* The information provided below is compiled from various independent organizations working on election defense. US BASE cannot verify the accuracy of all data. Additionally we cannot vet every state or local organization working on election defense.
North Carolina Technology in Use
Verified Voting Foundation
* Note that "Paper Ballot" in the map below typically designates paper ballots counted by an electronic scanning device.
Center for American Progress State by State Voting System Report
See State Grade Below
"In August 2017, the Center for American Progress released a report entitled “9 Solutions for Securing America’s Elections,” laying out nine vulnerabilities in election infrastructure and solutions to help improve election security in time for the 2018 and 2020 elections. This report builds on that analysis to provide an overview of election security and preparedness in each state, looking specifically at state requirements and practices related to:
1. Minimum cybersecurity standards for voter registration systems
2. Voter-verified paper ballots
3. Post-election audits that test election results
4. Ballot accounting and reconciliation
5. Return of voted paper absentee ballots
6. Voting machine certification requirements
7. Pre-election logic and accuracy testing
This report provides an overview of state compliance with baseline standards to protect their elections from hacking and machine malfunction. Some experts may contend that additional standards, beyond those mentioned here, should be required of states to improve election security. The chief purpose of this report is to provide information on how states are faring in meeting even the minimum standards necessary to help secure their elections.
It is important to note at the outset that this report is not meant to be comprehen- sive of all practices that touch on issues of election security. We recognize that local jurisdictions sometimes have different or supplemental requirements and proce- dures from those required by the state. However, this report only considers state requirements reflected in statutes and regulations and does not include the more granular—and voluminous—information on more localized practices. Furthermore, this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing ballots and system programming. And while we consider some minimum cybersecurity best practices, we do not analyze specific cyberinfrastructure or system programming requirements. These technical standards and protocols deserve analysis by computer scientists and IT professionals who have the necessary expertise to adequately assess the sufficiency of state requirements in those specialized areas."
North Carolina: B
North Carolina adheres to a number of minimum cybersecurity best practices related to voter registration systems and conducts its elections using paper ballots and voting machines that provide a paper record. However, its post-election audits do not currently include provisional ballots. North Carolina allows voters stationed or living overseas to return voted ballots electronically, a practice that election security experts say is notoriously insecure. The state did earn points for requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines before being purchased or used in the state, and for requiring election officials to carry out pre-election logic and accuracy testing on all machines that will be used in an upcoming election.
To protect its elections from potential manipulation, North Carolina should adopt robust post-election audits that adequately test the accuracy of election outcomes. In updating its requirements, the state should look to risk-limiting audits like those in Colorado as a potential model. Given the threat posed by sophisticated nation-states seeking to disrupt U.S. elections, it is imperative that post-election audits test the accuracy of election outcomes and detect any possible manipulation. North Carolina should also make sure that any cybersecurity training that state officials receive includes training specific to election security. The state should also prohibit electronic absentee voting, even by UOCAVA voters who are currently allowed to return voted ballots by email or fax. All voted ballots should be returned by mail or delivered in person.
Minimum cybersecurity standards for voter registration system: Good
The state’s voter registration system is estimated to be at least 10 years old. However, the North Carolina State Board of Elections maintains an in-house technical staff of approximately 19 employees to maintain and update the state’s voter registration system.
The state’s voter registration system provides access control to ensure that only authorized personnel have access to the database.
The state’s voter registration system has logging capabilities to track modifications to the database.
The state’s voter registration system includes an intrusion detection system that monitors incoming and outgoing traffic for irregularities.
• The state partners with DHS for regular security and vulnerability assessments in addition to monitoring through North Carolina’s Department of Information Technology and in-house controls.
The state has enlisted DHS to help assess and monitor state voter registration systems and identify potential vulnerabilities.
• Although election officials do not receive training specific to elections, all state employees must receive some basic cybersecurity training.
Electronic poll books are used by some, but not all, jurisdictions in North Carolina.1110 The state conducts pre-election testing on electronic poll books prior to an election. All polling places that use electronic poll books are required to have paper backups of voter registration lists available on Election Day.
Voter-verified paper audit trail: Fair
Depending on the jurisdiction, some voters in North Carolina currently cast paper ballots, while others vote using DRE machines with VVPR. Roughly three-quarters of North Carolina counties rely exclusively on paper ballots. By 2019, North Carolina will phase out all DRE machines and switch to a statewide paper ballot voting system.
Post-election audits: Fair
The state requires post-election audits.
The state’s post-election audits are conducted through manual hand count.
Audits include a statistically significant number—determined in consultation with a statistician—of precincts or ballot groupings derived from absentee or early voting. Usually two precincts or ballot contests are considered enough to produce a “statistically significant result,” as required by state law. Only one ballot contest is required to be included in an audit. During presidential election years, the contest to be audited must be the presidential contest. Two or more ballot contests are sometimes audited for municipal elections.
The precincts or ballot groupings included in the audit are selected randomly.
Provisional ballots are not included in manual audits.1122 North Carolina’s extensive post-election audit procedures include examining provisional ballots to determine voter eligibility.
An audit escalates in the event that preliminary outcomes are found to be incorrect up to a full recount if necessary.
• The audits are open to the public.
Audits typically occur within 24 hours after an election and are usually completed by the Thursday after Election Day, prior to certification of official election results.
An audit can reverse the preliminary outcome of an audited contest if a significant discrepancy is discovered and a full hand count is ordered.
Ballot accounting and reconciliation: Fair
All ballots are accounted for at the precinct level.
Precincts are required to compare and reconcile the number of ballots with the number of voters who signed in at the polling place.
Counties are required to compare and reconcile precinct totals with countywide results to ensure that they add up to the correct number.
Counties are required to review and ensure that all voting machine memory cards have been properly loaded onto the tally server.
State law requires that election results be made public, and while the state does not publish a full report on ballot reconciliation procedures, it is required to furnish public information, including election data, to any requesting party not covered by a very narrow list of exceptions in state law
Paper absentee ballots: Unsatisfactory
The state permits UOCAVA voters to submit completed ballots, via email or fax.
Voting machine certification requirements: Fair
Before being purchased and used for any election in the state, all voting machines must undergo testing by a federally accredited laboratory
Some jurisdictions in the state likely still use voting machines that were purchased more than a decade ago.