The State of Kentucky has pulled out of the Interstate Crosscheck System, Gizmodo has learned, making it the eighth state to quit the program so far—even though it cost nothing to participate.
A source with direct knowledge of the decision told Gizmodo that Kentucky never used the data that it received from Crosscheck for the purpose of purging voter rolls because the data was “unreliable.” Kentucky Secretary of State Alison Grimes also expressed concern about the security of the program, the source said.
Kentucky officially quit Crosscheck in June but made no official announcement at the time. A tweet by Grimes last week about Kentucky not submitting voter data to Crosscheck initially puzzled activists who were unaware of the state’s decision.
Kentucky joined the program under the previous secretary of state, Trey Grayson, primarily because it was free. The data returned by Crosscheck, however, contained mostly false positives. “On the surface of it, it sounds like an okay thing to do,” the source said. “But then you start participating, and the data is not useful.”
The program, run by the Kansas Secretary of State’s office, is meant to help identify people registered to vote in multiple states. When someone moves to a new state and registers to vote there, for example, their old registration doesn’t automatically disappear. But for every multi-registrant identified, Crosscheck generates hundreds of false positives, according to a study last year by researchers at Stanford, Harvard, Yale, the University of Pennsylvania, and Microsoft.
This error rate means a lot of work for the states participating in Crosscheck to identify voter fraud—finding actual multi-registrants is akin finding the proverbial needle in a haystack. Further, relying on the data increases odds that legitimately registered voters will be mistakenly purged from voter rolls—particularly if no additional steps are taken to verify the state in which the voter currently lives.
For the purpose of identifying a unique voter, you need more than just a name and date of birth; however, many states are hesitant to turn over additional voter information to Crosscheck, which has earned a reputation for improperly handling sensitive data. Several states do, however, include partial Social Security numbers for voters whose names and birthdays match those of voters in other states.
Earlier this month, reports revealed that nearly 1,000 Kansans identified by Crosscheck had the last four digits of their Social Security numbers exposed in Florida, and other voter files and the passwords to decrypt them fell into the hands of unauthorized third parties last fall.
In 2014, the Virginia State Board of Elections accidentally sent Kansas the first four digits of voters’ Social Security numbers instead of the last four digits. In the same year, Idaho officials were told to cancel registrations of potential multi-registrants, only to be informed a month later that instruction was given in error. States have routinely downloaded the wrong voter files or mistakenly deleted files intended for other states to download.
Passwords to decrypt voter files have been leaked on multiple occasions, as have credentials granting access to the Crosscheck servers that host them.
Last week, Gizmodo reported that Kansas Secretary of State Kris Kobach’s office had, for years, made available online records containing the partial Social Security numbers of thousands of elected officials and state employees. After Gizmodo said it intended to report on the database, Kobach pulled it offline, yet his office insisted that he had been required by law to publish it in the first place.
Alaska, Florida, Washington, Massachusetts, New York, Oregon and Pennsylvania all previously participated in the free program but likewise pulled out. Bills currently in the New Hampshire and Illinois legislatures would, if passed, require state officials to withdraw from Crosscheck. In Kansas, where Crosscheck is run, a bipartisan bill known as the Free State Elections Act was introduced this week and would end its participation.
In an online survey last year, a New York official wrote that when using Crosscheck “there was no guarantee [Social Security numbers] would be private and majority of records were inaccurate.” An official from Connecticut, which does not participate in the program, wrote: “Have been advised by some states who have participated that the information provided is labor-intensive and unreliable.”
A Maryland official simply wrote about the program: “A waste of time.”
As many as 23 states are enrolled in a similar program for voter roll maintenance run by ERIC, the Electronic Registration Information Center. However, the program, which has not suffered repeated security incidents and the methodology of which is considered far more accurate, is not free.
Annual fees vary, but ERIC’s one-time $25,000 fee is what drove many states to the Crosscheck program in the first place. In Kentucky, the Secretary of State’s office is barely receiving enough money from the general assembly to fully reimburse counties for election expenses, sources said, much less pay for participation in ERIC.
Correction: A previous version of this article stated that an Illinois official had expressed concern in a survey over Crosscheck potentially leaking Social Security digits. The official was from New York. Illinois ran the survey. We regret the error.