Idaho Secretary of State Lawerence Denney on Wednesday expanded on his comments about Idaho’s participation in the Voter Crosscheck program, saying Idaho needs such a program, but that its cybersecurity must meet expectations.
The Interstate Voter Registration Crosscheck Program was started by the Kansas Secretary of State’s Office more than a decade ago. It has come under recent scrutiny for its effectiveness and its data security, highlighted by recent reports by ProPublica, the Statesman and others.
In addition, the Statesman learned certain Idaho voter data not publicly disclosable was sent to Crosscheck, but denied later this year to President Donald Trump’s commission focused on election integrity and voter fraud. Kansas Secretary of State Kris Kobach runs Crosscheck and is also vice-chairman of the Trump commission.
In particular, Denney felt reports focused on the program have misstated its purpose and its capabilities.
Never miss a local story.
“First and foremost, the articles seem to either infer or directly state that (Crosscheck) is primarily focused on voter fraud. That is not its primary purpose, nor how Idaho has utilized the program,” Denney wrote in an extensive statement.
“Idaho entered the Crosscheck program in 2014 because Idaho’s Secretary of State Ben Ysursa saw it as a useful tool to help identify potential duplicate registrations. The need for this is seated in federal statutes that were enacted as part of the Help America Vote Act, or HAVA, and are further echoed in Idaho law. Along with creating a centralized statewide voter registration list, the laws require the list to be both “accurate and updated regularly.’ ”
Kobach refers to Crosscheck as a method of keeping voter registrations up to date and removing duplicates. But he does also often tout it as a tool to root out fraud, including in remarks he made at the Trump commission’s first meeting.
Denney also explained an apparent contradiction: State Elections Director Betsie Kimbrough told the Statesman that Crosscheck flagged 257 Idaho records of possible concern this year, while Ada County Deputy Clerk Phil McGrane reported getting about 9,000. Kimbrough’s figure was “a clerical error” mistakenly citing a case number from a 2016 file, wrote Denney. For 2017, Crosscheck alerted Idaho to 28,113 records meriting followup.
Denney made some additional points:
▪ The program returns “potential duplicates,” not “false positives,” he wrote. “The program only matches first name, last name and date of birth to generate a potential duplicate. That is not a false positive. It is a legitimate match of two registrations that share a birthday and a name. It is then up to the counties at that point to do additional review to determine if the potential duplicate is actually a single individual.”
▪ He defended giving private voter data, including voters’ birth dates and partial Social Security numbers, to the Crosscheck program, saying the memorandum of understanding governing that program established privacy protections and boundaries that don’t exist through the public records process. The Statesman has been unable to learn if records obtained by Crosscheck are subject to public records laws in Kansas, or in Arkansas where the server holding the data is kept.
“It is because of this MOU that these 30 states have confidently utilized this program. At no time was any of this information ‘released,’ nor placed in the public domain. It was transmitted inside the parameters of the MOU. To my knowledge, no evidence exists nor has any been reported of any actual data breaches or information compromises from any state member as a result of the program,” Denney wrote.
The Statesman submitted questions to Denney and his staff about a number of these topics prior to and shortly after publishing its first article on Crosscheck last week. At that time, only some of the questions drew a response.
On Tuesday, Denney told the Statesman he was re-evaluating Idaho’s participation in the program due to security concerns.
He reiterated this in his press release: “(W)hether or not we continue down the path with Crosscheck in our toolbox will depend on our reviews of the security protocols of the Crosscheck program, and its ongoing potential benefit to Idaho.”
Several articles have been published in the last week regarding the State of Idaho’s participation in the Crosscheck program. I would like to take a moment to publicly address some of the questions and concerns raised by those articles.
First and foremost, the articles seem to either infer or directly state that the Interstate Voter Registration Crosscheck Program is primarily focused on Voter Fraud. That is not its primary purpose, nor how Idaho has utilized the program.
Idaho entered the Crosscheck program in 2014, because Idaho’s Secretary of State Ben Ysursa saw it as a useful tool to help identify POTENTIAL duplicate registrations. The need for this is seated in Federal statutes that were enacted as part of the Help America Vote Act, or HAVA, and are further echoed in Idaho law. Along with creating a centralized statewide voter registration list, the laws require the list to be both “accurate and updated regularly…” We have continued to use Crosscheck in that manner since, and upon receipt of the potential duplicates, separate and forward those possible matches to our 44 respective counties for their manual review and any potential further action.
At least one article quotes Betsie Kimbrough as stating that Crosscheck only returned 257 potential duplicates (in 2016). While accurate as a quote, that number was a clerical error on her part, as 257 was the case number assigned to the last record in the 2016 file. Upon further review, Betsie determined that the correct number of potential duplicates that were turned over to review by the counties was 28,113. Of these, approximately 9,000 were in Ada County, as accurately cited by Ada County’s Phil McGrane.
It is stated that the system generates significant numbers of false positives. It is important to understand what the program IS returning – Potential Duplicates. The program only matches first name, last name, and Date of Birth to generate a Potential Duplicate. That is not a false positive. It is a legitimate match of two registrations that share a birthday and a name. It is then up to the counties at that point to do additional review to determine if the Potential Duplicate is actually a single individual. It is also at their discretion if they should choose to simply do nothing at all. I appreciate Mr. McGrane’s integrity in clearly pointing out that the issue Ada County faced in 2014 was not a Crosscheck issue, but an Ada County process issue. Ada County, as Phil noted, did not do the additional review of the list in 2014 like they do today, by comparing middle initials and the last four of a social security number.
The Memorandum of Understanding (MOU) that governs the relationship between the approximately 30 member states participating in Crosscheck is significantly different from a public records request. Public records requests for the voter roll govern the release of public information to an individual or organization, and the only restriction is that it may not be used for commercial purposes other than political purposes. The MOU under which Crosscheck operates, however, outlines the expectations and understandings of the member parties, all of whom are state officials, and includes the requirement that information transferred under the agreement be used only for the purposes identified in the agreement (identifying potential duplicate registrations). It further states that the information shall not be transferred to any third party outside of the agreement. It is because of this MOU that these 30 states have confidently utilized this program. At no time was any of this information “released”, nor placed in the public domain. It was transmitted inside the parameters of the MOU. To my knowledge, no evidence exists nor has any been reported of any actual data breaches or information compromises from any state member as a result of the program.
Obviously the articles of late from both ProPublica and others offer serious allegations regarding whether or not the intended processes and security protocols protecting Crosscheck have been either adequate or followed. This is the first time I have seen this information, and our office is going to be reviewing these alleged vulnerabilities before making any decisions about how we would move forward in the future.
This is consistent with the proactive and comprehensive review and IT restructuring that is already well underway in our office pertaining not only to cyber-security concerns, but to the overall health of our data systems and processes office wide, from elections to corporate. This overhaul was long overdue, and the groundwork began in my first days in office. The first fruits of these changes will be released to the public in early December.
Former Secretary Ysursa entered Idaho into the Crosscheck program in 2014 to assist Idaho with the goal of maintaining clean voter rolls. In the same way that we clean the list of those who choose not to vote for over 4 years, or those who are deceased, Idaho has utilized Crosscheck as a tool to help us achieve that goal. Notably, the landscape has changed. As such, whether or not we continue down the path with Crosscheck in our toolbox will depend on our reviews of the security protocols of the Crosscheck program, and its ongoing potential benefit to Idaho.
Though articles may allude otherwise, elections access and list integrity is not solely a current administration agenda. The Presidential Election Commission on Election Administration under then-President Obama in 2014 called for Election officials to “continue to modernize the registration process through continued expansion of online voter registration and expanded state collaboration in improving the accuracy of voter lists…”
It is the responsibility of the Secretary of State, under both state and federal law, to ensure that Idaho’s voter rolls are accurate, that the portion of that information that is considered public is available to the public, and that the remaining information required to be collected by Federal and Idaho Statutes remain isolated from the public. Since taking office in 2015, I have done that job, and I will continue to do so in the future.