More than 99 percent of voter fraud identified by a GOP-backed program is false, a study by Harvard, Yale, and Microsoft researchers found. Now Indiana is using the faulty program to de-register voters without warning.

In July, Indiana rolled out a new law allowing county officials to purge voter registrations on the spot, based on information from a dubious database aimed at preventing voter fraud. That database, the Interstate Voter Registration Crosscheck Program, identifies people in different states who share the same name and birthdate. Crosscheck has long been criticized as using vague criteria that disproportionately target people of color. Now Indiana voters who share a name and birthdate with another American can have their registrations removed without warning—a system ripe for abuse, a new lawsuit claims.

Crosscheck’s premise is simple. The program aims to crack down on people “double voting” in multiple states, by listing people who share a first name, last name, and birthdate.

“If an elections official in Alabama is reviewing information from Kansas and finds that John Lee, born January 1, 1973, matches up with one in Alabama, in some instances the state will just cross off the registrant in their state, thinking this indicates that John Lee has moved Kansas,” Allegra Chapman, director of voting and elections at the government accountability group Common Cause told The Daily Beast.

“Those three matching data points don’t suffice to indicate that your John Lee is the same as the John Lee in the other state. Some names are just very common.”

Indiana has used Crosscheck for years. But until July, the state had a series of checks on the program. If Crosscheck found that an Indiana resident’s name and birthdate matched that of a person in another state, Indiana law used to require officials to ask that person to confirm their address, or wait until that person went two general election cycles without voting, before the person’s name was purged from Indiana voter rolls.

Under the state’s new law, officials can scrub a voter from the rolls immediately. That’s a problem for Indiana residents, particularly people of color, a Friday lawsuit from Common Cause and the American Civil Liberties Union argues.

Crosscheck is overseen by Trump pal and Kansas Secretary of State Kris Kobach, a crusader against what he and the Trump administration describe as widespread voter fraud. Kobach has made repeated debunked claims that up to millions of fraudulent voters swung various 2016 elections in Democrats’ favor. (Actual studies of illegal voting have found it to be a statistically negligible incident, account for between 0.0003 percent and 0.0025 percent of votes.)

The Crosscheck program can be as overzealous as Kobach.

“Experience in the crosscheck program indicates that a significant number of apparent double votes are false positives and not double votes,” an official Crosscheck guide from 2014 warns participating states (PDF). “Many are the result of errors—voters sign the wrong line in the poll book, election clerks scan the wrong line with a barcode scanner, or there is confusion over father/son voters (Sr. and Jr.).”

Chapman described the disclaimer as “worrisome that you would acknowledge that, and still encourage people to use the program nonetheless.”

Fathers and sons aren’t the only people at heightened risk of being flagged as “double voters.” Black, Latino, and Asian Americans are statistically more likely to have the same name as someone else in the country.

“If you’re matching a John Lee with a John Lee, that surname is very common in the Korean community, for example,” Chapman said, pointing to a 2014 Al Jazeera investigation that found that 50 percent of U.S. racial minorities share the same last names, as opposed to 30 percent of white Americans.

A recent study by researchers at Microsoft, as well as Harvard, Yale, Stanford, and Pennsylvania universities found that, for every legitimate case of double-registration, Crosscheck erroneously flagged 200 voters who were only registered in one state.

Under a newly emboldened Crosscheck program, racial minorities in Indiana are at risk of having their registrations purged “in a manner that is not reasonable, nondiscriminatory, or uniform,” Common Cause’s suit reads. “As a result, numerous Hoosiers are at risk of being disenfranchised unlawfully.”

Double-registration isn’t necessarily nefarious. In the aftermath of the 2016 election, Tiffany Trump, Treasury Secretary Steve Mnuchin, and former White House adviser Steve Bannon were all found to have been registered in multiple states. But if states are going to use databases to sweep for duplicates on the voter rolls, there’s a better system than Crosscheck.

“We’ve been urging states to adopt ERIC, the Electronic Registration Information Center,” Chapman said. “States that use it have a contract, requiring them to only use the data for limited purposes, and it requires seven matching data points, so there’s a higher degree of certainty.”

Participating states also agree to send written notices to people suspected of being registered states, and abide by a waiting period.

“If you were to only use last names to knock people off rolls, that would be absurd,” Chapman said. “Adding just two more data points —last name and birthdate—is really not much more secure.”