The National  Memo Logo

Smart. Sharp. Funny. Fearless.

Monday, December 09, 2019

Can Voter Fraud Commission Keep Your Data Safe?

Reprinted with permission from ProPublica.


The voter-fraud-checking program championed by the head of the Presidential Advisory Commission on Election Integrity suffers from data security flaws that could imperil the safety of millions of peoples’ records, according to experts.

Indivisible Chicago, a progressive advocacy group in Illinois, filed a public-records request with Illinois and Florida for information on the Interstate Voter Registration Crosscheck Program. Crosscheck was created and run by the Kansas secretary of state’s office and is often cited by Kris Kobach, Kansas’ secretary of state, as a way to identify voters casting ballots in more than one state. Indivisible Chicago then posted emails and other documents it received, including messages exchanged between elections officials in Illinois and Florida and Crosscheck.

The emails and records revealed numerous security weaknesses. Crosscheck’s files are hosted on an insecure server, according to its own information. Usernames and passwords were regularly shared by email, making them vulnerable to snooping. And passwords were overly simplistic and only irregularly changed.

“It blows my mind — this is complete operational security incompetence,” said Joe Hall, the chief technologist for the Center for Democracy & Technology, an organization that promotes internet freedom. “You should consider all of that stuff in the hands of people who are clever enough to intercept someone’s email.”

The Kansas secretary of state’s office did not respond to emailed questions about Crosscheck’s security.

Crosscheck was conceived in 2005 as a way to, as the name implies, let states compare their voting rolls to prevent people from registering in multiple states. Kansas operates the program at no cost to the states that participate. Crosscheck assures them — about 30 states use the program as of now — that it employs “industry standard encryption technology and passwords.”

Hall disputes that. “It’s a complete lie,” he said.

Kobach co-chairs President Donald Trump’s voter fraud commission, which has been under heavy scrutiny over whether it will be able to secure the vast voting data it has requested, including names, addresses and dates of birth for virtually every voter in the country. When Kobach requested this data in June, the commission was scorched with criticism and lawsuits in both federal and state courts over privacy concerns. Kobach sent a second letter to states in late July promising data would “be kept confidential and secure throughout the duration of the commission’s existence.”

Experts say the documents released by Indivisible Chicago undercut Kobach’s claims that he understands how to protect voter data. “This raises serious concerns about the security of citizens’ data not only in Crosscheck, but with the voter fraud commission run by the same people,” said Dave Becker, the executive director of the Center for Election Innovation & Research. “They tell the voters, the states and the courts ‘trust us’ with personal data, but they refuse to answer basic questions about how they plan to secure or use that data.”

Concern over the commission’s ability to keep data secure given the new information about Crosscheck’s methods is “absolutely justified,” said Kenneth White, director of the Open Crypto Audit Project, and a security researcher and consultant.

Crosscheck’s data is stored on an FTP server run by the Arkansas Office of the Secretary of State. FTP servers are unencrypted, leaving passwords and downloads readable by electronic spies. It is standard across the industry to instead use SFTP (short for “SSH File Transfer Protocol”), which protects data from prying eyes, according to Hall. He compared FTP servers to a postcard and SFTP servers to a letter sealed in an envelope and locked in a vault.

Employees of the Arkansas secretary of state’s office send login credentials to election officials in states participating in Crosscheck and restrict access to either the public IP address or a range of addresses used by election officials in those states. That’s an important step to ensure users can only access the system through one of the approved IP addresses, according to White — but he said well-resourced attackers would be able to get around this protection.

And because Crosscheck routinely emailed full credentials, hackers may not even need to work particularly hard to do so. They could simply “spoof” — essentially, mimic — the email address of a state authority and send an email to Crosscheck’s administrators adding a different IP address, said Shawn Davis, the director of forensics at Edelson PC, a Chicago-area law firm specializing in cyber security. The firm has begun working with Indivisible Chicago, and Davis will testify before an upcoming joint session of the Illinois House and Senate to discuss Crosscheck’s vulnerabilities.

“Hackers do take these steps,” said Davis. “They are pretty patient — if they want to get the data they’ll do these things.”

Illinois has been a member of Crosscheck since 2011, but emails released by Indivisible Chicago show that no Illinois official inquired about data security issues until this July, when Indivisible Chicago raised questions. In response, Vipin Nischal, an analyst at the Arkansas secretary of state’s office, confirmed the use of an FTP server but claimed “no unauthorized or anonymous access” had been found. Bryan Caskey, Kansas’s director of elections, said officials at the Kansas secretary of state’s office, which performs the matching work, also have access to the data.

Arkansas employees sent emails to Crosscheck members containing the FTP address, the username and the password in the same email, which is considered bad security practice. Operating procedures included in the records request show that this practice was standard — Crosscheck instructed all three things to be sent in a single email every January before the matches were done. Hall called this “completely, unbelievably irresponsible.”

The Illinois State Board of Elections, which fulfilled one of the records requests from Illinois, redacted the FTP address but did not redact usernames and passwords. Passwords were emailed to all states in the same manner, leaving them vulnerable to similar exposure through public-records requests in other states.

The passwords are simplistic, and emails from Crosscheck’s operators show they were rarely changed. “Due to the heavy work load on our IT Director, we will not be able to update the passwords for this data pull,” an Arkansas employee said in an email to Crosscheck participants in 2011. “If there is a specific state that really needs/wants their password changed, please let me know and I will see what I can do for you.” Emails from Arkansas employees to the Illinois State Board of Elections in 2016 and 2017 also contained the same credentials.

“[Secretaries of state] took an oath to the people of their states to protect the state constitution, and part of that is the safekeeping of the citizens information,” said White. “They are abdicating that responsibility by putting their data in this sort of system.”



Start your day with National Memo Newsletter

Know first.

The opinions that matter. Delivered to your inbox every morning

Youtube Screenshot

In late 2011, John Oliver and his Daily Show cameraman made a trek to my office, then in Providence, Rhode Island, to take me to task. I had recently referred to the Tea Partiers who had pushed America to the brink of a disastrous default as "economic terrorists."

Oliver had apparently swallowed whole a series of barbs directed my way by a Wall Street Journal blogger who didn't seem to like women much. The blogger kept calling me the "Civility diva" and a "Baroness Catherine Ashton lookalike." (A member of the British parliament, Ashton was said to be homely.) He was quite the wit.

Keep reading...Show less

Donald Trump and Mike Pence

Youtube Screenshot

Several mainstream media outlets are manufacturing a political narrative that the discovery of classified documents at the homes of both President Joe Biden and former Vice President Mike Pence should alleviate pressure on disgraced former President Donald Trump, who not only took a vast trove of federal records but also refused to give them back.

Biden and Pence have both cooperated with federal investigators to recover and return documents that belong to the government, and both situations have rekindled scrutiny at the overall system of federal document classification and retention, which appears to be in serious need of reform. Their two examples stand in stark contrast to Trump’s behavior, and possible misconduct, regarding his own handling of government records.

Keep reading...Show less
{{ }}