Twenty-two localities in Virginia have roughly two months to replace their election technology after the state's board of elections decertified all Direct Recording Electronic (DRE) voting devices over hacking concerns.
The DRE devices, which generally operate via touchscreens, were deemed insecure by the Virginia Information Technology Agency (VITA), which was tasked to evaluate the machines following reports of researchers compromising certain models at the 2017 DEF CON hacking conference.
The unanimous 3-0 vote followed an official recommendation for decertification by Edgardo Cortes, commissioner of Virginia's Department of Elections. Among devices that have been decertified are the AccuVote TSX and AccuVote TSR6 from Premier/Diebold, the Edge and AVC Advantage from Sequoia Voting Systems, the eSlate from Hart Intercivic, the iVotronic from Election Systems and Software, and the Patriot from UniLect. Another DRE device, the WINVote, was banned by Virginia in 2015.
The Edge, TSX and ES7S iVotronic were among the machines featured at DEF CON's Voting Machine Hacking Village. Cortes partially attributed his decertification recommendation to reports of DEF CON hackers gaining access to DRE devices, as well as revealing their passwords. Citing VITA's findings, Cortes also cautioned that DRE devices in Virginia lack a voter-verifiable paper audit trail that can help election officials confirm vote counts or uncover possible errors or tampering.
"Each device analyzed exhibited material risks to the integrity or availability of the election process," the VITA report states, according to the Cortes recommendation. Moreover, "In each of the systems, the potential for loss of vote is significant, as none of the machines appear to produce paper audit trails during the voting process."
On Nov. 7, 2017, Virginians will be electing their new governor, choosing primarily between Republican Ed Gillespie and Democrat Ralph Northam. It will be the first Election Day following widespread reports of Russian interference in the 2016 presidential campaign -- making this an important test for state election systems leading up to the 2018 House and Senate elections.
The Cortes recommendation letter states that while 22 Virginian localities currently use DRE devices in their elections, nine of them have either already contracted with companies to obtain new equipment by the upcoming election, or have pending procurements. Still, that leaves 13 additional affected areas, which comprise 140 of Virginia's 2,439 voting precincts and about 3.77 percent of the state's approximately 5 million active voters.
Virginian localities were already under orders to replace their DRE devices by 2020. In letters sent prior to the election board's official resolution, some localities urged the board not to decertify the machines, expressing concerns over the accelerated timetable.
For instance, one day prior to the election board's resolution, the Office of the County Attorney of Culpepper County, Va. stated in a letter that purchasing approved replacement equipment would cost approximately $250,000, creating budgetary difficulties. "Premature decertification merely days before an election period...imposes a substantial burden and is fiscally unfair to the county and its residents," the letter states.
Another letter from the Virginia Association of Counties stated that "obtaining the machines in time to train staff and election officers in advance of the absentee voting period could be challenging."
However, Cortes pointed out in his recommendation that localities actually had less time to replace their machines in 2015 when election officials decertified the WINVote devices. He also noted that Virginia's General Assembly had previously voted down a December 2014 proposal from current governor Terry McAuliffe to add $28 million to the state budget for the purpose of purchasing new voting equipment for all localities.
Other organizations praised the Department of Election's recommendation and encouraged the board to decertify the machines. "There have [been] countless studies and security reviews over the years which have found the DREs in use in Virginia to have multiple insecurities making them vulnerable to manipulation and tampering," wrote Barbara Simons, president of Verified Voting, and Alex Blakemore, co-founder of Virginia Verified Voting, in a letter. "The universally accepted evidence that DREs are insecure and untrustworthy drove the legislature to pass a measure to eliminate them by 2020. But there is an imminent threat to the security of our elections that must be faced now."
Whether other states take similar measures remains to be seen.
"While Virginia is at a point where we feel it's necessary to have new equipment in place to reduce potential risks in our elections, each state has to make those decisions based on their individual circumstances," Cortes stated in his recommendation.
