Congress Looks to Coax States on Voting-Machine Cybersecurity

Deprived of their stick, lawmakers will need carrots to entice states into upgrading their systems.

A new voting machine which prints a paper record sits on display at a polling site in Conyers, Ga. on Oct. 19.
AP Photo/David Goldman
Brendan Bordelon
Add to Briefcase
Brendan Bordelon
Nov. 29, 2017, 8 p.m.

Cybersecurity debates on Capitol Hill often revolve around the penalties that Congress should levy on industries or agencies that fail to adequately secure their systems. But when it comes to upgrading the cybersecurity of voting machines—a power that the Constitution grants solely to the states—Congress is approaching the problem through persuasion instead of punishment.

“I don’t think we can push the states, right?” said Rep. Will Hurd, the Republican chairman of the House Oversight Subcommittee on Information Technology, during a brief interview following Wednesday’s hearing on voting-machine cybersecurity. “This is firmly a responsibility of the states.”

New machines that provide a paper copy of each electronic ballot cast aren’t cheap, and lawmakers may need to provide additional funding to states that are otherwise skeptical of top-down decrees pushing for new tools to audit electronic election results. “I think it is a carrot versus a stick,” Hurd said. “It is the opportunity to have access to resources if you are following good hygiene or best practices.”

There’s no evidence to indicate that the Russian government’s attack against the 2016 election extended to voting machines themselves, or that vote tallies in any state were altered. Many local election officials are adamant that such an attack would be impossible, claiming that the machines are never connected to the internet and are carefully monitored to prevent physical tampering.

But more than one lawmaker during Wednesday’s hearing brought up a demonstration carried out over the summer at the DefCon cybersecurity summit, where hackers were able to gain remote access to direct-recording electronic voting machines (equipment that does not include a paper-ballot backup for each vote) and alter vote tallies. Such a hack would likely be harder to achieve in real-world conditions, but cybersecurity experts say it’s important to expect the unexpected.

Matthew Blaze, a professor of information science at the University of Pennsylvania, told Hurd that it would be “very difficult” for hackers to compromise state-run voting machines in a way that would significantly impact voter tallies. But, he added, that’s not the only concern. “I think the difficulty that we have is it’s very difficult to prove that it hasn’t happened,” Blaze said.

Hurd and other lawmakers believe the goal of last year’s attacks on election infrastructure was to undermine confidence in America’s democratic institutions. While changing voter tallies may be next to impossible, without a paper trail it’s almost as hard to prove that the election was aboveboard. Hurd believes that lack of confidence undermines voter participation, and wants states to use machines that provide a hard-copy record of each ballot cast in case suspicions later arise.

Some states have already implemented these changes. Just ahead of this month’s election, Virginia scrapped its touch-screen voting machines in favor of new equipment that provides paper backups for each vote. But many more states—particularly those in the South and Midwest of the country—are hesitant to take the plunge, especially without federal assistance.

Some officials, including Louisiana Secretary of State Tom Schedler, believe that even talking about the security of voting machines in a public forum works to further undermine voter confidence. “Look, it’s a necessary thing to discuss—I’m not trying to pretend that it’s not,” he told National Journal after the hearing. “But the more we continue to do this—and the dilemma that an election official has in their state is we want to come solutions, but at the same time we have to keep voter confidence up. And that’s a real balancing act.”

When asked if federal legislation could do anything to help Louisiana enhance voting-machine cybersecurity—either through the use of paper-ballot backups or otherwise—Schedler first said no. But then he caught himself. “Money,” the secretary of state said, claiming that Congress is sitting on hundreds of millions of dollars in election-assistance funding that it has yet to appropriate.

Speaking to reporters after the hearing, Hurd said he’s not necessarily sold on the importance of legislation to coax states into stronger cybersecurity protections for voting machines. With January’s designation of elections as critical infrastructure by the Homeland Security Department—and with lots of federal money still locked up in the federal Election Assistance Commission—Hurd believes there may already be an existing infrastructure to achieve some of these concerns. “If we can do this without legislation, it can be done quicker,” Hurd said.

The chairman added that he’s particularly optimistic in the response that he’s received from secretaries of state like Schedler, many of whom were previously upset over a perceived power grab by Homeland Security. He believes some of those objections have fallen by the wayside in the past year, perhaps opening the door to greater cooperation between Washington and the states. That cooperation, of course, would almost certainly be greased by federal funds.

“There is no such thing as an impenetrable device or system,” Hurd said after the hearing. “With something so important as our elections, we have to be able to refute these concerns of manipulation or erosion of trust. Even though you can still use electronic tools to facilitate and make this process as quick as possible for the voter, you still have to have an audit trail. And a lot of the time that’s paper.”

What We're Following See More »
Trump Announces New “Space Force”
2 hours ago

President Trump announced that he is instructing the Pentagon to create a new "space force" independent service branch. "It is not enough to merely have an American presence in space," Trump said, "we must have American dominance in space." The new command will be the sixth branch of the U.S. Military, which currently includes the Army, Navy, Air Force, Marine Corps, and Coast Guard.

Roger Stone Says He Forgot About Meeting with Russian
3 hours ago

"Two longtime associates of President Donald Trump are now acknowledging a previously undisclosed contact in May 2016 with a Russian who they say offered dirt on Hillary Clinton. Roger Stone and Michael Caputo say they forgot to tell investigators about their contact with a Russian national who goes by the name Henry Greenberg — even though they say Greenberg offered to sell incriminating information to the Trump campaign for $2 million."

Kathy Kraninger to Get Nod for CFPB Post
3 hours ago

"President Trump plans to nominate Kathy Kraninger to lead the Consumer Financial Protection Bureau, the White House said on Saturday. The post is currently held by interim director Mick Mulvaney, who also leads the Office of Management and Budget, where Kraninger is an associate director. Kraninger is expected to continue Mulvaney's push to make the bureau more business friendly."

Supreme Court Punts Gerrymandering Cases
4 hours ago

"The Supreme Court on Monday passed up its two opportunities this term to rule on when and whether states violate the Constitution by drawing electoral maps that sharply favor one political party." In a dispute over Maryland's congressional map, the Supreme Court "upheld a district court judge’s decision not to grant a preliminary injunction" blocking the map. In the Wisconsin case Gill v. Whitford, the justices ruled that Democratic voters lacked standing to challenge the redrawn electoral boundaries at the Supreme Court. Seven justices
"agreed to give the challengers another shot at making their case in the lower courts."

Ross Still Has Stake in Chinese Companies
5 hours ago

Commerce Secretary Wilbur Ross failed to keep his promise to divest from his company holdings upon entering government, a Forbes investigation has found. Ross reportedly kept his stakes in companies co-owned by the Chinese government, a firm linked to Vladimir Putin’s inner circle, and a Cyprus bank caught up in the Robert Mueller investigation. Forbes reports that Ross’s family continued to have an interest in these holdings while he dealt with China and Russia in his official role, even while knowing that his family’s fortunes were linked to the countries. Although the arrangements appear to be legal, Forbes says Ross may have broken the law by submitting a sworn statement to officials in November saying he divested of everything he promised he would. His spokesperson said Ross did not lie and has filed amended paperwork.


Welcome to National Journal!

You are currently accessing National Journal from IP access. Please login to access this feature. If you have any questions, please contact your Dedicated Advisor.