In three Southern states with some of the nation's most vulnerable election systems, federal grants designed to help thwart cyberattacks may not provide much protection in time for the mid-term elections as Congress intended.
The $380 million in grant funding was supposed to help all states bolster their elections security infrastructure ahead of the 2018 elections after the intelligence community had warned that state voting systems could again be targeted by foreign hackers as they were in 2016.
States have until 2023 to spend the grant money, said Thomas Hicks, chairman of the Election Assistance Commission, which distributes the grants.
But the long procurement process for voting machines makes it hard for states to buy new machines with their grants and get them into service by the 2018 mid-terms, even though “Congress looked at getting this money out quickly to have an effect on the 2018 election,” Hicks said.
The money could have an impact in 2018 if states used it to hire security auditors to inspect voting systems in each county, said Ben Wallach, a computer science professor at Rice University who has studied election-system vulnerabilities in several states.
That kind of proactive computer hygiene could reveal bigger problems that might be caught and fixed before the mid-term elections, Wallach said.
But rather than shore up their aging, outdated voting systems, election officials in South Carolina and Louisiana will use their $5.9 million and $6 million grants as down payments on a fleet of new voting machines that won't be fully operational until 2020.
And in Georgia, where an 18-member commission is studying a similar replacement of the state's touch-screen voting machines, Secretary of State Brian Kemp hasn't decided how the state will use its $10.3 million grant.
Georgia, Louisiana and South Carolina are among only five states – along with New Jersey and Delaware - in which all voters use Direct-Recording Electronic voting machines that provide no independent paper trail to verify machine-reported vote tallies in the event of a close race or a security breach.
Experts have shown that a cyberattack could alter the programming of election-machine network systems and change voting results without detection.
In 2016, Russian hackers tried to penetrate election systems in 21 states, although there's no evidence that vote counts were changed.
In response, Congress provided states $380 million in Help American Vote Act funds through the Consolidated Appropriations Act of 2018. The grants range from $3 million for states with smaller voting-age populations, to more than $34.5 million for California.
The money can be used for things like cybersecurity training for elections officials, election-related technology upgrades or to fund post-election audits to confirm the accuracy of the vote counts.
The grants can also purchase replacement voting machines that provide an paper record, which can be checked against the final count. But the grant amounts are too small to buy all the replacement voting machines needed in states that use paperless electronic voting machines.
Many states, starved for funding needed to update their aging equipment, are using the one-time grants as seed money for costly new voting systems that state lawmakers must fund and approve in the future.
Even in Louisiana, which is moving to replace its voting machines in phases starting with the five largest parishes, the new equipment won’t begin rolling out in those areas until Spring 2019 at the earliest, said Meg Casper Sunstrom, a spokeswoman for Louisiana Secretary of State Kyle Ardoin.
“We’ve got to do it right rather than fast,” Sunstrom said.
Louisiana will formally request its grant money in a few weeks when the state legislature concludes a special session. The state hopes to replace all 10,000 of its 13-year-old paperless electronic-voting machines by 2020 at a cost of $40 million to $60 million, Sunstrom said.
In South Carolina, state officials will use their $6 million grant along with an expected $5 million in state funds to begin replacing more than 13,000 paperless voting machines, said Chris Whitmire, a spokesman for the South Carolina Election Commission. The effort, which likely won't be completed until 2020, is expected to cost more than $50 million, Whitmire said.
With just over four months remaining until the mid-term elections, at least 40 states and the District of Columbia have requested more than $266 million of the $380 million pot, according to the EAC.
"This money is enough that (states) could have security professionals go through and fix low-hanging fruit; installing the right security patches, cleaning things up, installing intrusion detection systems, improving the security of voter registration database," said Wallach, of Rice University.
But in the 13 states that still use paperless machines, the grant money is better spent on newer, more secure voting machines - even if they won't be ready for use in November - said Marian Schneider, president of Verified Voting, a group that promotes improved security at the polls.
"The utility of this ($380 million) is to go towards this large one-time expenditure to replace voting systems," Schneider said.
"What makes the paperless systems vulnerable is the inability to detect any problems with them," like a cyberattack, "and the inability to recover (vote counts through paper records) if a problem is detected,'" Schneider added.
In Georgia, Democratic State Rep. James Beverly of Macon, said the state should consider another possible use of its $10.3 million grant.
Replacing Georgia’s 27,000 paperless voting machines could cost anywhere from $40 million to more than $200 million, said Beverly, who chairs the Georgia House of Representatives Democratic Caucus.
Instead of a down payment on that cost, Georgia’s grant should be used in the 2018 election for technology improvements that ensure accurate vote counts in highly-populated areas, said Beverly, who's a member of the Secure, Accessible & Fair Elections Commission that’s studying a replacement voting system in Georgia.
State Representative Barry Fleming, the Republican co-chair of the SAFE Commission, did not respond to a request for comment in time for publication.
Georgia Secretary of State Brian Kemp is working with Governor Nathan Deal's office to decide how to the money will be used, said Kemp’s spokesperson, Candice Broce.