October 23, 2017

Trump Election Commissioner’s Voter Database Is a Ripe Target for Hackers

Kris Kobach calls the program a model for the country. It has major security problems.

Kansas Secretary of State Kris Kobach talks with a reporter in his office in Topeka, Kan. Orlin Wagner/AP

Fight disinformation: Sign up for the free Mother Jones Daily newsletter and follow the news that matters.

Kansas Secretary of State Kris Kobach has called his Interstate Crosscheck Program, which compares voter registration lists among states to search for fraudulent double voting, a model for the nation. Kobach is the vice chair of President Donald Trump’s controversial election integrity commission, which is seeking to find evidence of voter fraud and use it to impose new restrictions on voting. Crosscheck “illustrates how successful a multistate effort can be in enhancing the integrity of our elections and in keeping our voter rolls accurate,” Kobach said at the first meeting of the commission in July.

Yet newly released documents show that the program touted by Kobach has major security vulnerabilities that could lead to sensitive voter data being hacked, released, and even modified. States that employ the program upload their voter data to an unsecured server and exchange usernames and passwords to access the server over unsecured emails. They have also released sensitive, unredacted information on voters to the public.

Crosscheck was founded in 2005 to compare registration lists among Midwestern states but has been dramatically expanded by Kobach, and it’s now used by 32 states. Participating states upload their voter lists to a server run by the Arkansas secretary of state, and then Kobach’s office analyzes the data to search for illegal double voting. However, those files are being uploaded to a server that is not encrypted and could be hacked, according to documents released to the grassroots anti-Trump group Indivisible Chicago following a Freedom of Information Act request by the group. (Indivisible Chicago is lobbying Illinois to leave Crosscheck.)

Typically, sensitive data like this would be handled using a secure file transmission network called an SFTP, but Crosscheck uses an unsecure system, according to the documents. “This is a FTP site and not an SFTP,” Bryan Caskey, deputy assistant secretary of state for elections in Kansas, wrote to Clayton Nicholson, an information specialist with the Illinois State Board of Elections, on June 28. Moreover, the usernames and passwords used by state election officials to upload voter data are being sent in the body of unsecured emails to more than 80 people. That makes these communications a ripe target for hackers, says Shawn Davis, director of digital forensics at Edelson PC, a Chicago-based law firm specializing in technology issues.

“It’s completely vulnerable and wide open,” says Davis. “The largest issue is that they’re emailing the credentials back and forth. That’s a huge vulnerability.”

If a hacker sent a “phishing email” to Kansas pretending to be from another state that’s part of Crosscheck, Davis says, he or she could potentially get access to the voter files of every state participating in Crosscheck. That information could be stolen, released, or even modified, Davis says. “It’s not very secure at all,” he says of Crosscheck.

States are also not always protecting the data they have. After Florida received a FOIA request from a voting rights activist in Kansas, it released unredacted personal information on 1,400 voters, including their names, birth dates, and the last four digits of their social security numbers. This information could be enough to make them targets of identity theft, says Davis.

Crosscheck’s security vulnerabilities are particularly noteworthy because Trump’s election commission has requested voter data from all 50 states, leading to fears about how secure that data is and how it will be used. Kobach has repeatedly cited Crosscheck as a template for the commission’s work.

In addition to the risk of hacking, Crosscheck has been found to produce false matches 99 percent of the time. Academics from Stanford, Harvard, Yale, and the University of Pennsylvania who studied Crosscheck found that “200 legitimate voters may be impeded from voting for every double vote stopped.” Because the program searches for double voting using only voters’ first and last names and date of birth, it generates thousands of false matches, which makes double voting seem far more common than it is and can cause people to be incorrectly taken off voter rolls and even wrongly prosecuted for illegal voting.

In the newly released emails, Kansas election officials admit that Crosscheck can lead to mistaken cases of alleged fraud. “In a majority of cases of apparent double votes, in the end they do not turn out to be real double votes due to poll worker errors, mis-assignment of voter history, voters signing the wrong lines in poll books, etc,” wrote Brad Bryant, the state election director for Kansas, to Kyle Thomas, director of voting and registration systems at the Illinois State Board of Elections, in 2011. 

Following the release of the new documents, 20 state legislators in Illinois have called on the state board of elections to withdraw from Crosscheck. “We urge the Board to end the state’s participation in the Interstate Voter Registration Crosscheck System (‘Crosscheck’) and to refuse to comply with the Presidential Advisory Commission on Election Integrity’s second request for voter registration data,” they wrote. 

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with The Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

AN IMPORTANT UPDATE

We’re falling behind our online fundraising goals and we can’t sustain coming up short on donations month after month. Perhaps you’ve heard? It is impossibly hard in the news business right now, with layoffs intensifying and fancy new startups and funding going kaput.

The crisis facing journalism and democracy isn’t going away anytime soon. And neither is Mother Jones, our readers, or our unique way of doing in-depth reporting that exists to bring about change.

Which is exactly why, despite the challenges we face, we just took a big gulp and joined forces with The Center for Investigative Reporting, a team of ace journalists who create the amazing podcast and public radio show Reveal.

If you can part with even just a few bucks, please help us pick up the pace of donations. We simply can’t afford to keep falling behind on our fundraising targets month after month.

Editor-in-Chief Clara Jeffery said it well to our team recently, and that team 100 percent includes readers like you who make it all possible: “This is a year to prove that we can pull off this merger, grow our audiences and impact, attract more funding and keep growing. More broadly, it’s a year when the very future of both journalism and democracy is on the line. We have to go for every important story, every reader/listener/viewer, and leave it all on the field. I’m very proud of all the hard work that’s gotten us to this moment, and confident that we can meet it.”

Let’s do this. If you can right now, please support Mother Jones and investigative journalism with an urgently needed donation today.

payment methods

We Recommend

Latest

Sign up for our free newsletter

Subscribe to the Mother Jones Daily to have our top stories delivered directly to your inbox.

Get our award-winning magazine

Save big on a full year of investigations, ideas, and insights.

Subscribe

Support our journalism

Help Mother Jones' reporters dig deep with a tax-deductible donation.

Donate