Big from Gizmodo on Crosscheck:

A program overseen by the head of President Trump’s so-called “election integrity” commission—which is now largely a tool for driving conspiracy theories about “massive voter fraud” in the United States—is placing the personal data of millions of American voters at risk, according to internal records and security experts who examined the program at Gizmodo’s request….

Gizmodo has learned, however, that the records passing through the Crosscheck system have been stored on a server in Arkansas operating on a network rife with security flaws. What’s more, multiple sets of login credentials, which could be used by virtually anyone to directly access the Crosscheck system—as well the encrypted voter data it contains—have been compromised.

Our investigation into the program builds on the work of ProPublica, which last month published a report describing multiple security flaws plaguing Crosscheck’s operations. Documents obtained under state transparency laws by the anti-Trump group Indivisible Chicago revealed that Crosscheck had emailed Illinois election officials both the username and password to the program’s FTP server—credentials that Illinois neglected to redact before releasing the emails publicly.

The emails further revealed that participating states had submitted millions of voter files to the Arkansas server using an unencrypted transfer protocol. Gizmodo has learned that while some of the data sets were encrypted prior to being transferred, the passwords to decrypt three year’s worth of the voter files belonging to every state participating in Crosscheck have likewise been exposed.

The internet address of the Crosscheck server was redacted in the Illinois records exposing the program’s login credentials. It was not redacted, however, in the emails of Idaho election officials released to Indivisible Chicago this month. On Monday, Gizmodo provided the server’s publicly available location to multiple security firms and requested an analysis of its vulnerabilities.

The results are troubling, to say the least. They not only confirm the findings contained in ProPublica’s report, but further reveal an alarming array of previously unreported weaknesses in the network hosting the Crosscheck server….