Virginia bans paperless touchscreen voting machines over hacking concerns ahead of November election

Virginia agreed on Friday (8 September) to immediately stop using paperless touchscreen voting machines ahead of its gubernatorial election in November following security experts' concerns that the machines are potentially vulnerable to hackers. The decision, taken by the Virginia State Board of Elections, comes after the Virginia Department of Elections recommended that the machines be decertified.

The move marks a significant step for a US state to bolster its election system's cybersecurity since the 2016 presidential election. US intelligence agencies concluded in January that Russian President Vladimir Putin ordered a complex "influence campaign" including cyberattacks, disinformation and leaks to sway the vote in Donald Trump's favour.

"As security threats against election systems have increased, the Department has grown more vigilant regarding potential threats against voting equipment," Virginia's Department of Elections said in a memo. They also cited the security research involving Direct Recording Electronic (DRE or touchscreen) voting equipment at the recent Def Con hacking convention in its decision as well.

In July, security experts were able to easily break into multiple types of voting machines at the Def Con hacking conference in Las Vegas.

"Multiple types of DREs, some of which are currently in use in Virginia, were hacked according to public reports from DefCon," the department said.

"Additional troubling reports from DefCon were publicized, including one that expressly stated the password for a DRE that was in use in the Commonwealth, and one that indicated that some DREs in use have a single password shared by all machines from an individual vendor."

Following a review of various DREs, the Virginia Information Technology Agency (VITA) assessed that "each device analyzed exhibited material risks to the integrity or availability of the election process." It also noted that the potential loss of vote in each system was "significant" since none of the machines seem to produce paper audit trails during the voting process either.

In June, more than 100 cybersecurity and voting experts urged Congress in a letter to take steps to phase out DRE voting machines that do not produce voter-verified paper ballots that can be checked with electronic records to ensure that votes are accurately tallied.

According to the Department of Homeland Security, Russian hackers targeted the election systems of at least 21 states in the lead up to the November election last year. Although a small number of systems were successfully breached, DHS said no votes were manipulated.

Virginia earlier passed a law ordering that DRE machines be phased out by 2020.

This November, the state will be electing a new governor and other officials. The Richmond Times-Dispatch reports that 10 localities have purchased voting equipment for the upcoming election, while the rest will have to quickly do so before the upcoming races in 7 November.

"The security of the election process is always of paramount importance. The Department is continually vigilant on matters related to security of voting equipment used in Virginia," Edgardo Cortés, the state's Commissioner of Elections said in a statement. "The ability to meaningfully participate in our democracy is one of the most important rights that we have as citizens, and the Department of Elections is dedicated to maintaining voters' confidence in the democratic process."