Kansas Secretary of State Kris Kobach’s quest to discover voter fraud exposed sensitive data for nearly 1,000 Kansans when an official tried to compare partial Social Security numbers sent via an unsecured email to election staff in Florida.
The revelation led the Florida Department of State to offer a year of free fraud detection and protection services in a news release issued Friday.
Voters’ data was exposed in the course of the Interstate Crosscheck System, which serves to detect illegal double voting and find people registered to vote in more than one state. The system was set up in 2005 by former Kansas Secretary of State Ron Thornburgh and has taken criticism for security concerns and identifying false matches, though election officials are expected to go to great lengths before removing voters from the rolls.
In 2013, a Kansas official sent a list of 945 potential double registrants — Kansas and Florida voters who shared a first and last name and date of birth. The spreadsheet, sent over an unsecured email, included Kansans’ partial Social Security numbers, and the official requested that Florida officials check the list with their voters’ Social Security numbers to verify the identities truly matched. The Florida Department of State then released that list in September in response to an open records request filed by Anita Parsa, a Mission Hills resident interested in Kansas’ role leading Crosscheck.
Parsa, who began working with the advocacy group Indivisible Chicago after filing the request, said she didn’t ask for any data in her request. She wanted to know why Florida decided to leave the program. The first time she looked through the disclosed emails between Florida and Kansas officials, she said, she didn’t see the spreadsheet of 945 voters.
“And when I opened it, I was floored,” Parsa said.
Kansas Director of Elections Bryan Caskey has said repeatedly Crosscheck’s entire database, which last year totaled nearly 100 million records, to his knowledge has never been breached. He said the large database was still secure despite the release. He said he wasn’t aware of the smaller data release before taking questions on it, and emailing that data violated policies.
“That email should never have gone out,” Caskey said.
Caskey said the Kansas elections office doesn't send sensitive information over email now and staff members are periodically trained on how to send data securely. He said Kansas and other states in Crosscheck have frequent discussions about data security, and he criticized Florida for releasing the data.
“Although I agree that it should not have been sent by email, I also am adamant that Florida had no business turning that over to any third party,” Caskey said.
In the statement, Florida officials called the release “inadvertent.”
“These numbers were originally provided to the department by another state in 2013 as information that may have been a potential match to a Florida voter’s information,” the release says.
Florida will directly contact people affected by the data's release.
“At this time, the department has no reason to believe individuals’ information has been misused,” the release said. “However, in an abundance of caution and to help individuals detect any possible misuse of this information, we are providing a one-year membership in LifeLock program for those affected. This service will be free for all those who were identified.”
Crosscheck has come under fire in recent months for data security weaknesses. This week, Caskey announced the state would take over some key data transmission responsibilities. Arkansas had handled transmission of Crosscheck information but was criticized for emailing usernames and passwords for the server containing state data.
Kansas also pushed back the start of the 2018 Crosscheck program to accommodate an ongoing review of election security protocols in the Kansas Secretary of State’s office. That began in October 2016.
The now-defunct election integrity commission Kobach was leading for President Donald Trump also raised security concerns. A group of national security and cybersecurity officials raised alarms in a court brief in a lawsuit against the commission over the its plan to aggregate data into a national database.
Joshua Geltzer, executive director of Georgetown Law School’s Institute for Constitutional Advocacy and Protection and a co-author of the brief, said he couldn’t speak to the data release, but thought protection of voter information had become more important amid fears of Russian interference in the 2016 election.
“It seems to me big picture to put a real premium on using good cyber hygiene and cybersecurity practices when handling that sort of information,” Geltzer said.
Parsa said she would like to see more oversight of the Crosscheck system and was concerned about Kansas' potential liability in the event of a breach.
“If Crosscheck is a value to member states, I feel like it should be run by a bipartisan group, and it should have appropriate oversight and some mandatory reporting so it is far more transparent and trustworthy than it is under kind of the secretive control of a single state,” Parsa said.
The Florida release urged affected voters to call (850) 245-6022.