Voting machine security: Too little too late?

In a  Jan. 9 House Administration Committee hearing, three of the largest U.S. voting system manufacturers said they would support a range of new regulatory and reporting requirements, but at least one election security expert said that may not be enough.

Among the potential requirements being floated are that states purchase voting machines with paper records and conduct post-election audits for every vote cast, publicly report on equipment-related security risks and follow new federally crafted guidelines for how to best set up their manufacturing supply chains.

The three companies -- Election Systems and Software, Dominion Voting Systems and Hart InterCivic -- have a history of resisting outside scrutiny of their products, but company representatives expressed openness to new federal regulations to bolster confidence about the security of their products.

"I think we would support any requirements that [apply] to all vendors in our industry that would help educate users of our system and anyone who interacts with them," said E&S CEO Tom Burt.

Committee Chair Rep. Zoe Lofgren (D-Calif.) proposed five new potential reporting mandates for manufacturers: detailing their policies and practices on cybersecurity and incident response, disclosing information on any cyberattacks they've faced, reporting on whether their staff undergo background checks, specifying corporate ownership and foreign investment and describing how and where their supply chains are set up.

The openness to new mandates marks a shift for the industry, but some longstanding concerns endure.

While the major vendors said they were in favor of auditable paper trails for all their systems, that would include the use of Ballot Marking Devices. Such systems allow voters to use an electronic touchscreen or user interface to mark a paper ballot that is then scanned or counted manually. Although they were designed to increase accessibility for voters with physical disabilities, some election jurisdictions are purchasing BMDs for all their voters, and some experts have warned the machines are not conducive to effective voter verification and post-election auditing procedures.

Concerns also exist about the companies' software and hardware supply chains. A report released last month by Interos found that at least one major voting system vendor sourced parts and components out of China, where U.S. officials have raised general concerns about supply chain compromise. The report did not identify the vendor, but witnesses from all three of the major manufacturers acknowledged they relied on Chinese-made gear. Lawmakers expressed concerns that such hardware and software could open the door to compromise or sabotage by bad actors.

Burt said his company had a "limited" number of components that come from China, claiming many amounted to plastic or metals that make up the device, not IT. However, he acknowledged that for at least one of ES&S' machines, the DS200, one of its nine programmable logic devices is sourced from a California company that produces the part in China.

Dominion Voting Systems CEO John Poulos and Hart InterCivic President Julie Mathis said their companies use Chinese-made LCD screen components, chip capacitors and resistors, arguing that in some cases there's no option for manufacturing those parts in the United States.

"We would welcome guidelines and best practices from the committee and from the federal government," Poulos said. "This is not a problem that's unique to the election industry."

While the hearing represents somewhat of an about-face for an industry that has often largely downplayed its vulnerabilities and rejected calls for increased regulation, some election specialists were unimpressed.

Eddie Perez, global director of technology research and development at the OSET Institute, said in a phone interview that while it's important to get industry on record supporting increased reporting requirements, he's skeptical whether the companies plan to follow through absent federal enforcement.

He argued many of the other proposed changes discussed in the hearing would not meaningfully address the fundamental, systemic problems that plague the industry and inhibit better security practices, namely the consolidation of voting machine production across just three vendors and a plodding system for testing and certifying machines.

"I would have preferred to have heard more questions that press upon the status quo, because the fundamentals of the market today, supported by current policies of the [Election Assistance Commission] and in particular implementation of its certification program, those are big part of the reason why voting infrastructure is suffering," he said.

While many new voting machines have come on the market over the past two decades, virtually all of them were designed to system standards developed by the EAC in 2005. The agency is working on updated standards, but they will almost certainly not be in place this year as states look to spend hundreds of millions of dollars in new federal grant funding to update their voting machines.

Perez said he was worried states would end up simply repeating the mistakes of the past.

"The real danger is that in the absence of any more significant change, Congress and EAC and the vendors are just going to hit the reset button on 10 more years of dysfunction in continuance of the last decade's problems," he said.

This article was first posted to FCW, a sibling site to GCN.