Editorial: Scrap insecure voter system

Given the security concerns surrounding the Interstate Voter Registration Crosscheck Program, the state of Kansas should be developing a strategy for getting out of managing the database.

Unfortunately, that seems unlikely, given how enamored Kansas Secretary of State Kris Kobach is of the program.

The Interstate Voter Registration Crosscheck Program contains voter registration information for millions of voters in more than 25 states — names, birthdates, addresses and, in some cases, the last four digits of voters’ Social Security numbers.

The Kansas secretary of state’s office manages the database, which was built in 2005 and originally only included four states: Kansas, Missouri, Nebraska and Iowa. It was designed to help states clean up voter rolls by being able to easily cross reference voters who moved across state lines and registered in their new state without informing their former state of their move.

The program expanded to more than 25 states during Kobach’s tenure in office. And since becoming vice chairman of President Donald Trump’s Advisory Commission on Election Integrity, Kobach has requested that all 50 states submit voter registration information for the database.

The problem is, the database isn’t even close to being secure, as nonprofit investigative journalism outlet ProPublica demonstrated with relative ease. In an article last month, ProPublica worked with a progressive-leaning group called Indivisible Chicago to obtain public records showing that the Crosscheck files are hosted on an ftp server in Arkansas that is not secure, and that user names and simplistic passwords were frequently shared in emails, making them even more vulnerable to hackers.

“It blows my mind — this is complete operational security incompetence,” Joe Hall told ProPublica. Hall is the chief technologist for the Center for Democracy and Technology, an organization that promotes internet freedom.

Bryan Caskey, the chief election officer in Kobach’s office said this week that Crosscheck is being thoroughly reviewed for security concerns. He wasn’t sure who would pay for the security review and any necessary upgrades.

“I legitimately do not know the answer to that yet,” Caskey said. “We’re still evaluating all options, and one of the options is cost.”

So, to review, Kansas has taken responsibility for storing and managing multi-state voter registration information on a server that is easy to hack and if that wasn’t enough, officials responsible for the system have taken to routinely sharing user names and passwords back and forth via email, creating even greater security risk. And Kobach, with the president’s blessing, has touted this database as the system every state should use as the way forward to ensure election integrity. Finally, it appears Kansas taxpayers are likely to foot the bill for the security review and fix for the Crosscheck system.

At a minimum, Kansas should turn over management of the program to another state and pull out of participation in the database. Better yet, Crosscheck should be scrapped and the data purged. Sadly, neither step is likely.