‘Better than federal standards’ on Pennsylvania’s new voting tech

Pennsylvania Secretary of the Commonwealth Kathy Boockvar said at an event in Washington Thursday that most of her state’s 67 counties have made progress in phasing out their antiquated voting machines for new equipment that allows officials to collect paper records of individual ballots.

As of this week, Boockvar said, 76 percent of counties have selected one of seven lines of voting machines that her office has certified as suitable replacements for the paper-free touchscreen devices used by a vast majority of Pennsylvania voters through last year’s elections. She also said Pennsylvania set security requirements that exceed those set by the U.S. Election Assistance Commission, the federal board that issues standards for voting technology.

“All new systems have had penetration testing, security testing and audit login capabilities,” Boockvar said during a panel at an event on global election security hosted by Auburn University and the Center for Internet Security. “Every physical access point is secured. We created our own standards that are better than the federal standards. Every system has a paper trail, whether it’s ballot-marking device or a paper ballot.”

One of the biggest knocks on Pennsylvania’s old touchscreen machines — known as direct-recording electronic devices, or DREs — is that they do not produce any paper records of votes, making post-election audits near-impossible and raising fears of machine tampering.

And some of the new systems may have other flaws. Boockvar’s remarks came a few hours before the release of findings from the DEF CON Voting Village, during which white-hat hackers identified physical and digital vulnerabilities in a variety of vote-collecting devices. Some ballot-marking devices — on which voters use make their choices on a touchscreen interface and then receive a paper receipt that can be fed into a scanner — were found to be susceptible to denial-of-service attacks, CyberScoop reported. The researchers who compiled the DEF CON findings called for “more comprehensive studies” of the machines.

Security concerns aside, the process of replacing the DREs, which have been used in precincts covering 83 percent of Pennsylvania voters, will be expensive, with estimates running at least $125 million. The state has distributed $14.1 million to counties from an EAC grant last year, and in July, Gov. Tom Wolf announced the state would issue $90 million in new debt to help county election offices purchase new equipment.

Boockvar said she’s also working across state lines, with Pennsylvania election officials participating in a tabletop exercise earlier this month that was hosted by New Jersey. She’s also part of an interagency working group Wolf created last year — including the Pennsylvania National Guard, State Police, Emergency Management Agency and Office of Homeland Security — that convenes officials in individual counties responsible for counting votes and IT security.

“The county administrators didn’t even know their own emergency management folks in their own counties,” she said. “We started doing tabletops. We invited IT, emergency, elections, communications, legal. Everyone would come to the table so people knew who to call.”

The result, she said, has been the breaking down of silos ahead of future elections. Still, Boockvar said Thursday that more resources will be needed.

“The amount [of money] so far has not been enough,” she said.

Boockvar and her fellow secretaries of state got a bit of encouraging news last week when the U.S. Senate reached a tentative agreement on $250 million in election-security funding. But even that is a small payment compared to what’s needed nationally. New York University’s Brennan Center for Law and Justice estimated last month that safeguarding election systems over the next five years may cost states up to $2.15 billion.