Election security experts have long warned that touchscreen voting machines are a top target for hackers. | Steve Helber/AP Photo Virginia bars voting machines considered top hacking target

Virginia’s election supervisors on Friday directed counties to ditch touchscreen voting machines before November’s elections, saying the devices posed unacceptable digital risks.

The move represents one of the most dramatic actions taken to help secure elections since a 2016 presidential race rife with concerns about digital meddling and vote tampering. Election security experts have long warned that such machines are a top target for hackers.


The decision forces Virginia counties to swiftly replace any touchscreen devices with machines that produce a paper trail, ensuring the state can audit its closely watched gubernatorial race this November between Democrat Ralph Northam and Republican Ed Gillespie.

The Virginia State Board of Elections voted on Friday afternoon to accept a recommendation from the state's election office that it decertify the machines.

“The Department of Elections believes that the risks presented by using this equipment in the November general election are sufficiently significant to warrant immediate decertification to ensure the continued integrity of Virginia elections,” wrote Edgardo Cortés, the head of the Elections Department, in a memo to board members.

The decision to swap out touchscreen machines is “an extraordinary step forward for the integrity and security of Virginia's elections, allowing them to be audited and recounted in a meaningful way,” said David Jefferson, an election security expert who chairs the board of Verified Voting, a nonpartisan group that tracks election equipment nationwide.

Morning Score newsletter Your guide to the permanent campaign — weekday mornings, in your inbox. Email Sign Up By signing up you agree to receive email newsletters or alerts from POLITICO. You can unsubscribe at any time. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

“In one stroke,” he said in an email, “replacing the paperless electronic voting machines makes defense possible against the whole range of potential software errors and cyberattacks.”

Cybersecurity experts consider these touchscreen devices — known as direct-recording electronic, or DRE, voting machines — to be dangerous because they do not produce paper records of votes that can be compared with their electronic tallies, thus making it impossible to detect tampering. External attachments can create paper backups, but Virginia’s machines lack them.

Cortés told the board that in a security review of the machines prepared for the election office, Virginia’s IT agency concluded that “the potential for loss of vote is significant” because of the lack of paper audit trails.

Twenty-two Virginia voting localities — including counties and independent cities — use the machines, according to Cortés’ memo.

“Those remaining localities really need to switch to a system where we have some sort of backup that can be used in case there’s any question,” Cortés told POLITICO in an interview.

The department presented its recommendation at the state board’s public meeting Friday in Richmond. All three board members voted to approve the suggestion.

In addition to the gubernatorial election, Virginia will hold a slate of statewide elections on Nov. 7.

DRE machines are the starkest example of a danger that election security experts have warned about for years. Like other voting machines, they are not connected to the internet. But the machines used to program them may be, and if hackers compromise those machines, they can tamper with the programming process. Without paper records to verify their output, infected DRE machines could silently tally incorrect votes.

“It’s really not equipment that we feel comfortable using,” Cortés said. “We’re at a point — and our localities are at a point — where we need to make the switch, just to make sure that our November election is successful.”

Unlike most other states, Virginia’s election supervision is bifurcated. The state's Department of Elections, led by Cortés, manages the voter registration system, works with local officials and handles other administrative matters. The three-member Board of Elections makes policy decisions — including approving and disapproving voting equipment — and certifies election results.

The Department of Elections previously worked with the state IT office in 2015 when it convinced the board to decertify Virginia’s notoriously insecure WINVote machines.

Virginia had previously passed a law to phase out all of its touchscreen voting equipment by 2020. But if the department’s recommendation is approved, the decision would essentially nullify that law, moving up the sunset date to Nov. 7 of this year.

Joe Hall — a Verified Voting board member who is also chief technologist at the Center for Democracy and Technology, a digital rights advocate — praised the Virginia Elections Department for its new recommendation and said the state had “come a long way in recent years in terms of embedding security and privacy into the election process.”

He also said that he hopes the Virginia state Legislature or Congress will step in to help counties replace the now-decertified DRE machines. Two years ago, Democratic Virginia Gov. Terry McAuliffe asked the state Legislature for $28 million to help counties buy new machines, but the Legislature denied the request.

“We are getting to a point where we need to explicitly budget for protecting the machinery of democracy,” Hall said in an email, “and everyone else thinks that’s someone else's job.”

Many other states use DRE machines, some exclusively and some in combination with paper ballots. Cortés said the election office had notified other states of its recommendation.

