The new concerns relate to the state's decision to buy voting machines before the 2016 election equipped with their own Verizon modems that transmit preliminary election results to the state Board of Elections after the polls close. The modems have helped shorten the time it takes the state to declare winners on election night.
But because any Internet connection exposes a system to potential cyberattack, the federal government never certified the modem-equipped machines for states to use and this summer the U.S. Senate committee investigating Russian efforts to breach the 2016 elections urged states to tighten their election security, use only federally-approved voting machines and "remove (or render inert) any wireless networking capability," such as a modem.
Following that, a Vice.com investigation published Thursday found Rhode Island's elections system was, at least for some period of time, connected to the Internet, contradicting assurances from the company that makes the machines that they are walled off from any possible web-based attack.
"Rhode Island, unlike other states, conducts its elections from a centralized office at the state Board of Elections, instead of farming out election administration to each county or jurisdiction," the story said. "The election reporting system the researchers found online, therefore, was the reporting system for the entire state."
The Internet hacking issue prompted the state Board of Elections Tuesday to begin a new review of the modems just a month after giving the go ahead for an upgrade — from 3G to 4G — of all 260 vote-counting machines in the state. (The upgrade was slated to begin next January.)
Rob Rock, director of elections for Secretary of State Nellie Gorbea, recommended the state "convene a meeting of cyberexperts" to study varying risk of transmitting election results by modem.
Board of Elections Director Robert Rapoza said the possible alternatives to transmitting results by modem would be having election workers deliver memory sticks or paper tallies of preliminary results by hand to the Board's headquarters. He said the results have been transmitted either by modem or land line since 1997.
Rhode Island's voting machines are made and serviced by Elections Systems & Software of Omaha, Nebraska, the dominant player in the United States election equipment market. Rapoza said 11 other states, or some jurisdictions in those states, use the same modem-equipped DS200 optical scanners as Rhode Island.
Hacking concerns prompted Maryland to cancel an order for modem-equipped scanners and buy them at a lower price with the modems removed.
Although the issue with the modems is drawing attention now with the Russian hacking investigation, Common Cause Rhode Island flagged the issue back in the spring of 2018, just as the state was about to buy 20 new modem-equipped voting machines to supplement the 600 it purchased before the 2016 election.
"The presence of these modems in the absence of a well-defined strategy for mitigating the risk they present, undermines confidence in the voting system," Common Cause Executive Director John Marion wrote to the Board of Elections and Gorbea in May 2018. "We believe the people of Rhode Island should be provided with assurances that the Board understands the risks created by the presence of the modems in the tabulators and is doing something — whether removing them or managing the risk — to protect the voting system."
State law allows the secretary of state to use voting machines that aren't federally approved in some circumstances and Gorbea went ahead with the purchase.
Responding to a separate concern last year that ES&S voting machines came with "remote access software" for technical support that could be hacked, the company told Rhode Island and other states that this feature had been discontinued, leading many to believe the machines were offline.
Election Systems & Software maintains that the modem-connected voting machines are secure.
"I think our system is safe and we are doing everything we can to make sure it stays that way," Joe Vitale, Rhode Island Account Manager for Election Systems & Software, told the Board of Elections Tuesday.
If the state does convene a panel of cybersecurity experts to look at the modem issue, it will not have the benefit of a state cybersecurity officer after Gov. Gina Raimondo eliminated the post earlier this year.
"The primary objective of that role was to complete the Cybersecurity Strategy," Department of Administration spokesperson Brenna McCabe said. "We reached a point where Mike Steinmetz was on track to complete the strategy and was ready to move on. With the strong foundation he helped build during his time here and the improvements made to IT over the last few years, we are now in a different phase of implementation that no longer necessitates that [position.]"
©2019 The Providence Journal (Providence, R.I.) Distributed by Tribune Content Agency, LLC.
