Pennsylvania Is Taking Election Security Seriously
This time last year, Pennsylvania received a horrible grade in the Center for American Progress report on Election Security in All 50 States. Over the last year, the state has made significant improvements. This is a case study in just how much can be accomplished when officials take election security seriously…and act. CDT supports Pennsylvania’s electoral policy changes, recognizing that security is a process of continuous improvement that must be prioritized.
The Secretary of State began the process with an ambitious goal. He quickly acted to take advantage of incoming security funds, provided by the Help America Vote Act (HAVA), by declaring counties must “have voter-verifiable paper record voting systems selected no later than December 31, 2019, and preferably in place by the November 2019 general election”. He also sought expert input on recommended improvements to the state’s election security posture, including the purchase of new equipment to perform enhanced audits.
The result was the Blue Ribbon Commission on Pennsylvania’s Election Security. It was established as “an independent, bipartisan commission studying Pennsylvania’s election cybersecurity”. The state used the commission process, led by the Institute for Cyber Law, Policy, and Security at the University of Pittsburgh, in order to provide experts with the opportunity to provide recommendations to local, state, and federal officials. The Commission convened throughout the second half of 2018 and released its report in late January. It is reassuring that the Commission recognized that the state’s election infrastructure is under threat, and that it is offering actionable recommendations to officials at all levels in concurrence with proposals from election security experts, advocates, and national security officials. In July, CDT submitted the following comments to the Commission:
- Voter registration, rolls, and databases can be immediately fortified by requiring two-factor authentication and cybersecurity training for all election officials and qualified candidates.
- Voting machines, tabulation, and storage devices should be subjected to thorough third-party vulnerability assessments, and those results should be available to election officials prior to making purchase commitments.
- Resiliency and recovery are a team effort that include internal and external partnerships codified in an organization’s business continuity and disaster recovery plans, and practiced regularly through sector-wide threat intelligence sharing.
Another key recommendation in the report is to “replace vulnerable voting machines with systems using voter- marked paper ballots”. The state also made significant progress in that regard – allocating $15 million of the Governor’s proposed budget for new equipment. It is far short of the estimated $125 million needed to replace all voting machines in the state. This is not uncommon. Like many other states, the Pennsylvania Legislature faces the significant challenge of developing a long-term funding plan that will need to include a combination of county, state, and federal dollars. Unfortunately, depending on federal funds such as 2018 HAVA Security grants and proposed H.R. 1 appropriations from the federal government will not be sufficient.
In addition to new equipment, two counties were selected to begin the use of enhanced post-election audits. Philadelphia and Mercer counties will use enhanced post-election audits in the 2019 November election. We applaud this development and enthusiastically agree with the Commission that “Pennsylvania officials should improve upon the Election Code by embracing risk-limiting audits, which would offer a more effective and efficient method of verifying election results”. Robust post-election auditing for every race can be a powerful deterrent against interference and an objective means of boosting voter confidence.
More states can benefit from the approach that Pennsylvania took to developing its election security plan. Convening a diverse panel of experts to adapt industry best practices for local needs, and then codifying them into a series of recommendations, provides lawmakers with a blueprint for developing a long-term strategy.