It's been roughly two years since the first signs that Russia had launched an interference campaign aimed at the 2016 presidential race, and now the United States is hurtling toward a set of pivotal midterm elections in November. But while some states have made an earnest effort to secure the vote, the overall landscape looks troubling—and in some cases, it's too late to fix it this year.

While Russian meddling inspired many election officials to take cyberthreats seriously and double down on security, each state oversees its own elections process. In the limited window to make defense improvements before the midterms, regional officials can approach the risk in whatever way they see fit.

As a result, some citizens will go to the polls in precincts and states that have audited their systems and plugged holes. Some will vote in places that have strong protections on digital election assets, like results-reporting websites and voter registration databases. Some will vote with paper ballots—that's good—or on machines that automatically generate a paper backup. But election officials and security experts who have participated in or observed the scramble to improve defenses agree that most voters will encounter a mishmash, with some of these protections in place, and some still years away.

In the meantime, the threats to US elections are real. When the BBC asked CIA Director Michael Pompeo last week whether he foresaw Russia continuing to pursuing election meddling during the 2018 midterm elections, he said, "Of course. I have every expectation that they will continue to try and do that." Likewise former State Department cyber coordinator Christopher Painter said in Congressional testimony on Tuesday that, "The lack of a sufficiently strong, timely, and continuing response to Russian interference with our electoral process virtually guarantees that they will attempt to interfere again."

And time is running short. Though the full midterm elections are still nine months away, primaries kick off on March 6 in Texas.

Mixed Bag

Some states have moved quickly to enact large-scale changes. Virginia memorably took the plunge this fall, rushing to finish a decade-long process of replacing all of its digital-only touchscreen voting machines with voter-marked paper ballots. Shortly after at the end of November, Colorado completed a large-scale election system integrity audit (known as a "risk-limiting audit") first mandated by the state legislature in 2009 and delayed from an original 2014 goal. Rhode Island is working to implement risk-limiting audits for this year's elections. And Michigan is on track to replace all of its aging and unsupported voting machines with new paper ballot systems in time for the state's August primaries.

'Congress has really dragged its feet.' Lawrence Norden, Brennan Center

You might have noticed a common thread: Experts agree that a critical step for security is ensuring that all precincts in all states use paper ballots and optical scanners, or have digital voting machines that produce voter verified paper backups. Heading into 2018, five states—Delaware, Louisiana, Georgia, South Carolina, and New Jersey—all still use digital voting without paper backups. Nine other states have a mix, in which some precincts still don't have any type of paper ballot or backup. Delaware has worked to replace its digital voting machines, but the change is only slated to arrive in time for the 2020 presidential election season.

"First we need to replace these older systems that don’t have a paper record, then we need to replace the other states' older equipment that’s vulnerable based on its age," says Marian Schneider, president of Verified Voting, a group that promotes election system best practices. "There are recommendations to move in that direction, the question is whether they are going to be able to do it before 2018. You’d have to move pretty quickly to do it now."