* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense. 

 

Michigan Technology in Use
Verified Voting Foundation

* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device. 

Click for Verified Voting's interactive map

Screen Shot 2019-03-08 at 12.22.15 PM.png

Center for American Progress State by State Voting System Report

See State Grade Below
 

Report Excerpt:

"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:

1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing

This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.

It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."

Michigan: C

Michigan adheres to a number of minimum cybersecurity best practices related to voter registration systems and conducts its elections with paper ballots, but its failure to mandate post-election audits that can confirm the accuracy of election outcomes leaves the state vulnerable. After certification, the state conducts a procedural review that evaluates the proper testing of voting machines’ programming and the functionality of hardware and software. The current process does not yet compare ballot totals in a meaningful way. Michigan’s ballot accounting and reconciliation procedures can also use improvement. The state did earn points for requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines before being purchased or used in the state, and for prohibiting absentee voters from returning voted ballots electronically. In Michigan, all voted ballots must be returned by mail or delivered in person. The state also requires election officials to carry out pre-election logic and accuracy testing on all machines that will be used in an upcoming election.

To improve its overall election security, Michigan should adopt robust post-election audit processes that test the accuracy of election outcomes. Encouragingly, we were told that state officials piloted a ballot tally comparison as part of Michigan’s postelection procedures during the November 2017 election. To improve its auditing procedures, the state should look to risk-limiting audits like those in Colorado as a potential model. Given the threat posed by sophisticated nation-states seeking to disrupt U.S. elections, it is imperative that post-election audits test the accuracy of election outcomes and detect any possible manipulation. Michigan should also update some of its requirements for electronic poll books. We were told by Michigan officials that testing electronic poll books prior to an election is not necessary, given that the poll book system is not connected to the state’s voter registration system. Instead, prior to Election Day localities download the relevant voter lists onto the electronic poll book laptop. The concern, however, is that malware could be embedded into these downloaded files, which could leave voter lists inaccessible on Election Day. This is one reason why it is important to test all electronic poll books prior to every election. Finally, Michigan can strengthen its ballot accounting and reconciliation procedures by requiring counties to compare and reconcile precinct totals with composite results to confirm that they add up to the correct number.

Minimum cybersecurity standards for voter registration system: Fair

  • The state’s voter registration system is estimated to be at least 10 years old. However, the system is in the process of being completely rewritten in a new language on a new platform and a new server. The new system is expected to be rolled out in early 2018.

  • The state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.

  • The state’s voter registration system has logging capabilities to track modifications to the database.

  • The voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.

  • The state performs regular vulnerability assessments and penetration tests on the state’s voter registration system.

  • The state has enlisted DHS to help assess and identify potential threats to its voter registration system and election infrastructure.

  • The state provides initial cybersecurity training to election officials at the state level and to others who have access to the state’s voter registration system. The state plans to expand its online cybersecurity module training to election officials at the local level.

  • Electronic poll books are used statewide in Michigan. The state’s electronic poll book system is not connected to the state’s voter registration system. Instead, prior to Election Day localities download the relevant voter lists onto an encrypted electronic poll book laptop. In doing so, they are directed by the state to confirm that all of the proper software updates have been loaded onto the machine. Pre-election testing of electronic poll books is left up to the localities that use them. Paper voter registration lists are available at polling places that use electronic poll books on Election Day.


Voter-verified paper audit trail: Good

  • Elections are carried out using paper ballots and optical scan machines.


Post-election audits: Unsatisfactory

  • The state conducts a post-election procedural review after certification and evaluates the proper testing of voting machines’ programming and the functionality of hardware and software. The review does not yet compare ballot totals in a meaningful way. However, during the 2017 elections, state officials piloted a new ballot-tally comparison with plans to expand the program to counties this year. According to one state official, the program “will include a ballot count for 1-3 races on the audited precinct ballot. The number This year, Michigan will unveil a completely refurbished new voter registration system, rewritten in an updated language on a updated platform and server. Michigan has received or is expected to receive additional funding for cybersecurity at their election agencies. 102 Center for American Progress | Election Security in All 50 States of races counted will depend on the number of races and proposals on the ballot … For larger statewide ballots in even years, we will plan to count up to 3 races (e.g., top of the ticket, county level, local level).” The process includes a manual hand count conducted by two staff persons to verify that the number of ballots matches the number tabulated on Election Day. According to the state officials, “The ballots are then separated into piles based on the vote cast in the counted race; totals are then tallied and reported for each candidate (if applicable); proposal Yes/No (if applicable); write-in votes (if applicable); overvotes; and undervotes. Audit count results are recorded and reported with the rest of the audited tasks, with any anomalies and/or changes from Election Day totals noted.


Ballot accounting and reconciliation: Unsatisfactory

  • All ballots are accounted for at the precinct level.

  • Precincts are required to compare and reconcile the number of ballots with the number of voters who signed in at the polling place.

  • Counties are not explicitly required to compare and reconcile precinct totals with county-wide results to ensure that they add up to the correct amount.

  • As a matter of standard practice on election night, counties confirm that all precinct tally results and memory cards are received and loaded at the county level.

  • All election results and reconciliation procedures are made public.

Paper absentee ballots: Fair

  • The state does not permit voters—including UOCAVA voters—to submit completed ballots electronically. All voted ballots must be returned by mail or delivered in person

Voting machine certification requirements: Fair

  • Before they may be purchased and used in the state, all voting machines must be certified by the Election Assistance Commission.

  • Some jurisdictions in the state likely still use voting machines that were purchased more than a decade ago. However, the state began to replace all optical scanning machines in August 2017. As of November 2017, 49 of 83 counties had converted to new voting systems. All remaining voting machines are scheduled to be updated by August 2018.

Pre-election logic and accuracy testing: Fair

  • Election officials conduct mandatory logic and accuracy testing on all voting machines prior to an election.

  • Testing is open to the public.

  • Testing is carried out at least five days before an election.







SIGN UP FOR ACTION ALERTS