Voting machine vendors say they’re open to new mandates

In a congressional hearing, executives from the three major voting machine manufacturers said they were open to new reporting and regulatory requirements.

secure voting machines
 

Representatives from three of the largest U.S. voting system manufacturers expressed openness to new federal regulations to bolster confidence about the security of their products. Whether any of them will come to fruition and what effect they would have is less clear.

The three companies, Election Systems and Software, Dominion Voting Systems and Hart InterCivic, have a history of resisting outside scrutiny of their products. Under a battery of questioning from lawmakers at a Jan. 9 House Administration Committee hearing, they said they would support a range of new regulatory and reporting requirements for their companies and the election industry as a whole.

Those potential requirements include a congressional mandate that states purchase voting machines with paper records and conduct post-election audits for every vote cast, new public reporting on security risks associated with their equipment and new federally crafted guidelines for how to best set up their supply chains.

"I think we would support any requirements that [apply] to all vendors in our industry that would help educate users of our system and anyone who interacts with them," said Tom Burt, CEO of ES&S.

Committee Chair Zoe Lofgren (D-Calif.) floated five new potential reporting mandates that would require the companies to detail their policies and practices on cybersecurity and incident response, information on any cyberattacks they've faced, whether their staff undergo background checks, information on corporate ownership and foreign investment in their companies and how and where their supply chains are set up.

All three CEOs said they would support such requirements. Lofgren, who introduced similar requirements in the SAFE Act passed in the House last year, said their commitment was "very helpful."

"As you know we have passed a pretty robust bill in the House, it's pending in the Senate and perhaps your testimony will move that forward," she said.

The openness to new mandates indicate a shift from the industry, but some longstanding concerns about industry practices endured.

While the major vendors said they were in favor of auditable paper trails for all their systems, that would include the use of Ballot Marking Devices. Such systems allow users to use an electronic touchscreen or user interface to mark a paper ballot that is then scanned or counted manually and are designed to increase accessibility for voters with physical disabilities. However, some election jurisdictions are purchasing BMDs for all their voters, and some experts have warned the machines are not conducive to effective voter verification and post-election auditing procedures.

Concerns also exist about the companies' software and hardware supply chains. A report released last month by Interos found that at least one major voting system vendor sourced parts and components out of China, where U.S. officials have raised general concerns about supply chain compromise from state intelligence agencies. The report did not identify the vendor, but witnesses from all three of the major manufacturers acknowledged they relied on Chinese-made gear. Lawmakers expressed concerns that it could open the door to compromise or sabotage of software and hardware by bad actors.

Burt said his company had a "limited" number of components that come from China, claiming many amounted to plastic or metals that make up the device, not IT. However, he acknowledged that for at least one of their machines, the DS200, one of its nine programmable logic devices are sourced from a California company that produces the part in China.

Dominion Voting Systems CEO John Poulos and Hart InterCivic President Julie Mathis said their companies use Chinese-made LCD screen components, chip capacitors and resistors, and argued that in some cases there's no option for manufacturing them in the United States.

"We would welcome guidelines and best practices from the committee and from the federal government…this is not a problem that's unique to the election industry," Poulos said.

The hearing represents an about face for an industry that has often largely downplayed their vulnerabilities and rejected calls for increased regulation. Still, some election specialists were unimpressed.

Eddie Perez, Global Director of Technology Research and Development at the OSET Institute, told FCW in a phone interview that while it's important to get industry on record supporting things like increased reporting requirements, he's skeptical whether the companies plan to follow through absent federal enforcement.

He argued many of the other proposed changes discussed in the hearing would not meaningfully address the fundamental, systemic problems that plague the industry and inhibit better security practices, namely the consolidation of voting machine production across just three vendors and a plodding system for testing and certifying machines.

"I would have preferred to have heard more questions that press upon the status quo, because the fundamentals of the market today, supported by current policies of the [Election Assistance Commission] and in particular implementation of its certification program, those are big part of the reason why voting infrastructure is suffering," he said.

While many new voting machines have come on the market over the past two decades, virtually all of them were designed to system standards developed by the EAC in 2005. The agency is working on updated standards, but they will almost certainly not be in place this year as states look to spend hundreds of millions of dollars in new federal grant funding to update their voting machines.

Perez said he was worried states would end up simply repeating the mistakes of the past.

"The real danger is that in the absence of any more significant change, Congress and EAC and the vendors are just going to hit the reset button on 10 more years of dysfunction in continuance of the last decade's problems," he said.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.