The Virginia State Board of Elections voted Friday to discontinue use of all touch-screen voting machines throughout the state because of potential security vulnerabilities, forcing 22 cities and counties to scramble to find new equipment just weeks before voting begins for the November gubernatorial election. Behind closed doors at an emergency meeting in Richmond on Friday afternoon, the board heard about specific vulnerabilities identified after a cybersecurity conference this summer in Las Vegas, where hackers showed they could break into voting machines with relative ease. After the July Defcon conference, Virginia’s Department of Elections asked the state’s IT agency to review the security of touch screens still in use in the state. Details of that review were kept confidential, but they caused the elections board to speed up the end of touch screens, which were already scheduled to be phased out of Virginia elections by 2020.
Most Virginia localities — including the city of Richmond and Henrico, Chesterfield and Hanover counties — have already transitioned to optical-scan systems, in which voters fill out bubbles on a paper ballot that is fed into a scanner.
In a memo on touch-screen machines prepared for the board, the Department of Elections said the Virginia Information Technologies Agency, or VITA, found that “each device analyzed exhibited material risks to the integrity or availability of the election process.”
The password for a touch-screen machine used in Virginia was publicized after the July hacking conference, the memo said, and one report indicated that one vendor with machines in Virginia uses a single password for all machines. The memo also notes that, unlike optical systems, touch screens leave no paper trail that can be used in post-election audits.