When Democrat Senator Jeff Yarbro (D-Nashville) sponsored a bill earlier this year that would provide greater vote security by requiring that before January 1, 2020, electronic voting machines have the capability to create a voter verifiable paper audit trail (VVPAT) for each ballot cast and that the VVPATs be preserved as paper ballots, the bill failed to advance because no Republican on the committee seconded the sponsor’s motion on the proposed legislation.
Background
The issue of election integrity continues to receive attention since the U.S. Department of Homeland Security in 2017 notified 21 states that were targeted by hackers during the 2016 election, and the 2018 mid-term elections are viewed as targets for Russian interference.
In February, it was reported that Director of National Intelligence Dan Coats testified before the U.S. Senate Intelligence Committee, “There should be no doubt that Russia perceives that its past efforts as successful and views the 2018 U.S. midterm elections as a potential target for Russian influence operations.”
A “Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases and Infrastructure” was an outcome of the 25th annual DEF CON hacker conference held in July 2017 in Las Vegas and, for the first time, featured a Voting Machine Hacking Village (Voting Village) containing 25 pieces of election equipment including paperless electronic voting machines and electronic poll books.
“By the end of the conference, every piece of equipment in the Voting Village was effectively breached in some manner,” the DEF CON report states in its introduction. Also within the introduction was a specific reference to an electronic poll book used in Tennessee’s Shelby County to check in voters at the voting precincts.
Disturbingly, the report states that the former Shelby County equipment “was found to have been improperly decommissioned with live voter file data still on the system; this data should have been securely removed from the device before reselling or recycling it. The unencrypted file contained the personal information – including home residential addresses, which are very sensitive pieces of information for certain segments of society including judges, law enforcement officers, and domestic violence victims – for 654,517 voters from Shelby County, Tennessee, circa 2008.”
The report offers a serious warning, “For years, computer science and cybersecurity experts have been sounding the alarm on US. election infrastructure which can best be described as a patchwork of aging, insecure voting systems that vary from state-to-state. As their research has shown, among the most vulnerable voting systems are Direct Recording Electronic (DRE) voting machines,” those used almost exclusively throughout Tennessee.
This past week, questions were raised about the security of elections with reports of different types of issues in the states of Florida and Georgia.
At DEF CON 26 held August 9 to 12, 2018, the highlight was the conference’s second Voting Village, out of which was the widely-reported 11-year-old who, as the quickest of about 50 participants in the hacking event for children, managed to hack a replicated Florida Secretary of State website and changed election results in less than 10 minutes.
In Georgia, Breitbart reported that more ballots were cast in a precinct than registered voters for the state’s primary election.
Tennessee Voting System Security
At the request of Committee Chairman Ken Yager (R-Kingston) and apparently prompted by a letter authored by Tennessee Conservatives Union Chairman Gary Loe, Secretary of State Tre Hargett, Coordinator of Elections Mark Goins, Director of IT for the Department of State Bill Rogers and Curtis Clan from Strategic Technology Solutions (STS) appeared before the state’s Senate State and Local Government Committee in January, presenting and answering questions for about an hour on the topic of “The Security of the Voting System in Tennessee.” The video of the meeting can be watched here.
Testimony focused primarily on the multi-layered security of the computer systems within the Tennessee Secretary of State function. The hacking attempts of 21 states during the 2016 presidential election, which did not include Tennessee, was explained by Goins as an effort to enter by turning the knob of a door. Goins also revealed that the door was actually opened in two of the 21 states, representing a 10 percent success rate. The target seemed to be voter data, Goins surmised, “where it might have created some type of disruption if they could have deleted voters or put voters back in.”
Security of the electronic voting machines used throughout the state is the responsibility of local election commissions and is based primarily on the “air gap” maintained with voting machines, by virtue of the fact that they are not connected via the internet to any computer system.
The unaddressed chasm in the Secretary of State’s presentation, and not addressed through questioning by any of the Committee members except Senator Jeff Yarbro (D-Nashville), was the potential hacking at the individual electronic voting machine level.
According to VerifiedVoting.org, a non-partisan non-profit organization that advocates for legislation and regulation that promotes accuracy, transparency and verifiability of elections, Tennessee is one of just 12 states that use DREs (Direct Recording Electronic voting machines) without Voter Verified Paper Audit Trail (VVPAT) and just one of 5 that relies virtually exclusively on DREs without VVPAT.
In addition to not requiring policies on a chain of custody for voting machines, state law under Tennessee Code Annotated SS 2-9-116 actually allows for the use of voting machines by non-governmental outside groups, stating, “A county election commission may establish and implement a policy permitting the use of voting machines by a group of citizens; provided, that in any county having a metropolitan form of government, the decision to implement the policy is subject to the approval of the local governing body.”
No Action by Tennessee General Assembly
In a February 2018 meeting of the State Senate Local State and Government Committee, a bill that would require a voter-verifiable paper audit trail for each ballot cast on an electronic voting machine failed due to the lack of a second.
Bill sponsor Senator Jeff Yarbro, a Democrat from Davidson County who also sits on the Committee hearing the bill, introduced SB2090, a common sense bill that would mandate that by January 1, 2020, counties utilizing Direct Recording Electronic (DRE) voting machines have the capability to create a Voter Verifiable Paper Audit Trail (VVPAT).
Prompted by the bill appearing on the Committee’s calendar, petitions expressing support of the bill were prepared by two separate citizen groups, one from middle Tennessee and another from the Knoxville area, contained a total of 68 registered Republicans and were provided to each member of the Committee prior to their meeting. In light of the lack of action by way of a second that would have allowed discussion of the bill, the citizen petitions were effectively ignored.
Costs and Funding
As with all bills submitted by the Tennessee General Assembly, SB2090 has a fiscal note that estimates the cost of implementing the proposed legislation. The fiscal note estimates that state expenditures would increase $4,753,800 in fiscal year 2019-20 and every four years thereafter. The much higher expense is at the local level, where one-time expenditures for the purchase of new equipment is estimated to exceed $53,000,000 in fiscal year 2018-19.
Additional one-time local expenses of $4,411,903 is estimated for supplies, software, training and voter education. Ongoing expense increases at the local level are estimated at $9,507,300 every two years from fiscal year 2020-21 and $4,753,800 at the state level every four years starting fiscal year 2021-22.
Duly noted in the SB2090 fiscal note is that Article II, Section 24 of the State of Tennessee Constitution provides that “no law of general application shall impose increased expenditure requirements on cities or counties unless the General Assembly shall provide that the state share in the cost.”
What the fiscal note does not describe is the type of system the DREs would be replaced with and the detail of how the total cost reached $53 million.
Pew reported in 2016 the “latest computerized machines typically cost between $2,500 and $3,000 each, and election boards should budget for one machine per 250 to 300 registered voters, according to the National Conference of State Legislatures (NCSL).”
As of the most recent Secretary of State election statistics, there are nearly 4 million registered voters in Tennessee, however, voter participation in Tennessee hovers at about 66 percent in the past three November presidential elections, which have the highest turnout — typically two-fold that of other elections.
With a fairly consistent 2.5 million votes cast in the highest turnout elections and the Pew estimates for the most up-to-date computerized machines, replacing them would require 8,333 to 10,000 voting machines at a total cost of $21 to $30 million.
But, Tennessee could opt to follow states that are already turning to other, cheaper approaches like optical scanners that read paper ballots. According to Pew, optical scanners that read paper ballots cost up to $5,000, but only one is needed per polling location in addition to the cost of the paper ballot at an estimated $0.35 to $0.65 each.
Even at 2,000 optical scanners for the entire state, the equipment cost would be $10 million. Paper ballots at an extremely generous three per participating voter, covering the May and August primaries in addition to a November general election, would have a cost of between $2.6 million and $4.9 million every two years.
The fiscal note indicates that “according to the Division of Elections, there is approximately $29 million remaining in Help America Vote Act (HAVA) funding that may be used for equipment upgrades.” However, the fiscal note goes on to say that “if these funds are used for purchasing VVPAT equipment, other funding will be required for the original planned usage of such funds,” although the original planned usage is not explained.
Tennessee was awarded an additional $7.6 million in 2018 HAVA funding as part of the Consolidated Appropriations Act of 2018 signed into law by President Trump on March 23, 2018. While the 2018 HAVA Election Security Fund was authorized under the HAVA of 2002, this is the first new appropriation for HAVA grants since 2010.
Rather than allocating funds to voting machines, the fiscal 2018-19 budget presented by Governor Bill Haslam to and subsequently approved by the General Assembly called for supplemental appropriations to last fiscal year’s general fund totaling $38 million slated for two corporate welfare recipients (page 20 of 546). Through the Department of Economic and Community Development, a $20 million capital grant went to DENSO and another $18 million went to the controversial Tyson Foods, as reported by The Tennessee Star, by way of a FastTrack grant.
Next Steps
The National Association of Secretaries of State (NASS) said in a statement it is “ready to work with civic-minded members of the DEFCON community wanting to become part of a proactive team effort to secure our elections,” while seeming to still be unconvinced that DEFCON’s approach is reflective of actual state election systems.
As Matt Blaze, DEFCON organizer, University of Pennsylvania computer science professor and cryptographer researcher said, to deal with insecure voting systems, the “overwhelming consensus among experts” is going to paper ballots as the number one thing to do.
Verified Voting Foundation further reinforces this concept in their 10-point guide, Principles for New Voting Systems. Their Point 1 and 6 sums it up: “1. It should be human-readable marks on paper as the official record of voter preferences and as the official medium to store votes.” and “6. It should be easily and transparently auditable at the ballot level.”
A new governor and a 111th Tennessee General Assembly with 25 new members in the State House as well as new leadership presents a new opportunity to address voting security. The move to voter verifiable paper auditable trail is not a negative reflection on the local election commissions or the secretaries of state, but rather an indictment of the bad actors looking to undermine our nation’s democracy that relies on the voter’s confidence that their vote is counted as cast.
– – –
Laura Baigert is an investigative journalist for The Tennessee Star.
