TOPEKA — Amid data security concerns, Kansas Secretary of State Kris Kobach’s office could make a number of changes to the Interstate Voter Registration Crosscheck Program it created to identify voters who are registered in more than one state.
The system, which Kansas established in 2005, compares voter registration records between about 30 states to identify potential double voters and clean up states’ voting rosters. States upload their voter registration rolls to a server in Arkansas, and Kansas identifies potential double registrants once a year.
Crosscheck has come under scrutiny in recent weeks after a ProPublica, a nonprofit investigative reporting outlet, raised concerns about lax security management. According to the report, Arkansas hosts the information on an insecure server, and officials have sent usernames and passwords over emails and rarely changed them. Kansas elections director Bryan Caskey said Kobach’s office already had started a security review of all of its systems prior to the controversy around Crosscheck.
“I can say that in the history of the program to my knowledge, no data has every been compromised or given to a nefarious third-party,” Caskey said.
Caskey said Kansas held a kickoff conference call with member states earlier this month and would likely make some changes to its operations. He said Kansas started reviewing its elections systems last year, which he called “a watershed moment on the vulnerability of election systems.”
“Obviously, security and cybersecurity of all of our elections systems is important, and we are evaluating the security of all of our systems, including crosscheck,” Caskey said.
One of those changes, Caskey said, is that states will not get usernames and passwords over email for the program’s 2018 data run. He said he couldn’t say when the review might be complete, but he hoped to have a report by early next year, in time for the 2018 data upload.
Ken Menzel, general counsel for the Illinois State Board of Elections, said Kansas officials indicated in the conference call they would communicate improvement details to crosscheck member states by the end of the year.
“They’re indicating the state’s wouldn’t be uploading data again until whatever changes they’re making would be in place,” Menzel said.
Menzel said member states were told on the conference call that Kansas would take over hosting the server that houses the Crosscheck data, but Caskey said officials were looking into several options, including the cost of hosting a Kansas-based server.
“It’s one of the options that was on the table,” Caskey said. “We are finalizing those options, and I’m not prepared yet to say exactly what the outcome is going to be, but it is definitely on the table.”
Menzel said Illinois officials had recognized the concerns raised in ProPublica’s report. The board voted narrowly last month against withdrawing from the program.
“That’s kind of what we were pitching to them — is that these are the concerns that not just us but a lot of people have, and we’re waiting to see what precisely they’re going to do to up their game,” Menzel said.
Rep. Keith Esau, an Olathe Republican running to replace Kobach, said he was not particularly concerned about the security of the program because the files were encrypted. According to documents released by advocacy group Indivisible Chicago, encryption keys were also emailed to states.
“But there should also be a more secure way of transferring exchanging passwords so that we make sure that can’t get exposed some place,” Esau said.
• The Associated Press Contributed to this report.