The Kansas Secretary of State's office has agreed to suspend a controversial program for scanning voter registration data until security vulnerabilities are resolved, settling a two-year legal battle with the American Civil Liberties Union of Kansas.
The ACLU of Kansas announced the settlement on Tuesday and said the agreement effectively puts the Interstate Voter Registration Crosscheck Program out of commission for the foreseeable future.
ACLU filed a lawsuit in 2018 to challenge the use of the 14-year-old program, which was developed to identify potential duplicates in voter registrations. The program became a controversial weapon in former Secretary of State Kris Kobach's unfounded war on voter fraud.
Critics say Crosscheck produced false positives 99% of the time and required the exchange of sensitive information through unsecured emails between election officials. Kansas last uploaded data to the program in 2017 when a Homeland Security audit confirmed vulnerabilities.
As part of the settlement, ACLU said, current Secretary of State Scott Schwab agreed not to resume operation of Crosscheck until all security upgrades recommended by Homeland Security have been implemented, industry standard encryption practices are adopted, and states that partner with Kansas to use the program agree to pay a penalty for disclosure of information.
Additionally, Schwab's office will issue a statement acknowledging personal information was improperly disclosed through the Crosscheck program.
“We realize it will take no shortage of time and resources to get the program up to code,” said Lauren Bonds, legal director for ACLU of Kansas. “In the meantime, we hope Kansas will continue to explore more secure and accurate alternative programs to identify double registrants."
Kobach chose not to make $20,000 in security upgrades or use Crosscheck during the last election cycle. In 2017, 28 states exchanged 98 million voting records through the program.
Originally designed to track individuals who moved without notifying election officials, the program searched for duplicate voter registration records based on birth dates and names. Voting rights advocates say a rival program known as ERIC is more reliable and incorporates other data, such as motor vehicle registrations.
Anita Parsa, a retired computer programmer from Mission Hills, filed an open records request with Florida officials in 2017 that revealed partial Social Security numbers of 945 Kansans and passwords for the Crosscheck system. ACLU of Kansas filed the class action lawsuit on behalf of those affected by the data breach.
Parsa said the state should avoid putting Kansas taxpayers on the hook for upgrades that already exist in ERIC.
"I’m pleased that Secretary Schwab has acknowledged the concerns about the data security risks of Crosscheck for voters across the country," Parsa said. "But Crosscheck’s issues don’t stop with data security. Its inaccuracy and lack of transparency combined with the burden of potential data liability issues being born solely by Kansas taxpayers should have led to a permanent shutdown of Crosscheck rather than an attempt to fix the data security problem."
Clay Barker, deputy counsel for the secretary of state's office, said Schwab would issue a statement after final wording is agreed upon.