Wisconsin beefs up voting security
MADISON – It’s encrypted, locked in a room and the centerpiece of voting in Dane County.
Wisconsin’s second most populated county relies on one computer locked in Madison’s City-County Building to program every municipality’s voting machine. It’s one step one county has taken to try to ensure Wisconsin’s elections are secure as the nation prepares for the next big test of its voting systems — the 2020 presidential election.
In July 2016, “Russian government cyber actors” scanned Wisconsin’s online defenses twice, according to the U.S. Department of Homeland Security. Russians attempted to hack 20 other states during the 2016 election.
Former special counsel Robert Mueller in his two-year investigation found the Russian government interfered in the 2016 presidential election in “sweeping and systematic fashion.” Numerous Russian officials have been indicted on charges including computer hacking and identity theft.
With the 2020 election just over a year away, federal officials continue to warn about Russia’s ongoing effort to interfere in elections. This has led Wisconsin elections officials to put an emphasis on securing voting information.
The Dane County computer is loaded with software that allows the county to keep track of candidate names, district boundaries and other municipalityspecific information. This data is put on memory sticks, which are sealed in bags and hand-delivered to each municipality in the county to transfer to their machines.
Dane County Clerk Scott McDonell said county officials choose to program their own machines because it is a more secure process. He noted that if they were to contract for the programming of election machines, the vendor could get hacked and potentially compromise the county systems.
“It’s one less access point,” McDonell said of the software that has been in place for the last five years. “If you do it yourself, you are reducing exposure. Our system is extremely secure.”
McDonell said Dane County has made numerous physical and technical improvements to its election security. In addition to increasing the auditing of polling places, disconnecting voting machines from the internet and encrypting servers, the county also posts pictures to its website of every cast ballot.
This has provided an extra layer of security for the county since it started doing this in 2016, McDonell said. Now, anyone can check to see if the reported results match with the ballots.
“The nice thing about the ballot images
“The problem with Wisconsin elections is that we use the computers, but we don’t verify their outputs. You have all that pre-election security, and then you have to have something in place to detect and correct any bad things that happened anyway.” Karen McKim Coordinator for the election security advocacy group Wisconsin Election Integrity
is you can look for what you want to look for, too. It’s not just what someone else picked,” McDonell said, adding that people sometimes sift through the ballots looking to see if someone wrote in their name.
Not everyone is convinced the machines used in the state’s elections are totally secure.
Group calls for election audits
Karen McKim, coordinator for the election security advocacy group Wisconsin Election Integrity, emphasized post-election audits — “just enough to verify you have the right winners” — as one of the best ways to detect election tampering. She said having people verify information generated by machines is essential.
“The problem with Wisconsin elections is that we use the computers, but we don’t verify their outputs,” she said. “You have all that pre-election security, and then you have to have something in place to detect and correct any bad things that happened anyway.”
Wisconsin’s elections are run at the local level by municipalities instead of at the county level like other states. Each municipality can choose its own state-approved voting machine, and local clerks are in charge of the voter information in only their jurisdiction.
Like Dane County, Milwaukee County programs its own voting machines. County Director of Elections Julietta Henry said the county uses four computers to program each municipality’s machines.
The county also audits one ward from each of the 19 municipalities after every election.
“We’ve not had any issues with any kind of violations where someone has been able to hack into our system,” Henry said. “The State of Wisconsin and Milwaukee County have done (a good) job in making sure that the elections are protected.”
Henry has been the director of elections for the county since 2014. She has worked in elections since 1992 but said statewide efforts over the last few years have improved overall elections security.
The Wisconsin Elections Commission doubled down on security since 2016 by encrypting voter servers, requiring additional clerk verifications and establishing security training for elections officials.
Commission spokesman Reid Magney said there is no evidence that the state’s elections systems have ever been compromised. He noted that hackers from around the world scan Wisconsin state government systems more than 9 million times a year looking for weaknesses they can exploit.
But he said extra security measures are important because voter information is one aspect of the elections that the commission has “the most control over.”
Security for voter registration system
Among the recent changes is the encryption of the statewide voter registration system known as WisVote. WisVote is used by nearly 3,000 government officials — mainly clerks in Wisconsin’s 1,852 municipalities. Magney said that the encryption ensures that, even if someone were able to get into the system and steal information, “it wouldn’t have any value to them.”
To prevent a hacker from getting that far, the commission implemented before the November 2018 elections a multifactor authentication system that requires clerks to use a USB-like key, along with their usernames and passwords, to get into WisVote.
Wisconsin’s decentralized election system also plays a role in the security of the systems.
Magney said that if a hacker were able to get a clerk’s username, password and key verification to access the WisVote database, the hacker would have access only to the voter information in that clerk’s municipality or county.
He added the segmented voter information also allows clerks to become familiar with their jurisdictions, saying this makes it harder to generate false identities and voters.
“The clerks know how many voters they have,” Magney said. “They know their people. They’re essentially an extra security vigil on their own system because they have experience with their system.”
Concerns for smaller communities
But Magney called the decentralized system a “double-edged sword,” noting it could lead to equipment disparities. He said a smaller, more rural communities may not have access to newer technology, potentially making them more vulnerable to hackers.
“The thing that we are dealing with now is how do we make sure that the clerks in smaller towns or villages — places where they don’t have those IT resources — how do we make sure that they have secure equipment,” Magney said.
In May 2018, the commission launched a mandatory election security training program for county and municipal election officials. The program includes general cautions about suspicious links, as well as training on system-specific modules.
McKim said just because Wisconsin’s elections haven’t been compromised does not mean they won’t be in the future.
She said it scares her when election officials say elections haven’t been compromised, calling the argument “irrelevant.”
“I don’t understand why election officials even bring that up,” McKim said. “They’re kind of implying that they are going to wait until something bad happens to take necessary preventive action.