* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense.
Kentucky Technology in Use
Verified Voting Foundation
* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device.
Center for American Progress State by State Voting System Report
See State Grade Below
"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:
1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing
This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.
It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."
Kentucky adheres to recommended minimum cybersecurity best practices related to voter registration systems, but the state allows voting using machines that do not provide a paper record, which makes it impossible to carry out meaningful post-election audits that test the accuracy of election outcomes. Even in places with a voter-verified paper trail, the state’s audits lack important criteria. For example, audits are tied to a fixed percentage regardless of the margin of victory, and there is no requirement that an audit escalate if necessary. Furthermore, state law limits public observance to members of the media. The state’s ballot accounting and reconciliation procedures also need improvement. Kentucky did receive points for prohibiting voters stationed or living overseas from returning voted ballots electronically, a practice that election security experts say is notoriously insecure. In Kentucky, all voted ballots are returned by mail or delivered in person. The state also exercises good practices by requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines before being purchased and used in the state, and by requiring election officials to carry out logic and accuracy testing on all voting machines that will be used in an upcoming election.
To improve its overall election security, Kentucky should switch over to a paper based voting system and require robust post-election audits that can confirm election outcomes with a high degree of confidence to strengthen defenses against malicious actors seeking to manipulate U.S. elections. In adopting post election audit procedures, the state should look to risk-limiting audits like those in Colorado as a potential model. Kentucky should strengthen its ballot accounting and reconciliation procedures by requiring precincts to compare and reconcile the number of ballots with the number of voters who signed in at the polling place and by requiring counties to compare and reconcile precinct totals with composite results to confirm they add up to the correct number.
Minimum cybersecurity standards for voter registration system: Good
The state’s voter registration system is estimated to be at least 10 years old.
The state’s voter registration system provides access control to ensure that only authorized personnel have access to the database. Kentucky receives a D 86 Center for American Progress | Election Security in All 50 States.
The state’s voter registration system has logging capabilities to track modifications to the database.
The state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.
The state performs regular vulnerability assessments and penetration testing on its voter registration system.
The state has enlisted DHS to help assess and identify potential threats to its voter registration system and election infrastructure.
The state provides cybersecurity training to election officials.
The state does not currently use electronic poll books, but has issued a Request for Proposals (RFP) with hopes of having electronic poll books available for the 2018 elections.
Voter-verified paper audit trail: Unsatisfactory
Depending on the jurisdiction, some voters in Kentucky cast paper ballots, while others vote using paperless DRE machines.
Post-election audits: Unsatisfactory
The state conducts mandatory post-election audits as part of its county certification process. However, Kentucky’s use of paperless DRE machines prevents it from carrying out audits that can confirm the accuracy of election outcomes. • The state’s post-election audits are conducted through manual hand count.
There are two state laws on the books for post-election audits. One audit consists of a manual recount of randomly selected precincts. The selected precincts must represent between 3 percent and 5 percent of all ballots cast in the election. Another law requires the Attorney General to conduct an “independent inquiry” in at least 5 percent of the state’s counties.
All categories of ballots—regular, absentee, provisional, and UOCAVA—are eligible for auditing.
There is no statutory requirement on whether an audit escalates to include more voting components in the event that preliminary outcomes are found to be incorrect.
State law does not require audits to be open to the public, but does permit the media to be present.
Audits occur as part of the state’s certification process.
An audit can reverse the preliminary outcome of an audited contest if an error is detected.
Ballot accounting and reconciliation: Unsatisfactory
All ballots are accounted for at the precinct level.
Precincts are not required to compare and reconcile the number of ballots with the number of voters who signed in at the polling place.
Counties are not explicitly required to compare and reconcile precinct totals with countywide results to ensure that they add up to the correct amount.
There is no statutorily mandated review process to ensure that all voting machine memory cards have been properly loaded onto the tally server at the county level.
The state requires that all election results and reconciliation procedures be made public.
Paper absentee ballots: Fair
The state does not permit voters—including UOCAVA voters—to submit completed ballots electronically. All ballots must be returned by mail or delivered in person.
Voting machine certification requirements: Fair
State law requires that before being purchased and used for an election, all voting machines must be shown to meet or exceed federal voting system standards. In practice, all voting machines are EAC-certified.
Some jurisdictions in the state likely still use voting machines that were purchased more than a decade ago. However, Jefferson County—the state’s largest county—will have all new machines in place for the 2018 elections.
Pre-election logic and accuracy testing: Fair
Election officials conduct mandatory logic and accuracy testing on all voting machines prior to an election.
Testing is open to the public.
Testing must be carried out no more than 30 days but no fewer than five days before Election Day. Testing on in-house absentee voting machines must be conducted no fewer than three days before the machine is used for absentee voting