higher education schools reopening covid

The companies that provide voting machines and other elections equipment advise lawmakers to avoid naming specific technology solutions in their election rules because tech is ever-changing.

Election Technology Providers Offer Advice on Cybersecurity

By Amanda Zoch | Sept. 10, 2021 | State Legislatures News | Print

Who runs elections in the United States? The easy answer is “the states.” More specifically, state and local election officials share responsibility for voter registration and voting, based on policies established by each state’s legislature.

Another set of experts who rarely get—and, in fact, do not want—the limelight are the corporations that provide technology and services to election officials. These companies may specialize in creating or maintaining voter registration databases, electronic poll books, polling place equipment, vote counting technology, ballot design and printing, electronic ballot delivery, tracking for absentee ballots, or some combination of these and other related tasks.

Whatever legislators decide, we want to be sure the outcome can be done securely, accurately and accessibly. —Sam Derheimer, Hart InterCivic

Representatives of many of these election tech providers were in Des Moines, Iowa, last month, for a meeting held in conjunction with the summer conference of the National Association of Secretaries of States. While they are competitors when it comes to the marketplace, if federal policy is at hand, they work together on the Subsector Coordinating Council to the Election Infrastructure Subsector, the newest “critical infrastructure sector” recognized by the Department of Homeland Security.

The SCC and its individual members are policy-neutral; they don’t have a horse in the race on voter ID, absentee voting rules and timelines, how voter registration is offered or any other policy question legislators might tackle.

“Whatever legislators decide, we want to be sure the outcome can be done securely, accurately and accessibly,” says Sam Derheimer of Hart InterCivic, a full-service provider in the elections sphere.

Because these folks know their onions, The Canvass asked them what advice they might offer to legislators. We’ve summarized their suggestions below.

Legislate the desired outcome, not the details.

Some states, by tradition, have bare-bones statutes and leave interpretation to the official who has rulemaking authority. (For elections, this is often but not always the secretary of state.) Other states tend to have very explicit statutes. The level of detail a legislator specifies in a bill may depend partly on the state’s pattern and partly on the bill author’s trust in the official who has rulemaking authority.

From the technology provider’s perspective, with all other things being equal, less is more. “Make sure that your policy approaches are neutral and nonideological to best serve all of the elections community with confidence,” advises Kay Stimson, of Dominion Voting Systems. “Neutral,” that is, in the sense of not prescribing how something is to be done, but rather setting a desired outcome—which could, potentially, be achieved through more than one approach.

“I’m deeply impressed by how many really great, well-read, tech-savvy legislators we see. And they are great allies when they work together with election officials,” Stimson adds.

An example: This year North Dakota replaced references to “electronic voting systems” with “voting systems,” a technology-neutral term that allows for multiple approaches.

Avoid naming specific technology solutions because tech is ever-changing.

Not naming a specific technology in statute is a derivative of the goal to “legislate outcomes, not details.” It’s worth highlighting on its own because “tech is changing so rapidly, you don’t want your choices in statutes,” Steve Trout, of VotingWorks, says. “Stick to high-level principles because otherwise you’re going to need to change that statute every year. If you put in the specs for an iPhone 1, you’re stuck and can’t move on to have the iPhone number we’re currently on.”

For instance, in its 2021 session, Louisiana reestablished the process for approving voting systems. The previous language called for touchscreen voting devices that included a voter-verifiable paper record of each vote; the new language specifies that a paper record—most likely the ballot—is required, without stipulating how it is to be created. The bill also creates a commission to oversee the selection of new voting systems.

Elections cybersecurity is trickier than cybersecurity elsewhere.

For bank transactions, it’s great that our systems know who is on either end of a transaction so errors can be tracked backward and fixed. With voting, the goal is to not track a specific ballot back to a specific voter (that’s what a “secret ballot” means, after all). That makes elections harder than banking, cybersecurity-wise.

Also, decentralization and the use of lay people in an intensely IT-related field both add to the intricacies of protecting against cyber intrusions. “The infrastructure is placed in the hands of grandma and grandpa, twice a year on average, and deployed across the nation in tens of thousands of polling places,” says Ed Smith, from Smartmatic, another full-service elections provider.

Because elections and the technology it takes to run them are unique, “so too should be the people tasked to protect it all from cyber threats,” says Chris Wlaschin, the VP of systems security for Election Systems & Software, one of the nation’s largest providers of elections equipment. “An expert who knows both elections and cyber is your best bet to protect your environment.”

Finding that expert isn’t easy. Some states are hiring “cyber navigators” at the state level to assist local election officials who may not have the required expertise. At least seven states have cyber navigators now; Illinois was first to make such an enactment in 2018.

Mailing ballots can be more difficult than mailing other items.

For most mail, “it’s a bummer if something is late but it’s not existential; if ballots are sent out a week late, that’s a real problem,” says Maria Bianchi, of Democracy Works, a not-for-profit technology group. The organization provides the Voting Information Project to states to help voters know how, when and where to vote, and Ballot Scout, a ballot-tracking system for absentee ballots that allows election officials to follow ballots through the Postal Service.

Mailing timelines matter, and so does the technology to produce and process those mail ballots. The COVID-19 pandemic created a larger demand for absentee/mail ballots in 2020, which in turn drove up demand for paper ballot tabulators—and for ballot stock. Ballots cannot be printed on just any type of paper—tabulators require heavier ballot stock, and the wrong kind of paper doesn’t work in the tabulators (a feature, not a bug). Planning for the right materials, machines and schedule is essential.

Supply-chain security came to the nation’s attention in 2020 for personal protective equipment—but it matters for elections, too.

In the last year, an understandable interest has surfaced in how “American” election technology is. In 2021, Texas enacted the first law to address this, requiring that all voting systems approved in Texas must be manufactured, stored and held in the U.S., with definitions of what those phrases mean. It states that all firmware and software must be installed and tested in the U.S. and calls for a feasibility study of requiring all voting system components to be made in the U.S. as well.

“My job forces me to deal with reality,” says Wlaschin. “And the reality is that voting systems, just like other technologies—some of which are the difference between life and death, such as a pacemaker or a defibrillator—rely on foreign-sourced parts in their hardware. These parts might be a screen, or plastic housing or other, more integral components. The bottom line is there are no voting systems made entirely in the United States. None. Many are assembled here. Many have the majority of their parts sourced from America. But to source 100% of components from the U.S. is not just a tall order, it’s likely an impossible one.”

What can legislators do? They can adopt a requirement that any technology used in their state is in accord with the latest voluntary voting system guidelines (VVSG 2.0) from the U.S. Election Assistance Commission and is tested by Voting System Test Laboratories, U.S. based companies accredited to test voting systems. The EAC also provides a list of manufacturers that are eligible to submit voting systems for federal testing and certification in the U.S.

Borrow ideas from your sister states—but adapt those ideas for your own state.

Over the years, election policies have spread from state to state—voter ID requirements, online voter registration and, more recently, requirements for postelection audits. This year, bills relating to ballot tracking and ballot drop boxes have become a trend.

Indeed, it can help to look at what other states have done. And yet bill drafting is a state-specific art, and “you can’t just take another state’s statute and put it in your own,” Trout says. Each state’s code has its own structure and nuances, and a given change in one area of code may have unforeseen consequences elsewhere.

Audits are hot—and they’re technology-based.

Two-thirds of the states require postelection audits, and many are moving toward statistically based audits, known as risk-limiting audits, at least on a pilot basis. In 2021, Alabama, Kentucky and Texas all enacted audit laws, and New Hampshire established a committee to study postelection audits. At NASS’s summer meeting, the organization released postelection audit recommendations.

“Audits are going to be the hot topic for some time to come,” Stimson says. “It’s not just how to do them, and what to audit, but the who and the when.” Many of the details relate to technology. Are paper ballots used? Is a cast-vote record (a spreadsheet-like list of all votes counted, without a trace to who voted of course) available? Are the paper ballots easily retrievable if needed for the audit? Does the state want to make ballot images (again, without any record of who voted them) available to the public? Election officials and the companies that support them can answer these questions—and so can experts in the nonprofit sector. See the Knowing It’s Right guides to risk-limiting audits; the author, Jennifer Morrell, may be able to provide technical assistance at no cost to the state.

Election technology providers can be helpful before drafting legislation begins.

Legislators know to go to subject matter experts when developing their policy ideas. They may not think of election technology providers as similar experts, but they could.

“Bills are written by people with an interest in the voter experience, which is great,” says Bianchi, of Democracy Works. And yet, “If you aren’t thoughtful about the ways state and local election administrators will be implementing the new law, you can end up creating legislation that falls short of the intended impact.”

Bianchi, Stimson and other providers recognize that a state’s election officials are the obvious go-to people when a new idea is heading toward bill drafters. Those officials will provide the best “how it works” information—and they may connect legislators with technology providers for details on how technology can help a state reach its policy goals.

Amanda Zoch is an NCSL policy specialist and Mellon/ACLS Public Fellow.

This story was first published in the September 2021 edition of “The Canvass,” NCSL’s election policy newsletter.

Additional Resources