A statewide elections technology that was considered an upgrade as recently as 2016 is now viewed as a potential security problem.
The modems added to voting machines in Rhode Island, in time for the 2016 presidential election, may be history by 2020.
The R.I. Board of Elections has a task force examining whether they represent a cybersecurity risk because they involve transmission of encrypted data over the internet.
The modems transfer unofficial election results from individual voting machines, in state precincts, to the Board of Elections in Providence. The machines are only turned on after voting ends. And a backup of both paper receipts and data on USB drives is available, according to elections officials.
For these reasons, they say a decision about whether to stop using the modems has to balance the benefit they represent – speedy transmission of results – with the potential risk.
A study group is looking into the security of the modems as the 2020 elections approach, including the presidential primary in April, according to Robert Rapoza, executive director of the R.I. Board of Elections.
A decision will be made by the end of November, he said, more than enough time to determine an alternate system.
“No determination has been made at this time whether we will be supporting the modems or not,” he said.
The backup system includes the USB results, which are hand-delivered to the elections board and downloaded the day after initial results are reported. In two statewide elections in 2018, this system was used and revealed no discrepancies, according to Rapoza.
R.I. Secretary of State Nellie M. Gorbea said any information system connected to the internet has the potential for intrusion. The state is working to make its system less vulnerable.
“What we’ve done as a Department of State, is to make sure our election system is not only resistant to that kind of operational attack, but that it’s less vulnerable. I’m not going to say completely invulnerable. In a world where financial companies, retail conglomerates are all getting attacked, it would be folly to say [that],” she said.
‘The cornerstone of the security of our system is ... a paper ballot.’
Nellie M. Gorbea, R.I. secretary of state
The state last year received $3 million in federal funds for election security, and Gorbea has used part of that money to bolster security for the state’s voter registration system.
It operates independently of voting tabulations, which are run by the state elections board.
Concerns about elections security have increased since the Rhode Island modems were introduced.
This summer, former special counsel Robert S. Mueller III testified on the efforts of Russia to interfere in U.S. elections. A day later, the Senate Intelligence Committee released a report that found elections systems in all 50 states were targeted by Russia in 2016, according to The New York Times.
While the report found no evidence votes had been changed, in Illinois the attackers were in a position to “delete or change voter data” in the state database, the newspaper reported.
Rhode Island was not targeted as part of that, Gorbea said in late September.
The voter registration system operates independently of the voting system, she said. Moreover, in Rhode Island, if someone is worried that they have had their registration unfairly removed, on election day they can vote through a provisional ballot. These ballots are counted once the voters’ information has been verified.
John Marion, executive director of the nonprofit government watchdog group Common Cause Rhode Island, said the state has had mixed success in shoring up election security.
Modems are an area that cause concern, he said. “The modems are a place where we don’t think the state has been aggressive enough in determining the kind of risk they represent and mitigating the risk.”
They represent a door to the voting system. “If you wanted to get in there, you would look for places to get in. One potential place is when those modems are turned on,” Marion said.
When modems were purchased for the voting machines in all state precincts, they replaced a system in which the results of each machine were entered on to a cartridge, taken to an office and connected via a dial-up line to the Board of Elections.
“[The modems] were purchased at a time when there was very little realization of any kind of cyberthreats,” Gorbea said.
Now, the process allows the transmission of initial voting results, called unofficial results, in a matter of hours. To go back to a manual system could lead to its own problems, she said.
“In this context of high suspicion, I believe it lends itself to a lot of theories about what might have happened while results are delayed,” she said.
As of now, the backbone for voter security in Rhode Island is low-tech: paper. Votes are cast on a paper document, which is then recorded with a receipt.
“The cornerstone of the security of our system is the voter is actually voting on a paper ballot,” Gorbea said.
Mary MacDonald is a PBN staff writer. Contact her at Macdonald@PBN.com.
