New Jersey plans to spend $10.2 million to enhance election security over the next several years, but will use only part of it to conduct a small pilot project involving what some experts say is the most important change the state needs to make: moving to a system of paper ballots.
The Center for American Progress has rated New Jersey’s election system among the least secure in the nation, in large part because there is no way to independently audit ballot results should a hacker meddle with the programming of one or more election machines. Pending legislation (A-3991) calls for the state to upgrade its voting machines to ones that have a paper trail and county clerks agree that change is needed.
New Jersey is only taking the smallest step in that direction.
The state plans to spend a portion of the $9.76 million it is getting in a federal “access and security” grant and close to $500,000 in state matching funds on a pilot program to let counties lease or buy a small number of voting machines with a “voter verified paper audit trail.” The pilot will take place in “small jurisdictions with a small number of voting systems.”
In complaining that the $380 million Help America Vote Act is not providing nearly enough funds needed to truly ensure election security, the Brennan Center for Justice noted that New Jersey is not getting enough money from the federal government to replace all its electronic voting machines — the cost to do so is estimated at between $40.4 million and $63.5 million.
Difficult, but not impossible, to hack voting machines
“These federal grants were an excellent first step by Congress, but, they’re exactly that — a first step,” states a Brennan blog post. “Now Congress must act again and provide more funding to help states secure the vote. If that doesn’t happen, state and local officials should prepare to step in to fill the void left by Congress.”
Although lawmakers are looking to change the state’s voting machines, state officials have maintained that the current system is safe from hacking because the electronic machines, many of which are now close to 20 years old, are not connected to the internet. Yet a Princeton professor in 2016 demonstrated how to hack a machine within seven minutes by replacing one of its computer chips with a chip that included programming to manipulate election results. Hacking a machine would be difficult, but not impossible, to do, since voting machines are typically delivered to polling places days before an election and are left unguarded during that time.
A portion of the funds the state is getting are earmarked for ensuring that election equipment is secure. The Secretary of State’s office plans to offer a physical vulnerability assessment program for counties to inspect for any deficiencies with the physical security of voting machines, election material, data and other devices used in the electoral process and develop a remediation plan for them. Based on the results of the assessments, security improvements and responsive strategies will be developed, and counties will be eligible to receive funding to help execute a remediation plan.
“The cybersecurity assistance that we provide to state and local officials in the form of vulnerability assessments of polling places, warehouses, and ballot storage areas will continue throughout this election cycle,” said Jared Maples, director of the New Jersey Office of Homeland Security and Preparedness, which is partnering with the Secretary of State’s office on enhancing security. “We are working with municipal, county, and state election officials to offer services to ensure the security and integrity of the Statewide Voter Registration System. To that end, the New Jersey Cybersecurity and Communications Integration Cell will continue to provide real-time monitoring of cyber threats, tailored analysis, and share information on resilience and risk mitigation strategies.”
The concern has been prompted in part by reports of Russian hackers attempting to access election systems in 20 states in 2016, and being successful in a handful of cases, though security officials say no votes were changed.
Other states in same boat
According to the Brennan Center, New York and Illinois — whose voter registration database was breached by Russian hackers — plan to use all their allotted funds on cyber-security. Alaska, Arkansas, Delaware, Louisiana, North Dakota, and Pennsylvania plan to spend all their allotted funds on new voting machines. Like New Jersey, these states use machines that leave no paper trail.
New Jersey, on the other hand, is using its money on programs into 2023 that meet other purposes in addition to the pilot project with machines that have a paper trail and other cyber-security efforts. These include:
Two other security-related expenses will cover updates to existing voting machines and the tracking of the seals that secure the voting machines and a pilot program of post-election audits in locations that use paper-trail machines.
Such audits are considered critical in being able to determine that election results as recorded by machines indeed reflect the actual ballots cast by voters.
No way to check accuracy of results
Currently, the machines used in 19 of 21 New Jersey counties store voting results on cartridges that are then read in county election offices and counted without leaving any paper trail of how individuals voted. So if someone were to write a program to have the machine record votes differently from the way they are cast, there would be no way to check that the results were accurate.
State law, passed in 2009, already requires audits of election results by the Attorney General’s office in at least 2 percent of the election districts in each county, but since there are no paper records to check against machine tallies, these audits cannot be done.
The legislation pending seeks to have New Jersey switch to an optical-scan voting system, such as the one used in New York and many other states.
It works like this: A voter receives a paper ballot, then proceeds to a privacy booth to fill it out by coloring in circles next to candidates’ names, similar to answering a standardized test. After completing the ballot, the voter takes it to a machine, where it is scanned in, the circles are read and the votes are counted. The paper ballot drops into a secure box and is held for purposes of an audit or recount.
Without this system, state officials still express confidence in the security of the election process in New Jersey. They note that they are continuously monitoring potential threats, have participated in national tabletop exercises conducted with officials from the U.S. Department of Homeland Security to gain more training and insight into how to spot and handle threats and are conducting vulnerability assessments and penetration tests of New Jersey systems.
“Our citizens deserve a secure election system that fulfills their unalienable right to participate in their government free from interference,” said Secretary of State Tahesha Way in a statement announcing the grant. “Improving New Jersey’s current election infrastructure has been an ongoing process, which has included planned database upgrades and increased cybersecurity partnerships. But this infusion of funding can help set the foundation for what we hope can be one of the most advanced and secure election systems in the nation.”