Election security a high priority -- until it comes to paying for new voting machines

When poll workers arrived at 6 a.m. to open the voting location in Allentown, N.J., for last November’s gubernatorial election, they found that none of the borough’s four voting machines were working. Their replacements, which were delivered about four hours later, also failed. Voters had to cast their ballots on paper, which then were counted by hand.

Machine malfunctions are a regular feature of American elections. Even as worries over cybersecurity and election interference loom, many local jurisdictions depend on aging voting equipment based on frequently obsolete and sometimes insecure technology. And the counties and states that fund elections have dragged their heels on providing the money to buy new equipment.

A ProPublica analysis of voting machines found that over two-thirds of counties in America used machines for the 2016 election that are over a decade old. In most jurisdictions, the same equipment will be used in the 2018 election. In a recent nationwide survey by the Brennan Center for Justice, election officials in 33 states reported needing to replace their voting equipment by 2020. Officials complain the machines are difficult to maintain and susceptible to crashes and failure, problems that lead to long lines and other impediments in voting and, they fear, a sense among voters that the system itself is untrustworthy.

Voting machines are over a decade old in most of the country

The first year voting machines in the 2016 election were used.

Notes: Does not include accessible voting equipment for the disabled, which tends to be even older. In Connecticut, Maine, Massachusetts, New Hampshire, Rhode Island, Vermont and Wisconsin, voting machines are acquired and maintained by towns and cities. Data is aggregated to the county level and shows the median age of used machine in each county. Colorado, Oregon and Washington are vote-by-mail states. Data shows their central counting equipment. Otherwise, a county’s primary polling place equipment is shown. Source: Verified Voting (Kate Rabinowitz/ProPublica)

“Today’s voting systems are not going to last 70 years, they’re going to last 10,” says U.S. Elections Assistance Commission Commissioner Matt Masterson. While previous generations of voting equipment, lever machines and punch cards, had hardware that could be relied on for decades, today’s technology becomes outdated a lot faster.

While election equipment needs to be replaced more often, election administration remains a low funding priority, a ProPublica review of state and local budgets nationwide found.

In 2017, Utah appropriated $275,000 to aid counties in purchasing new voting equipment, but $500,000 to help sponsor the Sundance Film Festival. A few years earlier, Missouri allocated $2 million in grants to localities to replace voting equipment, while increasing the Division of Tourism budget by $10 million to $24 million.

In Allegheny County, Pa., home to Pittsburgh, this year’s Division of Elections budget is $6.1 million. The budget of the county’s Parks Department is nearly three times as big. Across the state in Luzerne County, the Bureau of Elections budget is just under $900,000, while the Buildings and Grounds Department has a budget of $1.4 million.

“Election officials are low on the totem pole, budgetwise,” says Masterson. “A lot of times it’s you or a new gazebo or improvements to the local golf course.”

The cost of new voting equipment is typically many times larger than election administrators’ annual budgets. In both Allegheny and Luzerne counties, local officials estimate new equipment would be roughly four times the cost of their annual elections budget. Neither county has ticketed funds to make such large capital purchases.

Even where voting machines are functional, their age can contribute to errors and confusion on Election Day. During the 2016 presidential election, aging machines contributed to scattered reports of “vote flipping” in Georgia, Nevada, North Carolina, Pennsylvania, Tennessee and Texas.

Flipped votes occur when a voter selects one candidate but the voting machine shows a different selection. Voters are encouraged to check, and if necessary correct, votes before completing their ballot, but flipped votes can cause confusion and charges of rigging. Larry Norden of the Brennan Center says flipped votes often aren’t evidence of rigging or hacking, but age. Older machines have more fickle calibrations and the glue attaching the screen to machine wears, resulting in poor alignment.

The reason that so many voting machines are nearing their end dates simultaneously is in part due to the 2002 Help America Vote Act. Following the Florida ballot-counting controversy in the 2000 presidential election, Congress provided over $3.6 billion in funds to states and territories to upgrade election systems and improve election administration. HAVA also established minimum standards for voting systems and election administration, and created the Elections Assistance Commission to help states design systems that complied with the new law.

Proportion of HAVA funds remaining. Note: Arizona, Delaware, Iowa, Indiana, Maryland, North Carolina., South Carolina, Vermont and Utah data as of September 2015. All other states as of September 2016. Source: U.S. Election Assistance Commission. (Kate Rabinowitz/ProPublica)

HAVA, which prompted a flurry of upgrades, was the first time the federal government provided funds to states for election systems. It was also the last.

As their current stock of voting equipment ages, few states have unspent HAVA grant money left. Ninety-one percent has been spent. States with significant remaining funds cannot necessarily use it to buy voting equipment. Massachusetts, with the largest percentage of unspent funds -- 57 percent -- has slated the remaining money for a new voter database. New Hampshire is using its remaining funds as a maintenance endowment. In the past four years, only two states have provided sufficient funds, outside of HAVA, to completely replace old voting equipment.

While elections may be the cornerstone of a functioning democracy, funding them is an uphill battle. A 2014 report by the Presidential Commission on Election Administration reported that election administrators viewed themselves as the “least powerful lobby in state legislatures and often the last constituency to receive scarce funds at the local level.”

In 2015, The Brennan Center estimated that 43 states, along with the District of Columbia, used polling place machines that were no longer manufactured. Wendy Underhill, director of elections and redistricting at the National Conference of State Legislatures says, “Some voting equipment today works with old operating systems -- Windows XP or Windows 2000 -- and data storage devices we wouldn’t even know what to do with today.”

Finding the necessary software and hardware has election administrators sifting through technology graveyards. In Louisiana, machines that have been taken out of service are salvaged for parts. To find parts for Minnesota’s outdated voting equipment, Deborah Erickson, director of administrative services for Crow Wing County, told a Minnesota House committee, “The best answer to that is eBay.”

Buying machines online from non-certified vendors can heap additional security risks on top of the risk already posed by antiquated, vulnerable equipment. For over a decade, experts have warned of the risks of voting machines that store all information electronically, because voters cannot verify their votes and there’s no way to properly audit these machines.

A recent report on election security by the Center for American Progress says “conducting elections with paper-based voting systems is one of the most important steps states can take to improve election security.” Paperless machines are still used in 14 states.

It’s important to note that voting and tabulation equipment are not connected to the internet, making it difficult to hack systems remotely to change votes.

Last March, the National Association of the Secretaries of States wrote in a brief on cybersecurity in the 2016 election that “our diverse and locally-run election process presents serious obstacles to carrying out large-scale cyberattacks to disrupt elections, and that standalone, disconnected voting systems present a low risk.”

But election officials are still concerned about systems’ vulnerability to hacking by bad actors who gain access to individual machines on Election Day, and about the public’s ability to draw a distinction between small-scale in-person hacks and large-scale remote ones. There is no shortage of demonstrations of the former. Over a long weekend last summer, hackers at a conference in Las Vegas, DefCon, managed to breach all five models of paperless voting machines, as well as an electronic poll book. The hack received a great deal of media attention. One machine, called a WINvote by Advanced Voting Solutions, was hacked in under two hours and reprogrammed to play Rick Astley’s 1987 song “Never Gonna Give You Up.”

Masterson considers the Defcon hack a poor indicator of the security of real systems, describing the exercise as giving hackers “unlimited access to old systems.” Some relied on undetected physical access, a difficult feat in a polling place. The equipment in the experiment was chosen because of its easy availability on eBay, not because of its prevalence in actual elections. The WINvote machine has not been used in any U.S. election since 2014.

For others, though, the DefCon report was a resounding signal to end the use of paperless voting machines.

Less than six weeks after DefCon, the Virginia State Board of Elections decertified such machines, which were used in 23 cities and counties. This came only two weeks before absentee voting for the gubernatorial election began. The commonwealth provided no funding for new voting machines that keep paper records.

It was not the first time Virginia election administrators were scrambling to meet new security requirements. In 2015, two months before a primary election, the Board of Elections decertified WINvote machines, used by 30 localities, following an investigation by the Virginia Information Technologies Agency that found security issues ranging from a system that hadn’t been patched since 2004 to the use of an administrative password “admin.”

Virginia’s 2015 investigation was prompted neither by repeated warnings from cybersecurity experts nor that all other states had retired their WINvote machines. Rather, it was problems experienced by voters, most notably Gov. Terry McAuliffe himself, in the 2014 election that led to a review. McAuliffe requested $28 million to assist localities in purchasing new equipment, which the General Assembly did not agree to.

Two years later, the Virginia State Board of Elections again demanded changes but offered localities no money and little time to overhaul their voting machines. Weeks away from a governor’s race many considered a bellwether for the national political climate, 23 cities and counties scrambled for funds.

Norfolk, Va., bought new voting machines, spending over $630,000, and then tested and approved them under what Deputy Director of Elections Stephanie Isles called “a tight timeline.” Alexandria spent just under $600,000, taking it from the city’s 2018 budget. James Clement, the general registrar of Culpeper, Va., says that when it came to voting security, officials suddenly “were being directed to spend with no regard at all, but when you ask for funds it’s like talking into a vacuum.”

While Virginia jurisdictions were able to pay for new machines, such spending isn’t feasible everywhere. Norden says that post-HAVA election systems “require a lot more infrastructure and investment. That’s only compounded by a more difficult security environment. It’s unrealistic to expect all of this to fall at the local level.”

States and localities have each responded in their own way to the increasing complexity and cost of elections resulting in a patchwork of laws and procedures. “There is no one election in the United States, there are thousands of independent elections. ... They’re run with their own policies, and their own processes, and, frankly, in a lot of ways, their own vocabulary,” says Christy McCormick, a member of the EAC, at a recent summit on election administration.

The level of state government funding for elections is “all over the place,” says Bernadette Matthews of the Illinois State Board of Elections. Some states cover all costs for statewide elections. Others may only cover special elections or only presidential primaries. More than half a dozen states provide no money to localities to administer elections. Payment to counties for elections can vary from a set proportion of total costs to formulas based on number of precincts or voters to coverage for specific parts of election administration, like ballot printing.

Since elections happen only once, or maybe twice, a year Masterson says “they’re seen as periodic and not needing sustainable funding like roads.” But as the complexity of election systems have grown, Masterson says they should be viewed as infrastructure and just as important as IT systems.

That elections have run pretty smoothly overall can create a perverse incentive to lower them as a budget priority. The Caltech-MIT Voter Technology Project, started after the 2000 Florida recount, has found that, since then, a range of election performance metrics, from lost votes to long wait times, have improved dramatically.

But with voting equipment nearing the end of its lifecycle, election administrators are hoping for funds before antiquated systems create larger problems.

“We use the analogy of a firetruck,” says Meg Sunstrom of the Louisiana Secretary of State’s office. “We don’t want a firetruck going out of commission mid-run.”

Predictably, relying on local funding means large, well-resourced counties fare better than small ones. Travis County, Texas, home to Austin and over 1.1 million people, has spent the last five years and hundreds of thousands of dollars evaluating and then attempting to design its own voting equipment. Next to Travis County sits Blanco County, population 11,004. Its operating budget for election administration this year is $46,000.

Some state election officials say the uneven finances of counties is why the state should invest in new equipment. Chris Whitmire from South Carolina’s Election Commission wants to make sure that “nobody is left behind.” Similarly, Ohio Secretary of State Husted says “many local counties are struggling so we have to make sure cost is not a factor.” Husted is urging Ohio’s governor and legislature to cover the full cost of new voting equipment, estimated at $118 million.

A recent report by Pennsylvania’s Advisory Committee on Voting Technology reported that many committee members “expressed concern that their jurisdiction would not be able to afford voting technology that satisfies” their recommendations, but also expressed concern “that their jurisdiction would not be able to maintain their current electronic voting systems for much longer.” The committee recommended the General Assembly provide funds to counties.

State funding of new voting machines since 2014. Source: National Conference of State Legislators (Kate Rabinowitz/ProPublica)

Since 2014, only two states have provided sufficient funds for new voting equipment. Ten more have committed to partial funding. Last year Minnesota created a $7 million grant to aid counties and municipalities in purchasing new voting equipment. Local governments applied for nearly double that amount. In a statement Secretary of State Steve Simon says, “It is clear that replacing our state’s aging election equipment is an ongoing need.”

Some election officials hope the funds their state has allocated so far are just the start. In Louisiana, the Voter Technology Fund, started in 2015, has roughly $1 million. Secretary of State Tom Schedler plans to ask for between $40 and $50 million more from the legislature this year to purchase new machines. In Utah, the governor’s 2019 budget asks for $4.5 million, far more than $275,000 appropriated by the legislature last year.

More money also could be on the way from the federal government. In the closing days of 2017, six senators filed the bipartisan Elections Security Act, which would make $386 million in unspent HAVA grants available to states to replace paperless voting machines. “The amount of money in there won’t solve every problem, but it will go a long way ... and help states where they need help,” says Norden.

In a recent opinion piece for The Washington Post, Michael Chertoff, former secretary of Homeland Security, and Grover Norquist, president of Americans for Tax Reform, urged Congress to move ahead on the act for the sake of national security. “The best estimates show that we can replace all paperless voting machines in the United States for about the cost of a single F-22 fighter jet.” they said. “It’s not practical to expect local election administrators in rural Missouri or small-town Maine to go toe-to-toe with the premier government-backed cyber-mercenaries of China or North Korea.”

But the Elections Security Act provides no new money, and little progress has been made in taking it up in the Senate.

There are signs that states are at least talking more about modernizing voting systems. "Five years ago no states were asking about election equipment,” Underhill says. “Now there’s an interest and a real conversation. Across states there are task forces, special committees and proposals.”

Five of the 12 states that have allocated funds to new equipment since 2014 did so last year. There are more bills slated to come. In Ohio, Husted says his latest request for funds is his “most specific and aggressive” yet.

This will be the seventh year in a row South Carolina’s Election Commission asks for funds to replace voting machines, Whitmore says. The machines are 13 years old. He remains hopeful this will be the year. “Election security has hit the mainstream. Election security is on the radar and woven into the fabric. It’s on everyone’s mind.”

This article was first published on ProPublica.