November 12, 2019
Election Security: States’ Spending of FY2018 HAVA Payments
State and local systems have been targeted as part of efforts
One proposed way to help check—and reassure voters—
to interfere with U.S. elections, according to the U.S.
that votes have been captured and counted accurately is to
Intelligence Community. Congress has responded to such
ensure that there are voter-verifiable paper records of the
threats, in part, with funding. The Consolidated
votes cast and to audit the paper records. That proposal,
Appropriations Act, 2018 (P.L. 115-141) included $380
versions of which have appeared in bills such as S. 2593 in
million for payments to the 50 states, the District of
the 115th Congress and H.R. 2722 in the 116th Congress, is
Columbia, American Samoa, Guam, Puerto Rico, and the
reflected in the first two measures on the explanatory
U.S. Virgin Islands (referred to herein as “states”) under the
statement list: replacing paperless voting systems and
Help America Vote Act of 2002 (HAVA; 52 U.S.C.
implementing post-election audits.
§§20901-21145).
Vote capture and counting processes are part of larger
This In Focus provides an overview of states’ spending of
election systems that also include components such as voter
the FY2018 HAVA payments. It starts by summarizing
registration databases and election office email accounts.
how states have proposed and reported using the funds and
Foreign actors reportedly exploited human and
then introduces some issues related to the timing of state
technological vulnerabilities in some of the other parts of
spending and reporting.
those systems in the 2016 election cycle. According to a
July 2019 report from the Senate Select Committee on
Information about states’ spending of the FY2018 HAVA
Intelligence (SSCI), for example, Russian actors used spear
funds may be relevant both to Members who are interested
phishing attacks to access county systems in one state and a
in oversight of the FY2018 payments and to Members who
technique known as SQL injection to extract data from the
are considering further funding for similar purposes. It
state voter registration database in another.
might help inform decisions about whether to provide such
funding, for example, and, if so, whether to specify
The remaining three specific election security measures on
conditions for its use.
the explanatory statement list—updating election-related
computer systems to address cyber vulnerabilities,
Proposed Spending
providing election officials with cybersecurity training, and
The FY2018 payments were appropriated under provisions
instituting election cybersecurity best practices—focus on
of HAVA that authorize funding for general improvements
risks to election systems presented by human and
to the administration of federal elections (52 U.S.C.
technological vulnerabilities. Training election officials to
§§20901, 20903-20904). The explanatory statement
recognize and report spear phishing may help reduce the
accompanying the FY2018 appropriations bill highlighted
likelihood that they will click on malicious links or
five specific election security-related uses of the funds.
attachments, for example, and validating user inputs to
online voter registration websites may help thwart some
States were asked to submit plans for the FY2018 HAVA
SQL injection attempts.
funding to the agency charged with administering the
payments, the U.S. Election Assistance Commission
Much of the planned spending of FY2018 HAVA funds is
(EAC). The following subsections provide examples—
on the highlighted measures from the explanatory statement
drawn from the states’ plans—of proposed spending on (1)
list. Proposed spending includes transitioning to voting
the specific election security measures highlighted by the
systems that produce a voter-verifiable paper audit trail
explanatory statement for the FY2018 spending bill, (2)
(VVPAT) and advancing or enhancing the implementation
other election security measures, and (3) non-security-
of post-election audits. Some states reported planning to use
specific activities. Congressional clients may contact CRS
funds to research best practices for post-election audits, for
for state-specific information about spending proposals.
example, or to conduct audits or audit pilot programs.
Highlighted Election Security Measures
States have also proposed spending on updating their
Some of the election security measures highlighted by the
election systems to address cyber vulnerabilities, providing
FY2018 explanatory statement focus on risks to vote
election officials with cybersecurity training, and
capture and counting processes. Electronic devices, which
implementing election cybersecurity best practices. Many
are used by many jurisdictions to capture votes and most
of the states’ plans include training-related spending, such
jurisdictions to count them, are potentially susceptible to
as hiring an election security trainer, tailoring trainings to
hacking and errors. Mistakes may also be made when hand-
counties’ security needs, or running tabletop exercises that
counting ballots.
simulate real-world security incidents. Other planned uses
of funds include conducting penetration tests of the state
election management system, performing forensic audits of
https://crsreports.congress.gov

---

Election Security: States’ Spending of FY2018 HAVA Payments
election vendors, and acquiring tools to detect intrusions
which were provided to the EAC by the states on a
into election systems or protect against distributed denial-
voluntary basis, do not include responses from all states,
of-service (DDoS) or ransomware attacks.
and have not been independently verified by CRS—states
spent at least $128 million by the end of August 2019.
Other Election Security Measures
The types of risk described in the previous subsection are
Timing of Spending and Reporting
not the only security risks election systems face. Election
Funding like the FY2018 HAVA payments has also been
officials must also prepare, for example, for physical threats
proposed in subsequent appropriations cycles. Proposed
such as natural disasters or attempts to tamper with ballot
amendments to FY2019 appropriations measures would
boxes.
have provided similar funding for payments to states, for
example, as would the FY2020 Financial Services and
Some states have chosen to use some of their FY2018
General Government (FSGG) appropriations bills that were
HAVA funds to address such other election security threats.
pending as of this writing (H.R. 3351; S. 2524).
One state reported planning to use funds to improve the
physical security of state election board facilities, for
This section introduces some issues related to the timing of
example, and another proposed providing grants to county
state spending and reporting that may be of interest to
election officials to address physical vulnerabilities.
Members as they assess the need for further funding,
evaluate pending funding proposals, or develop new
Non-Security-Specific Activities
proposals.
The FY2018 appropriations bill stated that the HAVA
payments were “for activities to improve the administration
Timing of Spending
of elections for Federal office, including to enhance
Some states reported using all of their FY2018 HAVA
election technology and make election security
funds by the end of FY2018, but most have waited to spend
improvements.”
some or all of their shares. The spending plans states
submitted to the EAC suggest at least three factors that may
Some states have proposed spending FY2018 HAVA funds
have influenced the timing of the latter states’ spending: (1)
on activities that may not be focused specifically on
some of the costs associated with securing elections are
securing elections. A number of states reported planning to
ongoing, and some states plan to apply FY2018 HAVA
use some of their funding for voter outreach, for example,
funds to them in multiple fiscal years; (2) prior conditions,
or to ensure that polling places are accessible to individuals
such as state legislative approval or implementation of
with disabilities. States have also proposed spending to
prerequisite policies, must be met before states can engage
implement state elections policies, such as automatic or
in some of their planned spending; and (3) some states’
online voter registration.
proposed spending involves processes like procurement that
may take months or years to complete.
Reported Spending
Each state has five years to spend its share of the FY2018
Accounts of why states spend when they do might help
HAVA funds, according to the EAC, and must file a
inform assessments of funding needs. They also might help
Federal Financial Report (FFR) on its spending each year.
identify some of the tradeoffs involved in providing funding
on a one-time versus an ongoing basis or in setting specific
According to the FY2018 FFRs that had been released by
conditions on how or when funds are used. Responses to
the EAC as of this writing, states spent approximately $31
such tradeoffs might depend on the goals for funding.
million of the appropriated $380 million between the time
Different choices might be made about funding if it is
funds became available on April 17, 2018, and the end of
intended to be spent in time for an upcoming election, for
the fiscal year on September 30, 2018. Some states also
example, than if it is intended to fund an ongoing activity
reported spending from state matching funds—which all
like identifying emerging security threats.
but American Samoa, Guam, and the U.S. Virgin Islands
are required to provide—or from other funds, such as
Timing of Reporting
interest on federal funds deposited in interest-bearing
State spending reports for the FY2018 HAVA payments are
accounts. For example, two states reported supplying and
due once per fiscal year, in December of the corresponding
spending 100% of the required 5% state match in FY2018.
calendar year. Committee consideration of appropriations
measures typically starts in the spring, and Congress may
Examples of projects states funded with this early spending,
continue to deliberate through the fall or winter. The most
according to the EAC, include implementing multi-factor
recent official spending data available to Members when
authentication for county access to election systems and
they are considering elections-related funding proposals
setting up cost-sharing arrangements with counties to
may, therefore, be for a period that ended a number of
replace voting machines. States reportedly also used funds
months earlier.
in FY2018 for activities such as hiring security personnel
and conducting security assessments and trainings.
Unofficial interim data of the kind collected by the EAC for
FY2019 might be sufficient for congressional needs. If
Official FY2019 spending data were not available as of this
Members determine that they want or need official
writing because FY2019 FFRs were not yet due from the
spending data that are more closely aligned with the
states, but EAC staff partnered with states to collect
appropriations cycle, however, they might consider
unofficial numbers. According to those unofficial data—
https://crsreports.congress.gov

---

Election Security: States’ Spending of FY2018 HAVA Payments
encouraging or prescribing a corresponding reporting
Karen L. Shanton, Analyst in American National
schedule for future elections-related funding.
Government
IF11356


Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.

https://crsreports.congress.gov | IF11356 · VERSION 1 · NEW

---