Skip Navigation
Report

Defending Elections: Federal Funding Needs for State Election Security

KEY FACT: Despite Congress providing $380 million in the Help America Vote Act (HAVA), many state and local election offices have substantial election security needs that will not be met without additional federal support.

Published: July 18, 2019

i. Introduction

State and local elec­tion offi­cials are on the front lines of a cyber­war with soph­ist­ic­ated nation-state rivals and other malevol­ent actors. As Robert Brehm, co–ex­ec­ut­ive director of the New York State Board of Elec­tions, recently put it, “It is not reas­on­able” to expect each of these state and local elec­tion offices to inde­pend­ently “defend against hostile nation-state actors.”  foot­note1_5q0z3ux 1 Robert A. Brehm, co–ex­ec­ut­ive director, New York State Board of Elec­tions, inter­view by Bren­nan Center for Justice, May 6, 2019. State and local elec­tion systems have already been breached. In 2016 Russian hack­ers penet­rated computer networks in two counties in the swing state of Flor­ida, using inform­a­tion they had gleaned from a soft­ware vendor.  foot­note2_lwkuu7q 2 Pam Fessler, “Mueller Report Raises New Ques­tions About Russi­a’s Hack­ing Targets in 2016,” NPR, April 19, 2019, https://www.npr.org/2019/04/19/714890832/mueller-report-raises-new-ques­tions-about-russias-hack­ing-targets-in-2016 ; Lee Ferran, “Voter Data­bases in 2 Flor­ida Counties Hacked in 2016, Governor Says,” ABC News, May 15, 2019, https://abcnews.go.com/Polit­ics/voter-data­bases-flor­ida-counties-hacked-2016-governor/story?id=63052842 .  That same soft­ware vendor may have opened a gap for hack­ers to alter the voter rolls in North Caro­lina, another swing state, on the eve of the elec­tion.  foot­note3_7izetaz 3 Kim Zetter, “Soft­ware Vendor May Have Opened a Gap for Hack­ers in 2016 Swing State,” Politico, June 5, 2019, https://www.politico.com/story/2019/06/05/vr-systems-russian-hack­ers-2016–1505582 .  Epis­odes like these under­mine faith in our demo­cratic system, and steps must be taken to prevent them from occur­ring again.

Crit­ic­ally, in 2018 Congress provided $380 million in Help Amer­ica Vote Act (HAVA) grant funds to help states bolster their elec­tion secur­ity. Grant recip­i­ent states had to submit a grant narrat­ive—a list of specific elec­tion secur­ity projects (and estim­ated costs) that the state planned to fund with grant money—and provide a 5 percent state match within two years. Based on inform­a­tion that the states submit­ted to the Elec­tions Assist­ance Commis­sion (EAC) as part of the grant process, recip­i­ents are using the vast major­ity of this money to strengthen elec­tion cyber­se­cur­ity, purchase new voting equip­ment, and improve postelec­tion audits — all press­ing needs around which there is broad bipar­tisan consensus.  foot­note4_y2uynt6 4 U.S. Elec­tion Assist­ance Commis­sion, Grant Expendit­ure Report , Fiscal Year 2018, April 4, 2019, https://www.eac.gov/assets/1/6/FY2018HAVAG­rant­s­Ex­pendit­ureReport.pdf .  The EAC has estim­ated that 85 percent of the money Congress has provided will be spent ahead of the 2020 elec­tion.  foot­note5_j9nqelg 5 Over­sight of the U.S. Elec­tion Assist­ance Commis­sion Hear­ing, Before the Sen. Comm. on Rules and Admin­is­tra­tion , 116th Cong. (2019) (state­ment of Christy McCormick, Chair, U.S. Elec­tion Assist­ance Commis­sion).

Unfor­tu­nately, given the myriad secur­ity chal­lenges faced by these states, the $380 million is not enough to address the needs of state and local offices; many have substan­tial elec­tion secur­ity needs that likely will not be met absent addi­tional federal support.

This paper exam­ines six key states (Alabama, Arizona, Illinois, Louisi­ana, Oklahoma, and Pennsylvania) that repres­ent differ­ent regions of the coun­try, varied popu­la­tion sizes, and the full range of elec­tion secur­ity needs. It invest­ig­ates how they have alloc­ated their share of the 2018 federal elec­tion secur­ity grants and docu­ments their needs for addi­tional elec­tion secur­ity fund­ing. States’ use of HAVA funds is tailored to their specific require­ments and reflects the nature of the state and local govern­ments that over­see elec­tions. Like­wise, their unfun­ded elec­tion secur­ity needs vary accord­ing to state-specific circum­stances. While the authors have limited their review to a sampling of six states, it is clear that the other 44 states and the District of Columbia have similar unfun­ded needs.  foot­note6_qdibyeq 6 National Asso­ci­ation of Secret­ar­ies of State, “NASS Interim Posi­tion on Poten­tial Federal Elec­tion Fund­ing,” https://www.nass.org/node/1556 (“The emer­gence of cyber threats to elec­tion systems require[s] resources state and local govern­ments may not sustain alone. Elec­tion secur­ity is equated with national secur­ity. Common nation­wide threats justify federal assist­ance in fund­ing indi­vidual state efforts to prevent and defend against cyber threats”); Elec­tion Secur­ity Hear­ing, Before the Comm. on House Admin­is­tra­tion , 116th Cong. (2019) (state­ment of Lawrence Norden, director of elec­tion reform, Bren­nan Center for Justice) (docu­ment­ing, among other things, that 28 states do not yet conduct post elec­tion audits of all votes before elec­tion certi­fic­a­tion, 40 states use at least some voting equip­ment over 10 years old, 41 states rely on voter regis­tra­tion data­bases created at least a decade ago, and 11 states continue to use paper­less elec­tronic machines as the primary polling place equip­ment in at least some counties)

End Notes

ii. State Spotlights

Alabama

In the wake of unsuc­cess­ful cyber­at­tacks against the state voter regis­tra­tion data­base in 2016, Alabama Secret­ary of State John Merrill stated, “While it is encour­aging that our efforts to protect Alabami­ans’ data have proven to be success­ful, we must remain vigil­ant and prepared for the constantly evolving threats to our voting systems and the integ­rity of those processes. We will util­ize every resource avail­able to ensure we are protect­ing the data of all Alabami­ans.” foot­note1_q5dsuxs 1 Callum Borch­ers, “What We Know About the 21 States Targeted by Russian Hack­ers,” Wash­ing­ton Post, Septem­ber 23, 2017, https://www.wash­ing­ton­post.com/news/the-fix/wp/2017/09/23/what-we-know-about-the-21-states-targeted-by-russian-hack­ers/?nore­dir­ect=on&utm_term=.058ac930e61e .

As part of these ongo­ing efforts, Secret­ary Merrill has welcomed public and private elec­tion secur­ity part­ners, such as the U.S. Depart­ment of Home­land Secur­ity (DHS), into Alabama, taking advant­age of a wide range of free resources avail­able to further improve Alabama’s elec­tion secur­ity risk posture. foot­note2_nlpmx4s 2 John Merrill, Alabama Secret­ary of State, “Panel 1, Invest­ing in Secur­ity — Best Prac­tices” (remarks, U.S. Elec­tion Assist­ance Commis­sion 2018 Elec­tion Read­i­ness Summit, Octo­ber 3, 2018), https://www.eac.gov/videos/open­ing-remarks-and-panel-1-invest­ing-in-secur­ity-best-prac­tices/ ; Elec­tion Secur­ity Hear­ing, Before the Comm. on House Admin­is­tra­tion , 116th Cong. (2019) (state­ment of John Merrill, Alabama Secret­ary of State).  These part­ner­ships are crit­ical to many states that are, in Merrill’s words, “not rich when it comes to resources that are avail­able for discre­tion­ary purposes or specific­ally [elec­tion secur­ity].”  foot­note3_uhpceqt 3 John Merrill, “Panel 1, Invest­ing in Secur­ity.”

While these part­ners can help identify vulner­ab­il­it­ies, best prac­tices, and import­ant support func­tions, they do not fund the person­nel, train­ing, and secur­ity meas­ures neces­sary to secure vulner­ab­il­it­ies in Alabama’s elec­tion system. For these reas­ons, Secret­ary Merrill supports federal block grants for fund­ing specific elec­tion secur­ity projects in the states and believes such grants “would be very help­ful” to Alabami­ans.  foot­note4_j9tondi 4 Elec­tion Secur­ity Hear­ing (state­ment of John Merrill).

Alloc­a­tion of 2018 Federal Elec­tion Secur­ity Funds

Federal grant: $6,160,383

State match: $308,020

Total: $6,468,413

Alabama has desig­nated the entirety of its federal elec­tion secur­ity grant and state match­ing funds toward the follow­ing four projects:  foot­note5_hfl6ynd 5 State of Alabama, “2018 Help Amer­ica Vote Act (HAVA) Elec­tion Secur­ity Grant Program Narrat­ive, State of Alabama, Secret­ary of State,” accessed June 5, 2019, https://www.eac.gov/havadoc­u­ments/AL_Narrat­ive_Budget.pdf .

  • Voter regis­tra­tion data­base upgrades and main­ten­ance. With “more voters registered and more ballots being cast than ever before,”  foot­note6_6938fs8 6 Andrew J. Yawn, “E-lection Day? Why Online Voting Is Not an Option,” Mont­gomery Advert­iser, Novem­ber 12, 2018, https://www.mont­gomery­ad­vert­iser.com/story/news/polit­ics/2018/11/02/online-voting-unite-states-voter-turnout-alabama-esto­nia/1860186002/ .  the state is devot­ing $3 million to improve the voter regis­tra­tion data­base and its secur­ity features through upgrades, such as two-factor authen­tic­a­tion (2FA), to ensure that voter data is secure and reli­able.
  • Computer equip­ment replace­ment and upgrades. The state is provid­ing new computers and related equip­ment to each of the five primary elec­tion offi­cials in all 67 counties at an estim­ated cost of $300,000. Alabama offi­cials expect to complete this project by Septem­ber 30, 2019.  foot­note7_kn7fri7 7 John Merrill, “Panel 1, Invest­ing in Secur­ity.”  One of the many cyber­se­cur­ity chal­lenges faced in Alabama and several other states is related to the secur­ity prac­tices of the users of a shared system, such as a statewide voter regis­tra­tion data­base. By provid­ing computer equip­ment directly to local offi­cials, the state can ensure that users across the state are imple­ment­ing basic cyber­se­cur­ity meas­ures, includ­ing anti­virus soft­ware install­a­tion.
  • Postelec­tion audits. The state desig­nated $800,000 for postelec­tion audits. This process is an essen­tial elec­tion secur­ity bookend to the crit­ical elec­tion meas­ure already in place, paper ballots. While many of the audit-related costs will be incurred at the local level, the state plans to assume or reim­burse all costs asso­ci­ated with imple­ment­ing robust postelec­tion audits, as local elec­tion offi­cials simply don’t have the funds to under­write this project.  foot­note8_5a4y­wd2 8 Clay Helms (elec­tion director, Alabama Secret­ary of State) and John Bennett (deputy chief of staff, Alabama Secret­ary of State), inter­view by Bren­nan Center for Justice, May 9, 2019.  The state is currently work­ing with elec­tion secur­ity experts to determ­ine the best options for Alabama, and the first pilots are expec­ted to be sched­uled in calen­dar year 2019.  foot­note9_my4e­bid 9 Ibid.
  • Address­ing cyber vulner­ab­il­it­ies. The state desig­nated $2.3 million for vari­ous cyber­se­cur­ity enhance­ments, improve­ments, and fixes. Work­ing with a vari­ety of part­ners, the state plans to “invest­ig­ate, imple­ment, and identify new tech­no­lo­gies” to help reduce or elim­in­ate cyber vulner­ab­il­it­ies. As an example, the state previ­ously fixed an offi­cial state elec­tions website vulner­ab­il­ity that had been publicly iden­ti­fied by a private cyber­se­cur­ity firm.  foot­note10_ejr9kne 10 Clare Malone, “State Websites Are Hack­able—and That Could Comprom­ise Elec­tion Secur­ity,” FiveThirtyEight, May 31, 2018, https://fivethirtyeight.com/features/state-websites-are-hack­able-and-that-could-comprom­ise-elec­tion-secur­ity/ .

Addi­tional Unfun­ded Secur­ity Needs

Alabama elec­tion offi­cials iden­ti­fied two unfun­ded elec­tion secur­ity projects: legacy voting equip­ment replace­ment and devel­op­ment of a “cyber navig­ator program.” foot­note11_i08urxo 11 James Tatum (judge of probate, Bullock County, Alabama), inter­view by Bren­nan Center for Justice, May 2, 2019; Clay Helms and John Bennett, inter­view by Bren­nan Center.   foot­note12_50z06c9 12 As used in this report, the terms “cyber navig­ator program” (CNP) and “cyber navig­at­ors” refer to the Cyber Navig­ator Program estab­lished pursu­ant to 10 ILCS 5/1A-55 and CNP person­nel, not the Cyber Navig­ator service offered by Protinuum.

Legacy voting equip­ment replace­ment. Alabama elec­tion offi­cials in every county except Mont­gomery use legacy voting systems that are more than a decade old, includ­ing Auto­MARK voting systems, used in 66 counties, and M100s (precinct count optical scan­ners), used in seven counties.  foot­note13_858betj 13 Clay Helms and John Bennett, inter­view by Bren­nan Center.

These aging voting systems are a secur­ity risk and less reli­able than voting equip­ment avail­able today. Older systems are gener­ally “more likely to fail and are increas­ingly diffi­cult to main­tain.”  foot­note14_z8daft7 14 Elec­tion Secur­ity Hear­ing (state­ment of Lawrence Norden).  Specific­ally, as neither the Auto­MARK nor the M100 is currently manu­fac­tured, find­ing replace­ment parts will be increas­ingly diffi­cult over time.  foot­note15_b7df9lp 15 Lawrence Norden and Andrea Cordova, Voting Machines at Risk: Where We Stand Today, Bren­nan Center for Justice, March 5, 2019, https://www.bren­nan­cen­ter.org/analysis/voting-machines-risk-where-we-stand-today .  This prob­lem exacer­bates the system-specific secur­ity concerns that have been repor­ted to the EAC or by Veri­fied Voting, such as incon­sist­ent vote tally­ing and reboot times of 15 to 20 minutes.  foot­note16_5lipryn 16 Ruth John­son, Oakland County clerk/register of deeds, to Rose­mary Rodrig­uez, chair­per­son, Elec­tion Assist­ance Commis­sion, Octo­ber 2, 2008, https://www.eac.gov/assets/1/6/Oakland_County_Michigan_letter_regard­ing_ES_S_M-100_voting_machine_tabu­lat­ors.pdf (stat­ing that 8 percent of M-100 fleet in Oakland County “repor­ted incon­sist­ent vote totals during their logic and accur­acy test­ing”); “Elec­tion Systems and Soft­ware (ES&S) Auto­MARK,” Veri­fied Voting (list­ing Auto­MARK secur­ity concerns), accessed May 4, 2019, https://www.veri­fied­vot­ing.org/resources/voting-equip­ment/ess/auto­mark/ ).  Moreover, these systems simply lack import­ant secur­ity features expec­ted of voting machines today, such as hard­ware access deterrents for ports.  foot­note17_q6ufeax 17 Elec­tion Secur­ity Hear­ing (state­ment of Lawrence Norden).

State and local elec­tion offi­cials would consider using addi­tional elec­tion secur­ity fund­ing to replace these legacy systems.  foot­note18_7jydu6f 18 James Tatum, inter­view by Bren­nan Center; Clay Helms and John Bennett, inter­view by Bren­nan Center.  Bullock County Court of Probate Judge James Tatum, the local chief elec­tion offi­cial, explained, “Our [Auto­MARKs] are old and becom­ing very diffi­cult to main­tain . . . I would like to have the most secure equip­ment, cyber train­ing, and elec­tion secur­ity [tools], but we simply can’t afford it.”

Judge Tatum further explained that although “Secret­ary Merrill is a cham­pion of rural counties,” they often must do without the tools and resources avail­able in wealthy counties. “While Hunts­ville and Birm­ing­ham can afford these [replace­ment] costs, when you’re talk­ing about rural counties, we simply can’t afford these costs no matter how much they would improve our elec­tion secur­ity. For example, we would be respons­ible for paying for train­ing. Of course, we have to compensate our poll work­ers for their time when they come to train­ing. We can’t afford it. Rural counties are all in need of some addi­tional resources.”

Devel­op­ment of a “cyber navig­ator program.” Elec­tion offi­cials would like a state program that provides elec­tion secur­ity and cyber­se­cur­ity profes­sional services to local elec­tion offi­cials.  foot­note19_57g0l0n 19 James Tatum, inter­view by Bren­nan Center.

Illinois recently developed such a system, where cyber navig­at­ors with respons­ib­il­ity for geographic zones will work across the state with local elec­tion offi­cials to train relev­ant person­nel and lead risk assess­ments and eval­u­ations, among other things. They will fill a role akin in many ways to that of a chief inform­a­tion secur­ity officer for counties. Their assess­ment and eval­u­ation efforts will help offi­cials identify vulner­ab­il­it­ies and determ­ine where addi­tional resources may be needed to shore up cyber defenses. The program’s other prin­cipal compon­ents are infra­struc­ture improve­ment and inform­a­tion shar­ing.  foot­note20_8j5rkfl 20 Matt Diet­rich (spokes­man, Illinois State Board of Elec­tions), inter­view by Bren­nan Center for Justice, May 3, 2019.

Without a state resource for cyber assist­ance, local elec­tion offi­cials, such as those in Bullock County who do not have dedic­ated IT staff, may be at greater risk of a success­ful cyber­at­tack. Local elec­tion offi­cials consider the state a trus­ted part­ner and know person­nel are avail­able to address all voting equip­ment tech­nical ques­tions.  foot­note21_4nj2jzr 21 James Tatum, inter­view by Bren­nan Center.  However, without a cyber navig­at­or–­type of program, local elec­tion offi­cials may not have suffi­cient resources to appro­pri­ately respond to iden­ti­fied cyber threats to local systems or equip­ment, such as those risks shared by the Elec­tions Infra­struc­ture Inform­a­tion Shar­ing and Analysis Center (EI-ISAC).

End Notes

Arizona

After obtain­ing stolen log-in creden­tials of a local elec­tion offi­cial, cyber­crim­in­als attemp­ted to gain access to Arizon­a’s voter regis­tra­tion data­base in 2016.  foot­note1_aeb6shj 1 Mark Phil­lips, “Arizon­a’s Brush with Poten­tial Hacker During 2016 Elec­tion,” ABC 15, April 18, 2019, https://www.abc15.com/news/state/arizo­nas-brush-with-poten­tial-hacker-during-2016-elec­tion  Subsequently, state elec­tion offi­cials initi­ated the procure­ment process for a new, more secure data­base. They also estab­lished private and public part­ner­ships to help identify system vulner­ab­il­it­ies and appro­pri­ate steps to mitig­ate them.

For several reas­ons, includ­ing the decent­ral­ized nature of Arizon­a’s elec­tion admin­is­tra­tion system, state elec­tion offi­cials believe that support­ing local elec­tion offi­cials’ elec­tion and cyber­se­cur­ity improve­ment projects is a crit­ical compon­ent of their efforts to improve elec­tion secur­ity across the state.  foot­note2_gfzr9im 2 Sambo “Bo” Dul (elec­tion services director, Arizona Secret­ary of State) and Bill Maaske (chief inform­a­tion officer, Arizona Secret­ary of State), inter­view by Bren­nan Center for Justice, May 17, 2019.  While the 2018 grant provides neces­sary fund­ing for found­a­tional elec­tion secur­ity projects, some of which will directly bene­fit local offi­cials, it is simply not enough to also pay for projects that would provide or subsid­ize cyber services and more secure voting equip­ment to local elec­tion offi­cials.  foot­note3_c3sima2 3 Ibid.

Alloc­a­tion of 2018 Federal Elec­tion Secur­ity Funds

Federal grant: $7,463,675

State match: $373,184

Total: $7,836,859

Arizona has desig­nated the entirety of its federal elec­tion secur­ity grant and state match­ing funds toward the follow­ing projects:  foot­note4_sd4s­nr8 4   Arizona Depart­ment of State, “Arizona 2018 HAVA Elec­tion Secur­ity Funds,” 2018, https://www.eac.gov/havadoc­u­ments/AZ_Narrat­ive_Budget.pdf

  • Voter regis­tra­tion data­base replace­ment. The former Arizona secret­ary of state, Michele Reagan, explained the import­ance of this project, stat­ing, “When our online data­base was created, cyber­se­cur­ity was an after­thought. Now, faced with inter­na­tional threats, we must have a system that imple­ments strong protec­tions and the highest level of secur­ity capab­il­it­ies to protect voter data.”  foot­note5_wlhnaef 5 Matt Roberts, “Secret­ary Reagan Seeks Updated Voter Regis­tra­tion System,” Prescott Valley News, May 21, 2017, https://prescot­tval­leye­news.com/index.php/news/current-news/item/10238-secret­ary-reagan-seeks-updated-voter-regis­tra­tion-system  While the total cost of repla­cing the aging data­base is estim­ated at $7 million to $10 million, the state has devoted approx­im­ately $2.8 million to the project.  foot­note6_c753amd 6 Elec­tion Services Divi­sion, Arizona Secret­ary of State, “Request for Proposal for Voter Regis­tra­tion System,” 2017, https://aset.az.gov/sites/default/files/itac/Exhibit%204%20-%20Meet­ing%20Packet%20-%20PIJ%20-%20ST18001.pdf ; Arizona State Procure­ment Office, “Master Blanket Purchase Order ADSPO17–186601,” 2017, https://procure.az.gov/bso/external/purchase­order/poSum­mary.sdo;jses­sionid=C533D16BE1B852F8735B5323D81D4BCF?docId=ADSPO17–186601&releaseNbr=0&paren­tUrl=contract
  • Cyber­se­cur­ity. The state desig­nated the remain­ing grant funds, approx­im­ately $5 million, to vari­ous cyber­se­cur­ity projects, includ­ing:
    • Secur­ity assess­ment. The state partnered with a private vendor to conduct an assess­ment of the “current IT infra­struc­ture, focus­ing on crit­ical elec­tion systems.” The state expec­ted this assess­ment to “provide a frame­work for future spend­ing.” The vendor’s public report was released in late 2018.
    • Inform­a­tion shar­ing. The state is part­ner­ing with local elec­tion offi­cials to create stable commu­nic­a­tion chan­nels and build a culture of support between the state and local elec­tion offi­cials through routine meet­ings with inter­act­ive cyber­se­cur­ity discus­sion topics and curated agen­das.
    • Cyber­se­cur­ity subgrants to local elec­tion offi­cials. Work­ing in conjunc­tion with local elec­tion offi­cials, the state plans to distrib­ute a portion of its federal grant directly to counties to fund mutu­ally agreed-on cyber projects.

Addi­tional Unfun­ded Secur­ity Needs

Elec­tion offi­cials in Arizona noted they do not currently have funds they need to expand cyber­se­cur­ity assist­ance to local elec­tion offi­cials or replace legacy voting systems.  foot­note7_ijuy­gz6 7 Sambo “Bo” Dul and Bill Maaske, inter­view by Bren­nan Center; Tonia Tunnell (state and federal compli­ance officer, County Record­er’s Office, Mari­copa County, Arizona), inter­view by Bren­nan Center for Justice, April 26, 2019.

Greater cyber­se­cur­ity assist­ance to local elec­tion offi­cials. Assist­ing local elec­tion offi­cials with the cyber­se­cur­ity chal­lenges they face is an import­ant prior­ity for Secret­ary of State Katie Hobbs.  foot­note8_c2cg­gkp 8 Ibid.  The secret­ary of state’s chief inform­a­tion officer, Bill Maaske, stated that if Congress provides addi­tional elec­tion secur­ity fund­ing for the states, then he would support using those funds to imple­ment a state cyber navig­ator program, which, as described below, would coordin­ate cyber­se­cur­ity resources, inform­a­tion, and train­ings for and with local elec­tion offi­cials.  foot­note9_gl6hfsn 9 Ibid.

Such a state program could provide essen­tial services to local elec­tion offi­cials, some of whom lack dedic­ated IT staff and may be at a greater risk of success­ful cyber­at­tack. Without a cyber navig­at­or–­type of program, these local elec­tion offi­cials may not have suffi­cient resources to appro­pri­ately respond to iden­ti­fied cyber threats to local systems or equip­ment, such as those shared by EI-ISAC.

Legacy voting system replace­ment. Arizon­a’s legacy voting systems repres­ent a secur­ity and avail­ab­il­ity risk for three main reas­ons. First, “older systems are more likely to fail and are increas­ingly diffi­cult to main­tain.”  foot­note10_2w5k­wt7 10 Elec­tion Secur­ity Hear­ing (state­ment of Lawrence Norden).  Aging voting systems often use outdated hard­ware, and many of them, includ­ing the Accu­Vote TSX and AVC Edge systems used in multiple Arizona counties, are no longer manu­fac­tured.  foot­note11_tsz92uk 11 Ibid.   foot­note12_wc8m93q 12 Veri­fied Voting, “The Veri­fier — Polling Place Equip­ment in Arizona — Novem­ber 2018,” accessed May 2019, https://www.veri­fied­vot­ing.org/veri­fier/ .   foot­note13_jtqkmls 13 Lawrence Norden and Andrea Cordova, “Voting Machines at Risk.”  This can make find­ing replace­ment parts diffi­cult, if not impossible. Second, aging systems also frequently rely on outdated soft­ware, like Windows XP and 2000, which may not receive regu­lar secur­ity patches and are there­fore more vulner­able to the latest meth­ods of cyber­at­tack. Third, “older systems are less likely to have the kind of secur­ity features we expect of voting machines today.”  foot­note14_2dojhsq 14 Elec­tion Secur­ity Hear­ing (state­ment of Lawrence Norden).

State elec­tion offi­cials estim­ate the cost to replace the legacy voting equip­ment in use across the state, includ­ing the direct record­ing elec­tronic (DRE) machines, to be $40 million.  foot­note15_o1em6cu 15 Veri­fied Voting “The Veri­fier — Polling Place Equip­ment in Arizona.”  While relat­ively wealthy and urban counties, like Mari­copa County, may be able to fund the purchase of new voting equip­ment without finan­cial support from the state, Arizon­a’s more rural counties will likely struggle to find suffi­cient local resources.  foot­note16_mj8i­wr9 16 Tonia Tunnell, inter­view by Bren­nan Center.   foot­note17_mt7q8h9 17 Sambo “Bo” Dul and Bill Maaske, inter­view by Bren­nan Center May 17, 2019.  Consid­er­ing this, if Congress alloc­ates addi­tional state elec­tion secur­ity fund­ing, then state elec­tion offi­cials can prior­it­ize assist­ing counties with new voting system procure­ment costs.  foot­note18_iujp­fi5 18 Ibid.

End Notes

Illinois

Illinois

Former special coun­sel Robert Mueller’s report on Russian elec­tion inter­fer­ence included a troub­ling find­ing about Illinois: Russian oper­at­ives “comprom­ised the computer network of the Illinois State Board of Elec­tions . . . [,] then gained access to a data­base contain­ing inform­a­tion on millions of registered Illinois voters, and extrac­ted data related to thou­sands of U.S. voters before the mali­cious activ­ity was iden­ti­fied.” foot­note1_hbm59nk 1 Special Coun­sel Robert S. Mueller, III, Report on the Invest­ig­a­tion into Russian Inter­fer­ence in the 2016 Pres­id­en­tial Elec­tion , U.S. Depart­ment of Justice, 2019, 50, https://www.justice.gov/stor­age/report.pdf .  Although there is no single panacea to address such threats, the state is devot­ing a substan­tial portion of its federal elec­tion secur­ity funds to a cyber navig­ator program, which should help identify and address cyber­se­cur­ity vulner­ab­il­it­ies like those the Russi­ans exploited in 2016.

Alloc­a­tion of 2018 Federal Elec­tion Secur­ity Funds

Federal grant: $13,232,290

State match: $661,615

Total: $13,893,905

Illinois is using all of its federal elec­tion secur­ity funds to improve its cyber­se­cur­ity. The hall­mark of that effort is the state’s cyber navig­ator program; the state plans to devote at least half of its federal grant toward this program.

Cyber navig­at­ors with respons­ib­il­ity for geographic zones across the state will work with local elec­tion offi­cials to train relev­ant person­nel and to lead risk assess­ments and eval­u­ations, among other things. They will fill a role akin in many ways to that of a chief inform­a­tion secur­ity officer for counties. Their assess­ment and eval­u­ation efforts will help offi­cials identify vulner­ab­il­it­ies and determ­ine where addi­tional resources may be needed to shore up cyber defenses. The program’s other prin­cipal compon­ents are infra­struc­ture improve­ment, through the Illinois Century Network Expan­sion, and inform­a­tion shar­ing, through the Cyber­se­cur­ity Inform­a­tion Shar­ing Program.  foot­note2_ypguwp4 2 Matt Diet­rich, inter­view by Bren­nan Center.

Addi­tional Unfun­ded Secur­ity Needs

Elec­tion offi­cials noted two unfun­ded elec­tion secur­ity projects: adop­tion of coun­ter­meas­ures for secur­ity vulner­ab­il­it­ies iden­ti­fied through risk and vulner­ab­il­ity assess­ments, and legacy voting system replace­ment.  foot­note3_5j8g4kr 3 Noah Praetz (former elec­tions director, Cook County, Illinois), inter­view by Bren­nan Center for Justice, May 6, 2019; Matt Diet­rich, inter­view by Bren­nan Center.

The cyber navig­ator program will help Illinois offi­cials identify poten­tial vulner­ab­il­it­ies in elec­tion systems and concrete actions to correct those weak­nesses. However, as Noah Praetz, the former elec­tions director of Cook County, explained, counties will likely need addi­tional funds to correct any issues that arise during assess­ments: “The cyber navig­at­ors will be a great resource for counties and will go a long way toward help­ing offi­cials across Illinois improve their cyber­se­cur­ity. But we’ll likely need contin­ued fund­ing support to address any vulner­ab­il­it­ies that the Navig­at­ors identify and to carry the cyber navig­ator program forward after its first few years.”  foot­note4_bcxp9ed 4 Noah Praetz, inter­view by Bren­nan Center.

More imme­di­ately, Matt Diet­rich of the State Board of Elec­tions explained that Illinois needs signi­fic­ant addi­tional fund­ing to under­take a statewide replace­ment of its aging voting systems. He estim­ated the likely cost to be $175 million. “Many of our local juris­dic­tions used the [original] HAVA grants to modern­ize their outdated voting systems. But those systems are now 15 years old and in need of replace­ment.”  foot­note5_wq5ji6r 5 Matt Diet­rich, inter­view by Bren­nan Center.  As explained above, such aging systems were not designed to with­stand today’s threats and can be more prone to equip­ment and soft­ware issues that could affect perform­ance during voting.

End Notes

Louisiana

As one of only three states that continue to use paper­less voting machines statewide, Louisi­ana lacks one of the most crit­ical elec­tion secur­ity meas­ure avail­able today: voter-veri­fi­able paper backups of every vote. Despite warn­ings by Depart­ment of Home­land Secur­ity (DHS) offi­cials, cyber­se­cur­ity experts, and the former Louisi­ana secret­ary of state, these paper­less machines will likely be used in the upcom­ing 2019 general elec­tion for governor, attor­ney general, four other statewide elec­ted posi­tions, and all 144 members of the Louisi­ana Legis­lature. foot­note1_zrfg­bik 1 Alyza Sebenius, “Trump Cyber Offi­cial Warns Voting Machines Need Paper Trails,” Bloomberg, Febru­ary 13, 2019, https://www.bloomberg.com/news/articles/2019–02–13/trump-cyber-offi­cial-warns-voting-machines-need-paper-trails; Melinda Deslatte, “Louisi­ana Starts Process to Replace 10,000 Voting Machines, but It May Come with Hefty Price Tag,” The Advoc­ate, March 30, 2018, https://www.thead­voc­ate.com/baton_rouge/news/polit­ics/elec­tions/article_70500b­b0–345b-11e8-a151–9fe2f4f5b­d30.html (in which then-secret­ary of state Tom Schedler warns, “The day of reck­on­ing is coming”).   foot­note2_luxqmzu 2 Julia O’Donoghue, “Louisi­ana Won’t Have New Voting Machines for 2019 Governor’s Race,” Nola, Decem­ber 10, 2018, https://www.nola.com/news/2018/12/louisi­ana-wont-have-new-voting-machines-for-2019-governors-race.html (stat­ing, “The secret­ary of state’s office has faith in the older machines, even if it would have preferred to use new machines next fall. ‘We haven’t had prob­lems with the machines,’ Ardoin spokes­man Tyler Brey said. ‘We have no issues with vulner­ab­il­ity. They work just fine.’”).

The ongo­ing effort by state elec­tion offi­cials to replace the paper­less voting machines in order to make elec­tion results veri­fi­able has faced many setbacks, includ­ing bid protests, admin­is­tra­tion changes, and state budget woes.  foot­note3_ogzphnp 3 Julia O’Donoghue, “Plans to Replace Louisi­ana Voting Machines Stall,” Nola, Novem­ber 30, 2018, https://web.archive.org/web/20181129033258/https:/www.news­ob­server.com/news/busi­ness/article222332155.html ; Melinda Deslatte, “Louisi­ana Starts Process to Replace 10,000 Voting Machines” (stat­ing that, includ­ing the federal grant, there was approx­im­ately $8 million in state funds avail­able for new voting equip­ment as of March 2018); Mark Ballard, “Here’s Why Louisi­ana Won’t Get New Voting Machines in Time for Next Year’s Big Elec­tions,” The Advoc­ate, Decem­ber 11, 2019, https://www.thead­voc­ate.com/baton_rouge/news/polit­ics/elec­tions/article_2973c230-fda6–11e8-a0da-6bb5e6c765fa.html (stat­ing that the state has approx­im­ately $1.5 million set aside for new voting equip­ment); Melinda Deslatte, “Decision Upheld to Scrap Louisi­ana Voting Machine Contract,” Asso­ci­ated Press, Novem­ber 28, 2018, https://web.archive.org/web/20181129033258/https://www.news­ob­server.com/news/busi­ness/article222332155.html (stat­ing, “The voting machine replace­ment work began under Ardoin’s prede­cessor and former boss, Repub­lican Tom Schedler”).  Most recently, the process to purchase new, paper-based voting machines failed in Octo­ber 2018 after a bid protest was filed. With this process stalled, state elec­tion offi­cials plan to spend $2 million to rent reli­able voting equip­ment for early voting for the 2019 elec­tion.  foot­note4_7q8p9c2 4 Melinda Deslatte, “Louisi­ana Rent­ing Early-Voting Machines for Fall Elec­tion,” Asso­ci­ated Press, April 3, 2019, https://www.wwltv.com/article/news/polit­ics/elec­tions/louisi­ana-rent­ing-early-voting-machines-for-fall-elec­tion/289-a2aa9046–5468–4460-ae2f-9dab84363e6d ; Lani Durio (Louisi­ana deputy director of elec­tions), inter­view by Bren­nan Center for Justice, May 7, 2019.  Although Secret­ary of State Kyle Ardoin wants to get new voting machines “as soon as possible to continue to keep Louisi­ana at the fore­front of elec­tion integ­rity and secur­ity,” the timeline for repla­cing the voting machines is some­what unclear.  foot­note5_o846uoi 5 Julia O’Donoghue, “Plans to Replace Louisi­ana Voting Machines Stall”; Lani Durio, inter­view by Bren­nan Center (stat­ing that state elec­tion offi­cials plan to initi­ate the procure­ment process “in the near future”).

Alloc­a­tion of 2018 Federal Elec­tion Secur­ity Funds

Federal grant: $5,889,487

State match: $294,474

Total: $6,183,961

Given the press­ing need to replace the state’s paper­less voting machines, Louisi­ana offi­cials have alloc­ated the entirety of the state’s federal elec­tion secur­ity grant toward the purchase of new voting systems. However, those funds are insuf­fi­cient to cover the cost of repla­cing paper­less machines statewide. The original contract awar­ded for new voting equip­ment, since rescin­ded, was $95 million.  foot­note6_7nhappo 6 Benjamin Freed, “Louisi­ana Cancels $95 Million Contract for New Voting Machines,” StateS­coop, Octo­ber 11, 2018, https://states­coop.com/louisi­ana-cancels-95-million-contract-for-new-voting-machines/ .  Although state offi­cials believe that the ulti­mate contract price for new voting machines will be lower, federal grant funds may cover less than 10 percent of total costs asso­ci­ated with obtain­ing and deploy­ing a new, paper-based voting machine fleet across the state. foot­note7_80gmlnn 7 Melinda Deslatte, “Louisi­ana Starts Process to Replace 10,000 Voting Machines” (stat­ing, “[Secret­ary of State] Schedler estim­ates the entire replace­ment project, complete with new equip­ment and computer soft­ware, will cost between $40 million and $60 million”); Lani Durio, inter­view by Bren­nan Center.   foot­note8_xwl464q 8 Total cost estim­ates range from $40 million–$60 million to $95 million; see Benjamin Freed, “Louisi­ana Cancels $95 Million Contract”; also see Melinda Deslatte, “Louisi­ana Starts Process to Replace 10,000 Voting Machines” (stat­ing, “[Secret­ary of State] Schedler estim­ates the entire replace­ment project, complete with new equip­ment and computer soft­ware, will cost between $40 million and $60 million”). The federal portion of the 2018 grant, $5,889,487, is 9.8% of $60 million.

Addi­tional Unfun­ded Secur­ity Needs 

Louisi­ana has set aside all of its federal money to pay for much-needed new voting machines with paper backups. Even with this fund­ing, it still faces a multi­mil­lion dollar gap to replace its voting machines. In addi­tion, it has other secur­ity needs that have gone unad­dressed, includ­ing:

  • Post-elec­tion audits. If paper-based voting systems are deployed across the state, then the essen­tial elec­tion secur­ity bookend to the use of paper ballots – robust postelec­tion audits to ensure that the ballots were coun­ted as cast – can be imple­men­ted.
  • Address­ing iden­ti­fied cyber vulner­ab­il­it­ies. Cyber vulner­ab­il­it­ies are iden­ti­fied on an ongo­ing basis by the secret­ary of state’s inform­a­tion tech­no­logy depart­ment.  foot­note9_2k38c5u 9 Melinda Deslatte, “Louisi­ana Starts Process to Replace 10,000 Voting Machines” (stat­ing, “Schedler said Louisi­ana has upped its secur­ity and contin­ues to look for system improve­ments. ‘We are constantly chan­ging codes and putting up blocks,’ he said”).  They also may be iden­ti­fied peri­od­ic­ally through inde­pend­ent Risk and Vulner­ab­il­ity Assess­ments avail­able from DHS. Resources may be required to address cyber vulner­ab­il­it­ies discovered during these processes.

End Notes

Oklahoma

 

Although Oklahoma deployed a new statewide fleet of voting equip­ment in 2012, the state still faces many diffi­cult elec­tion secur­ity decisions. Recent finan­cial constraints have severely limited offi­cials’ discre­tion­ary spend­ing as Oklahoma slowly recov­ers from one of the most debil­it­at­ing finan­cial crises in the state’s history. Eight months into the past fiscal year, Oklahoma was forced to reduce state agency budgets, result­ing in a $50,000 cut in fund­ing to the Oklahoma State Board of Elec­tions.  foot­note1_ysxof4p 1 Oklahoma State Elec­tion Board, “OK Narrat­ive Budget,” 2018, https://www.eac.gov/havadoc­u­ments/OK_Narrat­ive_Budget.pdf .  The year ended in June 2019 with a $167 million projec­ted short­fall, and this was considered an improve­ment. One state offi­cial noted, “Last year [FY 2018], our short­fall was around $800 million. I believe the year before was about $1.3 billion, so we’re improv­ing.”  foot­note2_61lnh7p 2 Lili Zheng, “Oklahoma Faces $167M Budget Short­fall Next Fiscal Year,” KFOR, Febru­ary 20, 2018, https://kfor.com/2018/02/20/it-doesnt-look-hope­ful-oklahoma-facing-167-budget-short­fall-for-next-fiscal-year/ .

Alloc­a­tion of 2018 Federal Elec­tion Secur­ity Funds

Federal grant: $5,196,017

State match: $259,801

Total: $5,455,818

As of July 2018, Oklahoma planned to devote the entirety of its federal grant funds to the follow­ing four crit­ical elec­tion secur­ity projects:  foot­note3_ctof5uh 3 Oklahoma State Elec­tion Board, “OK Narrat­ive Budget.”

  • Voter regis­tra­tion data­base upgrades and secur­ity enhance­ments. The current custom-built state voter regis­tra­tion data­base relies on archi­tec­ture designed in 2005 that can be installed only on Windows PCs. Oklahoma plans to spend $1.65 million on the most crit­ical secur­ity and system updates and upgrades.
  • Cyber­se­cur­ity and phys­ical secur­ity improve­ments. Work­ing with state and federal part­ners, elec­tion offi­cials have iden­ti­fied multiple discrete projects, such as the relo­ca­tion of their serv­ers to a secure server bunker, imple­ment­a­tion of two-factor authen­tic­a­tion for access to the state Virtual Private Network (VPN), and remote anti­virus protec­tion manage­ment. The aggreg­ate estim­ated cost of these projects is $1 million.
  • Train­ing. The state estim­ates that devel­op­ing and provid­ing train­ing for local elec­tion offi­cials on the new equip­ment described above and addi­tional cyber­se­cur­ity train­ings will cost approx­im­ately $300,000.
  • New elec­tion system equip­ment. The state plans to use $2.5 million to purchase elec­tronic poll books, which offi­cials say can enhance elec­tion secur­ity through built-in secur­ity features, such as auto­mated noti­fic­a­tions in the event of unusual activ­ity, e.g., the addi­tion or dele­tion of a high number of voter records, by one or more users.  foot­note4_r5se5xo 4 Ibid.  The state also plans to purchase docu­ment scan­ners to reduce the need to store hard copies of docu­ments that contain personal private inform­a­tion and to protect against theft and loss of inform­a­tion through acci­dents and disasters.  foot­note5_wprsmm6 5 Ibid.

Addi­tional Unfun­ded Secur­ity Needs

Accord­ing to State Elec­tion Board Secret­ary Paul Ziriax, Oklahoma Cyber Command and the Depart­ment of Home­land Secur­ity (DHS) may recom­mend new elec­tion secur­ity projects that should be given higher prior­ity than those currently planned.  foot­note6_dz2r­qct 6 Paul Ziriax (secret­ary, Oklahoma Board of Elec­tions), inter­view by Bren­nan Center for Justice, May 2, 2019.  These part­ner agen­cies routinely provide services that identify cyber vulner­ab­il­it­ies and signi­fic­ant system risks and have been work­ing with the Elec­tion Board to explore options “to optim­ize the board’s phys­ical and cyber­se­cur­ity and plan for poten­tial elec­tion emer­gency situ­ations.”  foot­note7_7rwc63z 7 Office of Manage­ment and Enter­prise Services, State of Oklahoma, “State of Oklahoma Exec­ut­ive Budget Fiscal Year 2020,” Febru­ary 2019, https://omes.ok.gov/sites/g/files/gmc316/f/public­a­tions/bud20.pdf ; Paul Ziriax, inter­view by Bren­nan Center.

If this process leads to recom­mend­a­tions of new elec­tion secur­ity meas­ures, then Oklahoma would likely revise the current grant narrat­ive to include them, Ziriax stated.  foot­note8_5o009pf 8 Ibid.  If offi­cials desig­nate federal fund­ing for these new projects, then they must reduce the amount of federal funds currently desig­nated for one or more of the projects described above. Depend­ing on the costs asso­ci­ated with the new projects, offi­cials may be forced to delay, partially defund, or aban­don currently planned elec­tion secur­ity projects.

Regard­less of the outcome of these assess­ments, Oklahoma has several addi­tional elec­tion secur­ity needs, some of which have already been iden­ti­fied by elec­tion offi­cials, that are not currently desig­nated for federal fund­ing, includ­ing:

  • Robust postelec­tion audits. Oklahoma is one of only 10 states with no postelec­tion audit process.  foot­note9_ghik­dpo 9 National Confer­ence of State Legis­latures, “Post-Elec­tion Audits,” Janu­ary 2019, http://www.ncsl.org/research/elec­tions-and-campaigns/post-elec­tion-audit­s635926066.aspx .  Robust postelec­tion audits ensure that the ballots were coun­ted as cast and are an essen­tial elec­tion secur­ity bookend to the state’s use of paper ballots for all elec­tions.
  • Voting equip­ment hard­ware and soft­ware updates. Although Oklaho­ma’s fleet of paper-based voting equip­ment is relat­ively new compared with that of several other states, it is already at the approx­im­ate “halfway mark of its life span,” and state offi­cials “anti­cip­ate that the system may require hard­ware and/or soft­ware updates.”  foot­note10_8bt9cgh 10 Oklahoma State Elec­tion Board, “OK Narrat­ive Budget.”  If such updates become neces­sary for proper voting system fleet main­ten­ance, then offi­cials plan to revise the grant narrat­ive and use federal funds for this project.  foot­note11_ygcy9jq 11 Ibid.
  • Virtual Private Network (VPN) upgrades. Oklahoma elec­tion offi­cials are explor­ing options to upgrade the VPN provided by the Oklahoma State Regents for Higher Educa­tion to enhance secur­ity and protec­tion of the state voter regis­tra­tion data­base.  foot­note12_r7eqwbj 12 Oklahoma State Elec­tion Board, “OK Narrat­ive Budget.”  This data­base houses the personal identi­fy­ing inform­a­tion of more than 2.1 million registered voters in Oklahoma.  foot­note13_w6os­r8k 13 Oklahoma State Elec­tion Board, “Current Regis­tra­tion Stat­ist­ics by County,” Janu­ary 15, 2019, https://www.ok.gov/elec­tions/docu­ments/20190115%20-%20Re­gis­tra­tion%20By%20County%20(vr2420).pdf .

End Notes

Pennsylvania

Pennsylvani­a’s elec­tion secur­ity chal­lenges are substan­tial: As recently as the 2018 midterm elec­tions, more than 80 percent of Pennsylvania voters were registered in juris­dic­tions still using paper­less voting systems.  foot­note1_6xw9q8b 1 Blue Ribbon Commis­sion on Pennsylvani­a’s Elec­tion Secur­ity, Study and Recom­mend­a­tions, 2019, 14, https://www.cyber.pitt.edu/sites/default/files/FINAL%20FULL%20PittCy­ber_PAs_Elec­tion_Secur­ity_Report.pdf .  Yet Pennsylvania offi­cials have taken steps to move away from these vulner­able machines. Those efforts include the Pennsylvania Depart­ment of State direct­ing counties to have paper-based systems in place by 2020.  foot­note2_04a9n63 2 Pennsylvania Depart­ment of State, “Depart­ment of State Tells Counties to Have New Voting Systems in Place by End of 2019,” May 12, 2018, http://www.media.pa.gov/Pages/State-Details.aspx?newsid=276 ; Pennsylvania Depart­ment of State, “Wolf Admin­is­tra­tion Directs That New Voting Systems in the Common­wealth Provide Paper Record,” Febru­ary 9, 2018, https://www.media.pa.gov/PagesState­De­tails.aspx?newsid=261 .

Alloc­a­tion of 2018 Federal Elec­tion Secur­ity Funds 

Federal grant: $13,476,156

State match: $673,808

Total: $14,149,964

Given the press­ing need to replace the state’s paper­less voting machines, Pennsylvania offi­cials have alloc­ated the entirety of the state’s federal elec­tion secur­ity grant to the purchase of new voting systems. The state is shar­ing these funds with counties in the form of a partial reim­burse­ment once they have selec­ted new voting systems, with each county receiv­ing a share propor­tion­ate to its number of registered voters. Accord­ing to the Depart­ment of State, the counties have made great strides toward accom­plish­ing the state’s goal of having new paper-based machines in place across Pennsylvania by 2020, and acting Secret­ary of the Common­wealth Kathy Boock­var expressed confid­ence in the state’s abil­ity to meet that timeline.  foot­note3_4uo6­fun 3 Kathy Boock­var (acting secret­ary of the Common­wealth, Pennsylvania Depart­ment of State) and Jonathan Marks (deputy secret­ary for elec­tions and commis­sions, Pennsylvania Depart­ment of State), inter­view by Bren­nan Center for Justice, May 3, 2019.

Unfor­tu­nately, those funds (approx­im­ately $14 million with the state match added) are insuf­fi­cient to cover the cost of repla­cing paper­less machines statewide. The Pennsylvana Depart­ment of State estim­ates that federal funds will cover only 10 to 12 percent of the statewide bill to replace exist­ing machines (approx­im­ately $150 million).  foot­note4_0pwk­pap 4 Ibid; see also Blue Ribbon Commis­sion on Pennsylvani­a’s Elec­tion Secur­ity, Study and Recom­mend­a­tions, 24.  In Lehigh County, for example, Tim Benyo, the county’s chief clerk for elec­tions and regis­tra­tion, stated that federal funds will cover only a small portion of the county’s planned spend­ing to procure a new paper-based voting system: roughly $350,000 of the $3.5 million that the county had budgeted for upgrades.  foot­note5_khw7o58 5 Timothy Benyo (chief clerk, regis­tra­tion and elec­tions, Lehigh County, Pennsylvania), inter­view by Bren­nan Center for Justice, April 29, 2019.  Zane Swanger, Miff­lin County’s director of elec­tions and voter regis­tra­tion, simil­arly said that federal funds will cover only $41,000 of a likely $250,000–$300,000 total bill for the predom­in­antly rural county’s purchase of a new voting system.  foot­note6_i0fxx33 6 Zane Swanger (director of elec­tions and voter regis­tra­tion, Miff­lin County, Pennsylvania), inter­view by Bren­nan Center for Justice, April 30, 2019.

Addi­tional Unfun­ded Secur­ity Needs 

Setting aside the ongo­ing fund­ing gap for new voting systems with paper backups, the urgent need to replace the state’s legacy voting machines has deprived Pennsylvania of the abil­ity to direct federal funds toward other crit­ical elec­tion secur­ity needs. Examples include:

  • Voter regis­tra­tion system. The state is embark­ing on a procure­ment process to replace its aging statewide voter regis­tra­tion system, which is into its second decade of use. Pennsylvani­a’s state offi­cials “have regu­larly main­tained and updated its oper­at­ing system,” but as Benyo explained, “The system is really outdated, and it has gotten Band-Aid after Band-Aid and requires a lot of money to keep it work­ing prop­erly.”  foot­note7_ld80wre 7 Blue Ribbon Commis­sion on Pennsylvani­a’s Elec­tion Secur­ity, Study and Recom­mend­a­tions, 34.   foot­note8_5a6fy1i 8 Timothy Benyo, inter­view by Bren­nan Center.  Depart­ment of State lead­er­ship stated that although they remain confid­ent in the secur­ity of the current system thanks to multilayered secur­ity protec­tions in place, the “voter regis­tra­tion system replace­ment is abso­lutely about secur­ity,” as well as improv­ing its perform­ance and effi­ciency.  foot­note9_2irqxda 9 Kathy Boock­var and Jonathan Marks, inter­view by Bren­nan Center.  Not only is the current system expens­ive to main­tain, but offi­cials often confront perform­ance costs when weigh­ing secur­ity enhance­ments to the system.
  • Cyber­se­cur­ity assess­ments. County offi­cials also expressed interest in regu­lar, robust county cyber­se­cur­ity assess­ments, which can be crit­ical to identi­fy­ing vulner­ab­il­it­ies and shor­ing up cyber defenses. Although DHS has put Pennsylvania through its Risk and Vulner­ab­il­ity Assess­ment process and the Pennsylvania National Guard has been offer­ing some cyber­se­cur­ity assess­ment services to counties, counties tend to lack dedic­ated fund­ing for regu­lar, peri­odic assess­ments. The Depart­ment of State mentioned the Center for Inter­net Secur­ity’s “Albert” sensors and annual costs, in partic­u­lar, as some­thing that addi­tional fund­ing could support for counties.  foot­note10_3lyb4bz 10 Ibid.
  • Cyber­se­cur­ity train­ings. There was also interest in cyber­se­cur­ity train­ing, which can help elec­tions person­nel guard against spear-phish­ing attacks and learn other basics of cyber­se­cur­ity. Noting that the threat “envir­on­ment is ever chan­ging,” Zane Swanger emphas­ized the import­ance of train­ing his staff, poll work­ers, and others involved in elec­tion admin­is­tra­tion about current secur­ity threats and “better elec­tion mater­ial hand­ling.”  foot­note11_ibo0m0b 11 Zane Swanger, inter­view by Bren­nan Center.

End Notes

iii. Conclusion

In admin­is­ter­ing our elec­tions, states face secur­ity chal­lenges of unpre­ced­en­ted magnitude. They are, in many cases, ill equipped to defend them­selves against the soph­ist­ic­ated, well-resourced intel­li­gence agen­cies of foreign govern­ments. States should not be expec­ted to defend against such attacks alone. Our federal govern­ment should work to provide the states with the resources they need to harden their infra­struc­ture against cyber­se­cur­ity threats. At the very least, each state should develop the abil­ity to verify elec­tion results in the case of a breach.

Russia and other malign foreign actors use multiple tools and tactics to inter­fere in demo­cra­cies, and cyber threats against elec­tion systems are among them. The states included in this study have begun the hard work of upgrad­ing dated infra­struc­ture, setting aside funds for postelec­tion audits, and address­ing cyber vulner­ab­il­it­ies. But there is more they can do with addi­tional resources.

Elec­tions are the pillar of Amer­ican demo­cracy, and, as we saw in 2016 and 2018, foreign govern­ments will continue to target them. States cannot counter these adversar­ies alone, nor should they have to. But at a time when free and fair elec­tions are increas­ingly under attack, they can, with addi­tional federal fund­ing, safe­guard them.

 

Acknow­ledg­ments

The Bren­nan Center grate­fully acknow­ledges BLT Char­it­able Trust, Carne­gie Corpor­a­tion of New York, Craig Newmark Phil­an­throp­ies, Demo­cracy Alli­ance Part­ners, Ford Found­a­tion, Lee Halprin and Abby Rock­e­feller, The JPB Found­a­tion, Leon Levy Found­a­tion, Open Soci­ety Found­a­tions, Barbara B. Simons, and Wallace Global Fund for their support of our elec­tion secur­ity work.