The voter-fraud-checking program championed by the head of the Presidential Advisory Commission on Election Integrity suffers from data security flaws that could imperil the safety of millions of peoples’ records, according to experts.

Indivisible Chicago, a progressive advocacy group in Illinois, filed a public-records request with Illinois and Florida for information on the Interstate Voter Registration Crosscheck Program. Crosscheck was created and run by the Kansas secretary of state’s office and is often cited by Kris Kobach, Kansas’ secretary of state, as a way to identify voters casting ballots in more than one state. Indivisible Chicago then posted emails and other documents it received, including messages exchanged between elections officials in Illinois and Florida and Crosscheck.

The emails and records revealed numerous security weaknesses. Crosscheck’s files are hosted on an insecure server, according to its own information. Usernames and passwords were regularly shared by email, making them vulnerable to snooping. And passwords were overly simplistic and only irregularly changed.

“It blows my mind — this is complete operational security incompetence,” said Joe Hall, the chief technologist for the Center for Democracy & Technology, an organization that promotes internet freedom. “You should consider all of that stuff in the hands of people who are clever enough to intercept someone’s email.”

The Kansas secretary of state’s office did not respond to emailed questions about Crosscheck’s security.

Crosscheck was conceived in 2005 as a way to, as the name implies, let states compare their voting rolls to prevent people from registering in multiple states. Kansas operates the program at no cost to the states that participate. Crosscheck assures them — about 30 states use the program as of now — that it employs “industry standard encryption technology and passwords.”

Hall disputes that. “It’s a complete lie,” he said.

Kobach co-chairs President Donald Trump’s voter fraud commission, which has been under heavy scrutiny over whether it will be able to secure the vast voting data it has requested, including names, addresses and dates of birth for virtually every voter in the country. When Kobach requested this data in June, the commission was scorched with criticism and lawsuits in both federal and state courts over privacy concerns. Kobach sent a second letter to states in late July promising data would “be kept confidential and secure throughout the duration of the commission’s existence.”

Experts say the documents released by Indivisible Chicago undercut Kobach’s claims that he understands how to protect voter data. “This raises serious concerns about the security of citizens’ data not only in Crosscheck, but with the voter fraud commission run by the same people,” said David Becker, the executive director of the Center for Election Innovation & Research. “They tell the voters, the states and the courts ‘trust us’ with personal data, but they refuse to answer basic questions about how they plan to secure or use that data.”

Concern over the commission’s ability to keep data secure given the new information about Crosscheck’s methods is “absolutely justified,” said Kenneth White, director of the Open Crypto Audit Project, and a security researcher and consultant.

Crosscheck’s data is stored on an FTP server run by the Arkansas Office of the Secretary of State. FTP servers are unencrypted, leaving passwords and downloads readable by electronic spies. It is standard across the industry to instead use SFTP (short for “SSH File Transfer Protocol”), which protects data from prying eyes, according to Hall. He compared FTP servers to a postcard and SFTP servers to a letter sealed in an envelope and locked in a vault.

Employees of the Arkansas secretary of state’s office send login credentials to election officials in states participating in Crosscheck and restrict access to either the public IP address or a range of addresses used by election officials in those states. That’s an important step to ensure users can only access the system through one of the approved IP addresses, according to White — but he said well-resourced attackers would be able to get around this protection.

And because Crosscheck routinely emailed full credentials, hackers may not even need to work particularly hard to do so. They could simply “spoof” — essentially, mimic — the email address of a state authority and send an email to Crosscheck’s administrators adding a different IP address, said Shawn Davis, the director of forensics at Edelson PC, a Chicago-area law firm specializing in cyber security. The firm has begun working with Indivisible Chicago, and Davis will testify before an upcoming joint session of the Illinois House and Senate to discuss Crosscheck’s vulnerabilities.

“Hackers do take these steps,” said Davis. “They are pretty patient — if they want to get the data they’ll do these things.”

Illinois has been a member of Crosscheck since 2011, but emails released by Indivisible Chicago show that no Illinois official inquired about data security issues until this July, when Indivisible Chicago raised questions. In response, Vipin Nischal, an analyst at the Arkansas secretary of state’s office, confirmed the use of an FTP server but claimed “no unauthorized or anonymous access” had been found. Bryan Caskey, Kansas’s director of elections, said officials at the Kansas secretary of state’s office, which performs the matching work, also have access to the data.

Arkansas employees sent emails to Crosscheck members containing the FTP address, the username and the password in the same email, which is considered bad security practice. Operating procedures included in the records request show that this practice was standard — Crosscheck instructed all three things to be sent in a single email every January before the matches were done. Hall called this “completely, unbelievably irresponsible.”

The Illinois State Board of Elections, which fulfilled one of the records requests from Illinois, redacted the FTP address but did not redact usernames and passwords. Passwords were emailed to all states in the same manner, leaving them vulnerable to similar exposure through public-records requests in other states.

The passwords are simplistic, and emails from Crosscheck’s operators show they were rarely changed. “Due to the heavy work load on our IT Director, we will not be able to update the passwords for this data pull,” an Arkansas employee said in an email to Crosscheck participants in 2011. “If there is a specific state that really needs/wants their password changed, please let me know and I will see what I can do for you.” Emails from Arkansas employees to the Illinois State Board of Elections in 2016 and 2017 also contained the same credentials.

“[Secretaries of state] took an oath to the people of their states to protect the state constitution, and part of that is the safekeeping of the citizens information,” said White. “They are abdicating that responsibility by putting their data in this sort of system.”