Federal election agency adopts updated voting security standards. Not everyone is happy.

The Election Assistance Commission on Wednesday voted to adopt the first comprehensive update to its voting system security guidelines in more than 15 years, concluding a lengthy process that ended with a mixed reception from some election security experts.

The security community largely greeted the update as a security upgrade to standards that most states rely upon at least partially for their own equipment testing and certification. A significant number of academics, activists and even some in Congress, though, voiced displeasure in particular for how the so-called Voluntary Voting System Guidelines 2.0 would handle wireless connections on voting systems.

The update stands to shape the next generation of voting systems that election vendors produce for use around the country during a period of sinking trust in the electoral process.

Regardless, the more than five-year drafting process and resulting EAC vote won’t immediately transform election security because states, equipment manufacturers and others will take time to get in line with the new standards.

On the plus side, experts said the guidelines — VVSG 2.0 for short — would promote “software independence,” which translates into machines needing to produce independently verifiable records. The result will be the existence of verifiable paper ballots that election officials can audit after votes are cast.

EAC Chairman Ben Hovland touted those elements at a hearing where the commissioners unanimously voted to adopt the guidelines.

“VVSG 2.0 is a major step forward to ensure the next generation of voting equipment is more secure and accessible and ensures a better voting experience for all Americans,” he said. “Election security has been a major topic and focus during these efforts, and I’m proud that the VVSG 2.0 includes provisions to ensure that we will have more paper ballots and built in support for election officials to conduct more efficient post election audits.”

Other positive elements, experts said, included the incorporation of common private sector cybersecurity standards like multi-factor authentication. “These are requirements we’ve wanted for years,” said Kevin Skoglund, chief technologist at the nonprofit Citizens for Better Elections.

Wireless connectivity debate and other complaints

However some skeptics said they thought the guidelines’ language on banning wireless connectivity didn’t go far enough. A group of prominent election security professionals said last week that allowing those connections to exist, even if the guidelines say they should be disabled, is dangerous because it gives hackers a means to remotely attack election systems.

“Permitting the inclusion of wireless radios will both increase the vulnerabilities of the voting system and diminish voter confidence in the security of our election systems,” they wrote. “Neither is acceptable.”

Those experts accused the EAC of caving at the last minute to vendors who want to sell scanners and tablets with wireless connectivity.

“The EAC’s last-minute edits to the ban on wireless were concerning, but the EAC made unambiguous statements that it is banned,” said Skoglund. “We’ll hold them to that while we work to improve the language.”

The commission denied making any significant late concessions, publishing a document “dispelling misinformation” which said that the changes only served to clarify what already was there.

Others found that connectivity language acceptable.

“I am okay with the compromise to allow wireless networking hardware as long as wireless capability is disabled by software because it is impractical to try to source chips without wireless functionality,” said Maurice Turner, a former senior adviser at the EAC.

Turner, however, faulted the document for another element it left out.

It “completely misses the opportunity to improve defenses for the growing risk area of electronic poll books,” he said. “An attacker can’t change the markings on a ballot through an e-pollbook, but they can certainly disrupt the check-in process and prevent voters from getting to the voting booth.”

There were more gripes besides. Various groups interested in the formation of the guidelines pointed out that the final draft didn’t post publicly anywhere until Jan. 29, and that accompanying instruction manuals also approved on Wednesday only surfaced quietly last week, a timeline that critics have cited in complaints about a lack of transparency.

While calling the guidelines a “marked improvement” from the existing ones, the National Association of State Election Directors found the process for vetting them lacking.

“Unfortunately, the VVSG 2.0 approved today by the EAC did not meet our expectations of transparency when the standards and accompanying manuals were prepared for a vote,” the association said. “In the wake of the 2020 election, in which the integrity of the results, the equipment, and election officials ourselves were called into question, we believe that transparency and public engagement are critical to rebuilding trust in our democracy and in our election system.”

What the future holds

More work remains now that the commission has adopted the guidelines.

A coalition of vendors released a statement that largely praised the guidelines, but added that they would need to work with the EAC on a framework for currently operational voting systems, especially those purchased with recent congressional grants.

The EAC itself has to carry out additional bureaucratic steps, such as re-upping the accreditation process for the voting system test laboratories in response to the new requirements, said Eddie Perez, global director of technology development at the OSET Institute, an election security research nonprofit.

After that, it will take time for manufacturers to develop systems in response to the updated guidelines. Some states might be able to seamlessly incorporate those guidelines under existing law, while others might need to make changes. And the state and local government buying process can sometimes take years.

Perez predicted it could be 2023 at the earliest before anyone sees VVSG 2.0-compliant machines. Even then, states might be reluctant to debut new voting equipment one year before a presidential election.

“Manufacturers are going to move slowly,” he said. “The EAC moves slowly. State legislators move slowly. The procurement process for new technology moves slowly.”