Jacob Rush

Most Americans believe the right to vote is one of the most important constitutional rights.^[1] Moreover, eight out of ten Americans are concerned the country’s voting system is vulnerable to hackers.^[2] Although new voting technology has been implemented across the country, it largely enables, rather than prevents, hacking, causing “frightening vulnerabilities” for election administration.^[3] It seems that “America’s most ancient civilian office, the local election clerk, has become saddled with new and alien responsibilities tantamount to a military contractor.”^[4] Hacking presents a novel threat to elections and may have far-reaching implications on the right to vote.

Part I describes the current state of election technology and the hurdles preventing improvements. Part II addresses Russia’s cyberattacks in the 2016 elections. It highlights the unprecedented risk hacking poses to the right to vote and suggests that courts must intervene. Part III reviews recent litigation to suggest that vulnerable voting machines violate the right to have one’s vote counted accurately, which reimagines traditional right-to-vote jurisprudence in the context of hacking. Finally, Part IV posits that hacks that burden voter access, increase voter frustration, and foil voter participation are more likely, just as dangerous, yet less responsive to right-to-vote jurisprudence than hacks manipulating vote tabulations.

I. The Problem with Voting Technology: Federalism, Funding, and Industry

Voting technology matters so much because elections are so often so close. Accurate machines ensure that the electoral process both selects true winners and convinces losers to accept unfavorable results.^[5] The constitutional right to vote accordingly guarantees that each voter has about the same opportunity to have his or her vote counted, by requiring that counting methods (e.g., voting machines) distribute counting errors roughly equally. This is the promise and peril of Bush v. Gore.^[6] Problems with voting technology, where some legally valid votes may not be counted properly, which produces high residual vote rates, risk undermining the fundamental right to vote and the public’s confidence that the will of the people has been freely and fairly expressed.^[7]

Despite the stakes, there are three roadblocks to better voting machines.^[8] First, federalism. According to the constitution’s text and the gloss of history and tradition, states have wide discretion in election administration.[9] They run federal elections subject only to Congress’s authority, exercised occasionally, ^[10] to “at any time by Law make or alter such regulations.”[11] States also have plenary power over the time, place, and manner of local elections, subject to the restriction that they not overburden the right to vote.^[12] Accordingly, federal legislators fiercely resist anything resembling federal interference with state autonomy.^[13]

Second, funding. Although many election officials say that modernizing voting technology is an important concern,^[14] there are scant resources available to them to address it.^[15] Modernization, to be sure, is not cheap. South Carolina estimates that it will cost $40 million to replace its voting machines—$39 million more than its legislature allocated in 2017.^[16]

Finally, industry. The roughly $300 million market^[17] for voting technology is problematic. The industry is small but politically well connected, with especially strong ties to the Republican Party.^[18] It is mostly regulated at the state level.^[19] Customers are often locked into long-term contracts and face high switching costs, destroying industry incentives to innovate.^[20] Certifying new technology takes years.^[21] Equipment designs, hardware, and software are usually proprietary.^[22] Companies thus fight in court to prevent prying eyes when challenged. John Kerry lost a battle in 2004 to access the source code behind voting machines in Ohio.^[23] So too did a 2006 candidate for Florida’s 13th Congressional District, who alleged that machines in one county erroneously registered 18,000 “no” votes in her race.^[24] Moreover, the industry is composed of only three hardware companies that manufacture over eighty percent of machines and, in contrast, a large number of tiny third-party software vendors.^[25] And of the few industry-wide changes made after Bush in 2000, some actually undermined opportunities to innovate and improve the voting experience.^[26]

Congress passed the Help America Vote Act (“HAVA”) in 2002 in response to Bush.^[27] HAVA authorized $3.65 billion in payments to states to improve voting technology, and appropriated $3.28 billion of that amount between 2003 and 2010.^[28] States used funds to purchase new machines, often direct-recording electronic (“DRE”) or optical-scan machines.^[29] DREs read digital ballots. Optical-scanners read paper ballots. Both machines store votes on memory cards. Optical-scanners keep digital images of the paper ballots they read, which can provide an audit trail. DREs can, but do not always, print paper images that voters can review, although their scrolls could conceivably be hacked to print voters’ choices correctly while recording different choices on the memory card.^[30] Whereas in 2000 just nine percent of voting precincts were using DREs, after HAVA was passed the number of precincts using DREs increased to sixty-seven percent, despite the risk of hacking.^[31]

Whatever gains were realized in the early 2000s have been all but lost. Forty-one states still use machines that are at least ten years old,^[32] which creates a higher risk of failure and predictable vulnerabilities. Thirteen states still use machines that do not provide paper trails.^[33] Some states report scavenging for new parts on eBay.^[34] Forty-three states and the District of Columbia use voting machines that are no longer manufactured.^[35] In 2018, Congress provided $380 million more in grants to states to improve federal election administration.^[36] Yet these appropriations are entirely insufficient to replace voting machines, which are “reaching the end of their natural life cycle.”^[37] It would cost $2 per voter per year, ^[38] or over $270 million annually based on recent presidential-election turnout rates,^[39] to upgrade and properly maintain voting machines across more than 10,000 “hyperdecentralized” election jurisdictions.^[40]

The rapid shift to new voting technology in the wake of Bush, although well-intended, was poorly implemented. Coupled with inadequate maintenance and industry standstill, it created the conditions in which the hacks that now imperil the right to vote could occur. Indeed, software vendors, in at least one instance, let known security issues persist for eleven years.^[41]

The strings attached to HAVA’s grants^[42] arguably hurt election security more than they helped. First, states had to consolidate voter registration databases previously maintained at the county level.^[43] That created a one-stop shop for breaches. Second, the Act’s strict (albeit necessary) voting standards limited the kinds of voting machines states could buy with HAVA funds.^[44] That lead to widespread adoption of electronic voting technology,^[45] which in turn created incentives for private companies to rush to market with untested machines to take advantage of the windfall of cash and to sell states products that were not needed, such as e-pollbooks, which election officials often use to check-in voters on Election Day. Finally, states had to implement changes before the 2004 federal election,^[46] leaving no time for risk assessment, debugging, or testing. The speedy move to technology, without a plan or the funds to upgrade software and hardware regularly, was a solution in search of a problem: hackable voting machines.^[47] 

II. Hacking and the Right to Vote

The last presidential election put election hacking on the map, although election officials have been aware of the risk of hacking for decades.^[48] Russia’s attacks practically compel the conclusion that problems with election technology are not just “political questions” for the “political branches,”^[49] but rights-based threats that demand the attention of courts. Where the political system fails to adequately protect election integrity and the right to vote, courts must fill the vacuum.

Russia’s attacks were, indeed, unparalleled in nature and scope.^[50] Russian hackers targeted election infrastructure in twenty-one states with sophisticated cyberattacks.^[51] They successfully breached voter registration rolls in Illinois,^[52] stole the username and password of an election official in Arizona,^[53] and infiltrated an unnamed private company.^[54] Russian hackers also sent emails to 122 email addresses associated with named local governmental organizations and election officials containing malicious code^[55] and accessed county election websites in Georgia, Iowa, and Florida.^[56] The era of local administrative control over voting technology is over. Russia’s hacks changed the narrative.

The right to vote, which is implicated by voting technology in ways unforeseeable even a decade ago, is a fundamental constitutional right.^[57] At bottom, the idea is that “[t]he conception of political equality from the Declaration of Independence, to Lincoln’s Gettysburg Address, to the Fifteenth, Seventeenth, and Nineteenth Amendments can mean only one thing—one person, one vote.”^[58] The right adapts to the times, precluding first-generation infringements (restrictions on an individual’s ability to cast a ballot) as well as second-generation infringements (efforts to dilute the effectiveness of one’s vote).^[59] This jurisprudence culminated in Bush v. Gore, which applied the right to vote to election administration specifically, holding that counting votes by methods or means with similar levels of accuracy, or probabilities of inaccuracy, is part and parcel of the right to vote.^[60] As a result, when states rapidly modernized their voting systems, a number of technology-related challenges ensued, because of what Bush said and did not say and what states did and did not do.

The first round of voting technology challenges sought to enforce uniform adoption of electronic voting technology under the Equal Protection and Due Process clauses.^[61] Studies showed that paper-based punch cards and optically scanned ballots caused a greater number of votes to be invalidated in predominantly African-American precincts than elsewhere—a “racial gap” in the residual vote rate, or probability that votes would be counted inaccurately.^[62] States rendered such challenges moot by implementing electronic voting systems statewide, reducing the residual vote rate by one million between 2000 and 2004.^[63]

Challenges also arose in states whose counties purchased different types of technology. For example, in Weber v. Shelley, the plaintiffs argued that although voting equipment reduced under- and over-votes in the aggregate, it still did not distribute the residual vote rate equally across all groups and thus violated the Equal Protection and Due Process clauses.^[64] Because machines have varying levels of accuracy, by using one machine in some counties but not everywhere, the state subjected voters to different probabilities that their votes would be counted accurately. The challenge failed. The court found that the electronic system in use did not restrict the right to vote severely enough to justify relief.^[65] Courts facing these sorts of challenges cite Justice Souter’s dissent in Bush, which justified the use of different technologies across election jurisdictions based on “concerns about cost, the potential value of innovation, and so on.”^[66]

Beyond the challenges presented by the holding in Bush, voting-technology challenges continued to fail because of the standard of scrutiny established by Anderson v. Celebreze^[67] and Burdick v. Takushi^[68] (referred to as the Anderson–Burdick sliding scale test). Under the Anderson-Burdick sliding scale test, courts apply strict scrutiny to an election administration practice, such as what voting technology to buy or maintain, only if it is unreasonable and discriminatory or if it imposes a “severe” burden on voters.^[69] If the burden is “reasonable” and “nondiscriminatory,” or it is not severe, then it is constitutional if the state demonstrates an “important regulatory interest[]”^[70] or even “legitimate and valid” concerns.^[71] Anderson-Burdick is the workhorse of election administration law, even though it is arguably in deep tension with the central holding of Harper v. Virginia Board of Elections, which is that any practice that burdens the right to vote and that is unrelated to voter qualifications, not just outright proscriptions of the franchise, should receive strict scrutiny.^[72] Indeed, Harper said that “[t]he degree of the discrimination is irrelevant”^[73] precisely because the voter regulation at issue there (a poll tax in order to obtain a ballot) was unrelated to voter qualifications. Presumably, then, something far less severe than a poll tax as a condition for obtaining a ballot would trigger strict scrutiny if it were unrelated to voter qualifications. Yet, under Anderson-Burdick, the degree of a burden, even one that has nothing to do with voter qualifications such as voting technology that counts votes with varying degrees of accuracy, seems to be a threshold question as well as a dispositive one.

The Court applies Anderson-Burdick to election administration because of the basic difficulties of administering elections.^[74] Voters cannot expect perfection across jurisdictions because it is impracticable to ever fully equalize burdens. Some voters will always live farther from polling places. It will always be harder for some voters to obtain photo identification. Lines will always be longer and ballots more confusing for some voters. Some jurisdictions will always have fewer dollars or political capital to update voting equipment and will thus use older machines with greater residual vote rates. That is the inescapable reality of election administration, or so it seems. To require otherwise, in the Court’s view, would hamstring local officials seeking to impose order on a chaotic democratic process.^[75] Thus, at least in the context of voter technology, states can treat dissimilar people who are similarly situated differently without running afoul of the Equal Protection Clause.

Essentially, then, Bush and its progeny suggest that unequal residual vote rates are symptomatic of inevitably imperfect technologies. Bush and its progeny also suggest those rates are innocuous, in that they are beyond the reach of the constitution’s right to vote, because they are reasonable, nondiscriminatory, and do not severely burden that right. Election hacking, however, has forced at least one court to revisit that calculus.

III. Hacking the Right to Vote

Hacking sits squarely at the intersection of the Court’s right-to-vote jurisprudence and issues surrounding voting technology. For example, in Curling v. Kemp, the United States District Court for the Northern District of Georgia found that challengers to Georgia’s statewide voting technology provided sufficient evidence to show, on the basis of a factual record that was yet to be fully developed, “that their votes cast by DREs may be altered, diluted, or effectively not counted.”^[76]

First, the court did not discuss whether a particular residual vote rate must be found in order to find a right-to-vote violation.^[77] In fact, because it was a pre-election challenge, no such finding was possible.

Second, the challengers actually showed “serious security flaws and vulnerabilities,” as opposed to pointing to merely theoretical or hypothetical flaws, including “outdated software susceptible to malware and viruses.”^[78] This showing established “a concrete,” nonspeculative risk that ballots could be altered in a way that undermines the opportunity to cast an effective vote.^[79]

Finally, the court dismissed Georgia’s argument, at the motion-to-dismiss stage, that the injury to challengers’ right to vote was caused by hackers rather than the state.^[80] States typically have no duty to protect citizens from privately inflicted harms, but the court found that, for at least the purposes of the motion to dismiss stage, there was a plausible causal connection, even if only indirectly, between the state’s use of unsecure DREs and the injury to challengers’ constitutional rights.^[81]

The nature of hacking is the chief reason why Curling stands apart from Bush and its progeny. At the end of an election, there will be no way to determine the accuracy of a vote count. Post-Bush courts did not foresee this possibility. In one case, for example, the Eleventh Circuit rejected an equal protection challenge based on differing methods manual recounting to determine whether machines registered the correct number of no-votes, because the mere possibility of an “allegedly inferior type of review” in the event of a manual recount was not so substantial a burden as to warrant strict scrutiny.^[82]

Hacking, on the other hand, conceals its own detection. Malicious code that modifies vote counts hides evidence of its existence by also modifying the audit logs, vote records, and protective counters stored by the machine that are installed as countermeasures.^[83] Even electronic ballot “images are themselves subject to manipulation by hackers.”^[84] Given the archaic nature of election machines, a post-election investigation will not find evidence that anything went awry. Courts cannot rely on the absence of evidence of tampering or malfunction as evidence of absence of accuracy issues, or as evidence of user error, in the hacking era.

Hacking is no longer a far-off risk, either, but rather a near certainty. It is easy to manipulate vote tabulations even if voting machines are disconnected from the internet, or “air-gapped.” Hackers can access machines through the modems that transmit vote totals on election night.^[85] Hackers can “compromise voting equipment at many points along the supply chain, from the factory assembler to the election software programmer to the technician who makes a repair or installs a software upgrade.”^[86] Hackers could also commandeer remote access software that allows contractors to make updates from home, or infect installable memory cards that are carried to central-counting facilities to upload votes.^[87] Hackers can even compromise computers in election offices, then spread malicious code to voting machines when election officials program ballots.^[88]

Admittedly, it is harder to manipulate vote tabulations in a way that picks winners and losers—but this is because of an information gap, not a technology gap. To effectively do so, hackers “would have to know which districts could affect the outcome. Then they’d have to change just enough votes to ensure victory without switching so many that it would draw attention.”^[89] All the same, Curling suggests that antiquated voting systems are hackable voting systems and hackable voting systems violate the right to vote. This is not to suggest that the right to vote requires something that is not theoretically possible, i.e., unhackable voting machines. It is only to suggest that states must not sit idly by while vulnerabilities create arbitrary disparities in whether votes will be counted accurately.

IV. Access Hacks: Third-Generation Infringements on the Right to Vote

Manipulating vote tabulation is not the only way to hack an election. “Access hacks” have the effect of placing obstacles before voters that frustrate their ability to effectively participate in the voting process. The problem is that voting operations seem to be designed to perform the simple task of casting a ballot in an overcomplicated way, like a Rube Goldberg machine. Vulnerabilities include not just machinery, but websites, registration databases, e-pollbooks, and recording and reporting systems—systems that hackers could exploit to aggregate countless low-value burdens on voters. This is the third generation, or perhaps the final frontier, of voting infringements.^[90] Although harder to address in court, given existing right-to-vote doctrine, these risks can be mitigated with system updates.

Legacy systems contain known vulnerabilities that can disrupt election infrastructure. Hackers can take down voting machines through a Distributed Denial of Service (“DDoS”) attack. In North Carolina in 2016, an alleged software glitch demonstrated the chaos that an attack on infrastructure could cause, such as machine crashes, long lines, extended hours, and back-up paper ballots (if counties have them, which is by no means a guarantee).^[91] Long lines destroy voter confidence “even when individuals do not experience the long lines themselves” because voters could decide that voting simply is not worth the trouble or wait.^[92] Hackers can also crash e-pollbooks, which election officials often use to check-in voters on Election Day. In 2006 in Denver, for example, an e-pollbook malfunction caused about 20,000 people to leave polling places without voting.^[93] In 2008 in Georgia, a similar malfunction caused two-hour-plus lines.^[94]

Similarly, legacy databases are vulnerable to information exploitation, where hackers manipulate voter records to increase frustration and foil participation. Hackers could access databases to change precinct assignments to send voters to the wrong location, wasting time and costing votes.^[95] In 2016, when a Russian agent logged into a single election jurisdiction’s database in Illinois, he opened a backdoor to the files on all of the state’s voters in all 109 jurisdictions’ statewide since 2006.^[96] He then gained access to 15 million voter registrations, stole 90,000 files, and attempted, albeit unsuccessfully, to change voter information including names and addresses.^[97] Likewise, in California’s 2016 presidential primary, hackers used private voter information, including Social Security numbers, to change voter registrations in the state’s database, preventing a number of voters from casting ballots.^[98]

Hackers can even take advantage of state voter restrictions to disrupt elections and sow division. To illustrate this issue, consider Georgia. Just before Election Day in 2018, officials used an exact match voter registration law to stall over 50,000 voter registrations containing information that was inconsistent, they argued, with drivers-license records, such as mismatched signatures, omitted middle initials, misspelled names, and missing hyphens.^[99] They rejected a number of absentee ballots for similar reasons.^[100] A disproportionate number of voters facing stalled registrations and rejected absentee ballots were black.^[101] Georgia’s secretary of state, who is now governor, used Georgia’s exact–match voter registration law as a justification for the mass suspension.^[102] Hackers could exploit Georgia’s oppressive law and others like it to precisely the same effect. By altering voter registrations to make them inconsistent with drivers-license records, hackers could depress turnout, suppress or functionally deny the vote, or change the outcome of the election. To be sure, thirty-one states introduced ninety-nine bills impeding access to registration and voting in 2017,^[103] so the target market is a mile wide and the firewalls an inch deep.

V. Conclusion

It is difficult to square the extent to which we value the right to vote with the state of voting technology. Federalism, funding, and industry get in the way. Courts must then act as the forum of last resort. However, in the wake of Bush, technology became a solution in search of a problem, enabling the hacks that now imperil the right to vote. Bush’s progeny provided little recourse until Curling, where the unique nature, unparalleled scope, and concrete threat of hacking brought the vulnerability of voting machines into sharp relief. Curling offers promise in an area of the law where there is mostly peril. Moreover, although right-to-vote jurisprudence, even Curling, has little to say about what happens when hackers target information databases in order to increase frustration and thwart participation, sensible system upgrades and security protocols may reduce the likelihood of such threats. In short, judges have a role to play in holding states accountable, states must play a role in providing support to local officials across 10,000 election jurisdictions, and voters must begin demanding changes through their exercise of the franchise––by resort to the very polls that are endangered by hackers––and in keeping the faith otherwise.