Idaho Secretary State Lawerence Denney says he “wasn’t even aware of” security concerns and other issues surrounding Idaho’s participation in the Interstate Voter Registration Crosscheck Program until after he read an Idaho Statesman article posted online Thursday.
Crosscheck is a multistate program run by the Kansas Secretary of State’s Office that annually collects voter registration data, including such personal data as birth dates and partial Social Security numbers. It then compares them in search of duplicate registrations and voter fraud.
But the program has produced false positives in Idaho and other states, and public record requests have uncovered a number of cybersecurity concerns regarding its server, housed in Arkansas. The information given to the program includes voter data that can’t be shared through a public records request, and was denied to a Trump administration commission investigating voter fraud earlier this summer.
“We’ve done our research after we read the article,” Denney told the Statesman on Tuesday.
Sign Up and Save
Get six months of free digital access to The Idaho Statesman
And what did he learn?
“I thought the process was very secure. I had no idea maybe it wasn’t,” he said. “I would just say that it appears it has been very sloppy.”
So what’s next for Idaho and Crosscheck?
“We are reevaluating,” Denney said. “We are going to have to have some answers to the security or we are not going to participate next time around.”
Denney said “at this point” he does not think Idahoans’ voter registration data has been compromised.
“We will get answers to that before we make the decision to participate again or not,” he said.
Idaho, Crosscheck & Trump’s commission
Denney said his office has received 300 to 400 emails over the last several days from people concerned about their personal data and Idaho’s participation in the Crosscheck program.
This state has been a part of the project since 2013, when former Secretary of State Ben Ysursa approved joining it. Idaho has sent voter data to Crosscheck every year since 2014.
The person who since 2011 has overseen Crosscheck, Kansas Secretary of State Kris Kobach, also is vice-chair of President Donald Trump’s Advisory Commission on Election Integrity.
In July, Kobach asked all 50 states to submit to Trump’s commission their voter rolls, including voters’ birth dates, Social Security numbers and other personal data.
Denney told Kobach he only could have information available under Idaho’s public records law, which exempts voters’ birth dates and Social Security number information from disclosure.
But for the last four years, Idaho has been providing Kobach’s Crosscheck program with Idahoans’ voter registration information, including birth dates and partial Social Security numbers.
On Feb. 28, the Idaho Secretary of State’s Office uploaded 797,534 Idaho voter records to the Crosscheck server.
Even though Kobach, in effect, heads both programs, Denney said he does not think Kobach would transmit the Crosscheck data to the Trump commission.
“That would be a violation of the (memorandum of understanding). I do not think he would do that,” Denney said.
“I agree with former Secretary of State Ysursa,” Denney said. “We essentially have zero voter fraud (in Idaho).”
National criticism & another option
After learning the details, some members of Idaho’s House and Senate minority leadership said they are considering legislation to get this state out of the Crosscheck program.
“Idaho’s voters are being put at risk every year we participate in this unsecure program,” House Minority Leader Mat Erpelding, D-Boise, said in a news release.
They join other examples nationwide of how the Crosscheck program is under scrutiny.
Voter rights advocates are pressuring Illinois to drop out of the program, according to the Chicago Tribune.
And the Indianapolis Star reports several groups, including the Indiana NAACP, League of Women Voters and ACLU Indiana, have sued Secretary of State Connie Lawson claiming the state’s participation in Crosscheck violates federal law and is discriminatory.
Denney said he thinks Crosscheck, or a comparable program, could be “a very valuable tool” for cleaning up voter rolls if all 50 states participated and it was secure.
So, is there an alternative to Crosscheck?
Yes: the Electronic Registration Information Center, or ERIC.
ERIC is an independent, nonprofit organization owned and controlled by its participating states. It was created in 2012 as Pew Charitable Trusts project.
ERIC compares voter and motor vehicle registrations, U.S. Postal Service addresses and Social Security death records to help participating states update voter rolls.
Each participating state receives a report showing voters who have moved within their state, voters who have moved out of state, voters who have died, duplicate registrations in the same state and individuals who are potentially eligible to vote but are not yet registered.
In 2017, ERIC compared 25 million records from 16 states and Washington, D.C. The nonprofit says it found 722,443 records of voters who moved out of state, 1.65 million records of voters who moved within their state, 50,438 cases of duplicate registrations in the same state, and 28,548 records of voters who had died.
President Barack Obama’s Presidential Commission on Election Administration recommended states join ERIC in a report released in 2014.
As for security, ERIC has “a privacy and technology advisory board, comprised of leading experts in the field of data security and encryption, to review security protections and help provide advice,” states its website. “All data run through ERIC is collected, matched, and stored in an environment with state-of-art security protections.”
The Statesman could not quickly find any third-party review or report on ERIC’s data security.
Four of Idaho’s neighboring states participate in ERIC: Washington, Oregon, Utah and Nevada.
Just one adjacent state, Nevada, participates in Crosscheck.
But, unlike Crosscheck, ERIC is not free. Each state must pay annual dues to cover the program’s annual operating costs. ERIC’s budget for 2016-2017 is $785,000.
“The reason we have never joined ERIC is because of the cost,” Denney said.