How Secure Are West Virginia Elections?
The Mueller Report released earlier this year detailed numerous ways that Russian operatives sought to interfere with U.S state and local election apparatus in 2016. A Russian entity called the GRU targeted state boards of elections, secretaries of state and county governments with the intent of gaining access to databases of registered voters. In June 2016 they compromised the voter database of the Illinois Board of Elections and extracted information on millions of voters before the intrusion was blocked. Hundreds of outsiders probe West Virginia’s election computer security system daily. Just how secure will the West Virginia election process will be in 2020?
There are really two threats to the security of our elections. One is fraud — the threat that someone will seek to vote more than once, or will vote here after moving to another state, or will impersonate a deceased or ineligible voter. The other is that the election system – electronically maintained voter rolls or electronic vote tabulations – will be hacked and manipulated. Either type of threat could tip an election result and could certainly undermine voter confidence in the democratic system.
Steve Connolly, the Deputy Secretary of State in charge of election protection, has stated that over 50 state, local and municipal elections were decided by single digits in 2018.
Our democracy depends on accurate vote tallies, and even a couple of votes is serious business in tight races. Every fraudulent vote discounts or diminishes the vote of everyone who took the time to properly cast a ballot.
It’s hard to argue with this proposition. In practice, however, Secretary of State Mac Warner has been obsessively interested in preventing fraud, which is almost nonexistent, while risking the chance of disqualifying completely legitimate registered voters.
To keep voter rolls accurate, election officials must periodically remove the names of voters who have died or moved. Beginning in 2017, Warner began aggressively purging West Virginia’s voter rolls. Between January 2017 and October 2018, West Virginia removed 102,797 voters from the rolls – one in twelve who were registered to vote. Several West Virginia counties removed a very large percentage of their voter rolls. Calhoun County, for example, removed 21% of its voter registration list.
But wholesale purges can lead to the erroneous removal of eligible voters. For example, some voters were removed simply because they had not voted in a while, which risks of removing perfectly eligible voters simply because they chose to sit out one or two elections. The Brennan Center for Justice reviewed public reports and conducted interviews with voters and election officials to determine the effect of West Virginia’s purges. They found that voters across West Virginia had encountered problems locating their registration records using the online lookup tool at the Secretary of State’s website, although County clerks reported few problems during the 2018 midterm elections.
Purging voter rolls achieves nothing but eliminating the opportunity for duplicate voting. Someone registered in Jefferson County who moves to Randolph County or to another state could attempt to vote in both places. But, really, how big is that problem? The conservative Heritage Foundation, which tracks cases of voter fraud across the country, could only find two instances of this conduct in West Virginia since their tracking began. Yet Warner is willing to run the risk that eligible voters will be disenfranchised in massive purges simply to remove the tiny chance that someone will abuse the system.
Then there is the chance that someone will impersonate a registered voter. The chance of this happening is even more remote than duplicate voting. Voter impersonation fraud is virtually non-existent in the United States and no cases have been identified in West Virginia. Nonetheless West Virginia, along with a number of other Republican-controlled states, passed a law requiring a voter to present identification to the poll clerk. Voter ID laws complicate the voting process, intimidate some potential voters, and reduce the numbers of poor and less-educated voters who are less likely to have the required ID. These laws are chasing a problem that doesn’t exist and discourage voter participation as a side effect.
The other main threat to election security – the threat exposed by the Mueller Report – is interference and manipulation through hacking. Any electronic record or transaction is vulnerable. West Virginia has embraced cybersecurity with more enthusiasm than most states, but one practice adopted by Secretary of State Warner has been criticized by cybersecurity experts as a dangerous stunt that could allow easy hacking by foreign adversaries.
To resist hacking West Virginia election officials have mostly unplugged from the internet. Although our voting machines are electronic, they are standalone systems that, according to election officials, cannot be hacked from outside. In addition, every voting machine in the state produces a paper trail for every ballot cast. There is a 40-character password embedded in each voting machine that is verified by the tabulation system to ensure that each machine reporting is legitimate. We are assured by state Elections Director Donald Kersey that “what is not possible is for someone to change a vote total or a vote tally or a voted ballot in West Virginia.”
But how about the security of our voter registration records, which are kept in a state-maintained electronic database? Hackers could alter or delete voter registration information, which in turn could result in eligible voters being turned away at the polls or prevented from casting ballots that count. Switching just a few letters in a registered voter’s name in a centralized database could cause a voter to be prevented from voting because of discrepancies between the name listed in an official poll book and the individual’s identification document.
The liberal Center for American Progress awarded West Virginia’s cybersecurity standards for voter registration systems a rating of “good” in February 2018. Among the other positive features of our system is the coordination with the state’s National Guard Intelligence Fusion Center to detect outside efforts to breach the database. West Virginia was also praised for testing its voting machines before and after elections to ensure that a set of mock votes are reported identically. Overall, however, West Virginia and 22 other states received only a “C” grade.
Two practices in West Virginia received an unsatisfactory rating. First, it is not mandatory that precincts compare and reconcile the number of ballots with the number of voters who signed in at the polling place. Furthermore, there is no explicit requirement for comparing and reconciling precinct totals with countywide results to ensure that they add up to the correct number.
The second unsatisfactory practice involves voters stationed or living overseas. Under federal law, these individuals can register and request a ballot with a single post card. Nineteen states require the ballots to be returned by mail, nineteen others allow ballots to be returned by fax or email, and four allow ballots to be returned through a special online portal. In 2018 West Virginia became the only state in the nation to allow the ballots to be returned through a smartphone app. In the 2018 midterm elections 24 West Virginia counties allowed overseas ballots to be returned through the smartphone app, including Jefferson, Berkeley and Morgan.
Cybersecurity experts went ballistic when this practice was announced. “This is a crazy time to be pulling a stunt like this. I don’t know what [West Virginia election officials were] thinking,” said David Jefferson a computer scientist at Lawrence Livermore National Laboratories. Others called West Virginia’s experiment “horrible” and “completely nuts.” Election officials defend the practice by pointing out that the completed ballot is encrypted and secured by a blockchain. But a blockchain is not a way of securing mobile apps before or while the vote is cast. It is only a way to ensure the ballot is not tampered with after it enters the blockchain. If a voter’s phone or tablet is infected with malware it can record or change the person’s vote or infect the state’s entire election structure. So much for the standalone system unplugged from the internet.
In the 2018 midterm elections 144 ballots were returned using the smartphone app, but more than 200 additional voters downloaded the app, verified their identity and tried to get a ballot, only to find that their county wasn’t offering it. Secretary of State Warner declared the program a success and announced it would be used in 2020. But how successful – or not – was the program? Voatz, the company that made the mobile voting software, engaged security experts to audit the results. But none of the auditors have been identified. Moreover, the scope of the tests conducted, how long the auditors had to do the tests, and what information the auditors had access to were not disclosed. One wag has called this “security by obscurity.”
How secure are West Virginia elections? We really don’t know.
