Is the Internet a threat to America’s democracy?
6th August 2018 · 0 Comments
Louisiana’s choice of new voting machines is delayed
By Susan Buchanan
Contributing Writer
Louisiana is shopping for new voting machines as it bolsters security before the 2020 presidential election. But a decision, scheduled for late June, is delayed. Plans are to replace 10,000 machines, most of which are a dozen years old. Under the federal Help America Vote Act, the state was given nearly $5.9 million this spring for an overhaul that will cost much more than that.
Because of Russia’s interference in the 2016 presidential vote, Washington legislators and agencies have encouraged states to adopt machines with voter-confirmed paper trails and no WiFi capabilities. Louisiana’s Department of State, headed by the Secretary of State, is the agency that will acquire new equipment.
“Some of the most important security elements in our new machines will be that they can never be connected to the Internet and that they’ll include a voter-verified paper ballot trail that can be audited post election,” Meg Casper Sunstrom, spokeswoman for the Secretary of State, said in late July. Louisiana uses direct recording electronic or DRE machines that don’t print out a voter’s ballot on paper.
In late March, Louisiana’s Office of State Procurement announced a request for proposals for new voting machines statewide. Three companies submitted bids: Election Systems & Software or ES&S in Nebraska; Dominion Voting Systems in Colorado; and Hart InterCivic in Texas. Dominion supplied the machines that Louisiana voters use now.
State officials have said little about why the decision on new equipment is delayed. “The voting machine RFP is in the blackout phase,” Jacques Berry, spokesman for the Division of Administration, said late last month. “State law prevents us from commenting on anything during this process.”
Sunstrom said in her experience, it’s not unusual for a highly competitive RFP to be delayed.
The machines Louisiana uses now transmit votes into a computer’s memory, without paper trails. In 2006, Sequoia Voting Systems in California replaced all of Louisiana’s lever-operated machines for election-day use with electronic AVC Advantage DRE voting units. Sequoia was acquired by Dominion in 2010.
The state wants to replace machines in 64 parishes with smaller, secure touchscreen units that generate a paper receipt. These receipts can be used when election recounts and audits are done.
One reason Louisiana’s decision is delayed may be a desire to comply with advice from Washington. Prolonged haggling over the state’s budget this spring and the replacement of Secretary of State Tom Schedler in May with Secretary Kyle Ardoin are other factors. Ardoin took over after an employee filed a sexual harassment lawsuit against Schedler.
Washington has offered some guidance on equipment to the states. In May, the U.S. Senate Select Committee on Intelligence, or SSCI, issued the first installment of its “Russia Report, Updated Recommendations on Election Security.”
“States should rapidly replace outdated and vulnerable voting systems,” the SSCI said in its report.. “At a minimum, any machine purchased going forward should have a voter-verified paper trail and no WiFi capability.”
And, “if use of paper ballots becomes more widespread, election officials should re-examine current practices for securing the chain of custody of all paper ballots and verify that no opportunities exist for the introduction of fraudulent votes,” the report said.
Louisiana bought its current voting equipment in 2005 when Help America Vote Act dollars were first sent to the states. This spring, Louisiana was allotted nearly $5.9 million under HAVA by the federal Election Assistance Commission. Secretaries of state across the country fought for these latest allocations because of concerns brought to light in 2016, Schedler said in April. The HAVA money allocated to Louisiana requires a $294,400 state match.
With funds from the state legislature, nearly $10 million is available now for Louisiana’s new voting machines, according to the Secretary of State’s office. Replacing all machines statewide could cost nearly $60 million, however.
The state plans to roll out new equipment in phases over several fiscal years. Current funding is adequate to cover the first phase, Schedler said in April. “In phase one, we would replace all early voting machines, five parishes at a time, across the state, starting in 2018,” he said. “Phase two would include election day machines rolled out in the same manner, five parishes at a time, with full implementation expected by 2020.”
As of April, the Secretary of State’s office had invested about $500,000 of its own, self- generated money in technical improvements, mainly at parish registrar of voters’ offices.
So who’s been hacked? Last year, the U.S. Department of Homeland Security said Russian agents had targeted election-related systems in 21 states before the 2016 presidential election. Federal officials have said that hacking didn’t affect final vote counts, however. In response, California and Wisconsin claimed they hadn’t been hacked. But Illinois officials acknowledged that their voter registration data had been breached. Louisiana wasn’t among the 21 states named.
Last month, Special Counsel Robert Mueller indicted a dozen Russian intelligence officers, accusing them of interfering in the 2016 election. Mueller, a former FBI director, was appointed in May of last year to oversee an ongoing investigation into the last presidential campaign.
Nationally, concerns linger about past installations of remote-access software in election-management systems, or EMSs, in other states. ES&S, the nation’s top voting-machine vendor, admitted in an April 5 letter to U.S. Senator Ron Wyden (D-OR) that it from 2000 to 2006 sold EMSs with the remote-access software known as pcAnywhere to several states. Louisiana didn’t buy that equipment. EMSs are typically installed in county election offices. Some states that were ES&S customers with pcAnywhere had modems on their EMSs so that ES&S technicians could dial in to do troubleshooting.
“Louisiana has never had remote-access software on any of its voting machines and will not have it in the purchase we anticipate occurring soon,” Sunstrom said last month.
California-based Symantec, pcAnywhere’s maker, in early 2012 warned customers of a 2006 theft of the source code or blueprints to pcAnywhere. The software has vulnerabilities that could have allowed intruders to change election results. As of November 2014, Symantec said pcAnywhere was no longer being sold, and as of November 2015 Symantec no longer supported it. ES&S hasn’t disclosed where it sold the election equipment that included pcAnywhere software.
“It’s pretty clear that there’s enough technical competence to hack a voting machine,” Robert Montjoy, political science professor at the University of New Orleans, said in July. “Hacking parties have demonstrated this. But since most of these machines don’t connect to the internet, they can’t be hacked from long distances.”
In July of last year, computer experts at a DEF CON hacking convention in Las Vegas broke into voting machines and voter databases, both physically and remotely, and exposed the vulnerabilities of those assets.
“It’s doubtful that the outcomes of any U.S. elections have been affected by hackers to date,” Montjoy said. “But with the ongoing Russian investigation, there’s enough concern on the part of the public to warrant protection and to use paper trails as voting backups.”
Louisiana, Georgia, South Carolina, Delaware and New Jersey are the only states where all voters use direct-recording electronic machines that have no paper trails to verify vote tallies.
In Louisiana, the Secretary of State’s office has been vigilant. “Since the 2016 election cycle, Louisiana has secured its systems and participated in all suggested penetration testing and vulnerability scans with the Department of Homeland Security,” Sunstrom said. “We’ve constantly monitored our election computer servers for suspicious activity and hardened physical access to election equipment with tools like hand-print scanners and two-factor authentication protocols.”
Louisiana follows the best practices for its machines. “That includes pre- and post-testing every machine before an election, using tamper-proof seals on the machines, updating our software routinely and having a robust chain of custody for these machines,” Sunstrom said. “The state owns all of its voting machines. Our employees are the only ones programming and maintaining them. No one else touches them.”
Sunstrom said the Secretary of State wants to assure voters that the state was not targeted in 2016 and that elections since then have been safe. “We’re prepared for the 2018 election cycle and are focused on making sure it’s secure,” she said. Louisiana voters head to the polls on November 6.
This article originally published in the August 6, 2018 print edition of The Louisiana Weekly newspaper.
