Newly revealed records show sloppy practices that could put millions of people’s information at risk. 

Jessica Huseman and Derek Willis,
ProPublica

The voter-fraud-checking program championed by the head of the Presidential Advisory Commission on Election Integrity suffers from data security flaws that could imperil the safety of millions of peoples’ records, according to experts.

Indivisible Chicago, a progressive advocacy group in Illinois, filed a public-records request with Illinois and Florida for information on the Interstate Voter Registration Crosscheck Program. Crosscheck was created and run by the Kansas secretary of state’s office and is often cited by Kris Kobach, Kansas’ secretary of state, as a way to identify voters casting ballots in more than one state. Indivisible Chicago then posted emails and other documents it received, including messages exchanged between elections officials in Illinois and Florida and Crosscheck.

The emails and records revealed numerous security weaknesses. Crosscheck’s files are hosted on an insecure server, according to its own information. Usernames and passwords were regularly shared by email, making them vulnerable to snooping. And passwords were overly simplistic and only irregularly changed.

“It blows my mind — this is complete operational security incompetence,” said Joe Hall, the chief technologist for the Center for Democracy & Technology, an organization that promotes internet freedom. “You should consider all of that stuff in the hands of people who are clever enough to intercept someone’s email.”

The Kansas secretary of state’s office did not respond to emailed questions about Crosscheck’s security.

Crosscheck was conceived in 2005 as a way to, as the name implies, let states compare their voting rolls to prevent people from registering in multiple states. Kansas operates the program at no cost to the states that participate. Crosscheck assures them — about 30 states use the program as of now — that it employs “industry standard encryption technology and passwords.”

Hall disputes that. “It’s a complete lie,” he said.

Kobach co-chairs President Donald Trump’s voter fraud commission, which has been under heavy scrutiny over whether it will be able to secure the Employees of the Arkansas secretary of state’s office send login credentials to election officials in states participating in Crosscheck and restrict access to either the public IP address or a range of addresses used by election officials in those states. That’s an important step to ensure users can only access the system through one of the approved IP addresses, according to White — but he said well-resourced attackers would be able to get around this protection.

And because Crosscheck routinely emailed full credentials, hackers may not even need to work particularly hard to do so. They could simply “spoof” — essentially, mimic — the email address of a state authority and send an email to Crosscheck’s administrators adding a different IP address, said Shawn Davis, the director of forensics at Edelson PC, a Chicago-area law firm specializing in cyber security. The firm has begun working with Indivisible Chicago, and Davis will testify before an upcoming joint session of the Illinois House and Senate to discuss Crosscheck’s vulnerabilities.

“Hackers do take these steps,” said Davis. “They are pretty patient — if they want to get the data they’ll do these things.”

Illinois has been a member of Crosscheck since 2011, but emails released by Indivisible Chicago show that no Illinois official inquired about data security issues until this July, when Indivisible Chicago raised questions. In response, Vipin Nischal, an analyst at the Arkansas secretary of state’s office, confirmed the use of an FTP server but claimed “no unauthorized or anonymous access” had been found. Bryan Caskey, Kansas’s director of elections, said officials at the Kansas secretary of state’s office, which performs the matching work, also have access to the data.

Arkansas employees sent emails to Crosscheck members containing the FTP address, the username and the password in the same email, which is considered bad security practice. Operating procedures included in the records request show that this practice was standard — Crosscheck instructed all three things to be sent in a single email every January before the matches were done. Hall called this “completely, unbelievably irresponsible.”

The Illinois State Board of Elections, which fulfilled one of the records requests from Illinois, redacted the FTP address but did not redact usernames and passwords. Passwords were emailed to all states in the same manner, leaving them vulnerable to similar exposure through public-records requests in other states.

The passwords are simplistic, and emails from Crosscheck’s operators show they were rarely changed. “Due to the heavy work load on our IT Director, we will not be able to update the passwords for this data pull,” an Arkansas employee said in an email to Crosscheck participants in 2011. “If there is a specific state that really needs/wants their password changed, please let me know and I will see what I can do for you.” Emails from Arkansas employees to the Illinois State Board of Elections in 2016 and 2017 also contained the same credentials.

“[Secretaries of state] took an oath to the people of their states to protect the state constitution, and part of that is the safekeeping of the citizens information,” said White. “They are abdicating that responsibility by putting their data in this sort of system.”