This article is part of TechRepublic's series on how states across the US are approaching the cybersecurity threat to the 2018 midterm elections. Read each installment:
or download the entire series as a free PDF.
While no rumors of cheating or hacking have surfaced in Pennsylvania's previous election voting procedures, the state is still one of 13 that only stores votes electronically, without a paper trail. But not for long.
In January, all 67 Pennsylvania counties signed a letter agreeing that "most voting equipment is at the end of its useful life and will need to be replaced in the next few years." However, this idea was taken a step further by Pennsylvania's Acting Secretary of State Robert Torres.
SEE: Security awareness and training policy (Tech Pro Research)
"In April, Acting Secretary of State Robert Torres told Pennsylvania counties that they must have selected, by December 31, 2019, voting systems that provide a voter-verifiable paper record," said Department of State spokeswoman Wanda Murren. "They must be implemented by the April 2020 primary, but preferably sooner."
"We made this move to ensure that Pennsylvania voters are using the most secure, auditable and resilient voting machines available," Murren added. "The current voting systems in use in Pennsylvania are approaching the end of their useful life. They employ operating systems that are no longer supported by the manufacturers, or soon will no longer be supported."
The age of these systems is very telling in America's current state of election security, according to election voter security expert Harri Hursti.
Nothing has changed
"Unfortunately, nothing really has changed since 2000," Hursti said. "We started to do the [voting system] studies from 2005 to 2007, and early 2008. During that time we inspected every single widely used system in the United States. We believed that once we exposed the problems in these systems, it would take two years and everything will be fixed. Not the case."
In reality, the software with the same vulnerabilities and limits in 2007 is the same software widely used in systems today, Hursti added. Additionally, no major follow up studies on electronic voting systems have been conducted. The two major studies--Project EVEREST and California Top-to-Bottom Review--took place in 2008 and 2007, respectively.
The stagnation is due to a lack of funding, Hursti said. The money, time, people-power, and availability just don't exist. One quick solution? Paper.
Paper ballot benefits
Any digital system provides a threat vector. "Time and again computer scientists, election security experts, national security experts, have all warned that those paperless machines are extraordinarily vulnerable and just ripe for manipulation," said Danielle Root, voting manager at the Center for American Progress. Between malfunctions and malicious malware, these outdated digital systems open the door for threat vectors to walk straight through, Root added.
Paper ballots eliminate all the risks associated with computerized data, and if there is any question on someone's vote, you just go back to the physical paper the individual marked, Hursti said.
The new voting systems coming to Pennsylvania "are a better option because they produce a paper record that voters can confirm before casting their ballots, and election officials can use for more rigorous and meaningful post-election audits," Murren said.
"Make a mandatory audit," said Hursti. "All machines are always hackable. There is no unhackable [system] and there will be no unhackable system. Everything will be hackable."
Pennsylvania currently runs on a traditional post-election auditing procedure, which compares a portion of paper ballots to the digital copy on machines. Whether or not audit procedures will change with the reintroduction of paper ballots, only time will tell.
"Paper ballot is the only option," Hursti said. "There is no other option if you want to do something secure. We have become very good in mitigating against paper fraud. So, with the chain of custody and all the requirements, there's no way of making a wholesale fraud on paper ballot."
- State of Washington has new laws and the Air National Guard to help secure 2018 midterm election (TechRepublic)
- West Virginia moves forward with first mobile voting app, despite fears from security experts (TechRepublic)
- Ohio taps college cybersecurity experts to audit election systems before 2018 midterms (TechRepublic)
- How Florida is bolstering election security after being targeted by Russian hackers (TechRepublic)
- Special report: A winning strategy for cybersecurity (free PDF) (TechRepublic)
- Security experts warn lawmakers of election hacking risks (ZDNet)
- Cheat sheet: How to become a cybersecurity pro (TechRepublic)
- Election security is a mess, and the cleanup won't arrive by the midterms (CNET)
- Hackers, trolls and the fight over your vote in the 2018 midterm elections (CNET)
- What to expect from cyber-attacks during an election year (TechRepublic)