The true facts of the Crosscheck program

Several articles have been published in the last week regarding the state of Idaho’s participation in the Crosscheck program. I would like to take a moment to publicly address some of the questions and concerns raised by those articles.

First and foremost, the articles seem to either infer or directly state that the Interstate Voter Registration Crosscheck Program is primarily focused on voter fraud. That is not its primary purpose, nor how Idaho has utilized the program.

Idaho entered the Crosscheck program in 2014, because Idaho’s Secretary of State Ben Ysursa saw it as a useful tool to help identify potential duplicate registrations. The need for this is seated in federal statutes that were enacted as part of the Help America Vote Act, or HAVA, and are further echoed in Idaho law. Along with creating a centralized statewide voter registration list, the laws require the list to be both “accurate and updated regularly …” We have continued to use Crosscheck in that manner since, and upon receipt of the potential duplicates, separate and forward those possible matches to our 44 respective counties for their manual review and any potential further action.

At least one article quotes Betsie Kimbrough as stating that Crosscheck only returned 257 potential duplicates (in 2016). While accurate as a quote, that number was a clerical error on her part, as 257 was the case number assigned to the last record in the 2016 file. Upon further review, Betsie determined that the correct number of potential duplicates that were turned over to review by the counties was 28,113. Of these, approximately 9,000 were in Ada County, as accurately cited by Ada County’s Phil McGrane.

It is stated that the system generates significant numbers of false positives. It is important to understand what the program is returning – potential duplicates. The program only matches first name, last name, and date of birth to generate a potential duplicate. That is not a false positive. It is a legitimate match of two registrations that share a birthday and a name. It is then up to the counties at that point to do additional review to determine if the potential duplicate is actually a single individual. It is also at their discretion if they should choose to simply do nothing at all. I appreciate Mr. McGrane’s integrity in clearly pointing out that the issue Ada County faced in 2014 was not a Crosscheck issue, but an Ada County process issue. Ada County, as Phil noted, did not do the additional review of the list in 2014 like they do today, by comparing middle initials and the last four of a social security number.

The memorandum of understanding that governs the relationship between the approximately 30 member states participating in Crosscheck is significantly different from a public records request. Public records requests for the voter roll govern the release of public information to an individual or organization, and the only restriction is that it may not be used for commercial purposes other than political purposes. The MOU under which Crosscheck operates, however, outlines the expectations and understandings of the member parties, all of whom are state officials, and includes the requirement that information transferred under the agreement be used only for the purposes identified in the agreement (identifying potential duplicate registrations). It further states that the information shall not be transferred to any third party outside of the agreement. It is because of this MOU that these 30 states have confidently utilized this program. At no time was any of this information “released”, nor placed in the public domain. It was transmitted inside the parameters of the MOU. To my knowledge, no evidence exists nor has any been reported of any actual data breaches or information compromises from any state member as a result of the program.

Obviously the articles of late from both ProPublica and others offer serious allegations regarding whether or not the intended processes and security protocols protecting Crosscheck have been either adequate or followed. This is the first time I have seen this information, and our office is going to be reviewing these alleged vulnerabilities before making any decisions about how we would move forward in the future.

This is consistent with the proactive and comprehensive review and IT restructuring that is already well underway in our office pertaining not only to cyber-security concerns, but to the overall health of our data systems and processes office wide, from elections to corporate. This overhaul was long overdue, and the groundwork began in my first days in office. The first fruits of these changes will be released to the public in early December.

Former Secretary Ysursa entered Idaho into the Crosscheck program in 2014 to assist Idaho with the goal of maintaining clean voter rolls. In the same way that we clean the list of those who choose not to vote for over 4 years, or those who are deceased, Idaho has utilized Crosscheck as a tool to help us achieve that goal. Notably, the landscape has changed. As such, whether or not we continue down the path with Crosscheck in our toolbox will depend on our reviews of the security protocols of the Crosscheck program, and its ongoing potential benefit to Idaho.

Though articles may allude otherwise, elections access and list integrity is not solely a current administration agenda. The Presidential Election Commission on Election Administration under then-President Obama in 2014 called for Election officials to “continue to modernize the registration process through continued expansion of online voter registration and expanded state collaboration in improving the accuracy of voter lists…”

It is the responsibility of the Secretary of State, under both state and federal law, to ensure that Idaho’s voter rolls are accurate, that the portion of that information that is considered public is available to the public, and that the remaining information required to be collected by federal and Idaho statutes remain isolated from the public. Since taking office in 2015, I have done that job, and I will continue to do so in the future.

LAWERENCE DENNEY

Idaho Secretary of State