Updated March 12, 2020
Election Security: States’ Spending of FY2018 HAVA Payments
State and local systems have been targeted as part of efforts
hacking and errors. Mistakes may also be made when hand-
to interfere with U.S. elections, according to the U.S.
counting ballots.
intelligence community. Congress has responded to such
threats, in part, with funding. The Consolidated
One proposed way to help check—and reassure voters—
Appropriations Act, 2018 (P.L. 115-141) included $380
that votes have been captured and counted accurately is to
million for payments to the 50 states, the District of
ensure that there are voter-verifiable paper records of the
Columbia, American Samoa, Guam, Puerto Rico, and the
votes cast and to audit the paper records. That proposal,
U.S. Virgin Islands (referred to hereinafter as “states”)
versions of which have appeared in bills such as S. 2593 in
under the Help America Vote Act of 2002 (HAVA; 52
the 115th Congress and H.R. 2722 in the 116th Congress, is
U.S.C. §§20901-21145), and the Consolidated
reflected in the first two measures on the explanatory
Appropriations Act, 2020 (P.L. 116-93) provided $425
statement list: replacing paperless voting systems and
million for payments to those jurisdictions and the
implementing postelection audits.
Commonwealth of the Northern Mariana Islands.
Vote capture and counting processes are part of larger
This In Focus provides an overview of states’ spending of
election systems that also include components such as voter
the FY2018 HAVA payments. It starts by summarizing
registration databases and election office email accounts.
how states have proposed and reported using the funds and
Foreign actors reportedly exploited human and
then introduces some issues related to the timing of state
technological vulnerabilities in some of the other parts of
spending and reporting.
those systems in the 2016 election cycle. According to a
July 2019 report from the Senate Select Committee on
Information about states’ spending of the FY2018 HAVA
Intelligence, for example, Russian actors used spear
funds may be relevant both to Members who are interested
phishing attacks to access county systems in one state and a
in oversight of the FY2018 payments and to Members who
technique known as SQL injection to extract data from the
are considering further funding for similar purposes. It
state voter registration database in another.
might help inform decisions about whether to provide such
funding, for example, and, if so, whether to specify
The remaining three specific election security measures on
conditions for its use.
the explanatory statement list—updating election-related
computer systems to address cyber vulnerabilities,
Proposed Spending
providing election officials with cybersecurity training, and
Funding for the FY2018 payments was appropriated under
instituting election cybersecurity best practices—focus on
provisions of HAVA that authorize programs to provide
risks to election systems presented by human and
payments for general improvements to the administration of
technological vulnerabilities. Training election officials to
federal elections (52 U.S.C. §§20901, 20903-20904). The
recognize and report spear phishing may help reduce the
explanatory statement accompanying the FY2018
likelihood that they will click on malicious links or
appropriations bill highlighted five specific election
attachments, for example, and validating user inputs to
security-related uses of the funds.
online voter registration websites may help thwart some
SQL injection attempts.
States were asked to submit plans for the FY2018 HAVA
funding to the agency charged with administering the
Much of the planned spending of FY2018 HAVA funds
payments, the U.S. Election Assistance Commission
was on the highlighted measures from the explanatory
(EAC). The following subsections provide examples—
statement list. Proposed spending included transitioning to
drawn from the states’ plans—of proposed spending on (1)
voting systems that produce a voter-verifiable paper audit
the five specific election security measures highlighted by
trail (VVPAT) and advancing or enhancing the
the explanatory statement for the FY2018 spending bill, (2)
implementation of postelection audits. Some states reported
other election security measures, and (3) non-security-
planning to use funds to research best practices for
specific activities. Congressional clients may contact CRS
postelection audits, for example, or to conduct audits or
for state-specific information about spending proposals.
audit pilot programs.
Highlighted Election Security Measures
States also proposed spending on updating their election
Some of the election security measures highlighted by the
systems to address cyber vulnerabilities, providing election
FY2018 explanatory statement focus on risks to vote
officials with cybersecurity training, and implementing
capture and counting processes. Electronic devices, which
election cybersecurity best practices. Many of the states’
are used by many jurisdictions to capture votes and most
plans included training-related spending, such as hiring an
jurisdictions to count them, are potentially susceptible to
election security trainer, tailoring trainings to counties’
https://crsreports.congress.gov

---

Election Security: States’ Spending of FY2018 HAVA Payments
security needs, or running tabletop exercises that simulate
Timing of Spending and Reporting
real-world security incidents. Other planned uses of funds
Proposals have been offered in the 116th Congress to make
included conducting penetration tests of the state election
more election security funding available to states. Bills
management system, performing forensic audits of election
have been introduced to authorize appropriations for
vendors, and acquiring tools to detect intrusions into
general election security-related purposes as well as for
election systems or protect against distributed denial-of-
more specific activities, such as grants to replace paperless
service (DDoS) or ransomware attacks.
voting machines or conduct postelection audits.
Other Election Security Measures
This section introduces some issues related to the timing of
The types of risk described in the previous subsection are
state spending and reporting that may be of interest to
not the only security risks election systems face. Election
Members as they assess the need for further funding,
officials must also prepare, for example, for physical threats
evaluate pending funding proposals, or develop new
such as natural disasters or attempts to tamper with ballot
proposals.
boxes.
Timing of Spending
Some states have chosen to use some of their FY2018
Some states reported using all of their FY2018 HAVA
HAVA funds to address such other election security threats.
funds by the end of FY2018, but most waited to spend some
One state reported planning to use funds to improve the
or all of their shares. The spending plans states submitted to
physical security of state election board facilities, for
the EAC suggest at least three factors that may have
example, and another proposed providing grants to county
influenced the timing of the latter states’ spending: (1)
election officials to address physical vulnerabilities.
some of the costs associated with securing elections are
ongoing, and some states planned to apply FY2018 HAVA
Non-Security-Specific Activities
funds to them in multiple fiscal years; (2) prior conditions,
The FY2018 appropriations bill stated that the HAVA
such as state legislative approval or implementation of
payments were “for activities to improve the administration
prerequisite policies, had to be met before states could
of elections for Federal office, including to enhance
engage in some of their planned spending; and (3) some
election technology and make election security
states’ proposed spending involved processes like
improvements.”
procurement that can take months or years to complete.
Accounts of why states spend when they do might help
Some states proposed spending FY2018 HAVA funds on
inform assessments of funding needs. They also might help
activities that may not be focused specifically on securing
identify some of the trade-offs involved in providing
elections. A number of states reported planning to use some
funding on a one-time versus an ongoing basis or in setting
of their funding for voter outreach, for example, or to
specific conditions on how or when funds are used.
ensure that polling places are accessible to individuals with
Responses to such trade-offs might depend on the goals for
disabilities. States also proposed spending to implement
funding. Different choices might be made about funding if
state elections policies, such as automatic or online voter
it is intended to be spent in time for an upcoming election,
registration.
for example, than if it is intended to fund an ongoing
Reported Spending
activity like identifying emerging security threats.
Each state has five years to spend its share of the FY2018
Timing of Reporting
HAVA funds, according to the EAC, and must file a
State spending reports for the FY2018 HAVA payments are
Federal Financial Report on its spending each year.
due once per fiscal year, in December of the corresponding
calendar year. Committee consideration of appropriations
According to the FY2018 and FY2019 Federal Financial
measures typically starts in the spring, and Congress may
Reports that had been released by the EAC as of this
continue to deliberate through the fall or winter. The most
writing, states spent approximately $90 million of the $380
recent official spending data available to Members when
million appropriated for FY2018 between the time funds
they are considering elections-related funding proposals
became available on April 17, 2018, and the end of FY2019
may, therefore, be for a period that ended a number of
on September 30, 2019. Some states also reported spending
months earlier.
from state matching funds—which all but American Samoa,
Guam, and the U.S. Virgin Islands are required to
The EAC collected unofficial interim data about state
provide—or from other funds, such as interest on federal
spending for FY2019 prior to the reporting deadline, and
funds deposited in interest-bearing accounts. For example,
such unofficial data might be sufficient for congressional
21 states reported supplying and spending all of the
needs. If Members determine that they want or need official
required 5% state match by the end of FY2019.
spending data that are more closely aligned with the
appropriations cycle, however, they might consider
Examples of projects states funded with this spending,
encouraging or prescribing a corresponding reporting
according to the EAC, included implementing multifactor
schedule for future elections-related funding.
authentication for county access to election systems and
setting up cost-sharing arrangements with counties to
Karen L. Shanton, Analyst in American National
replace voting machines. States reportedly also used funds
Government
for activities such as hiring security personnel and
conducting security assessments and trainings.
IF11356
https://crsreports.congress.gov

---

Election Security: States’ Spending of FY2018 HAVA Payments


Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to
congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress.
Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has
been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the
United States Government, are not subject to copyright protection in the United States. Any CRS Report may be
reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include
copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you
wish to copy or otherwise use copyrighted material.

https://crsreports.congress.gov | IF11356 · VERSION 2 · UPDATED

---