Cross-posted from Slate.
In the past week, reports of foreign interference in American elections have reached what appears to be a crescendo, with multiple reports about foreign influence operations and targeting of our election infrastructure as well as federal and state efforts to push back.
Amid these reports, it’s important for the American public to understand that in the nearly two years since November 2016, election officials (in coordination with state and federal agencies) have done much to secure our voting infrastructure. Perhaps most importantly, federal and state agencies as well as security experts have worked with election officials to provide cybersecurity trainings, risk assessments, and new tools for preventing and detecting attacks.
But no election is perfect. Whether or not there are additional attacks against our election system, there will inevitably be some failures. For both glitches and cyberattacks, there are critical, immediate steps that officials can take (and in most cases, are already taking) to ensure that all citizens can vote and that their votes will be accurately counted. The infrastructure we use to administer and vote in elections in the United States is vast and includes election websites that provide voters information on their polling places, voting machines, and systems that report unofficial results on election night. Past attacks on election systems, both here and abroad, show that we should assume any part of them could be a target, and act with measures to prevent, detect, and recover against such attacks. Here are the kinds of election-security issues and voting-system glitches that we need to be most aware of — as well as the steps we can take to ensure they don’t interfere with our ability to cast and count ballots — as we approach both the 2018 midterms and the 2020 presidential race.
Failures of Registrations Systems or E-Poll Books
Voter-registration systems contain the official list of registered voters used for determining voter eligibility. Electronic poll books are laptops or tables that contain voter-registration information. Poll workers in 34 states use them to look up and check in voters at polling places. If a bad actor or a glitch changes voter information on either of these systems — marking voters as having voted, changing their addresses, or taking them off the lists entirely — there could be chaos and long lines at the polls, which may deprive citizens of the right to vote.
The easiest thing for election officials to do: provide sufficient provisional ballots for two to three hours of peak voting in every polling place. Under the federal Help America Vote Act of 2002, most states are required to allow voters to cast a provisional ballot if the voter’s name is not in the poll book or if there is any problem with her registration information (including not being listed as registered). Unfortunately, there is no minimum requirement for the number of provisional ballots in each polling place.
Voting-Equipment Failures
Even under the best of circumstances, equipment failures occur. Machines can freeze or fail to start. Candidates’ names might be missing from the ballot, as recently happened on some voting machines in Arkansas. On older touch-screen machines, in particular, there might be “vote flipping,” where voters select one candidate on a touch-screen machine but another choice shows up on the review screen. We’ve seen reports of vote flipping in both Georgia and Texas this year. (Vote flipping is disconcerting, can undermine confidence in our elections, and even potentially costs votes if voters don’t carefully check their review screens. But it is almost certainly the result of a malfunction or other error, rather than a hack — if someone were going to steal a vote by messing with the software, he wouldn’t let the voter know he was doing it.)
Direct-recording electronic machines that do not require a voter to use a paper ballot can cause more problems at the polls in the event of a failure. These machines — used by 22 states as primary polling-place equipment in at least some jurisdictions—will not function until repaired or replaced, and jurisdictions using them will need to print “emergency ballots” in advance of the election to allow voting to continue in case of machine failure.
Emergency ballots are different than provisional ballots that are provided to voters when their eligibility is unclear. Emergency ballots should be counted after the election without any additional scrutiny of voter qualifications, unlike provisional ballots that require research of voter eligibility.
We should also audit all voting systems that have paper backups. Eighty percent of Americans will vote on a paper ballot or a machine with a paper trail this November. By using the paper to check the machines in a public review after election night, we can verify that the software on voting machines has produced the correct outcome. According to the National Conference of State Legislatures, 33 states mandate some kind of postelection audit, though most are not as robust as they should be.
Attacks on Election Night Reporting
Officials usually post unofficial results on election night at the local and state level. While this information does not reflect the certified results, large changes in election night results and the final outcome can create questions for voters about the accuracy of the process.
Election night reporting sites are prime targets for denial of service attacks — in which attackers overload servers with requests — because they force reporting sites to go down at the moment most people are looking at them. This can create negative media attention about the process and doubt about whether the results can be trusted. In fact, bad actors have successfully attacked election-reporting systems around the world, including in Ukraine and Bulgaria and more recently here in the United States.
Several states, including Arizona and Virginia, experienced election night reporting failures in the 2014 midterm elections. In making changes afterward, many focused on establishing a redundant system that could be made available if the main system failed. It will be critical for officials to communicate clearly with the public and the media in the event of an attack on election night reporting, and for them to provide accurate information through redundant systems that have been established.
Once we get through Election Day 2018, it is critical we invest in securing elections for 2020, before what DHS Undersecretary Christopher Krebs has called the “big game.”
That means, at the very least, passing the bipartisan Secure Elections Act, which would create new federal guidelines for election cybersecurity. It means replacing aging equipment (especially in the 13 states that still use machines without paper backups) with machines that are more secure and reliable. And it means and mandating robust postelection audits so that we’re actually comparing what is on paper ballots filled out by voters with software-generated results, enhancing public trust in our elections.
While’s it’s hard to call it a silver lining, Russia’s interference in the 2016 election exposed vulnerabilities that need to be shored up to make our elections more secure and more reliable, even without the threat of foreign agents. This year, election officials are taking important steps to detect and recover from cyberattacks and election-system failures. After this election is over, it’s on us to convince our leaders to pass policies that strengthen and secure the ballot.
(Image: Ethan Miller/Getty)