As announced on June 19, 2018, the ACLU of Kansas filed a class-action lawsuit against Kansas Secretary of State Kris Kobach on behalf of three individual plaintiffs, who had their constitutional rights to privacy violated by Sec. Kobach's office.
In the case, Moore v. Kobach, lead plaintiff Scott Moore shared a name and birthdate with a different man from Naples, Florida, and Kobach’s Crosscheck program proceeded to “match” them as the same person. Kobach then shuttled Moore’s information to Florida officials via unencrypted emails, leaving Moore vulnerable to identity theft. Moore’s personal information was exposed in 2013, but he only learned of the breach this year when he received a postcard and a one-year subscription to LifeLock, an identity theft protection company.
Kobach has implemented the "Crosscheck" data matching program, purported to identify people registered to vote in more than one state, in a careless way that breaks the law and puts registered voters in Kansas at risk of identity theft and fraud. Outside analyses by data management professionals have found that Crosscheck's matching criteria yields false positives more than 99% of the time - however, Sec. Kobach continues to use this faulty data in his illegal experiment to reduce citizen participation in Kansas elections and to perpetuate the false narrative of voter fraud that courts have held as illegal (see Fish v. Kobach). Crosscheck is exclusively funded by Kansas taxpayers and therefore free of charge to participating states. Citing both data inaccuracy and privacy concerns, eight states across the country have opted out of the Crosscheck program.
This case seeks remedy for the flagrant disregard with which Sec. Kobach has used Crosscheck to recklessly and routinely share personal, private information of thousands of Kansas voters in ways that are unsafe, unsecured, and cavalier. The action seeks to prohibit Koback from continuing to maintain, share, and release sensitive voter registration information to other states through the Crosscheck program. The action also seeks remedy for past disclosures, as Kobach's disclosure of the plaintiffs' private voter data is an unconstitutional violation of the Kansas Public Records Act, which prohibits government disclosure of social security numbers.
The ACLU of Kansas calls on the Court to bring justice for Mr. Moore and the other plaintiffs and to also bring the state of Kansas closer to a truthful accounting of the enormous costs Crosscheck has on the privacy rights of citizens and on the institutions of our democracy itself.
*UPDATE* On February 1, the Court denied the defense's motion to dismiss, concluding that precedent establishes that a constitutional right to privacy and that our clients' complaints indeed pose plausible claim for relief.
In early December, the ACLU of Kansas and the Kansas Secretary of State's office reached a settlement in the case. As a part of the settlement, Secretary of State Scott Schwab has agreed not to resume operating Crosscheck until all security upgrades recommended by the Department of Homeland Security have been implemented, industry-standard encryption practices are adopted, and participant states agree to a penalty of expulsion from the program for any negligent, reckless or intentional disclosure of information. The settlement also includes a list of information safeguards before the program can resume as well as an “acknowledgment of error” statement from Kansas Secretary of State Scott Schwab’s office reading: “The Kansas Secretary of State's Office acknowledges your personal information was improperly disclosed through the Interstate Voter Registration Crosscheck Program. We recognize this led to an error in the use and handling of your information. Our office has adopted policies and procedures to ensure your voter information will be protected in the future.” Read the press release here.
