Feds Don't Regulate Election Equipment, So States Are On Their Own

This article originally appeared on Stateline, an initiative of the Pew Charitable Trusts.

Behind nearly every voter registration database, voting machine and county website that posts results on Election Day, there’s an election technology company that has developed those systems and equipment.

By targeting one of those private vendors, Russia, China or some other U.S. adversary could tamper with voter registration rolls, the ballot count or the publicly released results, potentially casting doubt on the legitimacy of the final tally.

Nevertheless, there are no federal rules requiring vendors to meet security standards, test equipment for vulnerabilities or publicly disclose hacking attempts. With the 2020 presidential election approaching, security experts, lawmakers and even election vendors themselves are calling for more rigorous testing of election equipment and stricter security standards for the private companies that provide election-related services.

“The lack of vendor regulation in the election technology space is a big gap that needs to be addressed,” said Edgardo Cortés, an election security expert at the Brennan Center for Justice at New York University Law School.

One of the many revelations from special counsel Robert Mueller’s report on foreign interference in the 2016 presidential election was that Russian military intelligence officers targeted employees of an election vendor that develops software that U.S. counties use to manage voter registration rolls.

Russians, according to the report, successfully installed malware on that company’s network. The name of the company was redacted, though according to reporting from The Intercept, the company was VR Systems, which maintains voter registration systems in eight states. The company has denied that Russians infiltrated its systems.

The threat did not stop after 2016, according to Maurice Turner, a senior technologist at the nonprofit Center for Democracy and Technology in Washington, D.C.

“The Mueller report is proof that targeting vendors is no longer a theoretical route,” said Turner, who worries that election technology companies are not rising to the challenge.

For example, election security experts have criticized Elections Systems & Software (ES&S), one of the largest election technology companies in the country, for installing software on 300 jurisdictions’ systems between 2000 and 2006 that was vulnerable to hackers. (The company will not disclose which jurisdictions were impacted.)

But the company notes that the vulnerable software hasn’t been used in more than a decade. It now submits its equipment to the U.S. Election Assistance Commission — a federal agency that serves as a resource for election administrators and vendors — for testing and certification. It also contracts with the Idaho National Lab, to assess whether its equipment can be penetrated, and the U.S. Department of Homeland Security, to scan its public-facing website.

ES&S is in a “very strong position going into 2020,” said Kathy Rogers, its senior vice president of government relations. But there should be even more testing, she said.

“People say there isn’t enough testing,” she told Stateline. “We agree.”

Hart InterCivic, another top election vendor, denied an interview to Stateline, but it pointed to an April letter it sent to Congress emphasizing that “protecting the integrity of elections is at the core of everything we do” and calling for more federal funding for election security.

But Richard DeMillo, a professor of computing at Georgia Tech University, says vendors that boast about taking new steps to secure their systems “are being disingenuous.”

“What they’re doing is giving the appearance of a company that is concerned about security,” he said, “but it doesn’t take much digging to see that they’re not.”

As an example, DeMillo pointed to last September’s Def Con hackers conference in Las Vegas, when ES&S lambasted researchers for publicly testing the company’s voting machines and publishing their vulnerabilities. The company at the time said foreign spies may have infiltrated the event. Researchers found several bugs in the software that left machines hackable.

Computing experts like DeMillo say independent public testing is essential to preventing foreign hacking in future elections.

Rogers of ES&S said her company is open to further testing, but that industry leaders, government officials and security experts should collaborate on hackathons.

Voluntary Security Requirements

Since 2017, the federal government has considered election systems to be critical infrastructure, just like nuclear facilities and public utilities.

While there are no federal mandates for election vendors, many states require vendors to follow voluntary guidelines from the U.S. Election Assistance Commission.

States can set security requirements during contract talks for new equipment. According to a 2018 analysis by the National Conference of State Legislatures, 38 states require some element of federal testing and certification of election systems before installing them in their state. In eight states, officials do not require that sort of testing or certification.

At the federal level, Republicans have resisted tougher regulations.

In June, the Democratic-led U.S. House passed an election security bill that would, among other measures, require backup paper ballots for all federal elections and add cybersecurity safeguards for election equipment and systems. The bill also would authorize $600 million in additional funding to states to boost security.

It garnered only one Republican vote, from U.S. Rep. Brian Mast of Florida. And GOP Senate Majority Leader Mitch McConnell of Kentucky has signaled his unwillingness to take up election security measures, long believing elections should remain a states’ issue.

Brennan’s Cortés, who served as Virginia’s commissioner of elections for four years until 2018, said that if the federal government won’t act, states and counties should push for security requirements in their contracts with private vendors.

A few days before the November midterms, Wayne County, which encompasses Detroit, said it would no longer use a vendor that failed to fix delays and accuracy issues that occurred in the primary.

And in February, Maryland announced it was cutting ties with an election vendor connected to a Russian oligarch. After investigating the company and its ties to Russia last year, the Department of Homeland Security found no evidence of foreign interference in the state’s election systems.

But Cortés acknowledged that many smaller counties lack the leverage to demand tougher security requirements for election vendors, in part because the industry is dominated by three companies: ES&S, Dominion Voting Systems and Hart InterCivic get 90% of the business.

Some critics have noted the close ties between these companies and election officials. The companies have covered travel expenses for industry meetings and formed customer advisory boards comprised of state and local election officials.

Rogers, at ES&S, said the procurement process is governed by “strict laws” at the federal and state levels, and the company makes sure they are “100 percent within those boundaries.”

Georgia Controversy

Similar criticisms have arisen in Georgia this year as the state decides which voting machines to use for future elections and which vendor will provide them.

Republican Gov. Brian Kemp signed a law in April to begin a search for a new statewide voting system. Georgia soon will be the only state in the country to conduct all its voting on touch-screen ballot-marking devices, which print a paper record.

But this has drawn the ire of a large contingent of election security experts, who say those machines are vulnerable to hacking and bugs that can alter votes. It is “impossible to make them perfectly secure,” DeMillo wrote in a recent paper.

Democratic state Sen. Elena Parent has been an outspoken critic not only of the “insecure” voting machines Georgia is preparing to purchase, but also of the contract process, which she said has been driven by “cronyism” and well-placed lobbyists. It leaves her with “a lot outstanding questions.”

“There’s a strong concern when it comes to something as fundamental as election security,” Parent told Stateline. “And anyone poo-pooing that is doing a disservice to the people that they represent.”

Until the $150 million contract for 27,000 new voting machines is awarded, Georgia officials have been tight-lipped on any special security measures they’ll negotiate with a vendor.

Tess Hammock, press secretary for Republican Secretary of State Brad Raffensperger, would not comment on questions related to the contract process nor on the importance of security standards in election administration. She referred questions to the office’s Request for Proposals document, which requires that any new hardware “must ensure security.”

The document mandates that suppliers provide a detailed overview of the company’s security protocols, software and cyber defenses of the products. The state also would have the power to conduct post-election audits using the new equipment, the document stipulates.

Beyond this, DeMillo said, there are no security requirements for software testing and notification of malicious breaches.

Georgia likely will announce its new election vendor in the next month, Hammock said. Four companies — Dominion Voting, ES&S, Hart InterCivic and Smartmatic — have submitted bids.

Meanwhile, a lawsuit seeking to change Georgia’s voting system to hand-marked paper ballots is moving forward in federal court. The plaintiffs in the suit, individual voters and a group called the Coalition for Good Governance allege the touch-screen voting machines are hackable.