Ahead of the 2020 election, state officials are replacing outdated voting machines, hiring full-time cyber security officers and instituting post-election audits in order to protect against meddling.
But not every polling place is keeping up.
According to a new report by the Brennan Center for Justice, local elections officials in a number of states say they don’t have the money to buy new equipment before 2020, leaving them with voting machines that don’t have a paper trail or use outdated hardware and software.
“That’s a concern about reliability, but it’s also a concern around security,” says Lawrence Norden, deputy director of the center’s Democracy Program. “Often, when they have to replace them, it’s because the machines are no longer manufactured. Then they have to find replacement parts on eBay, which is not a particularly secure thing to do.”
So far, elections experts say the chances that hackers could successfully sway an election remain slim, for the same reason that upgrading U.S. voting machines is so difficult: America’s decentralized and locally run elections system.
Their bigger concern is restoring voter confidence that elections will be run fairly, which has been hurt by revelations of Russian meddling in the 2016 election, break-ins to electronic voter databases and rhetoric from President Donald Trump and some congressional candidates about “rigged elections” and “stealing elections.” Already, Trump has claimed that Democrats cannot “legitimately win” in 2020.
Frank LaRose, Ohio’s new Secretary of State, says the risk right now isn’t as much foreign hackers changing election results as it is their efforts to undermine voters’ confidence in the system.
“What they’re doing is what we used to call propaganda or psychological operations. They’re flooding the zone with confusion, misinformation innuendo and memes on social media that make people question the legitimacy of our elections,” he says. “They’ve not meddled with our elections, they’ve meddled with us and our perception of our elections.”
Nearly eight in 10 Americans are at least somewhat concerned about potential election hacking, according to a recent survey conducted by the University of Chicago and the Associated Press. More than 20% said they had little or no confidence their votes would be counted correctly.
Elections officials say they hear these concerns and are acting on them.
Michigan Secretary of State Jocelyn Benson said if a constituent came up to her and asked about the current state of election security, she’d tell them “it’s more secure than ever before.”
So far this year, she’s helped Michigan develop a security plan that includes convening an election security commission with top industry experts, hosting town halls for citizen input and recommending the establishment of an office of election security.
“There are more eyes on the process than ever before. There’s more transparency than ever before, there’s more investment in the security than ever before,” she says, “and because of that, it’s a much stronger system.”
Still, secretaries of state, election security officials and industry experts tell TIME it’s practically impossible to keep every component of every election in every state and every jurisdiction certifiably protected — especially when you don’t know what threats you’re protecting against.
“The effort to fix a broken aspect of our election system often doesn’t begin until after something has already gone wrong,” Benson said.
Replacing outdated voting machines remains the biggest hurdle to securing elections.
Local election officials in 254 jurisdictions from 37 states told the nonpartisan policy institute they planned to purchase new voting equipment soon. For some states, the need is urgent: 121 officials from 31 states said replacing the machinery before 2020 was critical. Two-thirds of these officials said they don’t have the funds to do so in time.
What’s more, 45 states currently use voting equipment that is no longer manufactured. Election officials in 40 states reported to the Brennan Center their states are using machines at least a decade old, leading to difficulties in procuring replacement parts. One former South Carolina elections director said the state’s system was still running on Windows XP, an operating system first released in 2001.
The most problematic finding of the report, according to the experts who talked with TIME, is that 12 states currently use electronic voting machines that don’t have paper trails as their primary polling equipment in at least some counties and towns. Four states — Delaware, Georgia, Louisiana and South Carolina — use these paperless systems statewide, the report says.
In the areas that use these paperless machines, “if there is a problem, you can’t go back to a paper record and figure out how people intended to vote,” Norden says.
In Wisconsin, where elections occur at the municipal level instead of the county level, every vote has a paper trail. In some of the state’s smallest municipalities, the election offices skip expensive machinery in exchange for simple paper ballots. State statute requires they audit at least 100 pieces of randomly selected voting equipment after each general election to ensure they were tabulating correctly, but in 2018, they’ve more than doubled that, says Meagan Wolfe, administrator of the Wisconsin Elections Commission.
Read More: How Rhode Island Is Fighting Efforts to Undermine Confidence in Elections
Additionally, since more individuals work within their voter systems, Wisconsin instituted multi-factor authentication for all 3,000 people that need to have access to voter roll systems in order to do their jobs.
“We are the custodians of some really valuable information that’s really the crux of our democracy,” Wolfe says. “We have a huge responsibility to make sure that only people who are authorized to view that information, or to make changes about how elections are administered, are able to do that.”
New Mexico’s communications director to the secretary of state’s office, Alex Curtas, says his state keeps a paper trail of every vote, should systems break down and hand-tallies be necessary. New Mexico also recently created a position for a full-time dedicated I.T. cyber security staffer, Curtas says, in addition to having National Guard troops on site during recent elections to monitor cyber safety.
“What Secretary Maggie Toulouse Oliver strives to do is make sure people have the utmost confidence in the systems to make sure they know that their votes are counted and their voices are heard,” Curtas says.
In some states, elections officials are looking to hire experts on cyber security, either as a single official or a small group that can swoop in to address a problem.
Ohio Secretary of State LaRose recently testified before the Ohio statehouse about legislation intended to create a cyber reserve — a capability that would exist within the Ohio National Guard to keep “highly trained individuals” available for dispatch by the state’s governor should an election need arise.
“I think that it’s important that we look at cyber attacks as an attack. It’s a paradigm shift for people, but if there were foreign paratroopers parachuting into a city in Ohio we wouldn’t say, ‘Good luck with that,’” LaRose, a former U.S. Army Special Forces Green Beret, says. “We would send reinforcements. We would send the military or the National Guard.”
He’s also in favor of creating the permanent position of chief information security officer, and codifying post-election audits as law instead of just common practice in Ohio. “There are a few different processes for how you go about that, but essentially what it means is you take a sample of the votes cast and do a hand recount of that sample. Then you can certify and reassure the public that nothing went wrong with that election and that everything was exactly the way you had reported it,” he says of the way audits often work.
LaRose is confident about the steps Ohio is taking to keep votes safe, but he doesn’t pretend the task is an easy one.
“The bad guys only have to be right once and we have to be right every day. Are there concerns? There are absolutely concerns. Do we believe that there are bad actors that want to undermine the credibility of our elections? We absolutely believe that there are,” he says. “But we also have very good safeguards in place and we’re making them even better.”
While elections officials work to secure the next election, experts say the job won’t be finished on Nov. 4, 2020.
“This is a race without a finish line,” says Norden from the Brennan Center. “There’s always more that we could be doing.”
