How Secure Are Ohio Elections Boards?

YOUNGSTOWN, Ohio — As Joyce Kale-Pesta considers what upgrades need to be made to comply with a new directive to improve election security, one of the issues she needs to address has nothing to do with malware, hacking or other mischief to affect election results. 

It’s the openness of the building where the Mahoning County Board of Elections resides, Oakhill Renaissance Place.

“There are so many entrances here,” explains Kale-Pesta, executive director of the board. 

On Kale-Pesta’s desk is a red binder, about five inches thick, detailing the upgrades her department needs to achieve to comply with the directive issued by Secretary of State Frank LaRose June 11 to upgrade overall election security, in particular its information technology infrastructure.   

“This is my book on cybersecurity – so far,” she says. 

The security directive provides boards of elections in each of Ohio’s 88 counties with “a very clear task list” to be accomplished by Jan. 31, 2020.

“This is not an easy task list. This is a long list of things that are going to take a lot of work on their part,” LaRose tells The Business Journal. “When they’re finished, we’re going to be able to say that Ohio is the best-prepared state in the nation to protect against cyberattacks and make sure that we maintain the integrity of our election process.”  

The mandates come at a time of heightened concerns over election security, following efforts by Russia to intervene in the 2016 presidential election. 

A report released July 25 by the Senate Intelligence Committee concluded that elections systems in all 50 states were targeted. Among the recommendations in the report is that all voting machines and registration systems have paper backups.

Several safeguards are already in place, LaRose notes. For example, voting machines are never connected to the internet, so Ohioans should be confident that when they cast their vote, it will be counted accurately.  

Local elections results are transmitted to the Ohio secretary of state’s office on a dedicated computer, adds Stephanie Penrose, executive director of the Trumbull County Board of Elections. She anticipates LaRose’s office probably will come up with ways to further enhance the security of that process. 

While the vote itself can’t be hacked, other aspects of elections are vulnerable. 

“The voter registration system is connected to our main server, which is connected to the internet,” Penrose says. “You have to be very careful with people’s information.” 

Each county board of elections was instructed to implement digital and physical security measures to ensure Ohio is “a leader in election security,” says Kim Fusco, director of the Columbiana County Board of Elections.

Fusco’s office is in the “early stages” of implementing the security directive, she reports. 

“In every election cycle, our office routinely tests our elections equipment to verify accuracy,” she continues. “We utilize tamper-resistant measures and protect access to our elections equipment.”  

Kale-Pesta reports she has spent the entire summer working on cybersecurity, time she usually spends “doing other things – you know, preparing for the next election.”

Among the items in the directive is switching websites and email systems from .com to more secure .gov or .us addresses. “We’ve had that in place for years,” she says. 

Ron Massullo, deputy director of the Trumbull County Board of Elections, says the agency’s data processing department continually looks at cybersecurity issues and is already in compliance with many of LaRose’s orders. 

“When I called the data processing department head, he wondered when I was going to call him so that we would beef up our cybersecurity as we looked to the 2020 election,” he says. “That department stays on top of these types of things constantly.”

Personnel in Trumbull County’s information technology department have been involved with the county board of elections’ efforts since the day the board received the directive, Massullo says. “They’ve been attending the state webinars online as well as looking at potential things we may need once we have the facility assessment,” he says. 

Like Mahoning County, the Trumbull County elections board has shifted its email to better-protected web domains. 

“A government entity really at this point shouldn’t be using a .com email address,” LaRose asserts. “Going into that .gov domain where we have the special protections in place is an important step.” 

To help deal with the election security issues, each county elections board has been allocated $50,000, Kale-Pesta says. 

That’s not going to cover the costs for larger counties such as Cuyahoga County or even Mahoning County, but funds not used by smaller counties will go into a pool from which the large counties can request additional monies, she explains. 

Many boards of elections in Ohio, including in Mahoning and Trumbull counties, have already upgraded their elections equipment, from voting equipment at the polls to the tabulation machines at the board offices. 

“We made a complete change after 14 1/2 years this May,” Massullo reports. The board spent $2.2 million on the new equipment, almost all of it from state-allocated funds. 

Mahoning, Trumbull and Columbiana counties all use equipment purchased from Election Systems & Software, an Oklahoma-based vendor. All three systems also use paper ballots. 

“I would never go back to touch screen” for voting, Kale-Pesta says. 

But paper-backup touch screen terminals are used at the board of elections for early voting and one will be at each polling location in the county to provide access for people with disabilities. Those machines are marking devices that print the completed ballot, which is then fed into another machine to be tabulated.   

Mahoning County’s new voting equipment arrived recently and department staff are being trained on it. Columbiana County’s machines are about 13 years old, and the board plans to upgrade its equipment following next year’s presidential election. 

Daily webinars from the secretary of state’s office provide guidance for local boards of elections to meeting the security directive’s objectives.

“This is not something that we’re telling them what to do and letting them figure it out on their own,” LaRose says. 

The state is taking steps to address not only the technological aspect of security – hardware and software – but also the human element, such as proper training, background checks and vetting of the individuals engaging in the elections processes, board workers and vendors alike. Training includes teaching election workers to spot phishing emails. 

“A lot of these attacks simply come down to somebody emailing something and clicking on a link or document that downloads malicious code,” LaRose says.    

At the Mahoning County Board of Elections, servers have double – in some cases triple – backups, Kale-Pesta says. 

Employees can’t access their personal accounts from office computers, reducing vulnerability to malware or ransom ware, she adds. 

The county has a “great” information technology team that handles much of the work for the Mahoning County board, although she acknowledges meeting the demands of the directive could be challenging for smaller counties.

Sensitive areas of the Trumbull County Board of Elections’ offices, such as the tabulation room, already require keycards from both a Democrat and a Republican, but the board is working toward two-factor authentication to access desktops, Penrose says.    

“We’re going to be shifting into that for all our employees’ computers,” Massullo adds. “We have to shift gears on some of our normal workstation operations.” That shift also will give the department the opportunity to complete some software upgrades. 

Physical infrastructure is one of the issues that will need to be addressed at the Mahoning County board offices, Kale-Pesta says. 

When she recently had personnel from the Mahoning County prosecutor’s office in, they were surprised at how open the building is compared to the county’s two buildings in downtown Youngstown.

The Department of Homeland Security, which has visited the offices once, is returning to outline security issues, she says. The service counter is one area already identified. 

“Even though we lock the doors, someone could still jump over the counter and get to the computers,” she says. “I’m going to have to put screens in and lock the counters down at night.” 

Depending on what is required, county employees might be able to do the installation, leaving her department to just purchase the equipment, she says. 

The Trumbull County board has an August date scheduled with Homeland Security to assess both physical and digital security, Massullo says. 

“Our intention is a full-blown, front-door-to-back-door assessment of the building,” he says. 

The Columbiana County board has worked with the state and its vendors to determine best practices to ensure election security, and the necessary changes will be implemented fully by the January 2020 deadline, Fusco assures. 

Her office is working with both the Ohio secretary of state’s office and Homeland Security to identify vulnerabilities in the county’s current election system. 

“If any problems are revealed, we will then pursue solutions to remedy the deficiency,” she says. 

Pictured above: Joyce Kale-Pesta holds a thick binder of instructions from the Ohio secretary of state’s office.

Copyright 2024 The Business Journal, Youngstown, Ohio.