* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense.
Alabama Technology in Use
Verified Voting Foundation
* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device.
Alabama Election Security Grade: C
Center for American Progress Report
"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:
1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing
This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.
It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."
ALABAMA: GRADE C
Although Alabama conducts its elections with paper ballots and adheres to a number of minimum cybersecurity best practices for voter registration systems, it fails to require post-election audits that confirm the accuracy of election outcomes, leaving the state vulnerable to hacking and manipulation. Adding to this is the fact that Alabama permits UOCAVA voters to return voted ballots via web portal, a practice that election security experts warn as being notoriously insecure and vulnerable to manipulation. It is commendable that even though the state does not currently offer cybersecurity training to election officials, a new vendor con- tract requires personnel with access to the voter registration system will receive cybersecurity training in time for the 2018 elections. It is also worth recognizing that Alabama requires that all voting machine be tested to EAC Voluntary Voting System Guidelines before being purchased or used in the state, and also requires election officials to carry out pre-election logic and accuracy testing on all machines that will be used in an upcoming election.
To improve its overall election security, Alabama must require robust post- election audits that can detect errors in election outcomes and provide ad hoc corrections. In doing so, the state should look to risk-limiting audits like those in Colorado as a potential model. Alabama should also prohibit voters stationed or living overseas from returning voted ballots electronically.
Minimum cybersecurity standards for voter registration system: Good
The state’s voter registration system has been updated within the past 10 years.
The state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.
The state’s voter registration system has logging capabilities to track modifications to the database.
The state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.
The state performs vulnerability assessments on its voter registration system.
The state has enlisted DHS to help assess and identify potential threats to its voter registration system.
Officials within the Election Division of the Office of the Secretary of State completed cybersecurity training in 2017.105 The state does not currently require cybersecurity training for election officials, but will by the 2018 elections.
In May 2016 the state legislature enacted SB 200, which established an elec- tronic poll book pilot program.107 Electronic poll books were used in some counties during the 2016 general election. Paper copies of voter registration lists were available at the polling places that used them.108 In May 2017 the Alabama secretary of state began soliciting bids for electronic poll books that can be used statewide.109 Because Alabama’s electronic poll books are still in the piloting phase, the state was not graded on e-pollbook best practices.
Voter-verified paper audit trail: Good
• Elections are carried out with paper ballots and optical scanning machines.
Post-election audits: Unsatisfactory
• The state does not require post-election audits.
Ballot accounting and reconciliation: Fair
Ballots are fully accounted for at the precinct level.
Precincts are required to compare and reconcile the number of ballots with the number of voters who signed in at the polling place.
Counties are required to compare and reconcile precinct totals with countywide results to ensure that they add up to the correct amount.
There is no statutorily mandated review process to ensure that all voting machine memory cards have been properly loaded onto the tally server at the county level.
While state law requires that election results be made public, it is unclear whether the same is true of information regarding ballot reconciliation pro- cesses and results.
Paper absentee ballots: Unsatisfactory
• The state allows UOCAVA voters to submit completed ballots electronically, via web portal.
Voting machine certification requirements: Fair
Before being purchased and used for any election in the state, all voting machines must undergo testing by a federally accredited laboratory.
Some jurisdictions in the state likely still use voting machines that were pur- chased more than a decade ago.
Pre-election logic and accuracy testing: Fair
Election officials conduct mandatory logic and accuracy testing on all voting machines prior to an election.
Testing is open to the public.
The tests must be carried out “as close as is practical to the date of an election,” but no more than 14 days before Election Day.