Elections Cybersecurity: Striking a Balance
Over the past few years, local, state and federal officials have persistently pursued securing elections. It has been a critical effort undertaken by states, who have worked tirelessly to do everything they can. The race to secure election systems is often a game of catch-up and playing defense. And the odds are stacked against the defense.
But in the pursuit of complete cybersecurity, it can be difficult to remember that there are two sides to every coin. And on the reverse side of security, is access. “A perfectly secure system is one no one can use,” says Maurice Turner from the Center for Democracy and Technology. Two oft-discussed areas where it’s necessary to balance security and access are voting equipment and internet voting. While not the only two areas, these two arenas have seen considerable national debate.
Voting Equipment/Paper Ballots
Voting machines have faced much of the brunt of security concerns over the past years. The most common voting equipment under fire are direct recording electronic (DREs) voting machines. These machines are often a touch screen device that directly records votes into the computer memory. Some of these machines can produce a paper audit trail, but many do not use paper at all.
Paper is a common security answer to challenges posed by voting equipment. Indeed, paper ballots can be a reliable backup, easily reviewed and retabulated if needed. Many postelection audits require paper ballots to conduct because they are dependable. And many are heavily pushing for a return to paper ballots. But Turner has concerns about the return to paper ballots, “It simplifies the security threats and accessibility issues," he says.
Paper ballots are not always accessible for all voters. Voters with dexterity issues or visual impairments, for example, may find reading and marking paper ballots infeasible. A recent report by Rutgers University estimates that 14.3 million citizens with self-reported disabilities voted in the 2018 midterm election. Further, when examining reasons why voters who were registered did not vote, 40.9% of voters with disabilities did not vote due to “illness or disability (own or family’s)”. For voters without disabilities, only 8% did not vote for that same reason. If we add these individuals to the growing number of older Americans who may also share dexterity, visual or hearing challenges, access and ease of voting may be the focus of a large and active portion of the voting population.
Strides have certainly been made in this area since the Help America Vote Act (HAVA) of 2002. “We have to be careful to not throw the baby out with the bathwater. Machines are better now than they were 15 years ago. We need to keep moving forward to make equipment more accessible and more secure,” says Michelle Bishop, voting rights specialist from the National Disability Rights Network.
Internet Voting
Internet voting was a dream of many in the early 2000 and 2010’s but interest has declined due to security concerns. The most common form of internet voting is the electronic transmission of ballots over the internet via email, fax or web portal. The Military and Overseas Voters Empowerment Act (MOVE) requires states to provide blank ballots to uniformed military members and overseas civilians (UOCAVA) voters in at least one electronic format. The return of voted, electronic ballots is often limited to UOCAVA voters. Some states further limit this option to military members serving in Department of Defense designated “imminent danger zones.” If these options are vulnerable why are they allowed? The answer may be access.
Military and overseas voters are often unable to vote via traditional methods. Precinct polling places aren’t available overseas and foreign mail services may be unreliable and unable to send and return ballots in a timely manner. A survey of overseas civilian voters in 2016 found that 33% believe their local (foreign) mail service was less reliable than the United States Postal Service. Noting that traditional mail is not always dependable or timely, Jennifer Morrell, elections consultant and former local election official, says “If we don’t look at improving the electronic return of ballots, we will get caught unprepared. Email and fax are just not secure enough.”
West Virginia most notably began a pilot program testing the applicability of utilizing blockchain for overseas voters, focusing on deployed military members. While facing some backlash for this program, the West Virginia Secretary of State’s webpage cites the difficulty of uniformed members to participate in elections using paper ballots and traditional mail systems. Two other jurisdictions have piloted this system as well, the city of Denver and Utah County, Utah.
Even accessing election webpages can be difficult from overseas. Some states have implemented security protocols that block web traffic from foreign countries from accessing voter registration websites. Although designed to prevent illegitimate use of their webpages, it can also prevent legitimate use and can impact UOCAVA voters most.
Access and Security
Elections are the underpinning of this nation. The need for securing elections is paramount, particularly regarding voter confidence in the system. But so too is access and participation in the system. “State legislatures have a lot of power here. They are the largest customers of election equipment, they can demand better systems for both security and accessibility,“ says Bishop. There’s likely to be no perfect system. For policy and decisions makers any choice will require tradeoffs. The line between security and access is thin and states will need to find that balance in their own way.
From the Administrator's Perspective
George Stern serves as the Clerk and Recorder of Jefferson “Jeffco” County, Colo. Jeffco, “Gateway to the Rocky Mountains,” is the fourth most populous county in Colorado and has the distinction of being one of a handful of counties in the U.S. that borders 10 other counties. It is home to numerous state and national parks, the Colorado School of the Mines (the oldest school in the state of Colorado) and the Coors Brewing Company.
Q: How did you get into the field of election administration?
I ran for and was elected Jefferson County Clerk and Recorder last November, so I now oversee elections in Colorado’s swing county. Prior to taking office, I worked as an attorney in both the private and public sectors. My public sector work included my passions of election protection and voting rights, which was a big reason I decided to run for clerk.
Q: What about elections do you find interesting or unique?
Running elections is exciting! A lot of it is like a start-up: we hire, train, and deploy several hundred employees in a short amount of time; we contract for and use diverse spaces all over the county for vote centers, taking them from empty rooms to fully-outfitted election locations; we design, proof, and distribute hundreds of thousands of ballots and then receive those ballots back and count them; we retain attorneys, security, IT staff, and facilities workers to make it all run smoothly; and we educate the public and press about everything that’s going on. Not to mention, we get to coordinate with everyone from national campaigns and press to local entities and candidates all at the same time. And then we take a brief break and do it all again for the next election a few months later!
Q: What are some of the election issues that you see right now in your jurisdiction or state? How are you tackling these challenges?
Election integrity is at the forefront of everyone’s mind, so we’re doing everything we can to ensure top-notch election security. We’ve worked closely with the Department of Homeland Security to assess the security of our physical spaces, and with cybersecurity experts to improve our IT security. We’ve also enhanced our security trainings for our full-time staff and temporary election judges. To help reassure people about the integrity of our elections in Jefferson County, we’ve embraced complete transparency: We conduct regular tours of live elections for the public and press so they can see all of the checks in our system, and we’ve written OpEds, regularly post to social media, and frequently speak to local groups about the election process.
Q: Are you and your office doing anything different this year to prepare for the 2020 election cycle?
In addition to the increased security measures mentioned above, we’re also working as hard as we can to dramatically expand election accessibility. Thanks to financial support from our Colorado legislature, our county will be doubling the number of drop boxes where voters can turn in their mail ballots (drop boxes are the preferred method of voting for 75% of Colorado voters), and we’re expanding the number of in-person vote centers, where we have accessible voting machines and same-day voter registration. Additionally, we’re adding election judges to help manage the anticipated increase in voter turnout, and we’ll be working to educate the public about their voting options in our ongoing effort to break voter turnout records (71% of Jefferson County voters participated in 2018).
Q: In regard to your office and staff, what are you most proud of when running elections?
My team. They are always professional, nonpartisan, detail-oriented, and helpful—the qualities essential in great election administrators.
Worth Noting
U.N. Postal Treaty
On Sept. 25, the United States agreed to stay in the Universal Postal Union, a U.N. body that regulates international mail service. The U.S. had been threatening to leave the treaty due to concerns about the sliding fee scale that allowed manufacturers in developing countries such as China to pay less to ship small packages. The new deal allows the U.S. to determine its own postal fees starting in July and includes $40 million from the U.S. to increase security against international shipments of drugs and dangerous goods. This also means that for the upcoming 2019 November elections, ballots sent to and returning from overseas voters should travel unhindered.
QR Banned in Colorado
Colorado just became the first state to ban QR (“quick response”) codes on ballots. According to Secretary of State Jena Griswold, prohibiting QR codes, as well as keeping voting machines disconnected from the internet, will reduce the risk of election interference. When used on ballots, QR codes contain the voters’ selections, but prevent voters from confirming that their votes have been properly counted as a barcode cannot be read by humans.
Long Waits for Voters in Black Neighborhoods
A recent study found that voters in predominately black neighborhoods spend more time waiting at polling places than those in predominately white neighborhoods. According to the study, the average voter spends 19 minutes waiting to cast a ballot, but voters in largely black neighborhoods were 74% more likely to wait over 30 minutes. Another new report found that polling places across the South have been closing following the Supreme Court’s decision to overturn part of the Voting Rights Act. Areas with the highest numbers of shuttered polling places were more likely to have racially diverse populations.
Stolen Poll Computers
When you hear about the possible theft of voter registration information, you may think of a cyber-incident. However, that is not what happened the night before the polls were to open for a city school board special election in west Atlanta. Two express poll computers were stolen from the precinct. While the computers are password protected, they contain the names, address, birth dates and driver’s license information for every voter in the state. It is unlikely that this was a targeted theft of information.
Old Election Equipment Gets a New Life
What would you do with outdated election equipment? In Indiana, the Vigo County Election Board decided to donate 49 five-year-old laptops to community non-profits, including preschools, churches, and the Swope Art Museum. The laptops were previously used as e-poll books. Side note and elections trivia fact: Vigo County is a bellwether, having voted for every winning presidential candidate in more than a century – except Adlai Stevenson in 1952 and William Jennings Bryan in 1908. It is surpassed only by Valencia County, N.M.
Monthly Dose of Cybersecurity.
New Jersey—Who will bear the brunt of a 2020 election hack? County election officials, and a group from New Jersey recently met to practice responding to various cyber-attack scenarios. Over 12 states have held similar exercises for their county officials, often with the help of the Department of Homeland Security. These scenarios, or “war-games,” provide officials an opportunity to develop, rehearse and receive feedback on their response plans.
District of Columbia—Senate Majority Leader Mitch McConnell announced that he supports a measure to provide $250 million to improve election security. This funding would come as an amendment to an appropriations package, and it would help states update their voting systems and prevent foreign interference.
CISA—At the second annual Cybersecurity Summit hosted by the Cybersecurity and Infrastructure Security Agency (CISA), CISA Director Christopher Krebs opened the summit by arguing for a more moderate approach to election security. He acknowledged cyberthreats, particularly ransomware, while also warning attendees that “we have to take the hysteria out of the conversation” because it harms voter confidence.
Michigan—Michigan just hired its first-ever election security specialist. This new position is, according to Bureau of Elections spokesperson Shawn Starkey, "dedicated to coordinating Michigan’s overall election security plan, and working with state and federal partners to assess, train and communicate with our local election officials on election security best practices.” Ashiya Brown, the new hire, has a background in auditing and database management.
From the NCSL Elections Team
It is with some sadness that this edition of the Canvass will be my last as I will be leaving NCSL. I have greatly enjoyed being part of the Elections and Redistricting team and working on this excellent publication. It has also been a pleasure meeting and working with many of you. But fear not, the Canvass is in good hands and will return next month.
And as always, let us know what’s on your mind, elections-related or otherwise.
Dylan Lynch