Share this post

Indivisible Chicago Takes On Cross-Check

Jennifer O’BrienSteve Held - 11/09/2017

A
A
+
-

On October 23, a story broke in Mother Jones, ProPublica, and Think Progress that caused a big stir in voting rights circles. A group of citizens in Illinois had discovered some smoking-gun evidence that the  problematic Interstate Crosscheck program had some major security issues—and that key people knew about them.

That group was Indivisible Chicago. For several months, the team had been pressuring their own state’s board of elections to remove the state from the Crosscheck program, going from office to office to build a coalition of elected officials—and becoming statewide experts in the process. It was in the course of this work that they learned of major security flaws at the national level.

We on the national Indivisible Project team couldn’t be more floored. Indivisible Chicago took some familiar tactics in a different direction and showed us all what persistence, creativity, and knowing your stuff can do.

And Indivisible Chicago isn’t done! Twenty-eight states are still participating in this lousy program. Is your state one of them? Check out Indivisible Chicago’s new website, EndCrosscheck.com to learn more about what’s ahead.

For Those Who Aren’t Familiar, What Is the Interstate Crosscheck Program, Exactly?

The Interstate Voter Registration Data Crosscheck system is a data-sharing program between states, ostensibly used to maintain voter registration rolls.

There are massive and well-documented problems with this program.

The program has record of producing false positives in the matching. If you share the same first name, last name, and birthdate as someone in another one of the 28 participating states, you appear in the program as a potential duplicate registrant. This has already resulted in the purging of thousands of people from voter rolls in a few states—completely in error. In addition, the program has had a disproportionate impact on people of color, because census data shows there’s an even higher preponderance of repetition of names in some communities in the U.S. For example, if your last name is Kim, Washington, or Martinez, it’s likely that you are a person of color and it’s also more likely that you will be flagged by Crosscheck and potentially thrown off the rolls.

Crosscheck started as a project in Kansas in 2005 to share data between Kansas, Iowa, Missouri, and Nebraska. It was meant to simply identify people who moved from one state to another and to cancel their old voter registration information.

When Kris Kobach took over as Kansas Secretary of State in 2011, he grew the membership of the program from four states to twenty-eight states—including Illinois. He also expanded the focus to try to identify instances of voter fraud: looking for examples of voters deliberately voting twice in different states. Kobach’s true purpose behind Crosscheck seems to be to misrepresent the data to create propaganda that he can use to push for new laws that make it easier to purge citizens from the rolls and to make it harder to vote.

What Did You Guys Discover? Could You Walk Us Through the Security Problems You Found?

Within the past two weeks we discovered massive security failures in the Crosscheck program and in how the Illinois State Board of Elections (SBE) handles voter data.  

We sent Freedom of Information Act (FOIA) requests to Illinois and other states for information about the program. We were startled by what we got back.

For starters, we received multiple usernames and passwords that election officials use to log in to voter data and Crosscheck systems.

The primary problem here is not that we have these passwords, but that the records show that every official and IT department involved in this process has been sending those usernames, login passwords, and decryption passwords in clear text in regular old emails—sometimes on chains with up to eighty recipients. Those are really bad security practices, even under normal circumstances. Anyone could have these passwords, and they could have been used while the election officials would have been none the wiser.

In addition, Crosscheck asks states to upload their entire voter file to a server that does not use any encryption protocols. This means that every state’s username and password to this central server housing 100 million voter records is sent in clear text across the Internet.

Even worse: even after there was an unprecedented rash of hacks against voter registration systems in 2016, Crosscheck and the twenty-eight participating states changed nothing and continued their poor security practices in 2017.

In addition to these technical issues, we also exposed another flaw: if we can get information about thousands of voters through FOIA requests this way, other people can too. For example, we have about 1,000 Kansans voter information plus the last four digits of their social security number thanks to Florida. It appears that voter data sent to Crosscheck is then susceptible to open records requests in other states.

 

Influencing a State Board of Elections Doesn’t Sound Easy. Have Indivisible’s Tactics Worked at This Level?

Yes, but in a different way than you might expect.

Indivisible Chicago had a difficult task, because the members of the Board of Elections are appointed, not elected, so the typical citizen action tactics to influence elected officials aren’t always the right tactics here. For example, staging a rally or other large event wasn’t going to move this forward.

When we first heard about Kris Kobach’s request for voter data from all fifty states on behalf of the Presidential Advisory Commission on Election Integrity, we immediately launched a calling action, sending a ton of phone calls to the State Board of Elections’ office. This actually worked. The Board wasn’t used to calls and interest from the public. When they were inundated they didn’t know how to handle so they reached out to us and asked if we could ‘make them stop calling’.  We demonstrated that we were willing to work with them by switching from calls to emails. We reached out to partner groups like Indivisible Illinois, Lawyers for Good Government, and Action for a Better Tomorrow and together, members sent 1,100 emails to the board. We think this worked because the Commission request had some urgency behind it and there was a corresponding national backlash. Crosscheck has a longer time horizon—they only send data once a year, in January—so in the summer the Board felt less pressure to act and didn’t respond to similar tactics on that issue.

Regarding the Commission, Indivisible Chicago also reached out strategically to our state Attorney General’s office who worked with counsel at the Board of Elections offering legal advice on how to push back against the Commission’s request.

In parallel we started working on legislative support to fight Crosscheck. For the most part this involved our small team reaching out individually to gain lawmakers’ support, even to legislators other than our own. In the beginning this was a challenge—none of the legislators knew what this program was so there was some initial education involved.

In August, we were able to get seven state legislators  and three U.S. Representatives—Rep. Luis Gutierrez, Rep. Mike Quigley, and Rep. Jan Schakowsky—to sign onto our letter or release their own before the first board meeting we attended.  The legislator statements gave us more credibility than just a random group of concerned citizens. Legislative support also sets up a possible backstop down the road, if we have to legislate our way out of Crosscheck.

Because we were well-researched and had credibility, we were granted some time on the August Board of Elections meeting agenda, during the time they deliberated the Commission request. They granted one of our team members ten minutes to address the Board. This was a great opportunity to address the SBE and educate them on the program and our concerns. After the meeting, we were also approached by many other meeting attendees  and advocacy groups who wanted to partner with us in this fight.

Since then we’ve held a press conference with legislators. We’ve seen our support with legislators begin to snowball. By October we had around thirty state legislators who had made public statements of support.

What’s Happened Since the Big Story Broke in The National News?

In mid-October, following the national media coverage, our U.S. Senators Durbin and Duckworth issued a joint statement calling on Illinois to leave the Crosscheck program.

We’ve leveraged  these new stories and FOIA’d emails by sending them out to the 109 election authorities throughout Illinois. Most of them aren’t any more informed on this issue than any of us were in June. They just get data and process data, the larger concerns about security or voter suppression aren’t really on their radar. As a result of our findings, though, there are now election authorities who supported Crosscheck in August now reversing course and agreeing that Illinois should leave. This is a huge development, because the SBE claims they only participate in this program because local election authorities want this. In the end, they probably care more about what the local election authorities want than all of our state and federal legislators.

The Board of Elections has still not made an official decision to put Crosscheck on their agenda. Ultimately it will require a vote by the Board to leave.

In parallel, our state senators are now concerned enough about this program that the members of the technology committee are holding a hearing, currently scheduled for November 15th, in which they are calling on the board of elections to testify as well as cybersecurity experts.

The fight continues but it feels like we now have the momentum on our side!

Are You Continuing to Fight This on The National Level, Too?

Yes. We’ve also sent more FOIA requests to every Crosscheck state to continue to shine a light on the failures of this system. We’ve already seen some interesting information as a result of these latest requests, so a bit of a teaser… stay tuned for more!

This Is a Really Wonky Issue! Do You Guys Have Professional Background in This? or Did You Learn About This as You Went?

None of us had experience with voter information systems or election law. In our core team we have an technology consultant, a couple of lawyers, one person who works in real estate, and a data analytics consultant.  Some of the core skills we leverage in our day jobs certainly helped us since this is an issue that deals with data privacy and security, legal issues around publicly available information, and data integrity and analytics.

In the end a lot of our success has come down to teamwork, relationship building, natural curiosity, and the tenacity to keep digging beyond the surface-level information already out there.

How Did This Particular Team Get Interested in This Issue?

A small group of us within Indivisible Chicago found out about the system as we were researching the Presidential Advisory Commission on Election Integrity—also a Kobach project—and were shocked to discover Illinois participates in Crosscheck.  

The team came together in the midst of all the work on ACA stuff.  Our primary means of working together and communicating is on Slack, with different channels for different issues.  We heard about the election commission’s letter and created a Slack channel with four or five of us that were interested in looking more into it.  We’re all a little geeky and research-y and not big rally kind of people. So this was the perfect outlet for us. We found ways to fit this into our day, talking online at 10 or 11 pm on Slack.  Once we were aware of Crosscheck and that Illinois participated, we ended up going down this wormhole, compiled a ton of research, and now we probably know as much about Crosscheck as anyone.

Do You Have Advice to Indivisible Groups in Other States Who Decide to Join in The Fight Against Crosscheck, or Who Want to Make a Difference on Other Complex Issues Like This?

Do your homework.  Every state is different in how they use the data and who is the decision-maker. Know what you’re talking about. There’s a lot of hyperbole out there about this program so separate fact from fiction. This is a complex issue and you won’t sway people just by being upset.  You will need to educate your decision-makers.

Summarizing the issue was a challenge, but we’ve gotten better at it now. It was helpful to come up with some graphics and short talking points on social media.  We tried to boil down the message to the basics.

Use connections you already have with legislators to talk to them about the issue and build support.  In our case, we already had connections with state representatives from other Indivisible actions. They trusted us.  Then we could go to other representatives and say that ‘we have seven other representatives on board.’

It was also important to leverage other relationships, and put out calls for contacts. Group members knew people from working on other issues, like ACA and taxes, or they just knew someone who knew someone in the office.  For instance, one mother from my daughter’s preschool was well connected, and helped us figure out how to get connected in our state Attorney General’s office. This wasn’t an issue we could just leave a message or email people about; the goal was to get somebody in a legislative office who was an actual person, and we were creative in finding connections to actual people.