutor appointed by the Kentucky attorney general. She also said it “boggles my mind” that anyone would criticize her access to the system given that she is the state’s “chief elections official.”

On Jan. 24, six nights after ProPublica and the Herald-Leader posed questions about the VRS searches, Grimes went to Franklin Circuit Court in Frankfort. She filed a pre-emptive action requesting that a judge declare her right to gain access to the VRS. The suit names as defendants the executive director and assistant executive director of the Kentucky State Board of Elections or SBE, which is charged with overseeing the state’s elections and maintaining the voter rolls. (The executive director has filed an ethics complaint against Grimes.)

The filing asserts that Grimes’ office is “legally entitled to access the VRS pursuant to federal and Kentucky law. Indeed, access is necessary to perform the duties imposed on the Secretary of State by federal and Kentucky law.” The filing describes assertions that Grimes’ staff used the VRS to uncover party affiliations as “inaccurate” but goes on to assert that the office has the right to that information because Kentucky law requires the SBE staff to be bipartisan.

At least one Democratic election official in Kentucky takes a different view. “It’s inappropriate for the secretary of state’s office to have access at all,” said Don Blevins Jr., the clerk for Fayette County. “The fact that they’re abusing that privilege is no surprise.”

Grimes runs the first secretary of state’s office in Kentucky history to have such access. Trey Grayson, who held the position from 2004-11, said he could not think of a reason he or his staff would have needed it. Any need to access the system, he said, could have been accomplished by consulting the SBE. (The SBE is separate from the secretary of state’s office but closely linked to it; it’s chaired by the secretary of state.)

In fact, when Grayson served as secretary of state, Kentucky’s ethics commission ruled he could run for a Senate seat without recusing himself as chief elections officer expressly because he had no access to the rolls, which could have given him an advantage. The ethics commission has since said that opinion no longer stands in light of Grimes’ access.

Grayson said such separation “provided comfort for Kentuckians that no one person — specifically, the secretary of state — had too much authority over elections,” he said, adding that he and his predecessors “had the good sense to maintain that setup.”

State Sen. Damon Thayer introduced a bill several weeks ago that would block the secretary of state’s office and the board members of the SBE from accessing the VRS. The searches “make you pause,” Thayer said. “You wonder, is she conducting some sort of witch hunt?”

---

Grimes’ use of the VRS first raised questions in early 2017 when Matt Selph, then assistant executive director of the SBE, noticed that a voting precinct had been deleted from the system. He found that Grimes and seven of her staff members had administrative access to it.

It allowed her staff to see, and change, extensive personal data, though there’s no indication that they did so. One state official called the information “a starter kit for identity theft.” That access was then reduced to “read-only” in February 2017.

Pieces of the voter roll contained in Kentucky’s VRS have always been accessible. The public has the ability to search for a person’s party affiliation and voting precinct if they can supply a first name, last name and year of birth. Anyone can also buy a more extensive version of the voter roll for a fee. That version includes each voter’s full name, birth year, party affiliation, address, precinct and whether the voter has cast a ballot (but not for whom) in the past five years.

Internal access to the system reveals far more. Administrators can view voters’ drivers license numbers, every address ever linked to a voter, full birth dates, phone numbers, email addresses, Social Security numbers for some voters, disability status, military status and the addresses of voters — like domestic violence survivors — who have petitioned to have their address kept off the public roll.

Relatively few people have full access. County clerks and their deputies have such privileges in order to add people to the voter rolls but can make changes only in their counties. The SBE maintains the voter roll for the state and has the ability to make changes statewide. Grimes and her staff demanded the same access as the SBE staff before the 2016 election, claiming they needed it to monitor voter complaints.

Grimes says she no longer has access to the system, but her assistant secretary of state and elections director have maintained read-only privileges. Months after his discovery, Selph submitted a detailed 12-page complaint to the ethics commission and the board of the SBE, explaining his objections to her staff’s access to the VRS, among other things. The board voted to fire him shortly thereafter. (Selph has since filed a whistleblower suit against the state.)

Selph’s concerns have been echoed by current SBE Executive Director, Jared Dearing, and multiple county clerks, who say there is no legitimate reason for Grimes to have access to the database.

In August 2018, as part of his own complaint letter, Dearing first publicly accused Grimes and her staff of not only having inappropriate access, but also of searching for employees as well as job applicants in order to identify their political affiliation.

ProPublica and the Herald-Leader have examined documents that reveal the applicants Dearing was alluding to. They show that in April 2018, Lindsay Hughes Thurston, then an assistant secretary of state and now a Fayette County district judge, looked up Rashad Cleveland and Alan Hess. At the time, both were applicants for an IT position at the SBE. Hess is registered as a Republican and Cleveland as a Democrat. Dearing told the Personnel Board that Thurston had encouraged him to hire Cleveland, despite his view that Hess was more qualified. Dearing ignored this recommendation.

Attorneys representing the SBE have sometimes said searches of job applicants were part of “standard background checks.” But Thomas Stephens, the head of the state agency that performs background checks, also testified that the only information available in the voter roll unavailable in a state background check was political affiliation. “At this point, I am disturbed,” he said of the searches, adding that he could not “fathom” any need to use the VRS as part of a background check.

In several instances, Grimes’ staff engaged in what seem to be highly political searches. For example, Mary Sue Helm, director of elections in the secretary of state’s office, searched for Adkins, a member of the Kentucky house, during the 2018 legislative session after he said he was interested in running for governor. Grimes was then considering entering the race. In July, Helm looked up former Lt. Gov. Crit Luallen, who spent much of the summer stumping for Democratic congressional candidate Amy McGrath and has endorsed and donated thousands to Attorney General Andy Beshear, another Democratic gubernatorial candidate.

Adkins said he “needed to know more before commenting” and then declined to comment when presented with more information. Luallen said, “I can’t imagine why my name was looked up.”

For her part, Thurston summoned records for Thomas Fulton, a federal judge who’d presided over a swearing in ceremony for new citizens on the day he was searched. She sought records for “Benjamin Adams,” potentially Brig. Gen. Benjamin F. Adams III, the current commissioner of the Kentucky Department of Veterans Affairs. And she checked out a former veterans affairs commissioner, Norman Arflack, who is now the United States marshal in eastern Kentucky.

Only days before Sherry Whitehouse was named as a Democratic board member of the SBE in April, Thurston looked her up, too. On a single day in May, Thurston searched for more than 100 people, many of whom appear to be state employees across a range of agencies. Records show she continued her searches, even after being publicly criticized for the practice, until she left to become a judge.

Thurston did not reply to a written list of questions. Neither Whitehouse, Frazier nor the Department of Veterans Affairs returned calls seeking comment. A spokesperson for the Board of Education declined to comment.

At the September SBE meeting, which occurred after Dearing had publicly accused Grimes of inappropriate access, Grimes did not address these searches. Instead, she directed her ire at Dearing, who she said had jeopardized the security of Kentucky’s voter registration system by releasing search logs to investigators.

“Respectfully, Mr. Dearing, it is highly inappropriate for you as the executive director to put information about our voter registration system, the security of which is paramount to our cybersecurity efforts, in the public domain without the authorization of the chair, without the authorization of the board attorney and in the fashion in which you are attempting to do it now,” Grimes said.

“That’s why they call me a whistleblower,” Dearing interjected. Grimes then threatened to have state police remove him from the meeting.