How an election security push is running aground in Texas

Election officials across the country are spending millions of dollars to replace their insecure voting machines ahead of the 2020 election.

But America's patchwork voting system is a long way from being secure. To understand why, take a look at Texas.

More than a quarter of the state's 254 counties are sticking with paperless voting machines that cybersecurity experts and intelligence officials have condemned as vulnerable to hacking, according to an extensive, first-of-its-kind POLITICO survey of state and local election offices. At least 14 of them are even buying new paperless machines as they replace devices that are nearing 20 years old.

In the nation's second-largest state, the forces impeding the effort to secure the machinery of democracy are the same ones stalling this push for paper ballots nationwide. They include a lack of money, an absence of leadership from above, and a shortage of basic cybersecurity knowledge among the local election officials who make the technology decisions in much of the country.

Election officials in some Texas counties told POLITICO they still trust their paperless machines — which are being promoted by major voting-technology vendors — and will stick with them as long as they remain legal. Meanwhile, proposals to require them to purchase secure, paper-based voting machines have run aground in both Washington and Austin, despite repeated warnings by intelligence leaders that Russia and other nations are determined to interfere in American elections.

The U.S. Senate left town Thursday without acting on a series of Democratic election security bills blocked by Majority Leader Mitch McConnell, including one that would require paper ballots and provide $775 million to help state and local governments make the transition. In Texas, a proposed paper-ballot mandate stalled before the Legislature adjourned in May — and lawmakers don’t meet again until 2021.

As a result, major election security weaknesses continue to plague a state whose increasing diversity has Democrats eyeing it as a future competitive electoral battleground.

“Every county using paperless machines is a major hole in American election security, and it can only take a few compromised machines to swing a close House, Senate, or even Presidential race,” Sen. Ron Wyden (D-Ore.), one of Congress’ leading advocates for improved election security, told POLITICO.

POLITICO’s findings alarmed election integrity activists and cybersecurity experts, including Houston-based researcher Dan Wallach.

“It’s actually kind of a weird thing that these counties are buying something that I just assumed everybody knew was an obsolete technology,” said Wallach, a computer science professor at Rice University.

The paperless danger

Much of the U.S. election security gap originated with the aftermath of Florida’s “hanging chad” debacle in the 2000 presidential election: Stung by a six-week long recount that exposed the weaknesses in decades-old technologies like punch-card ballots, Congress provided $3.28 billion from the 2003 to 2010 fiscal years to help states modernize their election technology — much of which went to purchasing ATM-style, touchscreen voting machines and other paperless devices that supporters praised as the wave of the future.

But as experts warned at the time, paperless voting represents a severe cybersecurity risk. That’s because they do not produce independent paper records of voters’ decisions, making it impossible to reliably audit them to rule out malfunctions or hacking.

Those concerns received fresh attention on July 25 when the Senate Intelligence Committee issued a report on Russian election interference that urged state and local officials to buy paper-based voting machines, including hand-marked, machine-scanned paper ballots that the panel called “the least vulnerable to cyber attack.” One day earlier, special counsel Robert Mueller told House lawmakers that the Russians remain intent on disrupting American democracy, saying, “They’re doing it as we sit here.”

But the warnings haven’t filtered down to everyone making the decisions in Texas, according to POLITICO’s survey of the 14 states that used at least some paperless voting machines in 2018. The survey included outreach to five state governments and 598 county governments that make their own decisions about voting technology purchases.

Election officials in 69 Texas counties — representing 23 percent of the state’s 15.8 million registered voters — told POLITICO they are either sticking with their existing paperless machines, some of them almost 20 years old, or buying new ones. Several counties said they wouldn’t upgrade until the state Legislature mandated it.

The 14 Texas counties that reported buying new paperless machines range from Ector (76,536 registered voters as of November 2018) in the west of the state to Floyd (3,965) in the north and Tom Green (66,826) in the center. The largest county on the list is Galveston (212,630), followed by Comal (100,867).

All 14 of these counties reported buying the Verity Touch device made by Hart InterCivic, one of the three largest voting technology firms. (Hart did not respond to a request for comment.) Most reported doing so in 2017 and 2018, when the dangers of paperless machines were well known. Comal County said it purchased the machines in January, while Ector County said it would buy soon.

Officials in Chambers County, which bought new paperless machines in 2017, “have no intention of replacing [them] unless mandated by the
legislature,” county clerk Heather Hawthorne said.

Comal County elections coordinator Cynthia Jaqua said her county also won’t replace its machines unless required to do so.

Three of Texas’ 15 largest counties — Fort Bend (431,832 registered voters), Hidalgo (351,562) and Montgomery (333,488) — are sticking with their existing paperless machines. Officials in several others doing the same — including Foard, Jones and Randall — said they were happy with them and considered them secure.

“We are satisfied with our current paperless voting machines, and will continue to use them until the secretary of state no longer approves them,” said Jones County Clerk LeeAnn Jennings.

Convenience and misinformation drive purchases

Nearly 20 years after Bush v. Gore, many of the voting machines that election officials purchased in Texas and elsewhere are reaching the end of their life spans and are “simply physically wearing out,” Rice University’s Wallach said. To replace them, many Texas counties are sticking with the paperless technology they know and love.

“There’s a whole lot less work to do when you don’t have to manage all that paper,” he said. “The counties are more interested in the convenience, and they’re willing to believe the vendors’ unsubstantiated claims about security.”

This dynamic highlights the need for better cybersecurity education for election officials, multiple experts said.

“There’s a gap there in terms of the education and the information that’s getting out to folks,” said Edgardo Cortés, who presided over Virginia’s transition to paper ballots as the state’s election commissioner from 2014 to 2018.

Election officials are also pressed for time, said Wallach, and many don’t see the need to pause for a cybersecurity tutorial.

He paraphrased their perspective: “I’m running a small county elections office on a tiny budget without much in the way of tech support or local knowledge, and a vendor comes up and offers me a solution that fits my budget and solves my problem, and I say, ‘Well, that’ll do.’”

In some cases, local officials may understand that their machines are insecure, but they lack the funds to replace them, said Cortés, who discussed the issue with Virginia counties during the 2017 transition. “It’s cheaper for them in the immediate [term] to deal with machine failures and all those sorts of issues rather than invest in a new system,” he said.

Congress gave Texas $23.3 million in election security grants last year as part of a nationwide program, but that sum was tiny compared with the state’s needs. Replacing machines just in Texas’ three largest counties, a state spokesman said at the time, would cost between $40 million and $50 million.

Texas Elections Director Keith Ingram declined an interview request for this story. In an email, a spokesman for the secretary of state — a position that is vacant — argued that Texas counties “have trended towards” paper systems.

“Our office anticipates the majority of Texas voters to be on paper-based voting systems by the 2020 general election,” spokesman Stephen Chang said.

Several large counties — including Travis, the home county of Austin, and Harris, which includes the city of Houston — told POLITICO they were buying paper-based machines.

But ensuring that most voters use paper isn’t the only important objective. Equally important is preventing malfunctions or hacking in scattered low-population counties that could undermine confidence statewide. And the more contested Texas becomes in presidential elections, the more serious this problem becomes.

“If I’m an evil nation-state trying to manipulate a U.S. election,” Wallach said, “I want to focus on states where a small security hack can have a large impact on the outcome.”

Hence the dismay of so many experts at the state Legislature’s recent failure to require paper ballots.

The effort initially seemed promising. Wallach testified before a state Senate committee about the importance of paper vote records, and Senate Republicans seemed supportive. But the resulting bill included a provision making it a felony to report false information on a voter registration form. Democrats in Texas and nationwide assailed the provision as a poison pill, arguing that it would disproportionately punish low-income people who made innocent mistakes, and the bill died in the state House.

“The people who I was testifying to seemed to understand the importance of cybersecurity, and I came away from that hearing with a good impression,” Wallach said. “But politics intervened.”

The bill’s sponsor revived the paper mandate in another bill, but the Legislature adjourned before both chambers could pass it. The Legislature meets every two years, so Texas can’t mandate paper until after the 2020 election.

Wallach said lawmakers could have done much more. “My gut says that they could’ve tried to rescue this legislation, but they didn’t. And that says as much as anything about how important they think it is.”

The state lLegislature effectively sent two pernicious messages to counties considering their next voting machines, according to Cortés.

“No. 1 is that the equipment’s OK, and it’s not actually that big a deal that they replace it,” he said, “because obviously if it was that big a deal, the Legislature would do something about it.”

The second message is that counties don’t have state lawmakers’ backing if they do choose to upgrade.

Cortés also warned of another perverse effect: The more counties buy new paperless machines while they still can, the more reluctant state lawmakers will be to ban them.

For counties that just bought new paperless machines, a paper mandate in 2021 would mean “switching voting systems twice in the span of just two or three years,” Cortés said. The resulting financial strain, especially in small counties, would be massive.

Eddie Perez, a former director of product management at Hart, the company selling many Texas counties their paperless machines, said the bill’s failure “represents a missed opportunity to send a strong message about the importance of election security.”

The legislative breakdown in Austin was a boon to voting technology manufacturers, however.

“The situation in Texas … is one of the reasons that the vendors have not agreed to voluntarily stop making paperless voting equipment,” Cortés said. “There are locals that are demanding it, and if a vendor gives up making that equipment, it means they’re out of contention in those [localities] … and it just cedes that ground to their competitors.”

Vendors sell what local officials want to buy, Wallach said, and with continued demand for paperless machines, they have no incentive to stop making them. “The vendors appear not to have the self-awareness that it might be a bad thing for our democracy to sell inadequately secure equipment.”

One large vendor, Election Systems & Software, has announced that it will stop selling paperless machines as primary voting devices and will offer them only for voters with disabilities in situations, such as curbside voting, where its paper-equipped alternatives don’t work.

Without guidance from the state Legislature, “the counties are left to their own devices,” said Susan Greenhalgh, the policy director at the National Election Defense Coalition, a nonpartisan election security advocacy group. That means “the vendors can go in and sell whatever equipment is advantageous to the vendors, which is going to be [paperless], because that’s going to have a higher price tag.”

Perez, who now works at the OSET Institute, an election technology research firm, urged his former employer to change course.

“Hart InterCivic has an opportunity to display leadership and patriotism by announcing that it will only sell voting systems that include a paper trail,” he said. “Protecting our democracy is more important than protecting business markets for outmoded voting methods.”

Partisan feud in Washington

Texas’ failure to require paper vote records comes as Capitol Hill remains split over the idea of a federal mandate.

“State and local governments have shown that they don’t have the resources or expertise necessary to secure elections against dedicated foreign hacking campaigns,” Wyden said. The only solution, he argued, is to “pass binding federal rules.”

But that push has ground to a halt in Washington amid resistance from Republicans, including McConnell, whose critics have started calling him “Moscow Mitch” for his role in blocking the election security bills.

The Senate GOP leader has said experts’ advice should guide the federal response on election security. But despite the longstanding consensus that paper ballots are the gold standard for security, McConnell argues that the Democrats’ proposals to mandate them amount to “nationalizing election authorities that properly belong with the states.”

Another congressional opponent of a federal mandate is Rep. Mike Conaway (R-Texas), whose district includes Ector and Palo Pinto counties, which are buying new paperless machines. “I don’t believe it is the federal government’s place to make these decisions on behalf of states,” Conaway said through a spokeswoman.

Without monetary assistance, any paper mandate would disproportionately burden small and low-income counties that lack the funds to upgrade, Cortés said.

That creates an unfair divide, he argued. “You don’t want the voting experience that people have to be based on what sort of resources their locals have and what the economic situation is there.”

For this reason, Cortés said, federal and state officials need to make an “ongoing investment in election infrastructure” so local officials “can plan around that.”

Last month’s Senate Intelligence Committee report staked out similar ground, saying that “states should remain firmly in the lead on running elections, and the federal government should ensure they receive the necessary resources and information.”

But in a strongly worded dissenting opinion, Wyden said such advice and guidance are far too weak in the face of “a direct assault on the heart of our democracy by a determined adversary.”

“We would not ask a local sheriff to go to war against the missiles, tanks and planes of the Russian Army,” Wyden wrote. “We shouldn’t ask a county election IT employee to fight a war against the full capabilities and vast resources of Russia’s cyber army. That approach failed in 2016 and it will fail again.”