Download the Full Report (PDF) In October 2017, Rhode Island Governor Gina Raimondo signed into law a groundbreaking election security measure. Now, state law requires Rhode Island election officials to conduct risk-limiting audits, the “gold standard” of post-election audits, beginning with the 2020 primary. A risk-limiting audit (“RLA”) is an innovative, efficient tool to test…
A group of guys are starring into a laptop, exchanging excited giggles. Every couple minutes there’s an “oooooh” that morphs into an expectant hush. The Las Vegas scene seems more like a college dorm party than a deep dive into the democratic process. Cans of Pabst Blue Ribbon are being tossed around. One is cracked open and spews foam all over a computer keyboard. “That’s a new vulnerability!” someone yells. The laptop that’s drawing the most attention in this moment is plugged into a voting machine that was used just last year in Virginia. “Right now, we’re trying to develop a way to remotely control the voting machine,” said a hacker named Alex. He’s seated next to Ryan, and like a lot of the hackers at the Defcon conference, they didn’t feel comfortable giving their full names. What they’re doing — messing around with voting equipment, the innards of democracy — falls into a legal gray area. The voting machine looks sort of like a game of Operation. The cover is off and dozens of cords are sticking out, leading to multiple keyboards and laptop computers. No one could get that kind of access on a real Election Day, which is when most people come into contact with voting machines for a few minutes at most. Election supervisors are quick to point out that any vulnerabilities found under these conditions aren’t indicative of problems that actually could be exploited during an election. All the same, hackers like Alex and Ryan say the work they’re doing is important because it’s the highest profile public investigation of the equipment U.S. citizens use to vote. And if they can exploit it, so could government-sponsored specialists working for another nation’s intelligence agency.
The Federal Election Commission is essentially toast. Last week, Matthew Petersen, its Republican vice chairman, resigned, leaving the six-member panel with only three members — one person short of the requisite quorum. “Without a quorum, certain Commission activities will not take place,” said FEC commissioner Caroline C. Hunter in a statement. “For example, the Commission will not be able to hold meetings, initiate audits, vote on enforcement matters, issue advisory opinions, or engage in rulemakings.” In one of his last actions, Petersen, along with Hunter, also a Republican, stopped the FEC from using its powers as intended. They blocked an investigation into a report that Alexander Torshin (a Russian central banker close to Russian President Vladimir Putin) and Maria Butina used the NRA as “a conduit” to illegally funnel money between Russia and the Trump campaign. Butina later pleaded guilty to conspiring to act as an unregistered foreign agent of the Russian state. She was sentenced to 18 months in prison. Now the FEC’s dysfunction is tumbling toward disaster. The regulatory agency charged with enforcing campaign finance laws in federal elections has been kneecapped during a general election season already under a sustained attack by enemies both foreign and domestic.
In May, other members of Florida’s congressional delegation and I were briefed for 90 minutes in the U.S. Capitol by officials from the FBI and the Department of Homeland Security regarding Russia’s interference in the 2016 election. I sought the briefing after then-special counsel Robert S. Mueller III’s report showed Russia had probed and even pierced election networks in Florida, among the most closely contested states in U.S. politics. Although our briefers supplied new details, much remained unknown. What I do know, I can’t talk about. Why that’s the case is itself a mystery. The Mueller report noted that Moscow’s meddling involved three lines of effort, and Florida was a target of each. First, a Russian entity conducted a social media campaign to sow discord and help then-candidate Donald Trump, including by organizing pro-Trump rallies in Florida. Second, a Russian intelligence agency — the GRU — hacked computer accounts connected to Hillary Clinton’s campaign. As part of this effort, it published Florida-related data stolen from House Democrats’ campaign arm. Finally, Mueller reported, the GRU sought to infiltrate computer networks involved in the administration of elections, which could enable Russia to alter voter registration databases or perhaps vote tabulation systems. That would be tantamount to an act of war, with malware rather than missiles as the weapon of choice. While Russian cyber actors cast a wide net, Florida’s county-based election supervisors were a focal point.
Public confidence in the integrity and security of our elections is essential for democracy to be a trusted means of governing, and that very confidence is now under unprecedented attack by foreign adversaries. A newly released report from the Senate Select Committee on Intelligence, as well as recent congressional testimony by Special Counsel Robert Mueller, indicated that in 2016 Russia attempted intrusions into the election infrastructure of all 50 states. In one of the most dramatic moments of his testimony, Mueller said that Russia is at it again “as we sit here.” With just 15 months until the next round of major state and federal elections, and as Congress continues to debate the sources of and steps to combat the cyberattacks, it is sobering to consider the effect that a deep erosion of public confidence in the election process could have. It would be devastating to Americans’ faith in our democracy and the legitimacy of our elected government. For these reasons, state and federal leaders must act with urgency to secure our elections. As co-chairs of the committee convened in 2016 by the National Academies of Sciences, Engineering and Medicine to address voting security, we concluded that the nation should immediately take three actions to strengthen the safeguards for election systems against the mounting cyberthreats.
The 2,271 people eligible to vote in Chattahoochee Hills may feel like they’re stepping back in time whenever they cast a ballot for the City Council or mayor. In much of the rest of the state, electronic voting machines are standard for each and every election. But in Chattahoochee Hills and about 70 other cities, residents vote using paper ballots. In many of those cities, the votes are even tallied by hand.On election night in Chattahoochee Hills, residents can pile into City Hall to watch City Clerk Dana Wicher and a handful of poll workers open a locked metal ballot box and call out the names on each ballot. Like keeping score at a baseball game, they can even tally along.As the debate rages over whether Georgia’s new touchscreen-and-printed-ballot voting system is secure, voters in cities across the state will continue to fill out their ballots with pens this November. They won’t use any modern technology during their municipal elections. State law exempts cities from having to use the uniform voting system mandated for county, state and federal elections.“Folks like coming in and doing the paper ballots. It’s that old-town community feeling,” Wicher said. “There is some suspense. There’s probably more transparency with the paper system.”
The majority of voters in Cobb County will be using hand-marked paper ballots to vote in the Nov. 5 municipal elections, the Cobb County Board of Elections and Registration says. The Cobb board is piloting the paper ballot method for the elections it is managing in November for the cities of Smyrna, Kennesaw, Powder Springs and Austell. Acworth is managing its own municipal elections this year, using its existing paper ballot system, and Marietta is not holding elections in November because none of its elected members are up for re-election. In the four Cobb cities where the board manages elections, the hand-marked paper ballot trial will be conducted on Nov. 5 and in any subsequent runoffs as an extra safeguard to address concerns and any surprise problems associated with the statewide switch to new electronic voting machines in 2020, the board says. This kind of paper ballot system has to be used by Georgia if its new electronic voting machine system is not fully implemented and operational by the March 24, 2020, presidential primaries, according to a federal judge’s order. The Cobb trial is aimed at testing and refining if necessary a voting method which could be used in case of a problem with the new voting machines, which are supposed to be in place across the state for the March elections.
The St. Louis County Board of Elections unanimously voted Tuesday to shift toward using paper ballots and away from touch-screen voting machines. The elections board is moving forward with a $6.9 million contract with Hart Intercivic eSlate to provide new voting machines and software that primarily run a paper ballot system. The new apparatus is expected to be in place for the Nov. 5 election. A small number of touch-screen machines — one per polling station — will continue to be available for people with disabilities, said election board chair Sharon Buchanan-McClure. It’s unclear how many machines were purchased or other details, since the contract was not immediately provided Tuesday. The board held a closed-door meeting to discuss its voting machine options. Then, it opened the meeting to take the vote on the contract without any public discussion about its decision.
The Montana Secretary of State’s office announced Tuesday more than $1.3 million in money for counties to update their voting equipment. The money comes from a federal Help American Vote Act and is matched with county funds. Counties will be able to purchase new Express Vote voting equipment with the funding. “This is a big step in the right direction for counties to upgrade election technology that strengthens Montana’s election security ahead of 2020,” Secretary of State Corey Stapleton said in a press release announcing the funding. The new equipment is meant to ease voting access for people with disabilities. However, at a meeting of the State Administrative and Veterans Affairs hearing Tuesday, Beth Brenneman, attorney for Disability Rights Montana, said that because of how the Express Vote machines function, they may present some issues for voters who are blind. Joel Peden, advocacy coordinator with the Montana Independent Living Project, voiced more concerns to the interim committee about access to voting for those with disabilities. He said some machines, either new or old, don’t provide enough privacy for voters to feel comfortable their vote is secret.
Members of Pennsylvania National Guard’s Cyber Defense Team met with Pennsylvania Acting Secretary of the Commonwealth Kathy Boockvar to discuss current mutual projects, including election security, in early August during a Pennsylvania State Department orientation of the Pennsylvania National Guard’s capabilities and assets which included a tour of Fort Indiantown Gap, Pennsylvania. “This visit covered a variety of topics,” explained Maj. Christine Pierce, defensive cyber operations team chief. “We have been working with multiple Pennsylvania state agencies to provide a variety of services and we were excited to assist the Pennsylvania Department of State with the 2018 midterms as well as other cyber requirements.” Pennsylvania National Guard’s Cyber Defense Team provides comprehensive cyber defense services such as: vulnerability assessments, critical infrastructure assessment, penetration testing, and network monitoring. Network monitoring assistance was provided to the Pennsylvania State Department during the 2018 midterm elections. The team is preparing to assist the Pennsylvania Department of State during the 2020 elections.
A new report recommends how to adopt a system for auditing election results required in Rhode Island. Common Cause, Verified Voting and The Brennan Center for Justice at NYU School of Law released the report Tuesday. They helped the state design and test the risk-limiting audit system this year. Rhode Island will first use risk-limiting audits for the 2020 presidential primaries. There are three ways to do the postelection audit. The report recommends a ballot-level comparison because of its efficiency, transparency and relatively predictable cost. That type of audit would compare the vote on an individual ballot to the machine’s recording of the vote on that ballot, which requires the fewest number of ballots to be examined. The other methods, ballot polling and batch comparison, compare more ballots to totals produced by the machines and require the examination of far more ballots, John Marion, executive director of Common Cause Rhode Island, said Tuesday.
A Wisconsin Elections Commission security official is expressing concern that outdated operating systems are being used by local elections clerks across the state, raising the prospect of foreign interference in Wisconsin’s elections ahead of the 2020 presidential race. In a memo, Election Security Lead Tony Bridges details how a number of local clerks are using Windows XP or Windows 7 on office computers to access the WisVote voter database. According to Bridges, failure to maintain an up-to-date operating system poses “a tremendous risk.” Security patches on Windows XP have not been supported since 2014, while Windows 7 will reach its end-of-life cycle in January 2020, meaning Microsoft will no longer provide free security updates. Bridges pointed to a recent cyberattack in Georgia that brought down systems across Jackson County and warned a similar attack could “dramatically impact voter confidence in the electoral process” in Wisconsin.
Russian interference in the 2016 U.S. presidential election rattled America’s next-door neighbor so badly that Canada spent the last three years developing the most detailed plan anywhere in the Western world to combat foreign meddling in its upcoming election. But with the country’s national campaign to begin in a matter of weeks, one question remains: Will the efforts pay off? Prime Minister Justin Trudeau’s government passed new transparency rules last year for online political ads that run on platforms including Facebook and Twitter — further than what’s required in the U.S. It ordered the country’s usually tight-lipped intelligence services to go public about foreign threats. Canada also housed a G-7 project to share the latest intelligence between allies about possible foreign disinformation and created a non-partisan group to warn political parties and the public about outside interference. “The way the Canadians have responded to the problem of technology and democracy is much more impressive than what we’ve seen in Washington,” said Ben Scott, a former Hillary Clinton official, now based in Toronto, who has tracked disinformation campaigns in elections across the West. “Pound for pound, Canada is way ahead of the U.S. in terms of policy development on these issues.”
Senior civil servants giving evidence to the House of Lords Committee on Democracy and Digital Technology today gave insight into cross-Government work being carried out to monitor interference, disinformation and threats during elections – including the creation of an ‘election cell’ on the day of voting. Natalie Bodek, the acting deputy director of the elections division within the Cabinet Office, and Sarah Connolly, director of security and online harms at DCMS, both shared insights into how the government is collaborating across departments and agencies, as well as with social media giants, to monitor interference. Defending democracy from misinformation and digital interference has become a huge area of concern for governments across the world. Whilst no evidence has been found of online foreign interference in UK elections, it has been highlighted as a top priority by senior politicians and experts. Evidence on the topic has been collected by Parliamentary committees for some time now. A Commons Select Committee recently said that the “UK is clearly vulnerable to covert digital influence campaigns”.