Smart. Sharp. Funny. Fearless.
Sunday, January 20, 2019

Reprinted with permission from ProPublica.


The voter-fraud-checking program championed by the head of the Presidential Advisory Commission on Election Integrity suffers from data security flaws that could imperil the safety of millions of peoples’ records, according to experts.

Indivisible Chicago, a progressive advocacy group in Illinois, filed a public-records request with Illinois and Florida for information on the Interstate Voter Registration Crosscheck Program. Crosscheck was created and run by the Kansas secretary of state’s office and is often cited by Kris Kobach, Kansas’ secretary of state, as a way to identify voters casting ballots in more than one state. Indivisible Chicago then posted emails and other documents it received, including messages exchanged between elections officials in Illinois and Florida and Crosscheck.

The emails and records revealed numerous security weaknesses. Crosscheck’s files are hosted on an insecure server, according to its own information. Usernames and passwords were regularly shared by email, making them vulnerable to snooping. And passwords were overly simplistic and only irregularly changed.

“It blows my mind — this is complete operational security incompetence,” said Joe Hall, the chief technologist for the Center for Democracy & Technology, an organization that promotes internet freedom. “You should consider all of that stuff in the hands of people who are clever enough to intercept someone’s email.”

The Kansas secretary of state’s office did not respond to emailed questions about Crosscheck’s security.

Crosscheck was conceived in 2005 as a way to, as the name implies, let states compare their voting rolls to prevent people from registering in multiple states. Kansas operates the program at no cost to the states that participate. Crosscheck assures them — about 30 states use the program as of now — that it employs “industry standard encryption technology and passwords.”

Hall disputes that. “It’s a complete lie,” he said.

Kobach co-chairs President Donald Trump’s voter fraud commission, which has been under heavy scrutiny over whether it will be able to secure the vast voting data it has requested, including names, addresses and dates of birth for virtually every voter in the country. When Kobach requested this data in June, the commission was scorched with criticism and lawsuits in both federal and state courts over privacy concerns. Kobach sent a second letter to states in late July promising data would “be kept confidential and secure throughout the duration of the commission’s existence.”

Experts say the documents released by Indivisible Chicago undercut Kobach’s claims that he understands how to protect voter data. “This raises serious concerns about the security of citizens’ data not only in Crosscheck, but with the voter fraud commission run by the same people,” said Dave Becker, the executive director of the Center for Election Innovation & Research. “They tell the voters, the states and the courts ‘trust us’ with personal data, but they refuse to answer basic questions about how they plan to secure or use that data.”

Concern over the commission’s ability to keep data secure given the new information about Crosscheck’s methods is “absolutely justified,” said Kenneth White, director of the Open Crypto Audit Project, and a security researcher and consultant.

Crosscheck’s data is stored on an FTP server run by the Arkansas Office of the Secretary of State. FTP servers are unencrypted, leaving passwords and downloads readable by electronic spies. It is standard across the industry to instead use SFTP (short for “SSH File Transfer Protocol”), which protects data from prying eyes, according to Hall. He compared FTP servers to a postcard and SFTP servers to a letter sealed in an envelope and locked in a vault.

Employees of the Arkansas secretary of state’s office send login credentials to election officials in states participating in Crosscheck and restrict access to either the public IP address or a range of addresses used by election officials in those states. That’s an important step to ensure users can only access the system through one of the approved IP addresses, according to White — but he said well-resourced attackers would be able to get around this protection.

And because Crosscheck routinely emailed full credentials, hackers may not even need to work particularly hard to do so. They could simply “spoof” — essentially, mimic — the email address of a state authority and send an email to Crosscheck’s administrators adding a different IP address, said Shawn Davis, the director of forensics at Edelson PC, a Chicago-area law firm specializing in cyber security. The firm has begun working with Indivisible Chicago, and Davis will testify before an upcoming joint session of the Illinois House and Senate to discuss Crosscheck’s vulnerabilities.

“Hackers do take these steps,” said Davis. “They are pretty patient — if they want to get the data they’ll do these things.”

Illinois has been a member of Crosscheck since 2011, but emails released by Indivisible Chicago show that no Illinois official inquired about data security issues until this July, when Indivisible Chicago raised questions. In response, Vipin Nischal, an analyst at the Arkansas secretary of state’s office, confirmed the use of an FTP server but claimed “no unauthorized or anonymous access” had been found. Bryan Caskey, Kansas’s director of elections, said officials at the Kansas secretary of state’s office, which performs the matching work, also have access to the data.

Arkansas employees sent emails to Crosscheck members containing the FTP address, the username and the password in the same email, which is considered bad security practice. Operating procedures included in the records request show that this practice was standard — Crosscheck instructed all three things to be sent in a single email every January before the matches were done. Hall called this “completely, unbelievably irresponsible.”

The Illinois State Board of Elections, which fulfilled one of the records requests from Illinois, redacted the FTP address but did not redact usernames and passwords. Passwords were emailed to all states in the same manner, leaving them vulnerable to similar exposure through public-records requests in other states.

The passwords are simplistic, and emails from Crosscheck’s operators show they were rarely changed. “Due to the heavy work load on our IT Director, we will not be able to update the passwords for this data pull,” an Arkansas employee said in an email to Crosscheck participants in 2011. “If there is a specific state that really needs/wants their password changed, please let me know and I will see what I can do for you.” Emails from Arkansas employees to the Illinois State Board of Elections in 2016 and 2017 also contained the same credentials.

“[Secretaries of state] took an oath to the people of their states to protect the state constitution, and part of that is the safekeeping of the citizens information,” said White. “They are abdicating that responsibility by putting their data in this sort of system.”


  • Share this on Google+0
  • Share this on Linkedin0
  • Share this on Reddit0
  • Print this page
  • 31

8 responses to “Can Voter Fraud Commission Keep Your Data Safe?”

  1. FireBaron says:

    The GOP idea of voter security is to do anything it can to discourage potential democratic voters from casting ballots. Change times, move locations, reduce hours, require “unique” identification other than what was required to register to vote, etc.

  2. Eleanore Whitaker says:

    The Republicans benefit from rigged elections. It’s the only way they can win. If they had to rely ONLY on the popular vote, they’d lose as they did in 2016 when Hillary won the popular vote by 2.8 million more votes than Trump.

    To this day, that’s a sore spot in Trump’s mind. He knows he only won because of Electoral College votes.

    Anyone can rig the electoral college very easily. Absent gerrymandering and redistricting maps that deleted thousands of voters from registries in states like Wisconsin or overlapping Dem voting districts into Republican districts, all increase the number of Electors for Republicans.

    That’s why there is a major Supreme Court case Gill vs. Whitlock before the Supreme Court right now and why Gorsucker got under the skin of the other members of the SC when he tried to make excuses for why changing redistricting maps in Texas was a legal even when it omitted dozens of Dem voting districts.

  3. sharkbait4711 says:

    The ONLY WAY THE GOP can continue to win offices is by doing it unfairly. By cheating by lying and those that continue to support these lunatics are communists plain and simple. Trump is nothing more than a commie loving orange ape that is only looking to sell the United States of America to the highest bidder.
    He’s not draining the swamp – HE IS THE SWAMP!!!

  4. stcroixcarp says:

    Why would this commission want to keep our data confidential? Why should any of us expect any integrity from any commission trump appoints? The purpose of this commission is to stop citizens from voting.

  5. Richard Prescott says:

    My guess is “NO!”. Also, my guess is that anything entered into their “program” is going straight to Russia.
    The states with impeded voter access to voting need to have people get out house to house, apartment to apartment and get people registered. Of course no one can be forced to vote, but during the registration process try to point out why it is imperative to vote.
    I know, idealistic. But it will eliminate one aspect of the cry over voting, states that make it difficult for people to register.
    The other is to eliminate the Electoral College as archaic and unnecessary.
    Have a non-partisan Voters Commission that validates each state and the proper access to the polls. States that constantly change times and locations should have all that state’s votes disqualified.
    Point in fact, my local polling place has never changed since I have been living in this area, since 1984. How is it that some states can get away with routinely changing where their people can go to vote?

  6. johninPCFL says:

    ““It blows my mind — this is complete operational security incompetence,” said Joe Hall, the chief technologist for the Center for Democracy & Technology, an organization that promotes internet freedom.” – is anyone really surprised? This is a GOP operation after all.

    It would not be out of the ordinary in the age of Flynn, Manafort, Bannon, and Agent Orange to view the voter lists Kobach is obtaining as a precursor mailing list for the Kremlin hackers. That way, they have a head start on proposing voting list purge names and a target list for fake news “outrage of the day” emailings.

  7. Da FrogMeister says:

    Having worked over 40 years in data processing, I find that their security appears to be the approximately the level of what we used to use 25 – 30 years ago. In today’s world, that is the equivalent of no security at all. With all of the major breaches over the past year, Equifax being the biggest, I see little hope that they could even begin to have any control over the files. With what I read in the article, I think that any database that they created would be compromised from day 1, and I doubt seriously if they would have the expertise available to determine any compromises to the database. All this is is another way of trying to rig the voting and disenfranchise even more voters. They need to fold this sham up and put it in the garbage bin of bad ideas.

  8. Sand_Cat says:

    What makes anyone think this pack of zealots will even try? They wouldn’t be on the “commission” if Trump hadn’t decided they could be relied upon to “find” massive fraud, along with providing info that can be used in future elections to further corrupt our political system. NOTHING IS SAFE WITH ANYONE HAVING ANYTHING TO DO WITH TRUMP, INCLUDING THOSE WHO VOTED FOR HIM!!!

Leave a Reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.