Voting Machines at Risk: Where We Stand Today
While significant progress has been made in shoring up this country’s electoral infrastructure in recent years, local election officials maintain that much still needs to be done ahead of the 2020 election.
As we barrel toward 2020 and a momentous presidential election, the need to replace antiquated voting equipment has become increasingly urgent. This is true for at least two reasons. First, older systems are more likely to fail and are increasingly difficult to maintain. In the 2018 midterm election, old and malfunctioning voting machines across the country led to long lines at the polls, leaving voters frustrated – and, in some cases, causing them to leave before casting a ballot.
Second, older systems are less likely to have the kind of security features we expect of voting machines today. Chris Krebs, head of cybersecurity at the Department of Homeland Security has warned that the 2020 election is “the big game” for adversaries looking to attack American democracy.  Meanwhile, the National Academy of Sciences (NAS) recently noted that machines that do not produce a printout of a voter’s selections that can be verified by the voter and used in audits – should be “removed from service as soon as possible,” to ensure the security and integrity of American elections. 
This report is an update to earlier analyses conducted by the Brennan Center in September 2015 and March 2018, which examined the state of voting machines and election security in the United States. Since our last update, Congress provided $380 million in Help America Vote Act (HAVA) funds to help states to bolster their election security. For the most part, states have used this money for critical security measures. For instance, the Election Assistance Commission (EAC) has reported that states will use $136 million of this funding to strengthen election cybersecurity, $103 million to purchase new voting equipment, and $21 million to improve post-election audits. But this only scratches the surface of investments that are needed in the coming years. As we noted when the grants were issued, the way the money was distributed means it was insufficient to replace the vast majority of the most vulnerable machines before the 2020 election.
Below we detail data – culled from a recent Brennan Center survey of election officials, plus the Brennan Center’s own research and monitoring of the current state of election technology and security practices – to provide a snapshot of the current state of voting technology in the United States, as well as to detail critical steps that should be taken to increase the security and reliability of American elections ahead of 2020.
- Voting Machines Aging Out of Use
This winter Brennan Center surveyed election officials around the country on their need to replace their voting machines. Local election officials in 254 jurisdictions across 37 states told us they plan to purchase new voting equipment in the near future. For some, the need to make these replacements was extremely urgent: 121 officials in 31 states told us they must replace their equipment before the 2020 election. Two-thirds of these officials reported that they do not have the adequate funds to do so, even after the distribution of additional HAVA funds from Congress.
The need to replace this equipment is largely related to the fact that voting machines across the country are “aging out,” as more than one election official told us. For instance, 45 states are currently using voting equipment that is no longer manufactured (in the case of New York and Rhode Island, this only applies to accessible ballot marking devices that are not used to count votes). Jurisdictions that use machines that are no longer produced face challenges when trying to maintain them, including difficulty finding replacement parts. In an interview with the Brennan Center, Rokey Suleman, former elections director for Richland County, South Carolina, expressed feeling “lucky to be able get spare parts” for the machines in his county, which had been discontinued, but noted that it’s “not going to keep being that way in the near future.” 
And even when election officials can get spare parts, for those with paperless equipment, it might not make sense to keep pouring money into an antiquated system. “For years, my voters have been asking for a system that provides a paper trail. I don’t want to spend money on something that isn’t in line with where we want go as a county,” said Dana Debeauvoir, county clerk for Travis County, Texas. 
Many of these machines are reaching the end of their lifespan. Election officials in 40 states told us they are using machines that are at least a decade old this year. The lifespan of electronic voting machines can vary, but experts agree that systems over a decade old are more likely to need to be replaced for security and reliability reasons. Suleman compared maintaining old voting equipment to maintaining an old car. “When a car starts aging, you need to change the radiator fluid, the battery, the fan belt. We are driving the same car in 2019 that we were driving in 2004, and the maintenance costs are mounting up.” He also noted that South Carolina’s systems run on software that was developed decades ago, including Windows XP. Too often, vendors no longer write security patches for such software, leaving machines more vulnerable to cyberattacks. 
Finally, a disproportionate number of these old systems have no voter verified paper backup, something that NAS, the intelligence committees in both the U.S. Senate and House of Representatives, as well as security experts around the country, have argued is an unnecessary security risk. In 2019, 12 states still use paperless electronic machines as the primary polling place equipment in at least some counties and towns (Delaware, Georgia, Indiana, Kansas, Kentucky, Louisiana, Mississippi, New Jersey, Pennsylvania, South Carolina, Tennessee and Texas). Four (Delaware, Georgia, Louisiana, and South Carolina) continue to use such systems statewide.
- Prioritizing Paper Ballots (With Some Exceptions)
Almost every election official who responded that they planned on replacing voting equipment soon stated that their hope was to find new machines that produce voter-verified paper backups that could be used in a recount or audit (this includes jurisdictions in 9 of the 12 states using paperless voting equipment; election officials in the three remaining states, Indiana, Louisiana and New Jersey, did not respond to our survey). Of these 254 local jurisdictions, roughly half (139 jurisdictions) plan on purchasing optical scan machines with accessible ballot-marking devices, 13 percent (33 jurisdictions) plan on purchasing DREs (direct-recording electronic voting machines) with a paper trail, and 6 percent (15 jurisdictions) plan on purchasing ballot-marking devices only. The rest did not specify what equipment they are planning on purchasing or are currently undecided.
While only one local election official (from Texas) responded that he hoped to replace his current paperless system with another paperless system, it is clear he is not entirely alone. Despite the recent attention to election security, and repeated warnings by security experts that voting machines should have a voter-verified paper backup, several counties in Texas have purchased machines without a paper trail since 2016.
Suleman expressed dismay at the idea of continuing to purchase paperless equipment. “Why? Why? Especially with heightened sense of paranoia about outside influence into our election systems. We need to have a way to independently validate voters’ intent away from tabulation equipment. I don’t understand how any election official could really consider a totally paperless system in this day and age.” Shantiel Soeder, election and compliance administrator at Ohio’s Cuyahoga County Board of Elections, shared Suleman’s sentiment. “At the end of the day, we have that ballot that we can always go back to. We still find it important to print out receipts for other transactions in our lives. To have absolutely no paper, it’s almost irresponsible. These are people’s votes!”
Six of the 12 states (Delaware, Georgia, Louisiana, New Jersey, South Carolina, and Pennsylvania) that still use paperless electronic machines as the primary polling place equipment in at least some jurisdictions have either passed laws or taken other actions to replace those systems with machines that produce a paper backup. Of those, Delaware appears to have secured enough funds to replace its systems this year. New Jersey and Pennsylvania have yet to secure sufficient funding for such purchases. In Georgia and South Carolina, state election officials have requested funds to do so, and those requests are currently being considered by the state legislatures. Louisiana appears to have secured sufficient funds to replace equipment, but its purchase of new machines is stalled due to a controversy over how the state conducted its bidding process.
Of the remaining six states (Indiana, Kansas, Kentucky, Mississippi, Tennessee, and Texas), Kentucky Secretary of State Alison Lundergan Grimes and the state board of elections have called for replacement of all paperless systems, but do not yet have sufficient funds to do so. Kansas recently prohibited counties from purchasing new DREs that do not produce a paper record and implemented a post-election manual audit requirement this year, but has not yet forced counties continuing to use paperless machines to replace them. Indiana, Mississippi, Tennessee, and Texas do not appear to be taking steps to replace their paperless equipment before 2020, with Indiana’s Secretary of State Connie Lawson stating that the federal money provided last year was insufficient to replace the state’s machines.
- Progress on Post-Election Audits
Cybersecurity experts agree that routine and robust post-election audits of voter-verified paper records are necessary to ensure that the paper records provide real value. Currently, 22 states and the District of Columbia conduct post-election audits before certifying their election results. The Brennan Center, along with many other election integrity groups and security experts, has urged the more widespread adoption of risk-limiting audits (RLAs), considered the “gold standard” of post-election audits.
RLAs employ statistical models to provide a high level of confidence that a software hack or bug did not produce the wrong outcome. Effective RLAs can go a long way toward identifying any potential inaccuracy in election results, whether accidental or purposeful.
As of February 2019, only two states require RLAs: Colorado and Rhode Island. Two additional ones, Ohio and Washington, allow election officials to select them from a list of audit types that meet the state’s post-election audit requirement. A bill to require RLAs is pending in New York, while Georgia, Indiana, South Carolina, and New Jersey are all considering bills that would expressly authorize either pilots or immediate implementation of RLAs. Several more jurisdictions have recently piloted these post-election audits, and even more intend do so in 2019. This includes election jurisdictions in Michigan, Rhode Island, Virginia, Indiana, and California. Both Rhode Island and New Jersey used the 2018 Congressional HAVA grants to pilot RLAs in the last few months.
- Additional Election Security Priorities
In addition to replacing voting machines, election officials expressed the need for additional funding for other security related measures. A top funding priority for election officials was the hiring of more IT support staff, particularly at the local level. County election officials are literally on the front-lines defending our election equipment, yet they are frequently the least well-resourced offices. Richards Rydecki, assistant administrator for the Wisconsin Elections Commission, told us that one of challenges Wisconsin faces with being so decentralized is the varying levels of county and municipal resources. “Some of our counties might have only one county clerk and one more person working on elections. And most have very limited IT support. We would like to explore a program to provide contracted IT support on a regional basis.”
Dana Debeauvoir was one of several officials who noted that additional funds should be used by jurisdictions around the country to purchase Albert sensors, a network monitor that alerts election officials when unusual activity is going on that may be putting their data at risk. As Debeauvoir puts it, it’s a matter of learning how to practice “good computer hygiene.”
Other items that election officials mentioned include providing more training for their staff (cybersecurity, procurement, etc.), strengthening the physical security of their storage locations and polling places (security cameras, better inventory management, etc.) and putting in place robust post-election audits.
The authors thank the U.S. Vote Foundation for providing critical support for our survey of election officials, as well as the election officials who responded to the survey and agreed to be interviewed for this analysis, and our Brennan Center colleagues, Jeanne Park and Lorraine Cademartori, for their careful review and edits. Any errors should be attributed to the authors.
 Erik Ortiz, Shamar Walters, Emily Siegel, Jareen Imam, Sarah Fitzpatrick, and Alex Johnson, “Midterms 2018: Voters face malfunctioning machines and long lines at polls across country on Election Day,” NBC News, November 6, 2018, https://www.nbcnews.com/politics/elections/midterms-2018-voters-face-malfunctioning-machines-long-lines-polls-across-n932156; Ashley Lopez, “Old Voting Machines Confuse Some Texans During Midterm Election,” NPR, October 30, 2018, https://www.npr.org/2018/10/30/662095109/old-voting-machines-confuse-some-texans-during-midterm-election; Christina A. Cassidy, Colleen Long, and Michael Balsamo, “Machine breakdowns, long lines mar vote on Election Day,” Associated Press, November 6, 2018, https://www.apnews.com/6fb6de6fdb034b889d301efd12602e21; P.R. Lockhart, “Voting hours in parts of Georgia extended after technical errors create long lines,” Vox, November 6, 2018, https://www.vox.com/policy-and-politics/2018/11/6/18068492/georgia-voting-gwinnett-fulton-county-machine-problems-midterm-election-extension.
 Colleen Long and Michael Balsamo, “Cybersecurity officials start focusing on the 2020 elections,” Associated Press, November 8, 2018, https://www.apnews.com/cfaa16f6a86349bebc16e0633d6214dd.
 Lawrence Norden and Christopher Famighetti, America’s Voting Machines at Risk, Brennan Center for Justice, 2015, https://www.brennancenter.org/sites/default/files/publications/Americas_Voting_Machines_At_Risk.pdf; Lawrence Norden and Wilfred U. Codrington III, “America’s Voting Machines at Risk – An Update,” Brennan Center for Justice, March 8, 2018, https://www.brennancenter.org/analysis/americas-voting-machines-risk-an-update.
 “EAC Releases 48 HAVA Grants State Plans, Budgets,” U.S. Election Assistance Commission, August 2018, https://www.eac.gov/news/2018/08/21/state--territories-plan-to-spend-majority-of-hava-grant-funds-on-election-security-system-upgrades/.
 Federal Funds for Election Security: Will They Cover the Costs of Voter Marked
Paper Ballots?, Brennan Center for Justice, 2018. https://www.brennancenter.org/analysis/federal-funds-election-security-will-they-cover-costs-voter-marked-paper-ballots.
 In our survey, election officials in 37 states (Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Idaho, Illinois, Iowa, Kansas, Kentucky, Maine, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Mexico, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Virginia, Washington, West Virginia, Wisconsin, and Wyoming) told us they need to replace their equipment, either before or after 2020.
 In our survey, election officials in 31 states (Arizona, Arkansas, California, Colorado, Delaware, Florida, Georgia, Illinois, Iowa, Kansas, Maine, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Nebraska, New Hampshire, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, West Virginia, Wisconsin, and Wyoming) told us they needed to replace their voting machines by 2020.
 Rokey Suleman (former Elections Director, Richland County, South Carolina), interview by Brennan Center for Justice, February 8, 2019; Dana Debeauvoir (County Clerk, Travis County, Texas), interview by Brennan Center for Justice, February 14, 2019; Richard Rydecki, (Assistant Administrator, Wisconsin Elections Commission), interview by Brennan Center for Justice, February 20, 2019); Tonia Tunnell (Government Relations Director, Maricopa County Arizona), interview by Brennan Center for Justice, February 22, 2019; Shantiel Soeder (Election and Compliance Administrator at Cuyahoga County Board of Elections, Ohio), interview by Brennan Center for Justice, February 22, 2019.
 The Brennan Center confirmed with three major vendors (ES&S, Dominion, and Hart InterCivic) that the following models are no longer manufactured: iVotronic, M100, M650, AutoMark (ES&S); AccuVote OS, AccuVote OSX, AccuVote TS, AccuVote TSX, AVC Edge, AVC Advantage, Optech IIIP-Eagle and Optech Insight (Dominion); eScan, eSlate and Judge’s Booth Controller (Hart Intercivic). Danaher’s Shouptronic 1242, used mainly in Delaware, is also no longer manufactured. We used this information to confirm that seven states (Delaware, Georgia, Hawaii, Louisiana, North Dakota, Oklahoma, and South Carolina) are using exclusively discontinued voting machines, 38 states (Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Florida, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Massachusetts, Minnesota, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Jersey, New York, North Carolina, Ohio, Oregon, Pennsylvania, Rhode Island, South Dakota, Tennessee, Texas, Utah, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming) use discontinued voting machines in one or more jurisdictions, and five states (Maine, Maryland, Michigan, Nevada, New Mexico) and the District of Columbia use machines that are all currently manufactured. See Kathy Rogers, (Senior Vice President of Government Relations, ES&S), Conversation with Edgardo Cortez, February 13, 2019; Kay Stimson (Vice President, Government Affairs, Dominion), Email message to Edgardo Cortez, Feb 27, 2019; Sam Derheimer (Director of Government Affairs, Hart InterCivic), Email message to Edgardo Cortez, Feb 14, 2019; “Danaher Shouptronic 1242,” Verified Voting, accessed February 25, 2019, https://www.verifiedvoting.org/resources/voting-equipment/danaher/shouptronic/; “The Verifier — Polling Place Equipment — November 2018,” Verified Voting, accessed February 25, 2019, https://www.verifiedvoting.org/verifier/.
 Rokey Suleman (former Elections Director, Richland County, South Carolina), interview by Brennan Center for Justice, February 8, 2019.
 Dana Debeauvoir (County Clerk, Travis County, Texas), interview by Brennan Center for Justice, February 14, 2019.
 In our survey, jurisdictions from 40 states (Arizona, Arkansas, California, Colorado, Connecticut, Delaware, Florida, Georgia, Idaho, Illinois, Indiana, Iowa, Kansas, Kentucky, Maine, Massachusetts, Michigan, Minnesota, Mississippi, Missouri, Montana, Nebraska, New Hampshire, New Mexico, New York, North Carolina, North Dakota, Ohio, Oregon, Pennsylvania, South Carolina, South Dakota, Tennessee, Texas, Vermont, Virginia, Washington, West Virginia, Wisconsin, and Wyoming) told us that their voting machines were at least a decade old.
 For instance, Microsoft stopped supporting Windows XP in 2014, with the exception of a “highly unusual patch” that it issued in 2017 to prevent the spread of WannaCry malware. See Tom Warren, “Microsoft releases new Windows XP security patches, warns of state-sponsored cyberattacks,” The Verge, June 13, 2017, https://www.theverge.com/2017/6/13/15790030/microsoft-windows-xp-vista-security-updates-june-2017.
 Russian Targeting of Election Infrastructure During the 2016 Election: Summary of Initial Findings and Recommendations, U.S. Senate Select Committee on Intelligence, May 8, 2018, https://www.intelligence.senate.gov/publications/russia-inquiry; Report on Russian Active Measures, House Permanent Select Committee on Intelligence, March 22, 2018, https://republicans-intelligence.house.gov/uploadedfiles/final_russia_investigation_report.pdf; Securing the Vote: Protecting American Democracy, The National Academies of Sciences, Engineering, and Medicine, 2018, https://www.nap.edu/read/25120/chapter/1; Danielle Root, Liz Kennedy, Michael Sozan, and Jerry Parshall, Election Security in All 50 States: Defending America’s Elections, Center for American Progress, February 12, 2018, https://www.americanprogress.org/issues/democracy/reports/2018/02/12/446336/election-security-50-states/.
 Greg Gordon, “14 states' voting machines are highly vulnerable. How’d that happen?,” McClatchy DC Bureau, April 4, 2018, https://www.mcclatchydc.com/news/nation-world/national/article207851784.html.
 Shantiel Soeder (Election and Compliance Administrator, Cuyahoga County Board of Elections, Ohio), interview by Brennan Center for Justice, February 22, 2019.
 Sarah Muller, “Delaware lawmakers release $10 million for new voting system,” Delaware Public Media, September 17, 2018, https://www.delawarepublic.org/post/delaware-lawmakers-release-10-million-new-voting-system
 Colleen O’Dea, “There’s money for upgrading NJ election security but little for vital paper trail,” NJ Spotlight, September 12, 2018, https://www.njspotlight.com/stories/18/09/11/money-for-upgrading-nj-election-security-but-little-for-vital-paper-trail/; Marcy Levy, “Pennsylvania must replace voting machines, lawmakers told,” Washington Post, February 20, 2019, https://www.washingtonpost.com/national/pennsylvania-must-replace-voting-machines-lawmakers-told/2019/02/20/5c75d474-3533-11e9-8375-e3dcf6b68558_story.html?utm_term=.5f9af8ffd7e2.
 Kim Wade,“Georgia Sec. of State seeks to replace criticized voting machines,” WSAV, January 24, 2019 https://www.wsav.com/news/local-news/georgia-sec-of-state-seeks-to-replace-criticized-voting-machines/1722859964; Mark Niesse, “Voters Confront Georgia Lawmakers Over New Touchscreen Election System,” WSB Radio, February 19, 2019, https://www.wsbradio.com/news/state--regional-govt--politics/voters-contront-georgia-lawmakers-over-new-touchscreen-election-system/Jj26WLlCuMXKuzL6nZo9oI/; “SC takes first step toward switching to paper ballots in 2020,” The State, January 15, 2019, https://www.thestate.com/news/politics-government/article224557350.html.
 Melinda Deslatte, “Kyle Ardoin wins election for Louisiana secretary of state,” Associated Press, December 8, 2018, https://www.apnews.com/782bb812689045328f876dd300f08840.
 Bradford Queen, “Grimes Leads Board of Elections in Move to Require Voter-Verified Paper Trails in Kentucky,” Kentucky.gov, February, 27, 2018, https://kentucky.gov/Pages/Activity-stream.aspx?n=SOS&prId=156; In an email message to Natalie Tennant on February 25, 2019, Secretary Grimes confirmed that the $5 million HAVA funds are not enough to replace outright all paperless machines in the state and that it does not yet have the funds to do so.
 2018 Kan. Sess. Laws 1238.
 “Indiana’s election security plans don’t include new machines,” Associated Press, August 26, 2018, https://apnews.com/bb865bb2319e4b51b47695a51bc4f67a.
 These twenty-two states are Alaska, Arizona, California, Colorado, Connecticut, Hawaii, Illinois, Iowa, Massachusetts, Minnesota, Missouri, Montana, Nevada, New Mexico, New York, North Carolina, Ohio, Oregon, Rhode Island, Utah, Washington, and West Virginia. Although Ohio conducts post-election audits after certification, the Election Board must amend its certification if the audit results in a change of the vote totals reported in the official canvass. Kansas, Kentucky, Pennsylvania, Tennessee and Texas, which use paperless voting machines in many of their jurisdictions, only require post-election audits for jurisdictions that use paper ballots. New Jersey’s post-election statute is dependent on the implementation of new voting systems that produce voter-verifiable paper records (which have not yet been purchased); See “POST-ELECTION AUDITS,” National Conference of State Legislatures, last modified February, 1, 2019, accessed February 25, 2019, http://www.ncsl.org/research/elections-and-campaigns/post-election-audits635926066.aspx; Danielle Root, Liz Kennedy, Michael Sozan, and Jerry Parshall, Election Security in All 50 States: Defending America’s Elections, Center for American Progress, February 12, 2018, https://www.americanprogress.org/issues/democracy/reports/2018/02/12/446336/election-security-50-states/.
 Jerome Lovato, Risk-Limiting Audits – Practical Application, U.S. Election Assistance Commission, June 25, 2018, https://www.eac.gov/assets/1/6/Risk-Limiting_Audits_-_Practical_Application_Jerome_Lovato.pdf.
 Ohio Election Official Manual, Ohio Secretary of State, August 1, 2018, https://www.sos.state.oh.us/globalassets/elections/directives/2017/dir2017-10_eom.pdf/; Wash. Rev. Code Ann. §29A.60.185
 S.B. 2329, 2019 Leg., Reg. Sess. (Ny. 2019); H.B. 316, 2019 Leg., Reg, Sess. (Ga. 2019); S.B. 405, 121st Gen. Assemb., Reg. Sess. (In. 2019); H.B 3304, 2019 Gen. Assemb. 123rd Sess. (Sc. 2019); A.B. 3991, 218th Leg., (Nj. 2018).
 Kellie Ottoboni, “Piloting Risk-Limiting Audits in Michigan,” Berkeley Institute for Data Science, December 20, 2018, https://bids.berkeley.edu/news/piloting-risk-limiting-audits-michigan; Abigail Abrams, “Russia Wants to Undermine Trust in Elections. Here's How Rhode Island Is Fighting Back,” Time Magazine, January 26, 2019, http://time.com/5510100/risk-limiting-audit-election-security/; Risk-Limiting Audits, Department of Elections, Virginia, September 20, 2018, https://www.elections.virginia.gov/Files/Media/Agendas/2018/20180920-RLA_Report.pdf; Stephanie Singer and Neal McBurnett, Orange County, CA Pilot Risk-Limiting Audit, Verified Voting, December 7, 2018, https://www.verifiedvoting.org/wp-content/uploads/2018/12/2018-RLA-Report-Orange-County-CA.pdf.
 Colleen O’Dea, “Progress seen in test of paper-trail voting machines that allow audit of results,” NJ Spotlight, January 4, 2019, https://www.njspotlight.com/stories/19/01/03/progress-seen-in-test-of-paper-trail-voting-machines-that-allow-audit-of-results/.
 Richard Rydecki (Assistant Administrator, Wisconsin Elections Commission), interview by Brennan Center for Justice, February 20, 2019)
 See responses collected through Brennan Center survey of election officials (disseminated on January 2019); Richard Rydecki, (Assistant Administrator, Wisconsin Elections Commission), interview by Brennan Center for Justice, February 20, 2019); Tonia Tunnell (Government Relations Director, Maricopa County Arizona), interview by Brennan Center for Justice, February 22, 2019; Shantiel Soeder (Election and Compliance Administrator at Cuyahoga County Board of Elections, Ohio), interview by Brennan Center for Justice, February 22, 2019.