While most states have seen adoption of hybrid digital-paper solutions that include a voter verifiable paper audit trail (VVPAT), not all of them have.
Today, counties in Texas, Tennessee, Louisiana, Mississippi, Indiana, Kansas, Kentucky, and New Jersey are still exclusively using paperless machines, also called direct recording electronic systems (DREs).
Derek Tisler, election security analyst with the Brennan Center, said the number of states using DREs has nearly halved since the last election, but there are a smattering of states that, for reasons mostly financial, still have not switched.
"In 2016, there were 14 states that used paperless machines as the primary polling place equipment in at least some of their counties and towns. They represented about 1 in 5 votes that were cast in the 2016 election," said Tisler. "Since then, six of those states have fully transitioned to some sort of paper-based voting equipment."
Those include Arkansas, Delaware, Georgia, South Carolina, Pennsylvania and Virginia. There, counties have been transitioning to ballot-marking devices.
"That leaves 8 states in 2020 that still have at least some paperless voting machines," said Tisler, though he noted that, even amidst these, efforts have been made to redirect voters to more secure means of vote casting. New Jersey, for instance, has launched a healthy vote-by-mail program for voters, which means paper ballots will be used overwhelmingly this year.
"For the most part, there are a mix, where some counties have them and others do not. Texas is the state that has the most paperless equipment. In Texas, paperless equipment probably represents a third of the total voters within the state," Tisler said.
These machines linger on in counties because officials do not typically have the money to replace them, he said.
"When we talk to election officials, many of them understand the value of having machines with a paper record. The big constraint is just resources. Election administration has just been woefully underfunded for a long time," Tisler said. "Even with some election security funds that Congress approved in 2018 and 2019, it's just not enough money to fund the replacement of these machines on a large level."
Over the past two years, Congress passed two rounds of election funding through the Help America Vote Act (HAVA), totaling some $800 million. It's not nearly enough, Tisler said, but it shows that legislators are at least paying attention to the issue.
At the same time, COVID-19 has also had an impact on election spending.
"Of course, the pandemic has redirected election funding even further to just go towards basic health and safety needs at polling places," he added.
As to whether the machines could be commandeered by hackers, Tisler said he is less worried about that than the fact that these systems have no way to audit their results.
"What concerns me the most about these paperless machines specifically is not necessarily that they're more vulnerable to attack, it's that there's no backup record of the votes cast," he said. "In the states that have switched to machines with a paper record, if they discovered that a vulnerability was exploited in their voting machines they don't have to rely on the software's vote count, they have a printed record of every single vote."
What would really increase security around voting would be to increase regulation of voting equipment vendors, something that is currently almost entirely absent, Tisler said.
"Right now the only part of voting systems that have any sort of federal regulation is the voting machines themselves and that is a largely voluntary regime," he said. "A lot of the other equipment — voter registration systems and electronic pollbooks and ballot printing and other components — really face no federal regulation whatsoever," he said.
"Having a more comprehensive system of regulation could really ease the burden on local election officials whenever they're purchasing new equipment," he said. "They can have a lot higher degree of confidence that these vendors are at least meeting basic cybersecurity best practices."
