[E]LMORE — When Sharon Draper first became clerk of this lakeside town, there were about 250 registered voters. That has grown over the years to approximately 700.
But for many elections, the number of voters is still not robust enough to justify the expense of using a tabulator, so the paper ballots are counted by hand. As to fraud concerns, Draper says she doesn’t worry. She knows most of the people in town.
“There just are not any security issues, I feel, in a little town like Elmore,” Draper said.
Since revelations that 21 states’ systems were targeted by Russian hackers in the 2016 election, security of the democratic process has been a major concern across the country.
Election security has been the subject of congressional reports and hearings. Lawmakers approved an expenditure of $380 million earlier this year to help jurisdictions buttress their systems.
While federal and state officials are very focused on cyber threats to the voting system, the officials responsible for administering elections in Vermont towns say they aren’t too worried about the security of the electoral process.
At a U.S. Senate hearing last month, Vermont Secretary of State Jim Condos argued to lawmakers that the American election system is fortified because it is administered by state and local governments, rather than at the federal level.
“State and local autonomy over elections is our best asset against cyberattacks,” he said. “Our decentralized, low connectivity, electoral process is inherently designed to withstand and deter threats.”
But cybersecurity is not a top concern for the officials on the ground administering elections in Vermont. In interviews, several town clerks indicated they do not worry that their jurisdictions would be vulnerable to hacks, pointing to a system that relies on paper ballots, limited digital contact, and familiarity with the individual members of the community.
As a child, Morristown Town Clerk Sara Haskins loved elections. Her mother is a clerk, and Haskins said she grew up a reverence for the nitty gritty of the democratic process.
Now, as a clerk herself, Haskins said there are protocols town officials follow to ensure the accuracy of the vote count.
Vote tabulators are kept locked up, as are the memory cards used for each election. In advance of an election, town officials go through a process to test the machines, which is open to the public. The tabulators do not have any connection to the internet, so there is no potential for an online hack.
Haskins said she does not have a lot of concerns about the security of the elections in Vermont. For one, there’s not much anonymity in the state’s municipalities, she noted.
“Vermont’s so small-town,” she said. “We know our voters that are coming in for the most part.”
The state’s use of paper ballots also gives her confidence in the system.
“If the power went and you couldn’t use the tabulator, at the end of the day if there’s ever any questions, we still have those ballots that we can physically count,” she said.
The only aspect of the elections system that involves an internet connection is the voter checklist, which is maintained in an online database by the Secretary of State’s Office.
Haskins said access to the statewide database is limited. Only she and two assistant clerks have access in Morristown, and to set up access the town works with the Secretary of State’s Office. Their access to the system is limited to the Morristown voter roll.
Linda Martin, the clerk in nearby Wolcott, and Haskins’ mother, said the database is the only potential cybersecurity weakness in the state’s electoral system.
Martin feels the state has been “diligent” in monitoring the system for security vulnerabilities, though she said there is always a risk. For her part, the protections around accessing the system are similar to her access to her personal accounts.
“It’s not much different than accessing my checking account at this point,” Martin said. “You have a username and a password.”
Draper, the clerk in Elmore, also said she does not have concerns about cybersecurity threats. The state handles the security of the system, she said. Asked about protocols in her office, Draper said she’s pretty confident. She is the only person with access to her computer, she said.
In an interview last week, Condos said that there are always concerns about vulnerabilities with an online system.
“Nobody should feel comfortable that they can’t be hacked,” Condos said. If there is any type of computer involved, whether cell phone, laptop or tablet, it is vulnerable, he said. “The question is, have you put in the necessary deterrents to protect and defend against those attacks?”
The state is required by federal law to maintain a centralized voter database, he said, and his office takes charge of maintaining the security of the system.
They have an array of security measures already in place. The office uses a program that monitors for attacks and sends an alert within 15 minutes if a hacker is trying to gain access. Certain IP addresses are blacklisted, so known bad actors and people trying to access the system from certain countries, including Russia and China, can’t get to the system. There are multiple layers of firewalls to defend against attacks, he said.
The system is also subject to a weekly hygiene scan by the Department of Homeland Security, and it undergoes regular tests to see if the system can be hacked.
Election officials in Vermont’s 246 towns have access to the system, and Condos acknowledged that the more people who have access, the more vulnerabilities there are. However, he said, the system was designed to minimize security risks. For instance, town officials only have access to information about their own towns, he said.
Condos said that his office is taking steps to improve security around the towns’ access to the system.
The office already has issued guidance to clerks on basic elements of digital security — advice such as avoid leaving your password written down on a Post-it note near your computer, he said.
Within the next 90 days, his office will be looking to implement two-factor authentication for town officials logging into the system, which will be followed by a round of training with clerks. That protocol will require that in addition to using a password, people have to enter a code sent to them by text or email to access the system.
Meanwhile, a $3 million grant the state will get from the federal government as a result of the appropriation in last month’s omnibus bill will help to pay for additional tests of the system, and for upgrading the tabulator equipment many towns use, according to Condos.
His office is also raising awareness around election security measures. It will host a public forum on election cybersecurity Thursday.
