Independent commission will probe Pennsylvania voting system

Cybersecurity specialists at the University of Pittsburgh have formed an independent panel to study ways to protect Pennsylvania’s voting system from hackers.

The Blue Ribbon Commission on Pennsylvania’s Election Security includes experts, reform advocates, and present and former government officials. It met for the first time June 26.

David Hickton, a former U.S. attorney and founding director of the Institute for Cyber Law, Policy and Security, co-chairs the panel.

In an interview, he said the commission plans to examine the state’s election machinery, its voter rolls, and the system’s resiliency in the event of an attack.

Hickton said the Department of Homeland Security has confirmed the state’s voter rolls were compromised by hackers in 2016.

“Adversaries frequently park in your system so that they can take action,” Hickton said. “And you don’t always know they’re there, and you don’t always know what they’re doing.”

Hickton said he isn’t sure whether the state’s electronic voter database should be replaced, but he believes there are steps that can make it more secure.

UPDATE: The Pennsylvania Department of State, which supervises elections in the state, strongly disputes the notion that its voter rolls were penetrated by hackers.

In a statement, the Department said it was notified by the Department of Homeland Security in September 2017 that Pennsylvania was one of 21 states whose voter registration databases had been probed by Russian entities, “testing the security measures, looking for a way in.”

“There was then, and still is, absolutely no evidence that the Pennsylvania voter rolls have ever been hacked or compromised,” the statement read.

That’s consistent with media accounts and the June, 2017 testimony of Homeland Security officials before the Senate Intelligence Committee. The officials said 21 states were targeted by hackers, but only in a small number of cases were hackers able to access voter databases.

Hickton said in response that Department of State officials are “parsing their words a little too much.”

Hickton said he stands by his statement in our interview that in 2016 “people were trolling inside our voter rolls” and that the state is “exceptionally vulnerable.”

The machines

A bigger — or at least more expensive — problem is the vulnerability of the state’s voting machines. Nearly all of  them don’t generate a paper backup of votes that can be audited.

The lack of a paper trail is one big reason the state’s voting systems earned a grade of D in a February review of election security in all 50 states by the Center for American Democracy.

Voting systems are purchased and managed by each of the state’s 67 counties, and they’re limited to vendors and systems approved by the Pennsylvania Department of State as well as the U.S. Election Assistance Commission.

Lisa Deeley chairs the Philadelphia City Commission, which manages the state’s largest voting system. She said in a phone interview the commission hopes to get new voting machines in place by the 2020 election. But it won’t be easy.

The commission has to choose a technology, buy roughly 4,000 machines, then train the commission staff as well as the thousands of neighborhood officials and volunteers who run the city’s polling places.

“There are technical issues, procurement issues, budget issues, and training issues,” Deeley said. “We’re doing everything we can to get this done by 2020, but a lot is out of our control.”

An example is the fact that, currently, only one voting machine vendor whose machines generate paper backup (a requirement of an executive order from the governor) is approved for use by state officials.

Pennsylvania Department of State spokeswoman Ellen Lyon confirmed that’s the case, but said the department is reviewing other vendors and expects to have several approved by the end of the year.

Counties are also struggling with the cost of replacing machines, which will likely be tens of millions of dollars in Philadelphia and Pittsburgh.

Hickton said that’s a challenge officials simply must meet.

“I think we can find creative ways between cost-sharing arrangements and public-private partnerships to fund what we need to do,” he said. “If we cannot afford democracy in this country, we have a real problem.”

A shared problem

New Jersey and Delaware also earned D grades in the Center for American Democracy security survey, and both states are grappling with trying to replace voting machines.

Competing bills authorizing the purchase of new voting systems have been debated in New Jersey’s General Assembly, but none has been adopted.

Delaware’s Legislature has approved spending $10 million to replace the state’s voting machines in time for the 2020 election.