Independent panel to look for ways to protect Pa.’s voting system

*This story has been updated with comments from the Department of State*

(Undated) — Cyber security specialists at the University of Pittsburgh have formed an independent panel to study ways to protect Pennsylvania’s voting system from foreign hacking.

The Blue Ribbon Commission on Pennsylvania’s Election Security includes experts, reform advocates, and present and former government officials. It held its first meeting June 26^th.

David Hickton, a former U.S. Attorney and founding director of the Institute for Cyber Law, Policy and Security, co-chairs the panel.

He said in an interview the commission plans to examine the state’s election machinery, its voter rolls, and the system’s resiliency in the event of an attack.

In a statement, the Pennsylvania Department of State said it was notified by the Department of Homeland Security in September 2017 that Pennsylvania was one of 21 states whose voter registration databases had been probed by Russian entities in the 2016 election, “testing the security measures, looking for a way in.” But the department strongly disputes the notion that its voter rolls were penetrated by hackers.

“There was then, and still is, absolutely no evidence that the Pennsylvania voter rolls have ever been hacked or compromised,” the statement read.

That’s consistent with media accounts and the June 2017 testimony of Homeland Security officials before the Senate Intelligence Committee. The officials said 21 states were targeted by hackers, but only in a small number of cases were hackers able to access voter databases.

Hickton said in response that Department of State officials are “parsing their words a little too much.” He believes the state is exceptionally vulnerable to an attack.

“Adversaries frequently park in your system so that they can take action,” Hickton said, “and you don’t always they’re there, and you don’t always known what they’re doing.”

Hickton said he isn’t sure whether the state’s electronic voter data base needs to be replaced, but believes there are steps that can make it more secure.

The machines

A bigger, or at least more expensive problem is the vulnerability of the state’s voting machines, nearly all of which don’t generate a paper backup of votes that can be audited.

The lack of a paper trail is one big reason the state’s voting systems earned a grade of “D” in a February review of election security in all 50 states by the Center for American Democracy.

Voting systems are purchased and managed by each of the state’s 67 counties, and they’re limited to vendors and systems approved by the Pennsylvania Department of State as well as the U.S. Election Assistance Commission.

Lisa Deeley chairs the Philadelphia City Commissioners, which manages the state’s largest voting system. She said in a phone interview the commission hopes to get new voting machines in place by the 2020 election. But it won’t be easy.

The commission has to choose a technology, buy roughly 4,000 machines, then train the commission staff as well as the thousands of neighborhood officials and volunteers who run the city’s polling places.

“There are technical issues, procurement issues, budget issues, and training issues,” Deeley said. “We’re doing everything we can to get this done by 2020, but a lot is out of our control,” she said.

An example is the fact that currently, only one voting machine vendor whose machines generate paper backup (a requirement of an executive order from the governor) is approved for use by state officials.

Pennsylvania Department of State spokeswoman Ellen Lyon confirmed that’s the case, but said the department is reviewing other vendors and expects to have several approved by the end of the year.

Counties are also struggling with the cost of replacing machines, which will likely be tens of millions of dollars in Philadelphia and Pittsburgh.

Hickton said that’s a challenge officials simply must meet.

“I think we can find creative ways between cost sharing arrangements and public-private partnerships to fund what we need to do,” he said. “If we cannot afford to democracy in this country, we have a real problem.”

 

*An earlier version of this story appears below*

(Undated) — Cyber security specialists at the University of Pittsburgh have formed an independent panel to study ways to protect Pennsylvania’s voting system from foreign hacking.

The Blue Ribbon Commission on Pennsylvania’s Election Security includes experts, reform advocates, and present and former government officials. It held its first meeting June 26^th.

David Hickton, a former U.S. Attorney and founding director of the Institute for Cyber Law, Policy and Security, co-chairs the panel.

He said in an interview the commission plans to examine the state’s election machinery, its voter rolls, and the system’s resiliency in the event of an attack.

Hickton said the Department of Homeland Security has confirmed the state’s voter rolls were penetrated by hackers in 2016.

“Adversaries frequently park in your system so that they can take action,” Hickton said, “and you don’t always they’re there, and you don’t always known what they’re doing.”

Hickton said he isn’t sure whether the state’s electronic voter data base needs to be replaced, but believes there are steps that can make it more secure.

The machines

A bigger, or at least more expensive problem is the vulnerability of the state’s voting machines, nearly all of which don’t generate a paper backup of votes that can be audited.

The lack of a paper trail is one big reason the state’s voting systems earned a grade of “D” in a February review of election security in all 50 states by the Center for American Democracy.

Voting systems are purchased and managed by each of the state’s 67 counties, and they’re limited to vendors and systems approved by the Pennsylvania Department of State as well as the U.S. Election Assistance Commission.

Lisa Deeley chairs the Philadelphia City Commissioners, which manages the state’s largest voting system. She said in a phone interview the commission hopes to get new voting machines in place by the 2020 election. But it won’t be easy.

The commission has to choose a technology, buy roughly 4,000 machines, then train the commission staff as well as the thousands of neighborhood officials and volunteers who run the city’s polling places.

“There are technical issues, procurement issues, budget issues, and training issues,” Deeley said. “We’re doing everything we can to get this done by 2020, but a lot is out of our control,” she said.

An example is the fact that currently, only one voting machine vendor whose machines generate paper backup (a requirement of an executive order from the governor) is approved for use by state officials.

Pennsylvania Department of State spokeswoman Ellen Lyon confirmed that’s the case, but said the department is reviewing other vendors and expects to have several approved by the end of the year.

Counties are also struggling with the cost of replacing machines, which will likely be tens of millions of dollars in Philadelphia and Pittsburgh.

Hickton said that’s a challenge officials simply must meet.

“I think we can find creative ways between cost sharing arrangements and public-private partnerships to fund what we need to do,” he said. “If we cannot afford to democracy in this country, we have a real problem.”