Windows 7 woes crash into 2020 election cycle

Financial, technical and bureaucratic hurdles are making it more difficult for states to patch their election-related software and move on from an expiring Windows operating system.

 

Thousands of jurisdictions are relying on a nearly obsolete operating system to run their election systems, and it's not clear they will have the money or time to wean themselves off before the 2020 elections.

At an Aug. 15 election security forum hosted by the U.S. Election Assistance Commission (EAC), state officials, vendors and experts warned that a lack of money and resources as well as technical and logistical hurdles are preventing them from migrating their election systems from the Windows 7 operating system to Windows 10.

Lousiana Secretary of State Kyle Ardoin illustrated the costs and complexities associated with replacing outdated operating systems on election equipment like voter registration systems, e-pollbooks and other software. He said Louisiana will have spent more than $250,000 to replace computers using Windows 7 in clerks of court and voter registration offices. An additional $2 million has been spent to temporarily lease voting machines that require Windows 10 while the state waits for a new batch to go through the procurement process.

He estimated the cost of updating to Windows 10 to be around $670 per machine, not including the costs associated with testing, configuration and deployment.

Apart from causing technical conflicts when their elections systems communicate with the state's legacy voting machines, Windows 7 is also inching closer to its end of life, with Microsoft announcing it will stop supporting updates for the system entirely in January 2020.

The problem extends well beyond Louisiana, as a recent Associated Press investigation this year found that the "vast majority" of election jurisdictions in the U.S. are still using Windows 7 or older operating systems to program voting machines, create ballots, tally votes and report on election results.

Ginny Badanes, director of strategic projects for Microsoft's Defending Democracy Program, told the commission that her company would continue supporting Windows 7 through the 2020 election for an additional fee, but said the cost and other details are still being worked out

"We are committed to helping customers remain secure as they modernize systems and move to Windows 10," she said. "Some customers will need more time, [and] we will offer extended security updates for some."

There are other logistical and bureaucratic complications that make it difficult for states and localities to update and patch election and voting systems in a timely fashion. Perhaps most crucial: the EAC is still mulling whether patching the software of a voting machine would require new certification under EAC standards. That would introduce delays and perhaps keep election officials from implementing updates that "break" the certification of their machines.

"In our perception this is a lack of clarity about if and how a security update could be applied without triggering recertification," said Badanes. "We should stop giving administrators the choice of using systems with known vulnerabilities or applying security patches and taking their systems out of certification."

Ardoin said vendors had told him that while they can force updates, doing so could wreak havoc on functionality or cause those systems to fall out of certification. This puts officials in a seemingly no-win scenario the closer they get to Election Day, forced to choose between having secure systems and fielding any machines at all when voters head to the polls.

"We need to balance the need for certification with the imminent security needs of election officials on the ground, where time and resources are truly of essence," Kentucky State Election Director Jared Dearing said.

Ardoin lobbied for Congress to provide more funding to states, but like some other secretaries of state, he said that those funds should not come with any additional mandates, arguing that states can be trusted to take their own unique path to an improved election security posture.

"What we would hope for is if the federal government does make additional resources, it's necessary that there be no strings attached, [because] each state is different," he said.

Nearly all of the election security funding bills proposed by Congress over the past two years have specified some form of mandates on states, such as restrictions on buying voting machines without auditable paper trails, implementing risk limiting audits or other requirements.

Proponents of such mandates point to states like Georgia and Texas, where officials have used pots of new money in recent years to purchase new paperless direct recording electronic voting machines or ballot marking devices, as examples of how some states will simply repeat the same mistakes of the past if given complete autonomy over the funds. Both DRE and BMD machines are viewed as less secure, less auditable alternatives to optical scanning devices, though BMD machines are also considered one of the only viable voting equipment for disabled voters.

Intelligence officials continue to identify voting infrastructure as a target for state-sponsored hackers and other bad actors heading into the 2020 election. EAC Commissioner Thomas Hicks expressed confidence that the country was better prepared, but quoted former heavyweight boxing champion Mike Tyson in warning that "everyone has a plan until they get punched in the mouth."

"We all have our plans ready, but I think there's going to be a lot of swings at us," said Hicks.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.