After 2016 Russian hack attempts on Pa. voter data, registration system to be audited

Pennsylvania Auditor General Eugene DePasquale said Monday that his office will evaluate the security of the state's voter-registration system, a target of Russian hackers before the 2016 presidential election.

Pennsylvania was one of 21 states whose election data were sought by Russian hackers, the U.S. Department of Homeland Security said last year.

Though there was no evidence of a breach, DePasquale said, the revelation prompted him and others to test the system's security.

"This is something that has been talked about both locally and nationally for quite some time," DePasquale said. "I believe it is the right time to make sure we are doing everything we can to make sure our voting system in Pennsylvania is secure."

The audit will focus on the Statewide Uniform Registry of Electors (SURE), which holds the registration information of more than eight million voters in the state's 67 counties. The SURE system is run by the Pennsylvania Department of State.

The audit will be completed and its results will be sent to the Department of State so it can make necessary changes for the 2020 presidential election, DePasquale said. The process will assess whether the SURE system's records are accurate and secure and whether it is likely to be completed by early 2019, a spokesperson for the Auditor General's Office said.

Officials are looking to replace and improve the 16-year-old SURE system to ensure voter data security. But the new database will likely not be in effect in time for the 2020 election.

Last summer, state officials acknowledged that Russian hackers "scanned" state websites before the 2016 presidential election, searching for openings to exploit.

"Scanning is like a burglar going into your neighborhood, looking for a door that was not secured, or a window," Robert Torres, the acting secretary of the commonwealth, said at Monday's news conference. "If they get in, that's where they can take things and damage your systems or damage your property." He said there is no evidence anyone broke into the SURE system.

The state's elections system has "layers of security" to prevent hackers from accessing data, including encryption. The U.S. Department of Homeland Security also scans the state's election database daily, he said.

The SURE system houses a person's voting history, including every change of name, address, party, and marital status. It also records every election in which a voter participates, totaling about 150 fields of data per voter, said Wanda Murren, a State Department spokeswoman.

If Russians were to hack into the SURE system, officials fear they could remove a voter from the system, add names of noncitizens to the voter rolls, or delete a voter's history.

"I wouldn't want to play amateur Captain Chaos," DePasquale said after listing the concerns of his office.

The audit will include analyzing voter registrations online and through the state Department of Transportation when someone applies for or renews a driver's license or car registration.

That "motor-voter" process came under scrutiny last year, when a Philadelphia elections official said his office had learned that a glitch had allowed permanent residents who were not U.S. citizens to register and vote in elections.

Asked whether the Auditor General's Office would investigate this PennDot loophole, Barry Ciccocioppo, the director of communications for the auditor general, said: "Essentially, we'll be looking at all of the methods for registering to vote and all of the processes for how the voter registry is updated."

Murren said that loophole has been "corrected," though officials have never disclosed how many noncitizens were improperly registered. She added that the department is still investigating other ways that allowed legal residents who were not citizens to register to vote.

Through a separate investigation, Murren said, the State Department had learned that an unidentified number of noncitizens were able to register to vote through paper applications and voter registration drives approved by county elections offices. Officials are not legally allowed to ask for proof of citizenship, which is part of the problem, she added.

At Monday's news conference, DePasquale said he reached an agreement with the Wolf administration to audit the state's voting system. Legislation to require an audit, introduced last year by Sen. Kim Ward (R., Westmoreland), passed the Senate but remains in the House.

Ward said she proposed the legislation to "put conspiracies to rest" about Russian hacking in the 2016 election.

"It's not a Republican issue, it's not a Democratic issue," Ward added. "It is a citizen-have-confidence-in-your-election-process issue."

Contact Gillian McGoldrick at gillian@temple.edu.