From 8 a.m. to noon on Election Day last November, voting in Johnson County, Ind., ground to a halt.
Lines at precincts across the county, just south of Indianapolis, swelled. Some voters waited hours to cast a ballot; some left furious that they were unable to do so.
"People weren't happy. People had to leave and go to work," said Cindy Rapp, the Democratic member on Johnson County's election board.
The county votes on electronic voting machines, which don't provide a paper trail — something cybersecurity experts vehemently warn against.
But those machines weren't what caused the issue in November.
Instead, the problem came from the computer system, known as an electronic poll book, that poll workers were using to check people in. Increasingly, more and more states and voting jurisdictions are using these systems to speed up and improve in-person voting.
According to federal data, nearly half of all voters who voted in person in 2016 signed in at their polling place using an electronic poll book. That's up from 27 percent just one presidential election prior.
Like many issues surrounding elections, moving from paper to a digital process may bring convenience, but it also brings big questions about security and reliability.
They 'don't really know what's going on'
Electronic poll books, also known as e-poll books, move the check-in process from a big book of names that a poll worker must flip through to a tablet or laptop computer.
Depending on the voting jurisdiction and the specific product, the technology can provide myriad benefits, such as being able to point voters who have shown up at the wrong precinct to the right one and allowing for a vote center model in which voters can vote at any polling place in their jurisdiction.
But the biggest benefit is cutting down the amount of time it takes to get voters checked in, says Wendy Underhill, the director of the National Conference of State Legislature's elections and redistricting team.
"Lines can be a problem in elections, and if you can get checked in quickly, that's a good thing," says Underhill. "It's also an opportunity to update a person's record. It's about efficiency and accuracy as well."
But many of these benefits rely on the e-poll books' being able to be connected to the Internet or at least to an election board's network, thereby greatly increasing vulnerability to a cyberattack, says Joseph Lorenzo Hall, the chief technologist at the Center for Democracy & Technology.
Unlike with equipment used to cast and count ballots, there are no federal regulations or even voluntary guidelines for how these machines need to work or how secure they need to be.
"Which means that a lot of the stuff that happens to sort of cross the t's and dot the i's in a regular voting system certification, to make sure it's suitable for an election, just don't happen," said Hall.
Hall brought up what happened in Johnson County when he testified before Congress this month about election security. In an interview with NPR, Hall explained that in looking at the third-party investigative report, it was clear there were a number of issues.
The company in charge of maintaining the poll books, Election Systems & Software, didn't provide enough bandwidth for the computers on Election Day. That caused the poll books to slow down to the point where they were barely working.
Rapp, of Johnson County's election board, said poll workers weren't able to give voters the answers they wanted.
"There's no one voting on the machines, so [voters] know it's not the machines," Rapp said. "And [poll workers] don't really know what's going on. All we can say is 'It's a computer.' It's difficult."
ES&S came up with a workaround for the problem that created another serious issue.
In Johnson County, voters can vote at any jurisdiction in the county, but the e-poll books need to be connected to each other to prevent people from casting multiple ballots at different polling places.
To get around the bandwidth problem, ES&S disabled that connectivity, meaning a voter could have voted twice in Johnson County if the person had wanted to.
Maurice Turner, also of the Center for Democracy & Technology, compared that decision to an airport that stops screening passengers because the lines are long on busy travel days.
"If you just turn off the metal detectors, obviously you can get people through much more quickly," Turner said. "But the more secure way to do it is to open up more lines with more metal detectors."
Johnson County terminated its contract with ES&S and will use a different vendor going forward.
But the debacle showed the havoc that's possible with a simple hitch involving e-poll books, even though the systems aren't connected to anything that casts or tabulates votes.
In a high-profile case in 2016, e-poll book malfunctions caused long lines and confusion in Durham County, N.C. The company that provided the systems was the same one that then-special counsel Robert Mueller said was breached by Russian operatives in 2016, although there is no evidence that the two incidents are linked.
Security experts have regularly warned that registration and check-in processes are more vulnerable to cyberattacks than ballot totals.
Not 'entirely secure'
Still, states and localities buy e-poll books for plenty of reasons.
Earlier this decade, Connecticut Secretary of State Denise Merrill secured funding from her state's legislature to purchase electronic poll books for every voting jurisdiction in the state.
"It's so much less work and so much more accurate than doing things by hand," she told NPR.
Her office went to the University of Connecticut's Center for Voting Technology Research with three proposals from companies hoping to provide the state with e-poll books.
But the center's cybersecurity experts returned to Merrill with a warning.
"They came back to us, and they said they don't feel comfortable with any of these being entirely secure," she said.
So Merrill didn't pass the money down to the local jurisdictions, although she's optimistic that the products will improve over time. Still, she's concerned that election officials around the U.S. have jumped on the technology too quickly.
Once governments have spent the money on new technology, she says, "they're not eager to hear what's wrong with it."
"It's like anything in elections — there's a risk-reward ratio," Merrill said. "And no, I don't think there has been a thorough conversation of the risks inherent, and also the benefits, of electronic poll books."
Copyright 2021 NPR. To see more, visit https://www.npr.org. 9(MDAxNzg0MDExMDEyMTYyMjc1MDE3NGVmMw004))
