What Is Crosscheck?
Crosscheck is a data-sharing program between 28 participating states, ostensibly used to maintain voter registration rolls; however, since 2011 the program has been weaponized by white nationalist, paid Breitbart contributor and Kansas Secretary of State Kris Kobach to promote his lies about widespread voter fraud. The system uses a two point matching criteria, meaning that it analyzes first/last name and date of birth to find duplicate registration matches between states. The Crosscheck program is fundamentally flawed, as it exposes voters' personal data to massive security vulnerabilities, has been shown to be fundamentally discriminatory, and is tainted by Kobach's hyper-partisan voter suppression agenda.
Massive Cyber Security Vulnerabilities
1. How is data provided to Crosscheck?
Kansas/Arkansas election officials email user name and password to the FTP server hosted by the Arkansas Secretary of State. All participating states send their entire voter file to the FTP server. All states then email access passwords to their voter file to Kansas officials. Kansas officials then log in to the server, download all of the files, and then (allegedly) delete all of the files sent by member states. Kansas then runs the Crosscheck Program, uploads state-specific results files to the same FTP server, and emails all member states the decryption key to access their results file.
2. What are the security Vulnerabilities?
- An FTP server, without an encryption layer, is not a secure server platform.
- IP-address specific access, does not make up for a lack of encryption on the server. A skilled hacker can use a Man In the Middle attack to overcome IP address specific access.
- Access keys (Username/Password) to the FTP server are sent in clear text emails to state officials.
- Decryption passwords to access states' complete voter files are emailed in clear text emails to officials in Kansas.
- A single decryption password is used to access the results files of all 28 participating states. That password is bulk emailed in a clear text email to all election officials.
- We have evidence that FTP passwords did not change year-to-year. In fact, we have yet to see an email to any state where their FTP password changed.
It must be noted that the instruction guide for Crosscheck instructs elections officials to emails usernames and passwords so at its core, the system is not designed with data security in mind.
How accurate is the Crosscheck program?
Researchers at Harvard, Yale, Stanford, Penn, and Microsoft have used results data and statistical analysis to determine that Crosscheck results are over 99 percent inaccurate. “Out of the 240,000 paired registrations that Crosscheck sent to Iowa, there were only six cases where it appeared that the same person registered and voted in two different states. In other words, OVER 99 percent of the matches sent to Iowa were unlikely to have anything to do with attempted voter fraud.” Additionally, they have determined that the Crosscheck system purges 300 legal, legitimate voters for every single instance of double voting. Several states have left the program due to its significant inaccuracies and concerns over data privacy. Examples are Florida and Oregon who withdrew because they found the program to be overly inaccurate. The Oregon Secretary of State commented that “the data we received was unreliable.”
Have there been specific instances of abuse of Crosscheck data?
Other states such as Virginia, Indiana, Ohio, Georgia, and Idaho have been known to misunderstand and misuse the data returned by Crosscheck, leading to the cancellation of thousands of legitimate voters. In 2014 Ada County Idaho purged all of its 750 Crosscheck results without verification or notification to the purged residents. The State Board of Elections for Virginia attempted to purge over 40,000 voters just before an election. Through lawsuits, that number was reduced but still led to a purge of thousands of legitimate voters just prior to an election. The Indiana Secretary of State is being sued by the NAACP, the Brennan Center, and Common Cause for violations of the NVRA by utilizing Crosscheck to purge without notification. While states such as Illinois may make their best effort to use the data correctly, they are complicit in this voter suppression effort by fueling Kobach's propaganda machine and by providing the data that leads to intentional or accidental purges in other states.
Is the Crosscheck Program discriminatory?
It’s very possible. In a Rolling Stone article titled The GOP’s Stealth War on Voting, a database expert hired by the magazine found that Crosscheck disproportionately affects people of color. He concluded the system flagged 1-in-6 Latinos, 1-in-7 Asian Americans and 1-in-9 African Americans as potential double registrants based on common naming conventions within those communities.
How is Crosscheck related to the commission on election integrity?
Both are run by Kansas Secretary of State Kris Kobach. Both want to use poor analysis of voter data to create misleading statistics that can be used to perpetuate the lie of widespread voter fraud and to push for changes to our current laws which will make it harder for citizens to vote.
What is Kris Kobach’s history with voter suppression?
Kris Kobach is the current Kansas Secretary of State. Kobach manages the Interstate Crosscheck program and serves as Vice Chair of the Presidential Commission on "Election Integrity".
Kobach is an extreme Republican nationalist and Trump supporter, who promotes voter suppression efforts, a radical racist immigration agenda, and brazenly supports Trump's debunked claims that he lost the popular vote due to three million illegal voters. He is Vice Chairman of the Presidential Commission for Election Integrity, was educated at Oxford, and he has been actively working to take away YOUR right to vote for over a decade. Kobach has a long history of illegal voter suppression tactics and condoning discriminatory law enforcement practices. Kobach was the primary architect of NSEERS, the original “Muslim registry” created during the Bush Administration. A federal judge has ruled that Kris Kobach has been operating with “deceptive conduct and a lack of candor” before the court in a lawsuit filed by the ACLU which subsequently led to Mr. Kobach being fined. Additionally, while Kobach claims voter fraud is widespread, in the past three years he has successfully identified and prosecuted nine people for such voter fraud.
What is done with the results of Crosscheck?
While states aren’t required to act upon the results generated by Crosscheck, most states make an attempt to verify whether "matches" are in fact the same individual. Most states follow the NVRA by sending a postcard "notification of cancellation" to the in-state mailing address, after confirming they have a strong match in another state such as a matching SSN4 or signature card. However, some states have taken action based on Crosscheck reports without following the law. This happened in Ada County, Idaho. It happened in Virginia. Now Indiana has passed a state law that allows direct cancellations without notification, which has led to multiple lawsuits as this is clearly in violation of the NVRA. States like Indiana improperly interpret a Crosscheck ‘match’ to be a request by the registrant to be immediately removed from the rolls. Given the high number of false positives, these actions result in the unlawful purging of eligible voters from the voting rolls. Moreover, some states may not purge voters, but instead, they may wrongfully designating eligible voters as “inactive” based on Crosscheck’s faulty results. Even this designation may lead to negative consequences and ultimately can lead to having their registration cancelled. For example, such voters may be deprived of a mail-ballot application in states where mail-ballots are not sent to voters on the “inactive” list or if they skip an election cycle while inactive they could be purged before the next election.
How does Crosscheck compare to ERIC?
ERIC, or the Electronic Records Information Center, is a non-partisan, more secure, more accurate voter registration data comparison system. In addition to finding duplicate voter registrations, ERIC identifies unregistered eligible voters and requires member states to send them voter registration information. An in-depth analysis of ERIC is out of scope for this site; however, here is a comparison of the two systems.