* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense.
Indiana Technology in Use
Verified Voting Foundation
* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device.
Center for American Progress State by State Voting System Report
See State Grade Below
"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:
1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing
This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.
It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."
Indiana allows voting using machines that do not provide a paper record and fails to mandate robust post-election audits that test the accuracy of election outcomes, which leaves the state susceptible to hacking and manipulation by sophisticated nation-states. Unfortunately, state officials—citing security concerns—refused to provide us with information on whether the state is working with DHS to identify and assess vulnerabilities in its voter registration system. Even if Indiana is working with DHS, its overall grade would not be raised, given the point distribution for the other categories. For example, the state allows voters stationed or living overseas to return voted ballots electronically, a practice that election security experts say is notoriously insecure. In addition, the state only requires pre-election logic and accuracy testing for some voting machines, as opposed to all machines that will be used in an upcoming election. Indiana did receive points for requiring all voting machines to be tested to EAC Voluntary Voting System Guidelines before being purchased or used in an election.
To improve its overall election security, all jurisdictions should be required to use paper ballots in administering their elections and to carry out mandatory post-election audits that adequately test the accuracy of election outcomes. Encouragingly, we were told that the state is considering implementing risk-limiting audits for the 2018 elections.530 Indiana should also require backup paper voter registration lists at any polling place that uses electronic poll books to check in voters. Currently, state law only requires backup electronic poll books to be available on Election Day at polling places where they are used. These electronic backups, however, will do nothing to ensure that eligible voters can cast ballots that count when they show up to the polls if there is widespread system failure or a major cyberbreach, which would corrupt the entire electronic database. Indiana should also prohibit electronic absentee voting and require that all voting machines that will be used in an upcoming election undergo pre-election logic and accuracy testing, rather than only testing a sampling of machines. Furthermore, Indiana can strengthen its ballot accounting and reconciliation procedures by requiring that all ballots—used, unused, and spoiled—be accounted for at polling places and by requiring jurisdictions using DRE machines to compare and reconcile the number of ballots with the number of voters who signed into the polling place.
Minimum cybersecurity standards for voter registration system: Incomplete
*The Indiana secretary of state’s office declined to provide information regarding cybersecurity requirements for the state’s voter registration system, citing increased security risks in doing so. Information gathered for this section derives from independent research and interviews with other election officials in Indiana.
The state’s voter registration system is estimated to be at least 10 years old.
The state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.
The state’s voter registration system has logging capabilities to track modifications to the database.
The state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.
The state performs regular vulnerability assessments on its voter registration system.
State officials were unable to provide us with information on whether the state has enlisted the National Guard or DHS to help assess and identify potential threats to its voter registration system.
The state has provided some cybersecurity training to election officials and is working toward developing more robust training opportunities for county-level officials who have access to the state’s voter registration system.536 At the Indiana Election Division’s annual conference in 2017, the department set time aside for additional cybersecurity-related presentations.
Electronic poll books are used by some, but not all, jurisdictions in the state.538 The state conducts pre-election testing on electronic poll books prior to an election.539 Although state law requires that backup electronic poll books are available on Election Day at polling places where they are used, it does not require paper backup voter registration lists to be available.540 Some counties that use electronic poll books do provide paper voter registration lists that election workers can refer to if necessary.
Voter-verified paper audit trail: Unsatisfactory
Depending on the jurisdiction, some voters in Indiana cast paper ballots, while others vote using paperless DRE machines.
Post-election audits: Unsatisfactory
Indiana’s use of paperless DRE machines prevents it from carrying out audits that can confirm the accuracy of election outcomes. Even though post-election audits are not required in Indiana,547 an audit on paper ballots may be requested by a county chairman for either of the major political parties.548 Audits consist of 5 percent of precincts or five precincts—whichever is greater—and are only carried out in jurisdictions that use paper ballots.549 For counties using paperless DRE machines, if the county election board determines that the total number of votes cast at a polling place differs from the number of voters who received a ballot at the polls or returned an absentee ballot by five or more an audit is carried out on that precinct.550 The audit is carried out within 13 days after an election and is open to public observance.
The state is considering implementing risk-limiting audits for the 2018 elections.
Ballot accounting and reconciliation: Unsatisfactory
Ballots are not fully accounted for at the precinct level. For example, unused, uncounted, and defective ballots are not counted at polling places. They are simply gathered and returned to the county along with other voting materials.
• Precincts using paper ballots are required to compare and reconcile the number of ballots with the number of voters who signed in at the polling place. No such requirements apply to jurisdictions using DRE machines.
Counties are required to compare and reconcile precinct totals with countywide results to ensure that they add up to the correct amount.
Counties are required to review and ensure that all voting machine memory cards have been properly loaded onto the tally server.
The state requires that all election results and reconciliation procedures be made public.
Paper absentee ballots: Unsatisfactory
The state permits UOCAVA voters to submit completed ballots electronically, via email or fax.
Voting machine certification requirements: Fair
Before being purchased and used for an election, all voting machines must be shown to meet or exceed federal voting system standards.
Some jurisdictions in the state likely still use voting machines that were purchased more than a decade ago.
Pre-election logic and accuracy testing: Unsatisfactory
Jurisdictions using DRE machines conduct mandatory logic and accuracy testing on at least some voting machines prior to an election. DRE machines are tested in at least three randomly selected precincts in each county. For jurisdictions using optical scan paper ballot cards, 10 percent of tabulating machines that will be used in the election and up to 15 percent of all tabulating machines are tested if an individual attending the public test requests additional machines to be tested.
Testing is open to the public.
Testing must take place at least 28 days before Election Day.