By Roxana Hegeman, Associated Press
WICHITA, Kan. (AP) — A much-criticized database that checks whether voters are registered in multiple states has been suspended “for the foreseeable future” until security safeguards are put in place as part of a settlement of a federal lawsuit, a civil rights group said Tuesday.
The Interstate Crosscheck program was the subject a class-action lawsuit by the American Civil Liberties Union of Kansas on behalf of 945 voters whose partial Social Security numbers were exposed by Florida officials through an open records request.
Kansas has operated the multistate program since 2005, although the program hasn’t been used since 2017 when a Homeland Security audit discovered security vulnerabilities.
The settlement includes a list of safeguards the state has agreed to implement to protect voter’s personal information before the program can resume, the ACLU said in a news release.
Kansas has agreed not to resume operating Crosscheck until all security upgrades recommended by the Department of Homeland Security have been implemented and industry standard encryption practices are adopted. It also requires participating states to agree to a penalty of expulsion from the program for any negligent, reckless or intentional disclosure of information.
The settlement also includes an “acknowledgement of error” statement from Kansas Secretary of State Scott Schwab’s office: “The Kansas Secretary of State’s Office acknowledges your personal information was improperly disclosed through the Interstate Voter Registration Crosscheck Program. We recognize this led to an error in the use and handling of your information. Our office has adopted policies and procedures to ensure your voter information will be protected in the future.”
The ACLU commended Schwab for his commitment to overhauling Crosscheck.
“We realize it will take no shortage of time and resources to get the program up to code,” said Lauren Bonds, legal director for the ACLU of Kansas. “In the meantime, we hope Kansas will continue to explore more secure and accurate alternative programs to identify double registrants.”
At least 25 states shared voter registration records in the Crosscheck program in 2017, according to the lawsuit.
“This is a victory not only for our clients, but for every Kansas voter,” ACLU Executive Director Nadine Johnson said. “We’re pleased to see Secretary Schwab’s willingness to address this issue and to ensure the protection of voters’ personal data.”
The program, which looks for matches based on date of birth and first and last names, seeks to find duplicate registrations. Its critics contended the program had a high error rate and noted election officials in participating states exchanged possible matches via unsecured emails.
Crosscheck’s future had been up in the air since its patron, Kris Kobach, lost the Kansas race for governor in 2018. Kobach, now out of elected office, is seeking the Republican nomination for an open U.S. Senate seat in 2020.
Kobach’s successor as Kansas secretary of state had ordered a review to determine whether to scrap Crosscheck all together.
When the ACLU filed its lawsuit early last year, it said researchers discovered the system produced false positives 99 percent of the time. The lawsuit alleged Kobach sent voter signatures as well as the server address and passwords via unencrypted email. It also contended Kobach had weaponized Crosscheck in his quest to stamp out voter fraud.
Earlier this year, a federal court judge rejected an argument by the attorney general’s office that the lawsuit should be dismissed because voters have no right to privacy for the information in their registration record. Judge Daniel Crabtree said he was rejecting the argument “because its basic premise is wrong.”
Eight states — Florida, Alaska, Kentucky, Washington, Oregon, New York, Pennsylvania and Massachusetts — left the program due to security risks and data reliability concerns while Crosscheck was under Kobach’s management.