* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense. 

 

Arkansas Technology in Use
Verified Voting Foundation

* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device. 

Click for Verified Voting's interactive map

Screen Shot 2019-03-13 at 4.25.35 PM.png

Center for American Progress State by State Voting System Report

See State Grade Below
 

Report Excerpt:

"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:

1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing

This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.

It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."

Arkansas: F/D

Arkansas allows voting using machines that do not provide a paper record and fails to mandate post-election audits, which does not provide confirmation that ballots are cast as the voter intends and counted as cast. Despite numerous attempts to speak to someone in state government about the cybersecurity standards for the state’s voter registration system, state officials did not respond to our requests for information and comments and we were unable to locate it independently. If Arkansas is adhering to all of the minimum cybersecurity best practices for voter registration systems, it would receive a “good” score—worth 3 points—for that category, bringing its grade up to a D. The state exercises good practices by requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines prior to being purchased or used in the state, and by requiring election officials to carry out pre-election logic and accuracy testing on all voting machines that will be used in an upcoming election. The fact that the state prohibits voters stationed or living overseas from returning voted ballots electronically is also commendable. In Arkansas, all voted ballots must be returned by mail or delivered in person.

To improve its overall election security, Arkansas should stop using paperless DRE machines in some jurisdictions and should require mandatory post-election audits in all jurisdictions. Until Arkansas requires statewide use of paper ballots and robust post-election audits that test the accuracy of election outcomes with a high degree of confidence, its elections will remain a potential target of sophisticated nation-states. Arkansas should also strengthen its post-election ballot accounting and reconciliation procedures by enacting precinct-level accounting requirements for DRE machines that mirror those required for jurisdictions with ballot tabulators. Whereas state law currently requires ballot tabulating precincts to compare the number of ballots cast with the number of voters who signed into the polling place, it is unclear whether the same is true for jurisdictions using DRE machines.

Minimum cybersecurity standards for voter registration system: Incomplete

*State officials did not respond to our requests for information and comments on cybersecurity requirements for the state’s voter registration system. Information gathered for this section derives from independent research. If Arkansas does require the cybersecurity best practices about which we are missing, its grade would be raised from an F to a D.

  • The state’s voter registration system is estimated to be at least 10 years old.

  • State officials were unable to provide us with information on whether the state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.

  • State officials were unable to provide us with information on whether the state’s voter registration system has logging capabilities to track modifications to the database.

  • State officials were unable to provide us with information on whether the state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.

  • State officials were unable to provide us with information on whether the state performs regular vulnerability assessments on its voter registration system.

  • State officials were unable to provide us with information on whether the state has enlisted the National Guard or DHS to help assess and identify potential threats to its voter registration system.

  • State officials were unable to provide us with information on whether the state provides cybersecurity training to election officials.

  • The state permits the use of electronic poll books. Unfortunately, state officials were unable to provide us with information on whether the state requires pre-election logic and accuracy testing on electronic poll books before an election or backup paper voter registration lists in jurisdictions that use them in case of emergency.


Voter-verified paper audit trail: Unsatisfactory

  • Depending on the jurisdiction, some voters in Arkansas cast paper ballots, while others vote using DRE machines.195 Some voting machines in the state are DRE machines with VVPR, while others are paperless DRE machines.


Post-election audits: Unsatisfactory

  • State law does not require post-election audits.


Ballot accounting and reconciliation: Unsatisfactory

  • All ballots are accounted for at the precinct level.

  • Precincts using optical scan machines are required by law to compare the number of ballots cast with the number of voters who signed into the polling place. It is unclear whether the same is true of jurisdictions using DRE machines.

  • Counties are required to compare and reconcile DRE and paper return totals to countywide election records.

  • Counties review and account for all voting machine memory cards or flash drives to ensure they have been properly loaded onto the tally server at the county level.

  • For jurisdictions that use DRE machines, all results are posted at polling sites. For jurisdictions using paper ballots and optical scanners, the law merely states that the results must be made public, without going into specifics.

Paper absentee ballots: Fair

  • The state does not permit voters—including UOCAVA voters—to submit completed ballots electronically. All ballots must be returned by mail or delivered in person. 

Voting machine certification requirements: Fair

  • Before being purchased and used for any election in the state, all voting machines must be certified by a federal agency or undergo testing by a federally accredited laboratory.

  • Some jurisdictions in the state likely still use voting machines that were purchased more than a decade ago.
     

Pre-election logic and accuracy testing: Fair

  • Election officials conduct mandatory logic and accuracy testing on all voting machines prior to an election.

  • Testing is open to the public.

  • Testing occurs at least seven days before an election.






 

SIGN UP FOR ACTION ALERTS