Gov. Cuomo votes (photo: Kevin P. Coughlin/Governor's Office)

Is New York ready for an election cyber-attack? Are the state’s voting systems vulnerable to hacking?

The New York State Assembly’s Election Law Committee heard testimony on Tuesday from state and local election board officials and cybersecurity experts on the systems in place to protect the state’s election processes from the types of coordinated cyberattacks that were carried out by Russian actors who sought to influence the 2016 presidential election.

The hearing was prompted by developments in September, when the Department of Homeland Security informed officials from 21 states that their election systems, including their registration databases, were targets of the coordinated Russian hacking effort that also attacked the Democratic National Committee and members of Hillary Clinton’s campaign last year. Although New York was not among them, the news raised concerns among state officials that similar incursions could be levelled against New York election infrastructure.

With the local elections of this year over and a state-level election cycle coming up in 2018, when all of the state Legislature and the four statewide positions will be on the ballot, Assembly members spent four hours Tuesday seeking clarity on how election data is managed, results are counted and recounted, and how the state works with federal and local authorities to detect and prevent cyber attacks like the ones seen last year.

“These attacks were not aberrations, they were not isolated incidents and only the most naive and or the most corrupt would believe that they will not continue into the future,” said Assembly Member Charles Lavine, a Democrat from Nassau County and chair of the committee, in his opening remarks.

Officials from the New York State Board of Elections seemed to put fears at rest almost immediately, even as they acknowledged that certain changes are required and that existing regulations need to be implemented more stringently.

“New York actually has one of the most secure systems in the country,” said Douglas Kellner, co-chair of the state BOE. He noted that the Help America Vote Act passed by the United States Congress in 2002, which enacted reforms to voting systems and provided federal funds for new voting equipment, did not first establish standards for that equipment. New York was one of the last states to comply, but in doing so years later implemented it correctly, he said, “in a manner that provides voters with secure and verifiable elections.”

The state has strict laws requiring certification and testing of both election software and hardware, Kellner said, as well as independent outside reviews of software. Wireless connections and networking capabilities are prohibited in voting equipment and even the computers used to program ballot scanners must be standalone devices without internet connectivity. “That isolation of the system used to set up the voting machines is something relatively unique to New York and it substantially reduces the possibility for the introduction of malware into our voting machines,” Kellner said.

The state also prohibits county boards of elections from contracting with outside vendors to program voting machines, which Kellner did concede could be cumbersome for smaller county boards with limited staff.

Finally, the state requires an audit of three percent of the voting machines used in each county after every election. The audit requirements were a particular focus of the hearing, with good government advocates and cybersecurity experts advocating for a new, more efficient method, called risk-limiting audits, developed in recent years.

Risk-limiting audits randomly choose which ballots to audit for comparison with the paper record, and determine the statistical level at which one can be confident that election results are correct. It results in a changing standard for the number of ballots that have to be audited, depending on the closeness of election results. The closer the race, the more ballots would be examined, for instance. Kellner generally endorsed the idea and recommended that the committee explore legislation to enact the improved system.

Kellner did have his own points to make during his testimony, noting that the law dealing with extremely close contests is “flawed” since escalating from a three percent audit to a full audit requires consensus from election commissioners representing opposing political parties, which is not easy to come by.

As an aside, Kellner, a Democrat, noted that New York would not be able to implement online voting any time soon since “the best technical minds around the world have not solved the problem of maintaining the secret ballot while at the same time ensuring that the ballot is cast and counted in the manner intended by the voter.”

Robert Brehm, co-executive director of the state BOE, said though the board is unaware if New York was directly targeted during the 2016 election, hackers consistently attempt intrusions into their systems and none have significantly affected election administration. The BOE takes a three-pronged approach to cyber-preparedness, he said, which involves developing a comprehensive risk assessment strategy, a strategy for county cyber-readiness, and bolstering plans to respond to individual incidents of cyber-intrusion.

Brehm said state officials cooperate with a slew of federal authorities and are striving to ensure that the information shared between them is also given to county election boards, which lack a strong cybersecurity apparatus and are more vulnerable.

The Assembly members present for the hearing at 250 Broadway in Manhattan, seven Democrats and two Republicans, had a broad range of inquiries. They asked about the board’s experiences with cyber attacks in the past, conclusions on trusted vendors who can work with county boards, and the mechanisms for keeping the legislative and executive branches of government in the loop. They asked about recommendations on electronic poll books (BOE’s Kellner said they had yet to thoroughly examine the proposal, though legislation to implement e-poll books has appeared close to passage in the Legislature), plans to update equipment, and cyber-readiness training for county BOE staff.

At the county level, Brehm conceded, “there’s much more work that’s needed to be done....The voting machines are isolated and very much the voter registration systems are not. They’re part of county infrastructure.” The BOE has full authority, he said, “to promulgate regulations that we are considering with regards to improving our security posture and requirements at the county level, but implementing them is going to be very difficult.”

Assembly Member Robert Carroll of Brooklyn raised the prospect of hackers attempting to purge voters from the rolls, asking the BOE officials how they monitor county BOE rolls. Brehm insisted the board conducts real-time monitoring of voter rolls and is working on updating its system. Carroll also mentioned the infamous purge of nearly 120,000 voters in Brooklyn ahead of the 2016 presidential primary, which Brehm said was due to a procedure being inaccurately followed rather than a failure in the system. He later emphasized the need for greater resources for county boards, and said the BOE would make a more substantial funding request in the upcoming state budget session.

Michael Ryan, executive director of the New York City BOE, also insisted during his testimony that “money is always a critical thing,” although he did praise the cooperative attitude of the state BOE and federal officials.

Ryan said there were initial missteps in communication with federal authorities following the 2016 election cyberattack but the city was prepared for the eventuality. “The good thing is it was the type of circumstances that were built into the protections that were already in place,” he said. He insisted that the board had administered the 2016 and 2017 elections “without an issue of consequence,” but would need to be more vigilant for next year, when there will be congressional, state legislative, and statewide elections in New York. “We’re in pretty good shape...but we’re only in good shape until October of 2018,” he said. “So we really need to take a look at that critically and say, ‘how are we going to plan this out?’”

There were numerous recommendations made to the Assembly committee, some of which involved administrative solutions while yet others require legislative fixes.

Dustin Czarny, commissioner from the Onondaga County BOE said the current voting and election system leaves little time to identify and remedy issues with ballots. He encouraged the Assembly members to pursue electoral reforms such as early voting and no-excuse absentee voting. The two are among a slate of election reforms that have stalled in the Republican-controlled state Senate, with minimal objection from Democratic Governor Andrew Cuomo or the Democratic-led Assembly.

Susan Lerner, executive director of Common Cause New York, a good government group, and Susan Greenhalgh, vice president of programs at Verified Voting, a nonprofit focused on voting system technology, both argued for risk-limiting audits of voting machines.

Lerner pointed out that the current election auditing method looks at the process rather than results -- by testing vote totals from machines instead of directly examining ballots. She insisted that the state must constantly inspect paper ballots for accuracy, must never allow online voting, and must do away with the current system of election audits. “A flat three percent audit really, we feel, doesn’t hit the mark,” she said, agreeing to help legislators and election administrators in crafting legislation on risk-limiting audits.

“We have to look at ways to protect [the election system] as a national security asset,” Greenhalgh said, “and this is something that’s being run at county levels by people who are not in the federal national security space typically.”

Greenhalgh said the focus in computer security was increasingly on “resilience,” allowing a system to function even after it has been hacked. “If we’re looking at resilience in election systems, we want a system that would ensure that voters can vote,” she said, “that their votes get counted correctly...and that the proper outcome is realized.” She also supported the continued use of paper ballots as the simplest means of maintaining physical records, and reiterated the need for risk-limited audits.

“There is a limit to what our security practices, as good as they are in New York, can do,” she said.