RICHMOND — Concerned about potential hacking two months away from the state’s closely watched gubernatorial election, Virginia’s state Board of Elections voted Friday to replace any touchscreen voting machines before November’s elections.
The three-member board voted unanimously to decertify Direct Recording Electronic voting machines, acting partly out of concern that their security had been compromised at DefCon, an annual hack-a-thon held in July in Las Vegas. The machines do not produce a paper trail, which the department described as an important security feature.
The machines are in use in 22 localities, including Falls Church. Seven of the jurisdictions are already in the process of replacing them - Lee County, Rappahannock County, Russell County and the cities of Norfolk, Portsmouth, Poquoson and Martinsville. Another three have said they intend to get new machines.
Friday’s action will force the remaining jurisdictions – which together serve 140 of the state’s 2,439 voting precincts, or about 190,000 of the state’s 5 million active voters – to replace theirs before the November 7 election.
The localities must pick up the bill for new machines. In 2014, Gov. Terry McAuliffe sought $28 million to help jurisdictions replace voting machines, but the GOP-controlled General Assembly cut the funds from the state budget.
Virginians will choose a governor, lieutenant governor, attorney general and members of the House of Delegates in the most closely watched state election in the country this year.
“The ability to meaningfully participate in our democracy is one of the most important rights that we have as citizens, and the Department of Elections is dedicated to maintaining voters’ confidence in the democratic process,” Elections Commissioner Edgardo Cortés said in a written statement.
Board Chairman James Alcorn said the move was necessary to “ensure the integrity of Virginia’s elections.”
Ahead of the vote, state elections officials laid out concerns about the machines in a report, which noted vulnerability exposed and exacerbated by hackers at DefCon.
“DefCon, an annual conference of hackers, promoted the ‘Voting Machine Hacking Village’ at which multiple voting machines, mostly DREs, were made available,” it said. “Multiple types of DREs, some of which are currently in use in Virginia, were hacked according to public reports from DefCon. Additional troubling reports from DefCon were publicized, including one that expressly stated the password for a DRE that was in use in the Commonwealth, and one that indicated that some DREs in use have a single password shared by all machines from an individual vendor.”