Skip to main content

The Canvass | June 2019

June 1, 2019

Treating Elections as Infrastructure

“Infrastructure” usually means bridges, roads, power, water systems and more. Now, thanks to a new federal designation, elections are infrastructure too. In fact, critical infrastructure, according to the Department of Homeland Security (DHS).

Like many other infrastructure sectors, elections are a system of systems. The image below is perhaps the best representation of that.

Just as with other critical infrastructure sectors, much of the focus is on securing segments and portions of the system, such as voting equipment or the voter registration database. But could the focus on individual parts of the system be shortsighted? The securing of individual systems is very important. However, the interconnected nature of the parts means that one area of vulnerability could threaten the whole.

As shown above, the complexity of elections systems is a challenge. This can be compounded by a diversified administration structure in states, where it is rare for a single entity to administer the whole system. “It’s important to address everything. The entire elections workflow is infrastructure and it is important to fully understand how one part of the system can impact all the others,” said Senator Greg Walker (R-Ind.).

Reassessing Elections Cybersecurity as Infrastructure

The critical infrastructure designation in January 2017 makes election infrastructure a federal priority and allows the Department of Homeland Security to deploy services to state and local election officials. Those services include: cybersecurity advisors, assessments, detection and prevention services, information sharing, and training.

A little more than a year after this designation, $380 million was appropriated from the federal government to the states as part of the 2018 Help America Vote Act (HAVA). As the chart below indicates, over 58% of the funds spent by Sept. 30, 2018 were allocated towards cybersecurity. Some examples of cybersecurity expenditures include creating a cybersecurity information sharing center and forming a cyber navigator/advisor program (Illinois), statewide election system assessments (Michigan), purchasing ALBERT sensors (Georgia) and hiring election and voter security IT professionals (Montana).

Reported Spending as of September 30, 2018
Category Amount

Percentage of Total Spent

Cybersecurity $18,283,414 58.20%
Voting Equipment $10,658,794 33.90%
Voter Registration System $2,107,074 6.70%
Other $312,093 1.00%
Election Auditing $19,881 0.10%
Communication $27,747 0.10%
Total $31,409,003 100%

Legislators and Cybersecurity in Elections Infrastructure

Legislators may not be using the phrase, “critical infrastructure,” to describe elections yet, but they do know that elections are critical, and they have introduced (or enacted) a variety of bills that seek to make elections more secure. “In light of attempts in 2016 and the ever-evolving sophistication of hackers, we must redouble our efforts to secure our systems,” said Delegate Mark Sickles (D-Va.). Of the 36 cybersecurity bills introduced in 2019, four have been enacted so far:

  • Indiana SB 558: Requires state and local election officials to use two-factor authentication to access the computerized voter registration list.
  • Indiana SB 570: Requires the secretary of state to establish proficiency standards to access the voter registration list and further defines the VSTOP—Indiana’s voting system technical oversight program. (Other states might be interested in creating their own version of this university-based program.)
  • Oklahoma SB 261: Requires county election officials to implement security protocols (physical and cyber) equivalent to other county agencies, and requires county officials to notify the state election board of any attempted or successful cyber-attack or intrusion on their system.
  • Virginia HB 2178: Requires the state board to create standards to ensure the security of the voter registration list and related technology. All counties and cities that use the related technology or voter registration system must be in compliance with the state standard.

What else can be done?

The treatment of elections as infrastructure may mean more cooperation between different levels of government, including federal agencies. “I don’t see any way around continued federal involvement. There is room for the federal government to grow relationships with election officials, especially with information sharing, without impinging on the duties of the states.” says Maurice Turner from the Center for Democracy & Technology. What could this look like? Hard to say, but we’ve come up with a few ideas that relate to how federal agencies and local/state officials may develop moving forward.

  • Dedicated Funding: Many states have established a dedicated revenue sources for other infrastructure, such as transportation. A dedicated and fairly consistent source of funds for the maintenance and upgrading of the elections infrastructure (i.e. voting equipment, software upgrades, training) would provide financial security and allow for multi-year planning for projects.
  • Federal Support in Financing: Although states received funding in 2018, it was a one-time inflow. In other sectors, the federal government often not only helps fund, but also helps local jurisdictions finance investments. The ability to use federal financing (often bonds) could allow cash-strapped states to pay for investments sooner and over the course of their useful life. With aging voting equipment and tight state budgets, the ability of jurisdictions to absorb and appropriate large upfront costs for new equipment is a hurdle.
  • System Standards: The establishment of minimum standards is normal in many other infrastructure areas. In elections, the closest equivalent is the Voluntary Voting Systems Guidelines, from the U.S. Election Assistance Commission (with VVSG 2.0 coming soon). These voluntary guidelines are the basis for testing most voting equipment. At this time, 38 states and the District of Columbia use some aspect of the federal testing and certification program. In many sectors, states must often adopt standards at least as stringent as the federal regulations.
  • Regular System Tests & Audits: DHS is already offering cybersecurity services to test elections systems. Those services include assessments, cyber hygiene scans, risk and vulnerability assessments and resiliency reviews. The continued availability of these resources and continued testing and auditing of the election infrastructure can be invaluable to state and local jurisdictions and is a model of federal support for state responsibilities.
  • Professional Certifications/Requirements: Many states offer training opportunities for election officials, but they vary state by state. Opportunities for election officials to pursue professional training in election administration and especially election security is sparse and expensive, and therefore ripe for development to bolster the knowledge and skills of election officials.

Regardless of whether the thoughts above are feasible or practical, it’s paradigm-shifting to think of elections as infrastructure. Critical infrastructure. The critical part cannot be understated. "Elections are the infrastructure of infrastructure," said Justin Levitt, a professor at Loyola Law School. "They’re the way we decide on everything else that we want to do together, as local communities and as a country. It’s long past time they got an Infrastructure Week of their own..."


Legislative Update

Since 18 state legislatures have concluded their 2019 legislative sessions, we wanted to take a look at some of the legislation that has been enacted on post-election audits and youth poll workers.

Post-Election Audits

Arkansas SB 524: Requires the state board of elections to audit the results of each general election. Arkansas joins 31 states and the District of Columbia that conduct a traditional post-election audit.

Georgia HB 316: Although part of a much larger bill, section 42 of HB 316 permits the secretary of state to conduct a risk-limiting audit pilot program in selected jurisdictions. After the pilot program, the secretary must report the findings of the pilot program and include a plan on how to implement risk-limiting audits statewide.

Indiana SB 405: Allows the secretary of state to designate a “variety” of counties to conduct a risk-limiting pilot program. SB 405 also establishes a “procedure audit program” that will inspect election documents and review procedures and processes used by election officials.

Oklahoma SB 261: Grants the secretary of the state election board the authority to require county election boards to conduct a post-election audit. The state board shall determine the method, timing and procedures of the audit.

Youth Poll Workers

Arkansas HB 1492: Amends the current law to allow election pages (high school students) who have attended training provided by the county board to assist election officials in more duties, such as checking in voters, assisting voters with instructions on how to use the voting machine and guarding the ballot box.

Maryland SB 364: Establishes an election page program. The program is intended to stimulate students' interest in the election process, provide assistance to election officials and assist elderly voters and voters with disabilities. A page must be at least 16 years old.


Worth Noting

New Ballot Tracking Tool

Microsoft recently unveiled a new, open-source software kit called ElectionGuard. The ElectionGuard kit would allow voters to track their ballots and can also allow election officials and third-party individuals verify election results. The kit, which was developed in conjunction with Galois, is available for free to election vendors.

Currently Unavailable

On Tuesday, May 7, the city government of Baltimore was brought to a screeching halt as it was subjected to a crippling ransomware attack. Among the departments affected is the Baltimore Board of Elections. Until services are restored, the Harford County Board of Elections, Baltimore County Board of Elections, and Maryland State Board of Elections are all stepping in to aid the city board. A similar attack in 2018 shutdown the city of Atlanta and according to one report at the time, could cost the city and taxpayers $17 million to respond and recover from the attack. As of May 29, 2019, some email services have been restored, but the total cost of the ransomware is expected to be at least $18.2 million.

Research Ahead

In a continued effort to make elections more efficient, provide evidence for policy decisions and improve voter confidence, MIT’s Election and Data Science Lab announced the 11 recipients of its 2019 New Initiative Grants. Topics range from automatic voter registration to post-election audits and from the expectations and reality of election reform to polling wait times. The full list of recipients and projects can be found here.

Voters Just Can’t Get Enough of Them

Nothing feels better than voting, except maybe receiving a sticker for doing so. To keep those good vibes going, Ohio Secretary of State Frank LaRose (a former state senator) created a contest for students grade 6-12, to design a sticker to be used for the next four years. Over 2,000 submissions were received from young Ohioans and after being narrowed down to a final three, the winner of the contest was Emily Legg, a senior at Teays Valley High School.

U.S. Election Assistance Commission Staffing:

Jerome Levato, who has been with the EAC since 2017, has been tapped as the new head of the testing and certification team. Two new members will be joining Jerome on the team: Jessica Bowers, a former executive at Dominion Voting Systems, and Paul Aumayr, a former Maryland election official. The team will continue to work with voting equipment and software vendors, and accredited equipment testing labs, to certify election systems.

New at NCSL

Given the increased attention ranked-choice voting has received this year, we have created a brand new webpage dedicated to the subject. Some recent moves by states this year has lead us to update our Funding Elections Technology page.

FYI on RLAs

Still looking to understand what exactly is a risk-limiting audit? Well, you are now in luck! As part of Democracy Fund’s Election Validation Project, Jennifer Morrell recently published two parts of her risk-limiting audit report: Knowing It’s Right, Part I - A Practical Guide to Risk-Limiting Audits and Knowing It’s Right, Part II – A Risk-Limiting Audit Implementation Workbook. These are two great resources for anyone looking to learn more about risk-limiting audits.

Preparing for 2020.

On May 29, 2019 Judd Choate, Colorado’s director of elections, and Matt Masterson, senior advisor for the Department of Homeland Security, participated in a webinar discussing a few easy(ish) and inexpensive(ish) ways states could undertake to prep for the 2020 elections.


From the NCSL Elections Team

Summertime usually means conference time and this summer is no different. The elections and redistricting team will be out in force this summer, discussing everything from the census to redistricting to the testing and certification of voting equipment. Speaking of conferences, we are rapidly approaching our 2019 Legislative Summit, Aug. 5-8, in Nashville, Tenn. This is our biggest annual event, and we’ll have lots on elections as infrastructure, how DMVs fit into elections and other hot topics.

And as always, let us know what’s on your mind, elections-related or otherwise.

Dylan Lynch and Wendy Underhill

Loading
  • Contact NCSL

  • For more information on this topic, use this form to reach NCSL staff.