With the 2020 election rapidly approaching, many states are still facing significant election infrastructure challenges. During the 2018 midterm elections, there were reports across the country of long lines, registration problems, and broken voting machines. In 2019, 11 states used paperless electronic voting machines, which are vulnerable to hacking because they do not produce a paper record for postelection auditing. Many states are using outdated voter registration systems that are poorly equipped to address cybersecurity threats.
And worryingly, there is almost no federal regulation of the private vendors that build and maintain much of the nation’s election infrastructure, according to A Framework for Election Vendor Oversight, a new report by the Brennan Center. The study also highlights the extensive array of infrastructure required to conduct an election, which includes not only voting machines, but also ballots, voter registration databases, electronic poll books, and election websites.
A lack of vendor oversight leaves U.S. elections vulnerable to attack
Since the 2016 election, there have been notable efforts across the United States to bolster election security, which have included training state and local election officials on how to prevent, detect, and recover from cyberattacks. Those election officials, however, often must outsource the building and maintenance of much of that infrastructure to private companies. And in recent years, the market for election technology has consolidated around just a few companies. Today, more than 80 percent of the voting systems used in the United States are under the purview of just three vendors — and a successful cyberattack against any of these three companies could have devastating consequences for elections.
Unfortunately, those election technology companies receive virtually no oversight from the federal government. As a result, there is a troubling lack of transparency into election vendors, or their cybersecurity and supply chain practices, or whether they are conducting background checks on their employees, who may be required to handle sensitive information. This lack of oversight appears even more stark when juxtaposed with the strict rules that govern other “critical infrastructure” sectors, such as defense. In fact, even colored pencils, which are subject to standards set by the Consumer Product Safety Commission, are more strictly regulated than election vendors in the United States.
The timing is urgent for securing U.S. election infrastructure
There is still time for Congress to help state and local election officials better prepare for the attacks that the nation’s voting system will face. In A Framework for Election Vendor Oversight, the Brennan Center proposes a number of reforms that would improve the federal government’s oversight of the private companies behind so much of the country’s election infrastructure. These recommendations include empowering the Election Assistance Commission (EAC) or another federal agency to play a larger role in ensuring that election vendors comply with cybersecurity standards.
Beyond regulating election vendors, there is much more that Congress can do to bolster election security for 2020 and beyond. This includes approving funds for state-level election security projects, such as replacing outdated voting machines, upgrading voter registration systems, providing additional cybersecurity support, and conducting post-election audits.
And even if Congress fails to act, there are ways for the EAC to independently shore up its work on election infrastructure, such as revising its registration and certification systems to allow for better oversight of voting system vendors.
There is much at stake in the 2020 election, including the integrity of America’s election system itself. And there are signs that Americans are more eager to participate in that conversation than they have been for a long time. With that in mind, Congress should make the most of the time it has left to ensure that the system will allow those voices to be heard.
Read the full Brennan Center report, A Framework for Election Vendor Oversight.