New NPR Story Highlights Costs of Election Security – and Difficulty Finding Someone Who’ll Pay
[Image via boingboing]
What would it cost to protect the nation’s voting systems from attack? About $400 million would go a long way, say cybersecurity experts. It’s not a lot of money when it comes to national defense — the Pentagon spent more than that last year on military bands alone — but getting funds for election systems is always a struggle.
At a Senate intelligence committee hearing last week about Russian hacking during last year’s election, Jeanette Manfra , the acting deputy under secretary for cybersecurity at the Department Homeland Security recommended that election officials have a paper-based audit process to identify anomalies after an election.
While that’s the advice most cybersecurity experts give, right now more than a dozen states use electronic voting machines that have no paper backup. Replacing those machines would go a long way toward protecting one of the core functions of democracy, says Larry Norden of the Brennan Center for Justice in New York.
“I don’t think that would cost a huge amount of money. I think it would probably cost between $200 million and $300 million to replace that equipment,” adding that $400 million is his top estimate.
But try finding the money. Congress provided $3 billion to help states replace their punch card machines after the 2000 presidential election but since then, funds have been scarce.
A $30 million plan in Arkansas to replace voting equipment, including paperless touchscreen machines, has been left unfunded. Two years ago, Virginia lawmakers rejected Governor Terry McAuliffe’s request for $28 million to upgrade that state’s voting machines, some of which are also paperless.
In Ohio, officials say their voting system is secure, but would be even more secure if they can replace their aging equipment before the 2020 presidential election. Timothy Ward, president of the Ohio Association of Election Officials and election director in Madison County, says as in most of the nation, Ohio’s voting machines are more than a decade old.
He laughs when asked where election officials will find the money for replacements. His county alone could need as much as $1.8 million.
“That’s the $64,000 question,” he says. “Either the county’s going to have step up and spend that kind of money, which I don’t see that happening. Or the state’s going to have to step up and I don’t see that happening. Or the feds are going to have to step up. And it’s going to be who blinks first.”
Right now, no one’s blinking. Several bills have been introduced in Congress to provide more funds for voting equipment, but they’ve gone nowhere so far. President Trump’s budget also includes no new funding for states to improve election security.
Instead, the Department of Homeland Security is offering to help states identify where their systems are vulnerable to attack and how they can be made more secure. Manfra recommends paper-backed systems so election officials can audit results, where the electronic vote tally is compared with the paper one.
In addition, advocates are suggesting that other safeguards like audits will boost security at a much lower cost:
An audit is one of the best ways to ensure there’s been no tampering, says Ed Felten, a computer scientist at Princeton University. “If you’ve sampled enough ballots in the right way, then you can have high confidence statistically that the election was done correctly, or that if there were any errors they were not big enough to affect the result,” he says.
Right now, about half the states conduct post-election audits, but few do the targeted ones that Felten and other security experts say are needed.
Norden, of the Brennan Center, says audits wouldn’t cost very much to do. “We’re certainly talking in the tens of thousands of dollars, maybe hundreds of thousands of dollars in very close cases,” he says, adding that the cost would be even lower in races where the margin of victory is wide.
In any case, Norden says the price tag of an audit pales in comparison to the security it would provide.
In truth, however, both of these approaches will require a significant investment of resources – whether financial, organizational or both – and thus nothing can be considered a cost-free reform. The good news is that the election community is slowly coming to a consensus that these costs must be paid – but it’s not yet clear who will make the funds available to do so.
It’s also not entirely clear what the entire bill would be; last night, MIT’s Charles Stewart noted that he’d like to see the methodology behind the cost estimates and the response was that the $400 million would cover just the replacement of paperless DRE machines in those states that still use them. The price tag goes up if other jurisdictions want to upgrade or replace their older equipment.
We are starting to see some movement, like the new state-local cost-sharing agreement in Minnesota but those are still the exception rather than the rule. After years of concern, the need for a security upgrade is very real – but now policymakers and practitioners must come together and find the funds to make it happen. Thanks to Pam for this terrific report – and stay tuned …