Shapiro continues to promote partisan voter-registration site that mimics official state election site — and skims your data

Governor Josh Shapiro continues to cooperate with a voter registration website with a web address deceptively similar to the official Pennsylvania Department of State’s, but which also harvests the registrant’s personal information for partisan political advertising.

Broad + Liberty first reported on the website vote.pa last year, pointing out that the website address was a classic example of website impersonation, where a person or entity creates a web address (also known as a URL) that is extremely similar to a well trafficked, official web address, but that has minor variations such as being off by one letter.

In the most recent example of Shapiro’s cooperation, the governor appears in a Facebook video ad promoted by a local political action committee, Black Leadership Pennsylvania. In that video, Shapiro urges the user to register to vote, and the ad’s link takes them to vote.pa — just a few keystrokes off from the official state registration website, vote.pa.gov

Vote.pa will register someone to vote if the user fills out all the required information. But it will also pocket the user’s personal data.  The website’s privacy policy specifies, “We may use your personal information in connection with our political efforts and activities.” The policy also tells users, “We reserve the right to share your personal information to third parties as part of any potential business or asset sale…or similar type of transaction.”

One irony is that vote.pa is similar in a sense to “cybersquatting” sites of the kind Shapiro used to warn Pennsylvanians about when he was attorney general.

While attorney general, Shapiro frequently issued holiday-themed press releases warning about cybersquatting sites. “Crooks try to impersonate well-known websites by inverting characters or slightly altering the name of a well-known website,” the press release usually said. “The copycat sites may look similar to the real website – and they can steal your credit information.”

When comparing vote.pa to the state’s official homepage for voter registration, both websites use dark blue lettering and have outlines of the state for its “branding” logo or site logo, which could also add to user confusion. The image on the left is from vote.pa, and the image on the right is from the Department of State’s official website.

Vote.pa is a project of Commonwealth Communications, which is run by J.J. Abbott, a longtime Democratic political operative and former communications officer for Gov. Tom Wolf.

A small number of the ads imply direct cooperation from the governor, saying the message is “from Black Leadership PA and Gov. Josh Shapiro.”

Black Leadership Pennsylvania, meanwhile, is a relatively new political action committee, and was co-founded by Joseph Hill, who works at Cozen O’Connor. Hill has a substantial pedigree in Democratic Party politics, having done campaign work for former Gov. Tom Wolf and Hillary Clinton. He has also worked for former U.S. Senator Bob Casey, Jr., and the 2016 Democratic National Convention Committee, according to his professional biography available online.

Hill was a behind-the-scenes player of the controversial election grants given out in the runup to the 2020 presidential election from the Center for Tech and Civic Life, or CTCL. Those grants were promoted to citizens as being nonpartisan, even though they were frequently managed by partisan actors like Hill and others.

Vote.pa has made minor changes to its site since Broad + Liberty’s original reporting in the spring of last year. For example, the website now has disclaimer language in small print that the official website of the commonwealth is vote.pa.gov. 

Additionally, when a user of the Facebook ads for Black Leadership Pennsylvania clicks the web address provided, the vote.pa landing page has a different logo, one that replaces the image shown above with the state outline.

When users click through the Black Leadership Pennsylvania Facebook ads, they are taken to a version of vote.pa that displays ‘Black Leadership’ branding rather than the state-outline logo that typically appears on the site.

But even taking those minor changes into account, some in Harrisburg say it’s wrong for the governor to be cooperating with a website that mimics the commonwealth’s web address, and does so for partisan gain.

Republican State Senator Kristin Phillips-Hill (York) called Shapiro’s cooperation with the site “despicable.”

“I am concerned that he’s continuing to use those data mining operations on Pennsylvanians because I think it’s difficult for the average person to discern what is a campaign website and what is an official state government website,” Phillips-Hill said. “Because when you look at these, they look nearly identical. And this sort of tactic is what you expect from a fringe group, not from someone who sits as the governor of the commonwealth.”

BLPA’s website says it is a nonprofit organization, but does not specify which kind. As of this publishing, Broad + Liberty cannot find any documentation that it is a traditional 501(c)3 organization, but this does not mean it has not registered in some way.

Additional searches do establish a federal political action committee for the group, however.

The group’s Facebook page was created last August, and has about three dozen followers as of this publishing. The Instagram account for Black Leadership PAC, meanwhile, has just over 380 followers.

“Cybersquatting” sites have always been concerning to those who track and prosecute financial fraud. But the technique has become increasingly concerning to matters of election security in recent years.

In August of 2020, the U.S. Department of Homeland Security warned about the proliferation of cybersquatting sites — also sometimes called typosquatting — that were election-related.

“These suspicious typosquatting domains may be used for advertising, credential harvesting, and other malicious purposes, such as phishing and influence operations,” a DHS bulletin said at the time. “Users should pay close attention to the spelling of web addresses or websites that look trustworthy but may be close imitations of legitimate U.S. election websites.”

Broad + Liberty also reported in 2024 that a Democratic-aligned group, The Voter Project, had been sending out “how to register” flyers across the commonwealth that used Gov. Shapiro’s signature, and also pointed the reader to register at vote.pa.

And Shapiro isn’t the only elected Democrat to publicize the site. State Sen. Jay Costa, the minority senate leader from Allegheny County, also published a post to X last year directing people to the site.

Democratic State Sen. Judith Schwank (Berks) also promoted the site with an X post, but later deleted it.

Vote.pa is able to register voters through its own site because the Pennsylvania Department of State has set up protocols to allow third-party sites to do that kind of activity. When Broad + Liberty reached out last year to the DOS for comment on whether it had opinions about vote.pa and the closeness of the DOS website, it only said that the website was “permitted to participate in the Department’s API program so long as it complies with the Terms of Use.” 

The Department of State did not respond to a request for comment for the current story.

Meanwhile, Sen. Phillips-Hill says there are yet more ironies about the entire affair. 

Her office recently hosted a “scam jam” where elected officials and their team teach residents techniques to stay safe from fraudsters, especially those online. And as part of these efforts, the governor’s office participated by sending members from the governor’s Department of Banking and Securities to teach citizens about fake websites.

“They literally discussed this very thing, how to make sure that a website is legitimate. Now, they didn’t use the word typosquatting. They didn’t use the word URL hijacking, but they talked about this practice of cyber-criminals who register similar domain names to legitimate sites to try to trick people into giving up their personal information. And they explained how this leads to really harmful outcomes. You could have malware put onto your computer, you could suffer from phishing attacks, you could be defrauded of your money because you’ve given them your personally identifiable information,” the senator said.

“So the administration is warning people about this — spending taxpayer dollars to deploy these people” to warn about cybersquatting. “At the same time, the governor is actively engaged in this very deceptive and questionable practice,” she said.

J.J. Abbott, Joe Hill, and the governor’s office all did not respond to requests for comment for this story.

Todd Shepherd is Broad + Liberty’s chief investigative reporter. Send him tips at tshepherd@broadandliberty.com, or use his encrypted email at shepherdreports@protonmail.com. @shepherdreports

Editor’s Note: Black Leadership Pennsylvania’s website identifies the organization as a nonprofit, while federal records also show a registered political action committee under the same name. Due to the organization’s limited public documentation and the common practice of political groups operating parallel nonprofit and PAC entities, this article treats references to Black Leadership Pennsylvania as referring to the broader organizational operation without distinguishing between the specific legal entities.