A massive voter-tracking program run by Kansas Secretary of State Kris Kobach — which purports to help states keep voter rolls accurate — has halted operations over concerns about its own accuracy and security.
The Interstate Crosscheck system, which Kobach’s office promised would be working ahead of the 2018 elections, has been sidelined while the U.S. Department of Homeland Security conducts a security assessment following the unintended release of hundreds of voters’ private information.
Each year, the Crosscheck program compares voter registration lists from more than two dozen states, searching for duplicate names. The stated goal is to prevent people from voting in more than one state and eliminate voter fraud — although being registered to vote in two states is not illegal. Crosscheck then sends a list of duplicate names to each participating state, the first step in a long process of voter list maintenance.
Crosscheck, at one time, held data on half the registered voters in the country, and critics have warned that the program isn’t keeping the voter data safe. Crosscheck recently came under fire for a data security breach that made public the names, dates of birth and partial Social Security numbers of 945 Kansas voters. Others say Crosscheck is being used as a tool for voter suppression.
On Tuesday, the system came under further criticism when the ACLU of Kansas filed a federal class-action lawsuit charging that Kobach’s “reckless maintenance” of Crosscheck violated voters’ constitutional right to privacy. The suit seeks the removal of Kansas from Crosscheck until proper cyber-security safeguards are put in place.
Micah Kubic, executive director of the ACLU of Kansas, said Crosscheck was created in 2005 to help election officials in several states keep voter lists up-to-date. But under Kobach, Crosscheck has become a “farce of a data-matching program,” he said.
“Under Secretary Kobach’s watch, the program has become technologically obsolete, shoddily implemented and an utterly ineffectual spreadsheet containing sensitive personal information,” he said.
The system has been criticized for failing to meet industry security standards, like encrypting data, and for sending sensitive information, including passwords for election officials, via email.
Kobach, the former vice chair of President Trump’s controversial voter fraud commission, said Kansas is working on Crosscheck’s problems and is cooperating with the Department of Homeland Security.
“The transmission of the voter registration data is where we are particularly concerned, to make sure that there’s no possibility that it could be intercepted,” Kobach told KCUR during an interview last week. “So that’s where we’re working with DHS to make sure that we have the highest standards in the industry.”
Kobach, who’s been secretary of state since 2011 and is now running for governor, defends the program as a first indicator of possible voter fraud. He said that it’s up to each state to do its own checks when it receives the analysis. Crosscheck’s findings are “a very valid basis to begin the investigation” of whether a voter should be removed from a state’s rolls, he said.
But Kobach has also used Crosscheck to amplify his claims of voter fraud and to expand his own authority. Kobach said he did use Crosscheck in 2015 to help him win prosecutorial powers from the state Legislature — the only secretary of state in the country to have them. KCUR reported last year that Kobach had prosecuted only a handful of voter fraud cases.
In addition to security problems, Crosscheck has been criticized as a tool for voter suppression because it provides so many “false positives,” voters with the same name who should not be removed from the rolls. This month, a federal judge in Indiana blocked that state from implementing a law that uses Crosscheck data to automatically eliminate voters who appear in the system as registered in another state.
Despite promises by Kobach’s office that Crosscheck would be running analyses for states before the November mid-term elections, it has failed to do so, according to 18 states contacted by KCUR. Kansas offers the program to states for free, and Kobach refuses to say how much that costs taxpayers.Loading...
Meanwhile, a growing number of states are refusing to participate in Crosscheck, citing security problems and inaccurate data. “There were security concerns about Crosscheck and the usefulness of data we were getting back,” said Chris Whitmire of the South Carolina Secretary of State’s office, which recently halted its work with the program. “We haven’t heard from Crosscheck in months.”
Crosscheck began with just four Midwestern states, but by 2015 Kansas officials promoted Crosscheck as holding 109 million voter registrations from 31 states. Since Crosscheck started coming under fire in 2017, the database is down to 25 states, or roughly 85.2 million voter registrations.
In Illinois, election officials brought up security concerns with Kansas officials last fall and learned of Homeland Security’s involvement, said Matt Dietrich of the Illinois State Board of Elections. Kansas officials haven’t updated Illinois since December or January, he said.
“When we had the last discussion with them, it was that we were going to hear back from them when they got their clean bill of health from the Department of Homeland Security. So we are waiting for that,” Dietrich said.
Illinois could soon join those states who are stepping away from Crosscheck. The Legislature recently passed a bill removing the state from Crosscheck but it has not yet been signed by the governor, Dietrich said.
Bryan Caskey, director of elections for the Kansas Secretary of State, confirmed that Homeland Security agents visited Kansas in February and that he has continued to communicate with them. He wouldn’t disclose what he’s discussed with the agents, citing national security concerns.
Caskey downplayed the federal agency’s involvement and said the system is not operational because of an ongoing security review by state officials. Kansas had decided on a top-down look of all state systems after the November 2016 election, when claims first arose about Russian interference, he said.
Though some media reports have suggested that Russians attempted to hack into voter databases in a handful of states before the 2016 election, Caskey said there were never any attempts to infiltrate Crosscheck.
When Caskey learned of some security issues in 2017, thanks to public records requests by citizen watchdogs, “we thought it was in our best interest to completely revamp the security of the Crosscheck.”
Caskey traced the Homeland Security’s involvement with Crosscheck to a decision by the Obama administration to designate elections systems as critical infrastructure, adding them to a list that includes nuclear reactors, water systems and defense manufacturers.
“The world changed in 2016, and it changed again in January of 2017,” Caskey said, referring to Russian interference in 2016 and the critical infrastructure designation in early 2017. “That changed everything for every state in regards to our relationships with DHS.”
Spokesperson Scott McConnell confirmed that officials from Homeland Security have been in contact with the Kansas Secretary of State’s office and have “offered our cybersecurity expertise and services, as we do with every state.” He refused to elaborate.
What is clear is that the federal review of Crosscheck is affecting state election offices across the country.
During a recent court hearing on the challenge to a Crosscheck-related law in Indiana, Jeff Garn of the state Attorney General’s office, said the system is on hold because “there are concerns about data breach(es), and there's a Department of Homeland Security review being done of Crosscheck right now.”
In Idaho, officials decided not to participate in the Crosscheck program this year because of security fears, said Tim Hurst, chief deputy in the Idaho Secretary of State’s office.
“We’re not sure about their cybersecurity efforts,” he said. “They haven’t told us what they’re doing to protect the security.”
Idaho officials are evaluating whether they will work with Crosscheck in the future, Hurst said. The state had a problem with Crosscheck data in 2014, when local officials attempted to clear 3,243 voters from the rolls using erroneous data.
Crosscheck promises to send its analysis of potential duplicate voters to states by February each year. But the data input is very simple: usually just a first and last name along with a date of birth, so people with common names are often caught up in the analysis, creating lots of false positives. One analysis found that Crosscheck data was wrong more than 99 percent of the time.
Election officials defend Crosscheck as just a first step. They say they then follow standards set by federal law which calls for states to first send inactive voters a notification in the mail, and if voters don’t respond, wait for two federal elections before removing them from the rolls.
Massachusetts left Crosscheck this year because the data was often inaccurate, and the state has rigorous standards for deleting any voter from the rolls, said Debra O’Malley, a spokeswoman from the Secretary of the Commonwealth of Massachusetts.
“It’s a lot of work for local officials without a lot of actual matches,” she said. “The results were not worth all the work they put into it.”
Even if Crosscheck is off-line this year, some voting rights advocates are worried that 2018 could be the first time that voters who were flagged by the program in the past may find themselves off the rolls when they try to vote.
Jonathan Brater, an attorney with the Brennan Center for Justice in New York, said purging voters is not the way to address the perceived problem of double voting, which is rare.
“The idea of doing some sort of mass purge of the voter rolls and canceling a lot of legitimate voters in the name of trying to stop a stray number of illegal votes, it is just not good policy,” he said.
Peggy Lowe is an investgative reporter at KCUR. She's on Twitter @peggyllowe.
This story is part of an investigative journalism collaboration supported by the Corporation for Public Broadcasting. KCUR is working with APM Reports, WNYC in New York, KPCC in Los Angeles and WABE in Atlanta. Angela Caputo and Geoff Hing contributed to this report.
Copyright 2018 KCUR 89.3
