Wary of Hackers, States Move to Upgrade Voting Systems

WASHINGTON — State election officials, worried about the integrity of their voting systems, are pressing to make them more secure ahead of next year’s midterm elections.

Reacting in large part to Russian efforts to hack the presidential election last year, a growing number of states are upgrading electoral databases and voting machines, and even adding cybersecurity experts to their election teams. The efforts — from both Democrats and Republicans — amount to the largest overhaul of the nation’s voting infrastructure since the contested presidential election in 2000 spelled an end to punch-card ballots and voting machines with mechanical levers.

One aim is to prepare for the 2018 and 2020 elections by upgrading and securing electoral databases and voting machines that were cutting-edge before Facebook and Twitter even existed. Another is to spot and defuse attempts to depress turnout and sway election results by targeting voters with false news reports and social media posts.

West Virginia’s elections team has added a cybersecurity expert from the state National Guard with a top-secret federal security clearance. Colorado and Rhode Island will now verify election results via an advanced statistical procedure called a risk-limiting audit.

Delaware is moving its voter-registration list off the state’s aging mainframe computer and preparing to replace a 21-year-old electronic voting system that does not leave a paper record of votes to be audited.

Last month, a panel of state, federal and private election experts completed a sweeping revision of guidelines for manufacturers of new voting equipment, the first major overhaul in a dozen years. While the guidelines are voluntary, they are endorsed by all but three states, so manufacturers effectively must meet the new standards to sell their equipment in most of the nation.

Of course, threats to democracy and fair voting — such as gerrymandered election districts and disinformation campaigns on Facebook and other social media platforms — go well beyond election technology. And so far state and federal funds have often failed to match the scale and urgency of the problem. But in a time of widespread skepticism about the security of American elections, ensuring people that their votes have been counted accurately has become a pressing demand.

“What’s happening is a psy-ops operation,” said Mac Warner, the West Virginia secretary of state. “That’s what the Russians are running against us now, trying to erode confidence in our democratic process. We need to assure our citizens that we’re aware of these attacks, that we have assistance to counter them, and that when they do occur, don’t panic — there are resources to turn to.”

In an era of bitter political divisions and elections-rules disputes, the effort to make the vote more secure is notably bipartisan and relatively rancor-free. Republicans like Mr. Warner are largely aligned with Democrats on the need to act before the next presidential election in 2020, and there is some support in both parties in Congress for helping to finance changes.

Experts have warned for years that state and local election equipment and security practices were dangerously out of date, but state and local election agencies short of cash have often lagged in updating their systems. The 2016 election, however, laid bare the seriousness of the threat.

Federal officials have said they are confident that November’s election results were not tampered with. But federal intelligence and security officials were so shaken by Russian attempts to compromise the vote that the Department of Homeland Security designated election systems a critical national infrastructure, like banking and the electrical grid, that merit special protection.

The scope of the threat was underscored on Tuesday when a new report concluded not only that widely used voting systems can be breached by hackers — sometimes with almost trivial ease — but that they contain components manufactured in nations like China with a clear interest in undermining American democracy.

“It’s really important not to overstate the risk. There are lots of things that can be done to make sure machines are as secure as possible,” Lawrence Norden, the deputy director of the Democracy Project at the Brennan Center for Justice of the New York University School of Law. “But when you’re dealing with a nation-state, you have to assume that at some point they’re going to be successful in their efforts to breach things. The question then becomes resiliency and the ability to show people that you can fix things even if there is a breach.”

State officials, who zealously guard their control of elections, have greeted federal efforts to address voting security with wariness. But that, too, has changed. State election directors who were blindsided and angered by the Homeland Security department’s critical infrastructure designation will meet with department officials in Atlanta this month to discuss how they can share information about threats. The department also is working to give state election officials security clearances so they can view classified assessments of dangers to the election system.

The new guidelines for manufacturers of voting equipment — reduced to five pages from more than 200 — include for the first time principles as basic as a requirement that voting devices produce written records that can be verified, and that software or hardware errors cannot lead to undetectable changes in tallies. They are expected to spur the development of a new generation of cheaper and more secure equipment, said Matthew Masterson, the chairman of the federal Election Assistance Commission.

https://www.nytimes.com/2017/10/14/us/voting-russians-hacking-states-.html?hp&action=click&pgtype=Homepage&clickSource=story-heading&module=first-column-region&region=top-news&WT.nav=top-news