Russian hackers, town budgets, Windows updates: Officials grapple with realities of election security

Inside a 21-seat conference room in Silver Spring, Maryland, a meeting of the Election Assistance Commission convened to talk about a software update touched on much more.
Image:
A voter casts his primary vote in Hialeah, Florida on Aug. 30, 2016.Alan Diaz / AP file

Breaking News Emails

Get breaking news alerts and special reports. The news and stories that matter, delivered weekday mornings.
SUBSCRIBE
By Ben Popken and Kenzi Abou-Sabe

SILVER SPRING, Md. — The nation’s highest agency dedicated to election administration convened a security summit on Thursday to figure out how to confront a problem: The majority of the country's 10,000 voting jurisdictions still run outdated software.

In July, Associated Press reported that many counties still use Windows 7, initially released in 2009, or even older software in their back office election management systems used by officials to administer elections, but not on the machines where voters cast their ballots. It's so old that Microsoft announced last year it will soon stop supporting it — shipping free updates to bugs or fixing security issues. After 2020, updates will require a fee.

But inside a 21-seat conference room in Silver Spring, the discussion of the Election Assistance Commission — which included state election directors, secretaries of state and representatives from the Department of Homeland Security, election system manufacturers and testing laboratories — the hastily organized meeting also touched on broader frustrations over challenges local election officials face in trying to secure their voting systems as well as inaction from politicians in Washington.

“We are talking about local communities having trouble funding roads and water bills, and now we want them to take part in defense against foreign and state actors,” said Kentucky State Election Director Jared Dearing.

Also on Thursday, the Brennan Center for Justice, a nonpartisan public policy institute run by New York University Law School, released a report estimating that states could spend more than $1 billion in the next five years to replace old machines and upgrade software.

Louisiana Secretary of State Kyle Ardoin said he did not believe Washington fully grasped the challenges that states face.

“There's a huge air gap by federal officials regarding the reality of processes and procedures, as opposed to magnitude of speculation,” he said. “Elections are not a partisan issue. What is partisan is using security to create fear among the electorate for partisan policies that have nothing to do with election security."

Byers Market Newsletter

Get breaking news and insider analysis on the rapidly changing world of media and technology right to your inbox.

U.S. intelligence agencies determined that Russia interfered in the 2016 presidential election and have repeatedly warned about attacks on the 2020 election.

The 2020 election remains more than a year away, but since U.S. elections are run in a decentralized system, a right that states fiercely guard, local officials face an uphill challenge in securing their voting systems. Before the 2018 midterms, NBC News spoke to a range of experts who said that many of the country’s voting machines are woefully unreliable and in many cases around 15 year old.

Since 2016 there has been a renewed focus on election security from the public and private sectors, including the introduction of a variety of tools for local officials to use, and a huge push to replace all-electronic devices with ones that produce some kind of paper record.

But other elements in the voting ecosystem themselves have changed little.

The issues with the Windows 7 software aren’t necessarily difficult to fix, but at present they would require officials already on a tight budget to pay Microsoft. Louisiana’s Ardoin said at the meeting that the cost could be $300 per machine.

“Can you convince Microsoft to not charge us for updates past January?” he asked the commissioners.

Ginny Badanes, Microsoft’s director of strategic projects, cybersecurity and democracy, told NBC News it was working on a solution.

“We are dedicated to do whatever it takes so this is not an issue,” she said. “We are dedicated to making sure Windows 7 is not a barrier to a secure election.”

Several state and vendor representatives stressed the importance of the Election Assistance Commission adopting a more streamlined process for certifying systems updates.

“Hustle up with those certification standards," Connecticut Secretary of State Denise Merrill said.

Dearing concurred.

"Certification needs to be a stamp of approval telling us our technology is secured, not the obstacle to more secure systems," he said.

Dearing also tried to impress on the commissioners the challenges facing cash-strapped and technologically less advanced rural jurisdictions in his state, Kentucky.

“At 6 o’clock, McDonald’s is often the busiest place in town,” Dearing said of some towns. “And not because people are eating there. It’s because they're using the free Wi-Fi."

Dearing said some state elections departments have only one or two people on staff, and often “they’re not digitally native.”

“And we're asking them to take part in what is national security."