* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense.
Iowa Technology in Use
Verified Voting Foundation
* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device.
Center for American Progress State by State Voting System Report
See State Grade Below
"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:
1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing
This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.
It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."
Iowa carries out its elections with paper ballots, but the state’s post-election audit law is inadequate from an election security standpoint. The scope of the audits is based on a fixed number of counties and precincts rather than a statistically significant number tied to the margin of victory in one or more ballot contests. At the same time, the audits do not appear to include provisional ballots and there is no escalation requirement in the event that preliminary outcomes are found to be incorrect. Also problematic is the fact that audit results are not binding on the official election outcome, regardless of what they reveal. Adding to this is the fact that Iowa allows voters stationed or living overseas to return voted ballots electronically, a practice that election security experts say is notoriously insecure. The state did receive points for its ballot accounting and reconciliation procedures and for requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines before being purchased or used in the state. Election officials are also required to conduct logic and accuracy testing on all voting machines that will be used in an upcoming election.
Despite numerous attempts to speak to someone in state government about cybersecurity standards for the state’s voter registration system, state officials told us they would not provide information or comment on our research, and we were unable to locate all of the information independently. Even if Iowa is adhering to all of the minimum cybersecurity best practices for voter registration systems, its overall grade would not increase given the point distribution for the other categories.
To improve its overall election security, Iowa should immediately update its post election audit law to ensure that audits test the accuracy of election outcomes and are binding on any erroneous results. In updating its audit requirements, Iowa should look to risk-limiting audits like those in Colorado as a potential model. Given the threat posed by sophisticated nation-states seeking to disrupt U.S. elections, it is imperative that post-election audits test the accuracy of election outcomes and detect any possible manipulation. Iowa should also require that all electronic poll books receive pre-election testing to ensure that they are in Iowa receives a C* 80 Center for American Progress | Election Security in All 50 States good working order before Election Day. Furthermore, the state should prohibit electronic absentee voting of any kind, even by UOCAVA voters. Going forward, all voted ballots should be returned by mail or delivered in person.
Minimum cybersecurity standards for voter registration system: Incomplete
*State officials told us they would not provide information or comment on our research and were therefore unable to share information on cybersecurity requirements for the state’s voter registration system. Information gathered for this section derives from independent research.
The state’s voter registration system is estimated to be at least 10 years old.
State officials were unable to provide us with information on whether the state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.
State officials were unable to provide us with information on whether the state’s voter registration system has logging capabilities to track modifications to the database.
The state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.
The state performs regular vulnerability assessments on its voter registration system.
State officials were unable to provide us with information on whether the state has enlisted the National Guard or DHS to help assess and identify potential threats to its voter registration system.
State officials were unable to provide us with information on whether the state provides cybersecurity training to election officials.
Electronic poll books are used by some, but not all, jurisdictions in the state. Pre-election testing of electronic poll books is left up to the counties that use them. Paper voter registration lists are available at polling places that use electronic poll books on Election Day
Voter-verified paper audit trail: Good
Elections are carried out using paper ballots and optical scan machines.
Post-election audits: Unsatisfactory
In 2017, Iowa adopted House File 516, which requires a manual hand count of all ballots cast in randomly selected precincts after every general election. Currently, there are no requirements regarding escalation procedures or for making the audit open to public observance or for making the results publicly 81 Center for American Progress | Election Security in All 50 States available, though the law does state that the ‘hand count shall be observed by a representative selected by each of the two political parties whose candidates received the highest number of votes statewide in the preceding general election.” The audit law states explicitly that audit results “shall not change the results, or invalidate the certification, of an election.
Ballot accounting and reconciliation: Fair
All ballots are accounted for at the precinct level.
Precincts are required to compare and reconcile the number of ballots with the number of voters who signed in at the polling place.
Counties are required to compare and reconcile precinct totals with countywide results to ensure that they add up to the correct amount.
State law requires a review process to ensure that all voting machine memory cards have been properly loaded onto the tally server at the county level.
The state requires that all election results and reconciliation procedures be made public.
Paper absentee ballots: Unsatisfactory
The state allows UOCAVA voters and other absentee voters to return completed ballots electronically via fax or email.
Voting machine certification requirements: Fair
Before they may be purchased and used in the state, all voting machines must be certified by the Election Assistance Commission.
Some jurisdictions in the state likely still use voting machines that were purchased more than a decade ago.
Pre-election logic and accuracy testing: Fair
Election officials conduct mandatory logic and accuracy testing on all voting machines prior to an election.
Testing is open to the public.
Testing must be completed not later than 12 hours before the opening of the polls on Election Day.