The Washington PostDemocracy Dies in Darkness

The Cybersecurity 202: More states now have paper trails to verify votes were correctly counted

with Tonya Riley

When all the votes are counted this year, Americans should have far more confidence their votes were tallied correctly than in 2016. 

After that contest was upended by Russian interference, states vastly increased the number of votes that are cast with paper records that can be audited later. More than 90 percent of votes will have a paper record this year compared with about 80 percent in 2016. 

States have also significantly improved how often and how scrupulously they perform post-election audits. 

The changes have been especially significant in some of the states still counting ballots and where the Trump campaign has already launched legal challenges.  

Georgia and Pennsylvania have both shifted from having paper records for few or none of their voters in 2016  to having paper records for all votes cast in their states — a protection security experts say is a bare minimum to ensure votes weren’t altered by hackers or miscounted because of a technology failure. 

Michigan, Pennsylvania, Georgia and Nevada also probably are performing more rigorous audits of their results this year, though officials haven't finalized plans in all cases. Edison Research has projected that Biden will win Michigan and Wisconsin. Trump is leading in Pennsylvania, Georgia and North Carolina and Biden is leading in Nevada and Arizona, with many votes still to be counted. 

The changes are part of a wholesale shift by election officials after 2016 to prioritize the security and resilience of voting systems versus the post-2000 model that focused primarily on making voting easier and ensuring there wasn’t confusion about voter intent as in Florida that year. 

The ultimate goal — which is still a ways off — is a system in which even if Russia or another adversary succeeded in manipulating vote counting, officials would be able to spot the manipulation and re-create an accurate count with paper records. 

The country is making distinct progress toward an election system in which every voter is able to verify that their ballot is marked correctly and election officials are able to verify that ballots are counted correctly,” Mark Lindeman, interim co-director of Verified Voting, told me. He added that “2020 is by no means the promised land, but we’re certainly much closer.” 

The changes could be a safeguard against uncertainty as President Trump and some of his supporters aim to undermine confidence in the election results.

Trump spent months attacking the legitimacy of the election and has claimed without evidence since Tuesday that vote tallying and counting are being conducted improperly and in a way that aids Joe Biden in Pennsylvania, Michigan and elsewhere. 

Trump claimed on Twitter to have won the electoral votes of Pennsylvania, North Carolina and Georgia even though no major news organization has made those calls and electoral votes are determined by states, not candidates. 

He also claimed to have won the 16 electoral votes in Michigan “if, in fact, there was a large number of secretly dumped ballots.” In fact, there’s no evidence of such secretly dumped ballots and Edison Research has projected Biden won the state with about 120,000 more votes than Trump and about 99 percent of votes counted. 

Twitter labeled both of Trump’s tweets as misleading and limited their spread.

The Trump campaign has also filed a slew of lawsuits challenging the process or counting of mail ballots in Pennsylvania, Michigan and Georgia and demanded a recount in Wisconsin. Edison Research has projected that Biden will win Wisconsin. 

In fact, although a handful of states don’t have paper records for all votes now, none of them are among the states Trump is contesting or that haven’t been called. 

Michigan and Wisconsin have both used hand-marked paper ballots since before 2016 for all voters except those with disabilities that make voting by hand difficult or impossible. Those voters use machines that produce a paper record of their votes. 

This year, Arizona is using hand-marked paper ballots for all voters except those with disabilities. North Carolina and Pennsylvania are using a mix of hand-marked paper ballots and machines called ballot-marking devices that produce a paper record. Nevada is using voting machines that used to be paperless but have been rigged to produce a paper record. 

Georgia, which is one of the few states that makes a statewide decision about its voting system, made the controversial decision in 2019 to use ballot-marking devices rather than hand-marked paper ballots.  

Many election security experts say BMDs are inferior to hand-marked paper ballots because voters are less likely to look at their completed ballot to verify it’s accurate and because they’re more prone to malfunctions that can produce confusion and long lines. 

But there’s no question they’re superior to voting systems with no auditable paper trail. 

“Voters are much better served having some possibility for verifying their votes were cast on BMDs than having no possibility to verify their votes were cast at all,” Lindeman said.

Many of those states are also shifting to an advanced form of post-election audit called a risk-limiting audit.

Those audits typically verify by hand a percentage of votes in a race correlating the winner’s margin of victory. Statisticians say that effectively ensures there’s no reasonable chance that enough votes were miscounted or changed maliciously that it would alter the outcome. 

Michigan ran the largest-ever pilot of a risk-limiting audit during this year’s presidential primary but hasn’t yet finalized plans for such an audit after the general election. Pennsylvania similarly conducted a risk-limiting audit during its primary and may conduct one after the general election. Nevada is planning a pilot risk-limiting audit of the general election. 

Georgia has pledged to conduct a risk-limiting audit for at least one race in the general election but it’s not clear whether that will be the presidential race or another statewide race. Secretary of State Brad Raffensperger (R) said yesterday his office will make a determination shortly. 

Other states with tight races all plan to conduct more traditional audits to ensure ballots were tallied correctly. 

The keys

Unfounded voter fraud claims flooded TikTok during its first major election test.

Videos circulated on the popular app yesterday using the hashtags #voterfraudonlywaybidenwins and #riggedelection — parroting unverified claims by Trump and his supporters that Biden's lead in key states was the result of fraud.

The influx of such content shows how unverified claims are moving from Facebook and Twitter to other platforms with fewer resources to limit their spread, researchers at the Stanford Election Integrity Partnership say. For instance, prominent content in the search for #riggedelection, which had over 1 million views, consisted of viral tweets screenshotted from Twitter. (The hashtag also included posts debunking the claims and parodies.)

TikTok redirected the hashtag #voterfraudonlywaybidenwins to its community guidelines page after The Post flagged the search and has also redirected #riggedelection.

“This hashtag often violates our misleading information policy,” spokeswoman Jamie Favazza said in an email.  "We remove such content and redirect searches and hashtags to our Community Guidelines to limit the spread of misinformation."

But other election hashtags, such as #ballotharvesting, haven't met that threshold and remain up. In those cases, TikTok largely focuses on identifying and removing individual videos that violate its policies, Favazza said. 

The approach has resulted in mixed success, researchers say.

TikTok is kind of a tale of two platforms because they have a team that is very reactive to reports they get but they are having a problem being proactive, said Stanford's Alex Stamos, former cybersecurity chief at Facebook. Adding to that complication is the site's video-based content, which is harder to police than text, he says.

He suggested the platform should be more aggressively monitoring hashtags used to surface disinformation on other platforms.

This post was updated to reflect additional action taken by TikTok.

Thousands of mailed ballots didn't meet Election Day deadlines, USPS data shows.  

Nearly 7 percent of ballots in sorting facilities on Tuesday were not processed in time to be counted, the agency disclosed in a federal court filing, Jacob Bogage and Christopher Ingraham report

The relatively small portion of ballots could still make a big difference in close states. The unprocessed ballots were reported after the Postal Service rejected a court order demanding the agency sweep 12 processing facilities covering 15 states for potentially delayed ballots.

Civil rights advocates who are suing the Postal Service say it's hard to know what impact the decision had. 

We know yesterday that if the sweeps were doing their job, mail that was identified as ballots and were in the system should have been pulled out and delivered, and it may be that affects what we see as the scores,” said Allison Zieve, an attorney representing the NAACP, which brought the lawsuit against the Postal Service.

DHS’s top cybersecurity official praised state and local officials for keeping the election free of hacking. 

“We are only here because of the hard work of state and local election officials and private-sector partners who have focused efforts on enhancing the security and resilience of elections,” Cybersecurity and Infrastructure Security Agency Director Chris Krebs said in a statement. 

CISA saw no evidence of any foreign adversary preventing voting or altering results — a major development after the 2016 election was rocked by Russian interference. The NSA and FBI reached similar conclusions about election night. Gen. Paul Nakasone, who leads both the NSA and U.S. Cyber Command, said levels of foreign targeting were much lower than in 2018, Ellen Nakashima reported.  

CISA will continue to work with state and local election officials to secure systems while they tally and certify official results, Krebs said.

“We will remain vigilant for any attempts by foreign actors to target or disrupt the ongoing vote counting and final certification of results, he said. The American people are the last line of defense against foreign influence efforts and we encourage continued patience in the coming days and weeks.

More election news:

Confusion and conflict stir online as Trump claims victory, questions states’ efforts to count ballots (Craig Timberg, Tony Romm, Isaac Stanley-Becker and Drew Harwell)

Trump and his allies boost bogus conspiracy theories in a bid to undermine vote count (Isaac Stanley-Becker, Tony Romm, Elizabeth Dwoskin and Drew Harwell)

Fake Twitter Accounts Posing as News Organizations Prematurely Declare Election Victories (Wall Street Journal)

Chat room

Waiting on election results like:


  • The Cybersecurity Coalition and the Cyber Threat Alliance will host CyberNextDC on Nov. 17-18, starting at 11 a.m.

Secure log off

The power of voting: