In Focus This Week
Keeping voter sites secure while still keeping them accessible
By M. Mindy Moretti
Recently some Georgia voters living overseas attempted to access the state’s online voter registration database only to find that their access was denied.
Instead of access to the state’s online voter registration portal, overseas voters found an access denied warning along with contact information for assistance.
In an effort to secure the state’s website and OVR database, the Georgia secretary of state’s office made the choice to block international IPs from accessing the voter registration portal on their website.
According to a spokeswoman for the secretary of state’s office, the portal will be open from Sept. 18 to Election Day.
“I have a lot of sympathy for the states on these issues because they are caught between wanting to make an increasing number of online services freely available to voters and an exponential escalation in threats,” Susan Dzieduszycka-Suinat of the US Vote Foundation and Overseas Vote Foundation. “Not too long ago, this was being done without problems like what they face now. The attacks from hostile foreign powers are very real. These attacks are very real and bots can bog down these open services with SPAM just so many times before a state will want to put barriers up.”
However, Dzieduszycka-Suinat cautioned that blocking foreign IP addresses and locking overseas voters out of their services is the wrong kind of barrier.
“It won’t really do anything to dissuade a hacker. It will only turn away real voters. A hacker, or even a determined voter, will just get onto a VPN and to a US IP address, and guess what? They’re in,” Dzieduszycka-Suinat said.
The Federal Voting Assistance Program said that they reached out the Georgia secretary of state’s office for a better understanding of what was happening, but information appearing on social media is what concerned FVAP most rather than individual state policies.
“We are aware of reports that other states may also be limiting access to their websites from foreign-based IP addresses so we will continue to monitor social media. We are actively working to encourage states to leverage us as a key resource for access in light of any new cyber security protocols,” said FVAP Director David Beirne. “What will be especially interesting is to see if the impact of a whitelisting cybersecurity policy, or special access for known entities, will affect the ability of military and overseas voters to retrieve their electronic blank ballots — or if the impact is limited to online voter registration systems.”
The US Vote Foundation and Overseas Vote Foundation as well as FVAP portals remain open to overseas IPs. According to Beirne, FVAP leverages a content delivery network which provides duplicate web servers for U.S. and worldwide distribution to offset internet latency in other countries. FVAP also maintains a web application firewall to dynamically mitigate intrusion attempts.
We reached out to some of the states with the highest percentages of members of the armed services, and that offer online voter registration and the response was mixed.
Virginia Elections Commissioner Christopher Piper said that the commonwealth does not comment on specific election security protocols, however, quick check by a friend overseas, living in one of the former Soviet republics, found that Virginia’s online voter registration portal remains accessible to overseas IP addresses.
According to Hillary Rudy with the Colorado secretary of state’s office, most international IPs have access to Colorado’s online voter registration site. Colorado does have network blocks in place on some nations due to a high volume of attacks coming from the region. The Colorado Department of State also blocks IP addresses attempting to attack its systems, no matter the source of the traffic, until the attack stops.
Whitelisting and Blacklisting
One way that states can secure their sites—and some are already employing—is whitelisting and blacklisting.
According to FedTech, the use of blacklisting as a form of cybersecurity protection is common, but it requires security personnel to keep a permanent eye out for any malware they want to block from an agency’s IT environment. Whitelisting lets IT teams grant advance permission for specific, trusted items (such as applications or URLs) to run on the network, instead of blocking access to previously identified risks and threats.
Colorado employs both.
“We use whitelisting based on known users as well as blacklisting of known malicious IPs. Whitelisting and blacklisting is done both by in-house staff and through threat intelligence platforms,” Rudy explained. “The cost to a jurisdiction of using automated threat sharing feeds is dependent not only on the cost of the feed itself (in our case, approximately $10,000 annually), but also based on the ability of technical infrastructure to ingest or consume those feeds and apply them automatically.”
Beirne from FVAP said that whitelisting versus blacklisting isn’t an either/or proposition and that FVAP would also offer that neither is a single solution to cybersecurity, but both operate as part of a comprehensive approach. Whitelisting conveys a sense of limiting access which is accurate for more sensitive areas of a website. Blacklisting is a recognition of known bad actors or those of a particular reputation.
Beirne said it’s important to recognize the need for an audit of traffic prior to whatever form of security it implemented.
“There is no doubt that whitelisting holds value, but the relative benefit needs to be weighed against the relative cost of limiting access,” Beirne said. “For example, an audit of web traffic historically can help identify the need for blacklisting against known bad actors and only whitelist those portions of a website that require a deeper level of privileged access to some portion of a system on the backend.”
According to Common Cause all sensitive voter registration information gathered by the now-defunct Presidential Advisory Commission on Election Integrity has been destroyed in accordance to an agreement between the Administration and Common Cause.
“President Trump’s now-disbanded voter fraud Commission was flawed from the start,” Paul Seamus Ryan, vice president for policy and litigation of Common Cause, said in a statement. “Common Cause and its 1.2 million members celebrate the end of this litigation and the destruction of the commission’s illegally collected voter data.”
Arizona: Fallout from the September 4 primary in Maricopa County continued this week. A report from the Arizona Republic noted that some voters were denied the right to vote because they presented tribal IDs, although those IDs are acceptable under Arizona law. Analysis has shown that the delayed openings in Maricopa County affected 95 precincts and as many as 270,000 voters. On Tuesday, Maricopa County Recorder Adrian Fontes posted a video to Facebook Live apologizing for the problems. The county has approved $200,000 to audit the election.
Massachusetts: Turn-out on Massachusetts post-Labor Day primary was higher than expected, but the higher turnout did not seem to impact operations, which, for the most part, were smooth in the commonwealth. With only a few dozens votes separating candidates in a Democratic primary for a U.S. House seat, the secretary of state’s office ordered all ballots impounded in anticipation of a recount. In Lowell, about 100 votes cast at one polling place were not included in the unofficial election totals. Human error resulted in the wrong reporting of results from Fitchburg City. In Newton, heat caused some issues for poll workers, including machine malfunctions.
Election News This Week
The U.S Attorney’s Office for the Eastern District of North Carolina has subpoenaed voter records from the state board of elections and 44 counties. The SBOE, the subpoena came at the request of Immigration and Customs Enforcement. According to the News & Observer, among the state records from Jan. 1, 2010 through Aug. 30, 2018 that were requested: all voter registration applications, federal write-in absentee ballots, federal post card applications, early-voting application forms, provisional voting forms, absentee ballot request forms, all “admission or denial of non-citizen return forms,” and all voter registration cancellation or revocation forms. The request includes executed official ballots, including vote-by-mail and early ballots that are traceable to the voters who cast them. One local election official told the Outer Banks News that the request would be “devastating” to preparations for the midterms.
Elections officials in Hawaii do just about everything they can to get residents registered to vote. They set up booths at festivals and on college campuses and send staff to the monthly naturalization ceremonies with registration forms in hand. But, according to an article in the Honolulu Civil Beat, the one thing you won’t hear the officials tell anyone is to actually go vote. “It’s not on us. We can’t send out the message to go vote,” elections office spokeswoman Nedielyn Bueno told the Civil Beat. “It’s important for folks to know how to do it, it’s up to the individual to know, ‘I’m ready to vote.’” Bueno also noted that it’s not possible for the state to use federal funds to promote voting and that the office has unsuccessfully requested state funds in the past to boost its voter education efforts
Sometimes, you just have to spend some money. This week the Cerro Gordo, Iowa auditor’s office announced that it would spend $4,425 to retain RBM Election Support Services through the general election in November. The company will troubleshoot issues during ballot processing, assisting poll workers, result posting, post-election processing, and assisting with equipment that processes ballots. “It’s a good use of taxpayer dollars to make sure our elections are good and clean elections. It’s imperative to democracy,” Mark Suby of Mason City told KIMT.
Personnel News: Ed Finn is retiring from his job as the Medford, Massachusetts clerk after 20-years on the job. Ronnie Metsker has been reappointed as the Johnson County, Kansas elections commissioner. Brazos County, Texas Elections Administrator Trudy Hancock has completed her CERA certification program. Jordan Esten is the new Chief Executive Officer for Clear Ballot. Esten was previously Clear Ballots chief operating officer.
In Memoriam: Former Linn County Clerk Del Riley died on August 23. He was 93. Riley was known as the “father of vote-by-mail” in Oregon elections. “His leadership, practices and policies are still in place today, 30 years after leaving office,” Roger Nyquist, Linn County Board of Commissioners chairman told the Albany Democrat-Herald. “The standard that Del set in Linn County government will be in place for a long time.” Current Linn County Clerk Steve Druckenmiller told the paper Riley’s pursuit of a vote-by-mail system for Oregon “changed the way elections are held in a profound way. He took a lot of ridicule, but was a visionary and changed the face of elections in Oregon, Washington, Colorado, many counties in Utah and California. This movement is growing nationally and that is thanks to Del.” He ran for the Linn County Clerk’s position in November 1966, was elected and took office in January 1967. He held the position for 18 years.
Colorado: The Golden City Council has referred a measure to the November ballot that would give 16-year-olds the right to vote in local elections on issues and candidates. If approved, Golden would become the first locality in Colorado to extend voting rights to those under 18.
Ohio: Akron has gathered enough signatures to allow voters to decide in November whether or not the city’s primary election should be moved from September to May. Because moving the election is a charter issue, it must be approved by voters.
Pennsylvania: Erie City Councilwoman Kathy Schaaf has introduced a resolution to proclaim September 25 as Voter Registration Day in Erie. “We are living in a very crucial time in our history, and we need more people to realize the power that they have in their vote,” Schaaf told WFXP.
Arizona: The State of Arizona has reached an agreement with several groups including Mi Familia Vota, Promise Arizona and the League of Women Voters of Arizona who had threatened to sue over about 300,000 potential voters who weren’t offered a required chance to register to vote when they contacted the state’s Department of Economic Security or the Arizona Health Care Cost Containment System. Affected voters will get a bilingual letter explaining that they should have been offered the chance to register to vote.
Florida: U.S. District Court Judge Mark walker heard arguments this week over whether or not 32 Florida counties should provide bilingual ballots for the November elections. The suit was brought by Mi Familia and other organizations on behalf of the influx of Puerto Rican voters the state has seen since Hurricane Maria. A coalition of counties argued before Walker that there simply is not time to provide the ballots in Spanish. Although he did not rule, according to WCTV, Walker seemed to agree with the supervisors of electiosn.
Illinois: McLean County Circuit Judge Paul Lawrence has ruled that a referendum to disband the Bloomington Election Commission should proceed after he found 1,187 petition signatures were valid. The referendum needed 1,000 signatures to make the ballot.
Kansas: The Kansas Supreme Court has ordered Douglas County to summon a citizen-initiated grand jury to investigate allegations that Secretary of State Kris Kobach’s office mishandled voter registration forms during the 2016 election. According to the Lawrence Journal-World, In a one-page order signed by Chief Justice Lawton Nuss, the court denied Kobach’s request to review a Kansas Court of Appeals decision in June that said Lawrence resident Steven Davis had met the legal requirement for circulating petitions to summon a grand jury. The Supreme Court did not provide any further explanation of its decision.
Michigan: College Democrats from the University of Michigan and Michigan State University have filed suit against Secretary of State Ruth Johnson alleging that state voting laws discriminate against younger voters. According to the Detroit Free Press, the suit asks a federal judge to declare unconstitutional a state law that requires a voter’s residence for voter registration purposes to match the address on the voter’s driver’s license.
Also in Michigan, the U.S. 6th Circuit Court of Appeals, in a 2-1 decision has blocked a lower court ruling that would have struck down the state’s 2016 law banning straight-ticket voting. The appeals court said “there are very serious problems with both the factual underpinnings and the legal analysis” of the lower court’s opinion.
New Mexico: The New Mexico Republican and Libertarian parties, along with two outside political groups and a Democratic write-in candidate, filed a petition with the state Supreme Court late Thursday seeking to bar the straight-party voting option for the Nov. 6 election.
Texas: Crystal Mason, 43 of Tarrant County has been ordered to spend 10 months in jail followed by 26 months of supervised release after she illegally cast a ballot in the 2016 election while still on parole for another charge.
U.S. Virgin Islands: The U.S. Solicitor General Noel Francisco has filed paperwork with the U.S. Supreme Court rejecting any responsibility of the federal government for a law preventing some territorial residents from voting absentee in federal elections.
California: This week the California Department of Motor Vehicles announced that it sent the secretary of state’s office 23,000 erroneous voter registration records. According to the Sacramento Bee, the DMV said the errors stem from technicians toggling between multiple screens and registration information being improperly merged. According to the agency, 1,600 residents did not complete a voter registration affidavit and had their information sent to the secretary of state, which maintains the state’s list of registered voters. In some cases, people were registered in the wrong party. Some customers who wished to opt out of the program were added. The department said the inaccurate customer information largely affected “voter preferences such as, vote-by-mail options, language and political party selections.”
Louisiana: A second company (Hart InterCivic) that lost a bid to provide new voting machines to the state of Louisiana has sent a letter to the Office of State Procurement supporting a letter sent by another losing bidder. According to The Associated Press, Hart’s letter said the evaluation was “flawed and lacked the fundamental transparency that Louisiana voters deserve.”
Oklahoma: Things are about to get a bit easier for Sooners who wish to update their voter information without leaving home. Next week the Oklahoma State Election Board will roll out a new online form that current voters can use to update their information. Election Board Secretary Paul Ziriax told The Oklahoman it’s a good first step toward implementation of the state’s online voter registration system, which is still years away. “We have been testing this significantly over the past few weeks. We also had the (Oklahoma) Cyber Command test this for security, and it passed muster with them last week,” Ziriax said during a meeting of the board on Tuesday according to the paper. “We’ve been wanting online voter registration for a long time. While this is not full-blown online voter registration, it’s still a big step forward in modernizing elections in Oklahoma and I’m very happy to be moving forward with it.”
Rhode Island: As a result of what’s being called an IT snafu with the state’s Division of Motor Vehicles’ automatic voter registration system, the new and updated voter registration records of at least 5,000 people were not processed. According to the Providence Journal, there was an issue with “missing fields” in the program that transfers the information from the DMV to the secretary of state’s office. Secretary of State Nellie Gorbea asked the state board of elections to include those voters on the rolls for next week’s primary.
Opinions This Week
National Opinions: Secure Elections Act
Arizona: Maricopa County
Arkansas: Madison County
Indiana: Student voting
Mississippi: Voting rights
Oregon: Election security legislation
Texas: Election security
West Virginia: Election protection
Wisconsin: Automatic voter registration
EAC Online Discussion about Voter Registration — The U.S. Election Assistance Commission (EAC) will host an online event on Wednesday, September 19 to discuss two pre-election dates that are important to elections officials and voters: September 22, the 45-day deadline for states to send absentee ballots to uniformed and overseas citizen voters; and September 25, National Voter Registration Day. The 11 a.m. Eastern Time event will be live-streamed on Facebook and the EAC’s website, www.eac.gov. Moderated by EAC Chairman Thomas Hicks, the discussion will feature David Beirne, Director of the Federal Voting Assistance Program, and Brian Miller, Executive Director of Nonprofit Vote, detailing their organizations’ activities to ensure voters know they have an opportunity to cast a ballot in the upcoming midterm elections. Where: Online. When: 11 a.m.; September 19.
International Association of Government Officials — IGO’s 2019 mid-winter conference will be held in Irvine, California, January 6-11, 2019. Watch this space for more details about agendas and registration.
National Association of State Election Directors — The NASED Winter Conference will be held in Washington DC, February 1-4, 2019. Watch this space for more details about agendas and registration.
National Association of Secretaries of State — The NASS Winter Conference will be held in Washington, DC, February 1-4, 2019. Watch this space for more details about agendas and registration.
International Association of Government Officials — IGO’s 2019 Annual Conference will be held in Houston, Texas, July 11-17. Watch this space for more details about agendas and registration.
National Association of Counties — NACo’s 2019 Annual Conference will be held in Clark County (Las Vegas), Nevada July 11-15, 2019. Watch this space for more details about agendas and registration.
National Association of State Election Directors — The NASED Summer Conference will be held in Austin, Texas, July 14-16, 2019. Watch this space for more details about agendas and registration.
Job Postings This Week
electionlineWeekly publishes election administration job postings each week as a free service to our readers. To have your job listed in the newsletter, please send a copy of the job description, including a web link to firstname.lastname@example.org. Job postings must be received by 5pm on Wednesday in order to appear in the Thursday newsletter. Listings will run for three weeks or till the deadline listed in the posting.
Certification Manager (Denver, CO) – Dominion Voting Systems — Dominion Voting Systems is seeking a Certification Manager to join our team in Denver, CO! This position is a cross -functional leader playing a key role in managing certification efforts for Dominion Voting products. In this role, you will act as a representative of the company with State and Federal certification officials, test labs, and other key internal and external stakeholders throughout the certification process. Application: For the complete job listing and to apply, click here.
Customer Relations Manager (Phoenix, AZ) – Dominion Voting Systems — Dominion Voting Systems is seeking a Customer Relations Manager to join our team in Phoenix, AZ! This position will be responsible for effectively and proactively managing the day-to-day relationship, administration and technical/product support of one or more assigned customer accounts. Additionally, the CRM will serve as project manager for specialized projects such as pre- and postelection day support, new product implementations, and/or product upgrades/updates. Application: For the complete job listing and to apply, click here.
Election Security Lead, Wisconsin Elections Commission — the Wisconsin Elections Commission (WEC) develops and maintains several significant IT applications to assist in the administration of Wisconsin elections, including the statewide voter registration system known as WisVote, the Canvass Reporting System, and electronic poll book software known as Badger Book, as well as public websites such as MyVote Wisconsin and BADGER Voters. Protecting the security of these applications is crucial to ensuring accurate elections and maintaining public confidence in the integrity of Wisconsin elections. This position serves as the point person for developing and implementing the agency’s overall elections security plan. It is responsible for ensuring the implementation of cyber security best practices in the Commission’s technical applications including WisVote. This position will research and maintain the agency’s knowledge base regarding cybersecurity infrastructure, resources and practice. This position will also liaise with other State agencies and Federal entities regarding potential cyber threats against the Commission’s applications. Salary: $51,398-$80,621. Deadline: Open until filled. Application. For the complete job listing and to apply, click here.
Elections Program Manager, CIS— the Elections Program Manager is assigned to the Elections Infrastructure ISAC (EI-ISAC) at the Center for Internet Security. Reporting to the Director of the EI-ISAC, the Elections Program Manager will partner with other cybersecurity team members to promote the CIS mission and help support our growth. The primary purpose of this position is to serve as a subject matter expert on and represent the EI-ISAC in public forums regarding election infrastructure issues. The Elections Program Manager will work with the EI-ISAC Director to build relationships in the elections community and identify tools, products, and initiatives that meet the security needs of election officials. Application:For the complete job listing and to apply, click here.
Elections Supervisor, Pinal County, Arizona— performs professional and administrative work in planning, organizing and directing strategic and daily goals and objectives, operations and activities of the Elections Department. Work is performed under the general administrative direction of the Elections Director. The employee is expected to exercise initiative, independent judgment and discretion. Salary: $49,647-$56,473. Application: For the complete job listing and to apply, click here.
Field Sales Director, Hart InterCivic — the Field Sales Director works primarily on the road and from a home office when he/she is not on business travel. The Field Sales Director is responsible for creating news sales with prospects and existing clients in a defined region. Today, this role is a single contributor and does not directly manage people. This position will report to the VP of Sales. Application: For the complete job listing and to apply, click here.
Inside Sales Representative, Runbeck — to support our desired growth and market expansion, we continue to hire outstanding talent in multiple departments. We are looking for highly motivated, dedicated and talented individuals who will be able to contribute significantly to the success of the company while receiving great opportunities for professional growth and financial benefits. Responsibilities include: Contact potential or existing customers to inform them about a product or service; ability to present solution and its value to a prospect over the phone; answer questions about products or the company; ask questions to understand customer requirements and close sales; enter and update customer information in the database; keep records of calls and sale and note useful information in the CRM; process orders in an accurate manner; and go the “extra mile” to meet sales quota and facilitate future sales. Application: In order to apply, please send a resume to Tammy White: email@example.com.
Program Manager, Overseas Voting Initiative, Council of State Governments — the Program Manager of CSG’s Overseas Voting Initiative, funded through a cooperative agreement with the US Dept. of Defense (DOD) Federal Voting Assistance Program (FVAP), provides day-to-day management and oversight of the Initiative, including research and policy analysis of electronic absentee voting systems for military voters, and development and dissemination of educational policy programming and deliverables to state leaders in support of the cooperative agreement. The Program Manager works within CSG’s Center of Innovation and in cooperation with CSG’s policy and executive management teams as well as regional offices, affiliates and members to support, monitor and improve state elections processes for military and overseas voters. Application: For the complete job listing and to apply, click here.
Project Manager (Austin, TX) – Hart InterCivic — Hart InterCivic is looking for a project manager to work with our Professional Services Team. The project manager oversees the deployment of voting systems and training to both existing and new Hart customers. The ideal candidate has experience in the elections industry, is PMP certified, and is motivated to achieve success for our customers with initiative. Travel up to 80 percent. Reports to the Manager of Professional Services. Application: For the complete job listing and to apply, click here.
Project Manager (San Leandro, CA or Sacramento, CA) – Dominion Voting Systems — Dominion Voting Systems is seeking an experienced Project Manager to join our team in either San Leandro, CA or Sacramento, CA! This position will be responsible for the effective technical project management of assigned projects which includes but not limited to, business, functional, and risk analysis as well as implementation of new processes, equipment and systems. Application: For the complete job listing and to apply, click here.
Python Developer, Clear Ballot — Clear Ballot seeks a talented python developer in the Boston area to assume responsibility for an existing suite of python scripts to create files for use with ClearVote(TM) digital voting system. Job responsibilities: Maintain and enhance existing python scripts that read PDF formatted ballot styles and produce the files needed by ClearVote (TM) digital voting system to tabulate said ballot; Run existing python scripts to generate marked test ballots for use in testing ClearVote(TM); Develop and execute test plans to guarantee ClearVote tabulates marked ballots correctly; Expand PDF parsing capabilities as new customer’s ballot styles are introduced; Leverage analytics you gather to improve performance through script and/or hardware changes; Must perform these duties within aggressive timelines that often require working outside of normal business hours. Application: For the complete listing and to apply, click here.
Software Developer II (Toronto, ON) – Dominion Voting Systems — Dominion Voting Systems is seeking an experienced Software Developer to join our team in Toronto! This position will be responsible for providing high-level technical expertise to the design, development, coding, testing and debugging of new software products and/or significant enhancements to existing software products. Application: For the complete job listing and to apply, click here.
Software Product Specialist II (Denver, CO) – Dominion Voting Systems — Dominion Voting Systems is seeking a Software Product Specialist II to join our team in Denver, Colorado! This position will be responsible for delivering a wide variety of technical and non-technical customer support services related to the implementation, operation, repair, maintenance and upgrades of Dominion Voting Systems technology products. Application: For the complete job listing and to apply, click here.
Software Product Specialist II (Reno, NV) – Dominion Voting Systems — Dominion Voting Systems is seeking a Software Product Specialist II to join our team in Reno, NV! This position will be responsible for delivering a wide variety of technical and non-technical customer support services related to the implementation, operation, repair, maintenance and upgrades of Dominion Voting Systems technology products. Application: For the complete job listing and to apply, click here.
Software Product Specialist II (Phoenix, AZ) – Dominion Voting Systems — Dominion Voting Systems is seeking a Software Product Specialist II to join our team in Phoenix, AZ! This position will be responsible for delivering a wide variety of technical and non-technical customer support services related to the implementation, operation, repair, maintenance and upgrades of Dominion Voting Systems technology products. Application: For the complete job listing and to apply, click here.
Software Product Specialist II (San Leandro, CA) – Dominion Voting Systems — Dominion Voting Systems is seeking a Software Product Specialist II to join our team in San Leandro, CA! This position will be responsible for delivering a wide variety of technical and non-technical customer support services related to the implementation, operation, repair, maintenance and upgrades of Dominion Voting Systems technology products. Application: For the complete job listing and to apply, click here.
Systems Engineer, Clear Ballot — We are looking for a talented Systems Engineer who has both a technical and services/support background which enables them to quickly assess customer needs and offer value to Clear Ballot’s customers. The Systems Engineer will gain a deep understanding of how Clear Ballot’s products operate and their optimal configuration to build a streamlined installation process of the Clear Vote election system. The ideal candidate for this position can prioritize mission critical tasks and coordinate the implementation and expansion of our systems. They will be able to work directly with customers, display innovation, think conceptually and act tactically to build consensus around system installation and enhancement and meet deadlines. Application: For the complete job listing and to apply, click here.