Spooked by election hacking, states are moving to paper ballots

Paper ballots may seem like an antiquated voting practice, but hacking fears are now pushing an increasing number of states toward a return to the basics.

State legislatures and election directors are heeding warnings from Washington that hackers may tamper with electronic voting systems in the 2018 midterm elections. The U.S. intelligence community has said that Russian President Vladimir Putin launched a campaign to interfere with the 2016 presidential election and that the Kremlin will try to do so again.

On the national level, lawmakers have made several attempts to push legislation aiming to strengthen election cybersecurity through grants to upgrade equipment and to increase cooperation between the federal government and lower jurisdictions.

So far, no such legislation has passed either chamber of Congress.

Amid all this national attention, a number of states have started to act on their own bolster the integrity of elections they run. With these states, the focus has been on doing away with direct-recording electronic voting machines (DREs) that don’t produce a paper record.

Experts and advocates say it might be impossible to create an unhackable system, so the next best thing would be to ensure that a system is fully auditable, so that any tampering would be detected with a review.

“You have to have the ability to recover,” Marian Schneider, president of Verified Voting, told CyberScoop. Verified Voting is a nonprofit that advocates for transparency in the election process. “When you talk about voting systems, the way you have the ability to recover is that you have a voter-marked paper ballot, and you have a human process that checks that paper ballot against the software-driven process.”

For Ed Smith, vice president of product at Clear Ballot, a Boston-based election equipment manufacturer, auditability preempts security.

“We’ve got to secure the systems. But without a cornerstone of auditability and transparency, you know, you’re building your house on a little bit of quicksand,” Smith told CyberScoop.

“I personally believe … that the approach emphasizing auditability and transparency and having every voter finish the process with a scannable ballot — as the Clear Ballot system does — is really more important in some ways than securing the system,” Smith said.

A state-level push

According to Verified Voting, five states currently only use DREs without a paper trail: New Jersey, Delaware, South Carolina, Georgia and Louisiana. Many other states are a mixed bag when it comes to machines with a paper trail. Several have begun a process to replace paperless systems.

Georgia’s senate passed a bill last month that would require the state to only use optical scanning systems by 2024. It would also require the state to conduct risk-limiting audits for all state-wide elections starting the same year.

In Delaware, the Department of Elections is reviewing responses to a request for proposals for replacement machines that have a paper backup. State Election Commissioner Elaine Manlove told CyberScoop that the new equipment will not be used until 2020.

“The reason for the new machines is the age of our current equipment. While we are confident in their accuracy, I’d rather have new equipment in place before we have an issue. The demand for a paper trail — or paper ballots — is the reason that is a requirement,” Manlove said in an email. “All election offices are concerned about cybersecurity and we are working with the state’s Dept. of Technology and Information regarding security as well as [The Department of Homeland Security.]”

In Kentucky, the State Board of Elections last month moved to require that all future voting equipment the state purchases to provide a voter-verified paper trail. It also called on the Kentucky legislature and Congress to provide funding for equipment upgrades. The board cited concern about DREs from DHS and cybersecurity experts.

“In a time when bad actors and misinformation campaigns try to undermine confidence in our democratic process, making sure voters can verify their vote is critical to building up and protecting our process,” Kentucky Secretary of State Alison Grimes said in a statement.

Pennsylvania is taking a more limited approach. Gov. Tom Wolf ordered last month that when counties do purchase new equipment, it should have a paper record. The directive does not require that counties discard DREs currently in use.

While many of the states’ plans have timelines extending beyond 2018, there are some that have moved on a quicker timeline.

Virginia’s Board of Elections decertified all of the state’s paperless systems in September 2017, just two months before their gubernatorial election. Election officials cited an experiment run at DEFCON in which security researchers demonstrated vulnerabilities in various DREs, some of which were used by Virginia, according to the Washington Post.

Colorado was recognized this month by the National Association of Secretaries of State for both its cybersecurity and physical security practices. Colorado has also been widely praised for being the first state to require risk-limiting audits post-election. Rhode Island became the second state in September. Both states use only paper-based voting systems.

Tennessee, for one, is eschewing the trend. Mark Goins, the state’s election coordinator, told the Tennessean last month that there is no concern that votes will be tampered with, “just because of the way the system is set up.” Most of the state’s counties only employ paperless DREs, according to Verified Voting.

“It’s very costly to go to paper ballots. It’s one thing to say that voting machines can be hacked, but the reality is there are 95 counties here and thousands of machines and they are in secure locations,” he reportedly said, adding that the machines’ internet capability is disabled.

Rep. Jim Cooper, D-Tenn., recently called on the state legislature to use about $29 million that it has in leftover federal election funding to transition to paper systems.

National nonstarters

In Congress, a number of bills have been introduced in recent months that aim to address election security, and their backers have been vocal about their urgency. And while some of the bills have bipartisan support, none of them have seen much progress since they were introduced.

Notably, Sens. Amy Klobuchar, D-Minn., and James Lankford, R-Okla., introduced the Secure Elections Act with a group of bipartisan co-sponsors. The bill aims to expedite security clearances to state election officials, provide grants for updating election equipment and sponsor a “Hack the Election” program inviting researchers to identify bugs in equipment. The bill hasn’t seen any action since it was introduced.

Another bill, introduced in the House by the Election Security Task Force in February, seeks to increase cooperation between the federal government and states, require the Department of Homeland Security to issue security clearances to state officials, and authorize $1 billion in grants states can use to implement paper-based voting systems, among other provisions. The task force is a group of Democrats led by Rep. Bennie Thompson, D-Miss. The bill has amassed 52 co-sponsors, all also Democrats.

While it’s clear from the proposed legislation that both sides of the aisle are devoting at least some attention to election security, experts say it’s not clear why the bills haven’t moved.

“There’s a great deal of frustration that very little is moving forward,” said Greg Miller, chief development officer for the Open Source Election Technology (OSET) Institute.

Miller, who says he is in frequent contact with lawmakers, says that despite interest from both sides, Republican leadership appears to be holding up the process.

“There are several members of the GOP, of the majority, who are very concerned and very interested in these issues. But it seems like there almost forbidden from bringing them to the table by the leadership,” Miller said.

President Donald Trump issued a surprise endorsement last week of the notion of states transitioning to paper-based systems.

“You have to be very vigilant. One of the things we’re learning is that it’s always good, it’s old fashioned, but it’s always good to have a paper backup system of voting. It’s called paper. Not highly complex computers,” Trump said at a press conference with the Sweden’s prime minister.

Democrats have criticized Trump for not taking enough action on election security. While he has acknowledged attempted interference in the 2016 election, the president has (up until Tuesday’s statement) largely fixated on the point that there is no evidence vote tallies were changed.

Schneider, of Verified Voting, said she sees the issue of election security wrongfully getting politicized.

“I don’t think this is a political issue. Everybody gets elected on the same equipment, regardless of their party. So making sure that that equipment is working well, making sure that we can verify the results so that the outcome is correct is important to everyone,” Schneider said.

Miller echoed that sentiment, adding that the politicization is a sign that Russia is succeeding by sowing doubt in U.S. elections.

“It was part of the Russian strategy. Wildly successful,” Miller said. “Because as soon as it became a partisan issue and dumped in the lap of the minority you had no capacity whatsoever to deal with this patriotically, deal with this pragmatically, objectively, in a nonpartisan way.”