IE11 Not Supported

For optimal browsing, we recommend Chrome, Firefox or Safari browsers.

Are Open Source Elections More Secure? (Part 2)

Local jurisdictions can adopt tools directly from third-party open source projects, downloading the software onto commercial off-the-shelf (COTS) devices and making tweaks as needed. Or jurisdictions might consider creating their own election tech and making it open source, as San Francisco and Los Angeles counties have explored.

Part 1 of this two-part series by Government Technology* can be found here.

Making effective open source election software is one thing. Removing barriers to its use is another and means addressing concerns about liability, troubleshooting and certification.

Open source groups make election administration software to fill unmet needs, add transparency to the elections process or provide more budget-friendly alternatives to existing offerings.

But just because software might be effective hasn’t guaranteed election officials will be eager to use it, said Juan Gilbert. His Prime III open-source solution makes voting more accessible to people with physical disabilities and was used in several elections since 2012, though most jurisdictions have since abandoned the offering.

“You will not find jurisdictions out there craving for open source in elections. That I have not found,” Gilbert told Government Technology.

That’s because software is only one factor: Hardware and services remain high on election officials’ minds, too. Election officials must take on troubleshooting, maintenance, liability and other concerns when they adopt non-proprietary software directly or make their own.

“Everyone understands the benefits of [open source],” Gilbert said. “Here’s the issue — in elections … vendors offer services around the technology … if a jurisdiction wants to go open source, they have to do everything themselves.”

Another option: Election system vendors — or tech companies expanding into the market — can take up open source offerings and turn them into finished, for-sale products, providing jurisdictions with ready-to-go systems and the accompanying support services.

Will vendors want to do this?

Open source creators differ in their predictions: Gilbert points to past disappointments, while Dana DeBeauvoir says the climate has been changing.

DeBeauvoir previously was clerk for Travis County, Texas, where she spearheaded its effort to create an open source election system called STAR-Vote. DeBeauvoir collaborated with researchers to design an electronic voting machine that would make an auditable paper trail, a capability not well met by commercial offerings at the time. But the project ended in 2017 when they could not find any vendor willing to build it as open source.

DeBeauvoir believes today’s vendors can be swayed and may be interested in incorporating open-source features offered freely by third parties for several reasons. One, this approach lets vendors enhance their commercial products with new capabilities that they didn’t have to pay to invent. And two, vendors seeing open source offerings made available to everyone in the market may feel they need to adopt them to keep up.

“Vendors have taken a completely different attitude toward open source systems,” she told GovTech. "It’s because of the way open source is being offered to them — to the vendors — as a ‘level the playing field.’ Everybody gets this initial batch of software and firmware that includes all of these properties … and it resets the playing fields. ... They’re being given an opportunity to not have to justify all of that research and development expense into the sale of the product.”

DeBeauvoir is currently a board member for the open source election tech nonprofit OSET Institute. The organization aims to release a set of open source software components supporting the core election and voting activities and has thus far released several open source tools aimed at specific functions, like voter registration.

Some major election vendors said they’re keeping open minds toward open source.

“ES&S [Election Systems & Software] has had numerous discussions with Microsoft to explore the potential of its open source software, such as ElectionGuard,” ES&S senior manager of public relations Katina Granger told GovTech in an email. “We continue to evaluate this and other technologies in support of our customers’ needs.”

For-profit vendors aren’t the only option, however; voting solution nonprofit VotingWorks is demonstrating another approach. The organization sells an open source voting system and risk-limiting auditing tool. The former is used in elections in 14 Mississippi jurisdictions, while the auditing tool is used in five states, the company reports.

Even open source projects that haven’t been picked up by vendors or gained wide usage have had ripple effects on the election landscape.

“[Vendors] have modeled and created universal voting machines, ballot marking devices, modeled after our work with Prime III,” Gilbert said.

Prime III has seen its design influence other offerings.

STAR-Vote also inspired changes to U.S. voting machine standards, including around having voter-verifiable paper trails and third-party verification capabilities built into the systems at the basic software level, DeBeauvoir said.

In 2022, most jurisdictions used voting systems that provided paper trails, either via ballot-marking devices or paper ballots. The U.S. Voluntary Voting System Guidelines say voting systems call for either using cryptographic end-to-end verifiable voting systems or systems that create independent voter-verifiable paper records.

WILL GOVERNMENTS USE IT?


Prime III has been in action across the U.S. over the years. Several Oregon counties used it in 2012, as did two Wisconsin towns in 2014. New Hampshire tested it at some precincts in 2014 before rolling it out statewide in 2018. Ohio’s Butler County adopted the software in 2018.

Today, only Butler County still uses Prime III — even though the system performed well in other jurisdictions, too, Gilbert said.

The problem? Everything but the software. Jurisdictions adopting open source must take on a host of side responsibilities they used to receive from vendors.

“If they’re going to use open source, that means they have to be technically savvy to deal with the equipment and the software, they have to be liable for all issues that occur, and they have to provide all the services that come around that,” Gilbert said. “It’s easier to just pay the manufacturer to do all that stuff.”

Butler County is an exception because it had the dedicated IT staff to maintain the project after Gilbert helped them set it up. Plus, the county uses the software just for remote-accessible voting, which means officials don’t also have to handle hardware.

When New Hampshire tried Prime III, “by all indications they were happy,” Gilbert said. But “it was a lot of work to get the tablets, get the printers, get everything set up,” he said, and the state reverted to using a vendor’s proprietary offerings.

MAKING YOUR OWN?


Local jurisdictions can adopt tools directly from third-party open source projects, downloading the software onto commercial off-the-shelf (COTS) devices and making tweaks as needed. Or jurisdictions might consider creating their own election tech and making it open source, as San Francisco and Los Angeles counties have explored.

San Francisco’s feasibility assessment acknowledges that creating its own solution would entail new responsibilities for the election department or city. Those include voting system hardware maintenance, security, compliance and technical documentation, and other areas that have been thus far handled by its commercial vendor.

That’s in addition to learning how to engage the open source community.

Per the feasibility assessment, “Currently, Dominion staff handle hardware maintenance and keep the Department of Elections informed. Therefore, there are no currently known capabilities around hardware maintenance for voting systems within the city.”

Of course, just because the city hasn’t done this doesn’t mean it can’t.

The city could hire and partner up for help, while still maintaining ownership of the project, the assessment notes. San Francisco should also find a contractor to help it build and maintain the solution that’s willing to share some of the security risk and liability, it adds.

L.A. County is also thinking about liability. The county used open source components to build a system that it aims to eventually release with an open source license. But it wants to be sure that, once it does, the county will be protected from legal risks over how other jurisdictions might use the code.

“We also don't want to take on the liability of how that’s being used. There needs to be some level of indemnification,” County Registrar Dean Logan told GovTech.

Open source activist Brent Turner previously served as secretary for the California Association of Voting Officials (CAVO) and communications director for the Open Voting Consortium.

In contrast to the OSET Institute, Turner advocates for providing open source election software under AGPL licenses that prevent them from being incorporated into closed source products. He told GovTech the U.S. should ensure election systems are primarily handled by nonprofits and governments that can focus on democratic goals, rather than by vendors that need to make profit.

Turner believes election officials can pull off adopting open source themselves.

“In the spirit of the effort, you have to endure those growing pains and transitional pains for the good for the democracy,” Turner said. “… This all doable. This isn’t necessarily difficult. There’s a political will issue and a push by proprietary interests to create fear, uncertainty and doubt in the environment — that includes within the procurement departments of different government jurisdictions.”

CAVO is now “stagnant,” Turner said, but had aimed to advance open source voting, including by providing election officials with training and education. He said efforts to educate election officials about open source remain important.

THIRD-PARTY SUPPORT?


Travis County’s unrealized STAR-Vote initiative envisioned creating groups of independent experts that counties could call upon for operational and auditing support. This might be a nonprofit group, run by university staff and students who could provide services to jurisdictions at low cost, DeBeauvoir said.

“What you wanted to do was have these cadres, or groups of people with expertise that counties could call on — who were in the open-source market [and] committed to that model — but who could help counties that lacked an IT department or who didn’t have the support needed to perhaps take on more of the programming challenges that we might find with open source, especially as we’re just getting started,” DeBeauvoir said.

Another model would see for-profit vendors step in to deliver open source offerings, provide support services and handle the voting system certification processes, sparing jurisdictions the headache.

Vendor cooperation can play a major role in making open source systems “realistic and mak[ing] them on-the-ground systems that are affordable and that you can understand and buy and that voters will want to vote on,” DeBeauvoir said.

Election tech vendors largely are for-profit companies, but VotingWorks is an exception. The organization says it the only nonprofit vendor in the voting system space. It handles more than software and sells COTS hardware at cost as well as handles assembly and installation.

New Hampshire — which abandoned Prime III — is now showing tentative interest in VotingWorks. Three towns piloted the nonprofit’s ballot counting devices during a Nov. 2022 election.

THE CERTIFICATION HURDLE


Getting a voting system through the current regulatory approval process is expensive, which can be a deterrent to wider use of open source. Nonprofit open source groups making software may lack funding to get their offerings through certification, and jurisdictions considering those offerings may be reluctant to take on the certification cost, too.

“The certification and testing process that's in place for voting systems in California, and really throughout the country, is still really designed for commercial, proprietary voting systems,” L.A. County’s Logan said. “The certification and testing is paid for by the company that's bringing the system in. … Embedded in that is a pricing model that implies that you're going to the marketing that and selling it for a profit. That doesn't really apply to a publicly owned system or to the concept of open source.”

When it began its project, L.A. County decided it would rather invest in developing its own, tailored system than in getting an existing open source project certified.

“A lot of those other initiatives [at the time] were looking for someone to make the investment in them, as opposed to having a product that was ready to implement,” Logan said. “As a public entity, we weren't a venture capitalist that was going to invest in a system that could be marketed to other jurisdictions. We were really focused on meeting a timeline to ensure that we had a voting system that would meet the needs in our county.”

WILL VENDORS BITE?


In 2019, ES&S controlled more than 50 percent of the U.S. election system market, while Dominion held 30 percent and Hart InterCivic claimed 15 percent, per ProPublica.

Gilbert believes that major elections systems vendors see little need to invest in modifying their solutions to incorporate open code because they already dominate the market.

But DeBeauvoir believes vendors will see incorporating open source as a way to affordably add new features they can use to stay ahead of — or keep pace with — competitors and better vie for contracts. The assumption is that once one vendor adopts some of these offerings, others will need to as well to keep up.

What do the vendors think?

When asked about engaging with open-source, a Dominion spokesperson said the company’s voting systems are secure and reliable as is, but the company didn’t rule out the idea of adopting such offerings.

“Dominion has always taken the approach that customers drive demand. The door is always open when it comes to future product offerings our customers want,” the spokesperson told GovTech in an email. “That said, it's important to emphasize that thousands of post-election audits and recounts since the 2020 election have clearly demonstrated the accuracy, reliability and robust auditability of DVS systems.”

Microsoft-sponsored open source software development kit ElectionGuard has also drawn some interest from vendors. Hart InterCivic integrated it into a ballot scanning and tabulation device, which it then piloted in a precinct of Franklin County, Idaho, in 2022. And ES&S told GovTech it’s exploring the possibility of open source tools like ElectionGuard.

NEW ENTRANTS IN THE SPACE?


Greg Miller is co-founder and chief operating officer of OSET Institute, which hopes vendors will adopt its offerings and turn them into finished products. And if existing election vendors don’t do it, he believes that others will.

Major systems integrators that already hold master services agreements with states could be tempted to expand their offerings into election administration systems using the free software, he said.

“The integration and delivery and deployment of new election administration technology based on open source code is entirely within their grasp, within their reach, within their know-how,” Miller said.

Gilbert doesn’t believe other IT companies see much to gain from using open source offerings to move into the election market, however.

“The market is cold. There’s no person out there saying, ‘Oh, I’d really love to be a vendor in voting and break in,’” Gilbert said. He believes competition against existing vendors is too stiff, and high public scrutiny on the space can further deter new entrants.

Profits also may be slim, with a 2019 ProPublica article reporting that “the entire [voting technology] sector generates only about $300 million in revenue annually, according to Harvard professor Stephen Ansolabehere, who studies elections and formerly directed the Caltech/MIT Voting Technology Project. That’s far short of what Americans spend annually on Halloween costumes for their pets.”

Despite the mixed progress, many advocates continue to push to see whether this time, open source election tech can go further.

*Government Technology is a sister publication of Industry Insider — California.
Jule Pattison-Gordon is a staff writer for Government Technology. She previously wrote for PYMNTS and The Bay State Banner, and holds a B.A. in creative writing from Carnegie Mellon. She’s based outside Boston.