In 2016, America’s elections were targeted by a foreign nation-state intent on infiltrating and manipulating our electoral system. On September 22, 2017, it was reported that the U.S. Department of Homeland Security (DHS) notified 21 states that were targeted by hackers during the 2016 election.¹ Among those states notified by DHS were: Alabama, Alaska, Colorado, Connecticut, Delaware, Florida, Illinois, Maryland, Minnesota, Ohio, Oklahoma, Oregon, North Dakota, Pennsylvania, Virginia, and Washington.² Arizona, California, Iowa, Texas, and Wisconsin were also among those states originally contacted by DHS. However, those states have denied that their election systems were attacked.³ Ultimately, hackers only reportedly succeeded in breaching the voter registration system of one state: Illinois.⁴ And while DHS did not name those responsible for the attempted hacks, many believe the culprits can be traced back to Russia.⁵ Experts have warned that a future attack on our election infrastructure, by Russia or other malicious actors, is all but guaranteed.⁶

By now, the American people have been alerted to many vulnerabilities in the country’s election systems, including the relative ease of voting machine hacking,⁷ threats to voter registration systems and voter privacy,⁸ and disinformation campaigns waged by foreign nation-states aimed at confusing voters and inciting conflict.⁹ If left unaddressed, these vulnerabilities threaten to undermine the stability of our democratic system….

The main takeaway from the Center for American Progress’ research and analysis is that all states have room for improvement:

• Fourteen states use paperless DRE machines in at least some jurisdictions. Five states rely exclusively on paperless DRE machines for voting.
• Thirty-three states have post-election audit procedures that are unsatisfactory from an election security standpoint, due either to the state’s use of paperless DRE machines, which cannot be adequately audited, or other factors. At least 18 states do not legally require post-election audits or require jurisdictions to meet certain criteria before audits may be carried out.
• Thirty-two states allow regular absentee voters and/or U.S. citizens and service members living or stationed abroad to return voted ballots electronically, a practice deemed insecure by election and cybersecurity experts.
• At least 10 states do not provide cybersecurity training to election officials.

This point cannot be overemphasized: Even states that received a B or a C have significant vulnerabilities that leave them susceptible to hacking and infiltration by sophisticated nation-states. However, by making meaningful changes to how elections are carried out, states can improve their overall election security while supporting public confidence in election procedures and outcomes…..