In a report earlier this year, the Senate Intelligence Committee concluded that elections systems in all 50 states were likely targeted by foreign agents in 2016. Researchers also found evidence pointing to widespread manipulation of social media to spread misinformation prior to the 2016 elections.
But while political scientists debate the possible impact that any of this might have had in influencing the final tallies, the disclosures have added impetus to efforts among lawmakers and state and county election authorities to better protect their voting systems.
Their efforts include a range of security-centric initiatives, including a greater use of paper ballots; risk-limiting audits, or RLAs; and new voting equipment, election systems are committed to an overarching goal – ensuring voter confidence in election outcomes.
“Democracy runs on losers willing to admit they lost, and if you have losers who think they’ve been wronged, democracy breaks down,” said Max Hailperin, an expert on election security and professor emeritus of Mathematics, Computer Science and Statistics at Gustavus Adolphus College in Saint Peter, Minnesota.
With that in mind, the U.S. Congress last year allocated a total of $380 million, divided among states and territories, for the sole purpose of improving election security.
But some experts say the magnitude of the job ahead will take even more funding.
In a report earlier this year, the Senate Intelligence Committee concluded that elections systems in all 50 states were likely targeted by foreign agents in 2016.
“This money was a nice down payment, but it doesn’t pay for the most important part of election security” – helping states convert from paperless to paper-based voting equipment, key to creating a paper-trail and verifying election results, noted Liz Howard, counsel for the Democracy Program at the Brennan Center for Justice at the NYU School of Law.
For example, Pennsylvania provides each county with the option of using paper-based voting or direct recording electronic voting equipment, commonly referred to as DRE. The conversion cost could run as high as $150 million, including replacing aging equipment, said Howard.
“States cannot be expected to fight foreign enemies without investment from the federal government,” according to Howard, adding that she hoped that Congress would provide additional funding. “Election security is national security.”
Howard and other experts argue that paper-based voting enables authorities to conduct RLAs, the gold standard in certifying election outcomes. These audits use statistical principles and methods to minimize the possibility of validating an incorrect election outcome.
RLAs involve physically reviewing fewer ballots than a traditional percentage-based audit yet “achieve the same level of confidence in the election results,” said Miguel Nunez, deputy director of the Rhode Island Board of Elections.
In 2017, Rhode Island passed statewide legislation requiring RLAs to be conducted after recounts but prior to certifying the election’s results. The state plans to conduct its first official RLA after the Presidential Primary in April 2020; the audit isn’t expected to take more than three weeks.
Law enforcement personnel, members of the National Guard and other disaster management experts are joining together to brainstorm strategies for overcoming breaches.
Despite the anticipated growing reliance on RLAs, they have their challenges. Some election agencies may not have the sufficient number of experts needed – in complex math, statistics and software – to administer these audits.
For its part, Rhode Island, Nunez noted, turned to outside election groups and academic institutions for RLA assistance, including Worchester Polytechnic Institute, the University of Rhode Island, Verified Voting, the Massachusetts Institute of Technology, the Brennan Center and the Democracy Fund, as well as the federal Election Assistance Commission.
According to Nunez, Rhode Island has ensured the validity of election results in other ways, as in requiring precinct tabulators to use a complex password, which the state’s Board of Elections has no knowledge of until the morning of the election; and using electronic poll pads that employ state-of-the-art encryption, which Rhode Island’s National Guard has reviewed for best practices.
Beyond Rhode Island, election systems across the country are also stepping up their security activities.
Indeed, law enforcement personnel, members of the National Guard and other disaster management experts are joining together to brainstorm strategies for overcoming breaches. Plus, a growing number of security operation centers, or SOCs, which monitor election systems for threats, are sharing initiatives nationally through such institutions as the Elections Infrastructure Information Sharing and Analysis Center and the Center for Internet Security.
But while analysts note that a lot of progress underway, more work remains. For instance, a desktop invaded by ransomware, could still do reputational harm to an election system – even if the infiltration doesn’t compromise it one iota.
From Hailperin’s vantage point, more states need to implement multi-factor authentication in order to prevent hackers from penetrating entities that have legitimate access to election systems, like cities, counties, courts and motor vehicle departments.
“All these connections need to be secured,” said Hailperin. “Otherwise, an attacker could invade the system through the weakest unit.”