Reviewing Ford County’s Procedures for Election Security in the 2022 General Election

Introduction

The Legislative Post Audit Committee requested this audit, which was authorized by the Legislative Post Audit Committee at its August 5, 2024 meeting.

Objectives, Scope, & Methodology

This audit request included 2 questions. For reporting purposes, we combined questions 1 and 2 into the following question:

1. Did Ford County’s election office have adequate policies and practices to ensure the accuracy and security of voting machines, storage units, ballots, and devices used to tabulate votes for the 2022 general election?

This audit is a follow up to an audit we conducted in 2023 that answered the same question for 15 Kansas counties. The scope of our work in this audit was limited to the Ford County election office’s policies and practices during the 2022 general election.

Our method included comparing Ford County’s policies and practices against the 50 national best practices we identified in our previous 2023 election security audit. We chose those best practices based on which ones we thought were most critical to accuracy and security. We determined whether state law and regulations included those practices. Then we reviewed whether the Ford County election office had policies for those items and whether they had documentation showing workers carried them out in practice for the 2022 general election. We also went on-site to the election office to inspect storage sites, review security practices, and interview staff about security policies and practices.

More specific details about the scope of our work and the methods we used are included throughout the report as appropriate.

Important Disclosures

We conducted this performance audit in accordance with generally accepted government auditing standards. Those standards require that we plan and perform the audit to obtain sufficient, appropriate evidence to provide a reasonable basis for our findings and conclusions based on our audit objectives. Overall, we believe the evidence obtained provides a reasonable basis for our findings and conclusions based on those audit objectives.

Audit standards require us to report limitations on the reliability or validity of our evidence. During our 2023 election security audit, the Ford County Clerk sealed some of the documentation we needed to assess their practices with the ballots for the 2022 general election. This prevented us from drawing conclusions about Ford County’s practices in our 2023 audit. The Legislative Post Audit Committee subpoenaed the Ford County Clerk for those documents in August 2024. In response to the subpoena, we received electronic and hard copies of documents from the Ford County Clerk. Because this audit was conducted nearly 2 years after the 2022 general election, we can’t comment on the veracity of the documents provided nor could we test or observe certain elements present in the 2022 election.

Audit standards require us to report our work on internal controls relevant to our audit objectives. They also require us to report deficiencies we identified through this work. Most of our work for this audit consisted of reviewing Ford County’s controls for securing their elections. We found that Ford County had control design or practice deficiencies, as described in more detail later.

Ford County had some security practices that were adequate and others that were inadequate, and it lacked adequate written policies.

Background

This audit includes information about Ford County’s security practices, which we were unable to evaluate in a prior audit.

• We completed an election security audit in 2023 that reviewed the policies and practices of 15 Kansas counties’ election offices. The audit objective was to determine if the counties had adequate policies and practices to ensure the accuracy and security of voting machines, and to ensure the security of storage units, ballots, and devices used to tabulate votes used for either the 2022 primary or general election.

• Ford County was one of the counties we selected to review in the 2023 audit. However, election officials sealed a portion of the necessary documentation with the ballots for the 2022 general election. This prevented us from concluding on Ford County’s practices. The Legislative Post Audit Committee subpoenaed the Ford County Clerk for those documents in August 2024. This audit includes a review of that documentation and is a follow up to the 2023 audit.

Modern elections rely heavily on electronic voting and tabulation machines and election management computers.

• Nearly all Kansas counties use electronic equipment to administer elections. This is the primary way votes are cast and counted. Electronic equipment affects every stage of the election process.

• Polling places have voting machines called ballot marking devices. Voters can use these machines to make their selections on a touchscreen or through an accessibility device. The machine then prints a completed ballot reflecting the voter’s choices. Voters can also complete paper ballots rather than use these machines if they choose. In some counties, this may be more common than voting with a ballot marking device.

• Voters insert their hand- or machine-completed ballots through a separate tabulation machine called an optical scanner. These scanners read and count the ballots and store the results on election results storage media, such as a USB stick. Mail-in ballots are also scanned by tabulation machines, but at the election office rather than the polling places.

• The election results storage media is hand carried to the county election office and plugged into the county’s election management computer. This computer aggregates all the polling places’ results and determines each race’s countywide winners. State law (K.S.A. 25-4403) doesn’t allow these computers to be connected to the Internet, and best practices say they shouldn’t have any non-election software on them

• The official county canvass to determine the results is completed after these processes. It starts the Monday after the election at the earliest. It includes confirming staff research on the validity of any provisional ballots. Voters receive provisional ballots whenever there’s a question about their eligibility to vote, such as an address or name change. The county board of canvassers reports the county’s vote totals to the state board of canvassers, which includes it in the statewide canvass to determine the statewide election results.

County election officers appoint election workers who perform frontline election duties, including carrying out security policies.

• County election officers rely on county staff and volunteer county election workers to help run elections. County election workers help during many phases of elections, including before, on, and after election day. State law (K.S.A. 25-2808) generally requires each polling place to have 3 or more election workers. This includes a supervisor who’s responsible for overseeing the polling place and the other election workers.

• Election workers do the frontline work necessary to hold an election. They do things like open and close polling places, check voters in and assist them, and distribute and collect ballots. In many counties, they also transfer electronic election equipment, ballots, and other materials to and from polling places.

• To ensure election security, election workers should carry out all processes in accordance with the policies established by the county election officer. Election workers should understand why the policies are important and how to correctly practice them.

Election processes vary across counties.

• State law gives county election officers discretion over how to run elections in their counties. Differences are largely related to the number of voters in the county, since it’s more complicated to accommodate more voters. Each county has a county election office, but these offices look and function very differently.

• Larger counties tend to need more full-time county staff, volunteer election workers, electronic equipment, and polling places than counties with smaller voter populations. Larger counties also need larger offices and storage facilities to manage their staff, election workers, and equipment to accommodate more voting machines and polling places.

Election Security Best Practices

We identified and reviewed election security best practices from the federal election agency.

• To understand what security-related policies and practices county election offices should have, we reviewed best practices from the U.S. Election Assistance Commission (EAC) that were in place during the 2022 election cycle.

• The EAC is a federal agency that tests and certifies voting machines nationwide and publishes voluntary voting system guidelines. States and counties aren’t required to follow these guidelines. But the guidelines provide best practices states and counties can reference and use as appropriate.

• EAC best practices cover more areas than we had time or resources to review. We selected 50 practices we thought were likely to be important for most counties’ security. They also covered the security areas EAC officials told us were most important for securing elections.

Kansas had only a few high-level election security-related laws and regulations related to these 50 election security practices.

• In our 2023 audit, we reviewed state law and regulations that were in effect during the 2022 election cycle to determine whether they reflected the national best practices we identified.

• State law and regulations included very few best practices. Overall, law and regulations fully reflected 8 and partially reflected 3 of the 50 best practices we focused on. State law and regulations were more general than the best practices. For example, state law (K.S.A. 25-4406 and 25-4613) requires voting and tabulation machines to be EAC certified. But best practices specify that these machines’ software should come from a trusted source, and any vendor modifications or updates should also be EAC approved.

• State law included 5 additional election security requirements our selected best practices didn’t. Several related to conducting public post-election accuracy tests on all tabulation machines (K.S.A. 25-4610). We added these requirements to our review, for a total of 55 election security best practices we evaluated counties on.

County Evaluation Methodology

We reviewed whether Ford County had policies and practices that aligned with 55 best practices and state laws during the 2022 general election.

• To review Ford County, we talked extensively to the county clerk and spent time on site inspecting their election office and storage facilities. We observed some security practices through our visits. We also reviewed their written security policies, as well as available documentation to verify the county’s practices in 2022.

• We reviewed all of Ford County’s polling places. However, we didn’t have the time or resources to review all machines that Ford County used in 2022. Instead, we based some conclusions on a non-projectable sample of voting and tabulation machines. The sample we reviewed is sufficient to reveal problems with the design or execution of the county’s security controls. But because we didn’t review all machines, additional control weaknesses could potentially exist.

There are important caveats to the work we did.

• Our conclusions are based on the documents Ford County provided to us in the original audit and this audit, as well as our own observations from visits in 2022 and 2024. In some cases, the county election official told us they had controls in place during the 2022 elections that aligned with best practices but couldn’t provide documents or show us during our visits. Ford County may have followed best practices in 2022 but weren’t counted as doing so because we couldn’t verify this. We don’t know how common this might have been.

• We didn’t evaluate whether Ford County’s security controls worked as intended or otherwise how they might have affected the 2022 general election. For example, we reviewed whether the county used 2-person integrity security measures when recording daily ballot activity. But we didn’t determine whether these practices ensured accurate ballot activity accounting.

• We didn’t evaluate whether the 2022 election in Ford County was correctly tabulated or accurately reflected the will of the voters in that county. Such determinations were outside the approved audit scope.

• We didn’t review all important aspects of elections. The EAC has many best practices, covering all aspects of elections. We focused on 55 specific best practices and state laws related to security of voting machines, ballots, storage units, and devices used to tabulate votes. The scope of this audit did not have us review controls relating to voter registration, mail-in voting, ballot drop boxes, or the post-election auditing process. Practices in these areas would complement and back up the practices discussed in this report.

County Evaluation Results

We reviewed Ford County on 5 main categories of best practices and compared their results to other counties’ results from the previous audit.

• In the previous audit we summarized the 55 best practices into 5 main categories of best practices. Those were (1) overall process security, (2) ballot security, (3) voting and tabulation machine security, (4) election management computer security, and (5) transfer and movement security.

• These categories consist of subcategories which aggregate specific practices. For example, the overall process security category includes a subcategory of inventory practices, which is made up of 5 detailed practices. The inventory is: (1) updated, (2) includes quantities, (3) includes permanent and unique serial numbers, (4) tracks when equipment is checked in and out, and (5) tracks repairs. For reporting purposes, we rolled these individual practices into subcategories. Each figure in this section includes the subcategories of practices we reviewed. Appendix B shows the subcategories and their practices for every best practice area included here.

• The figures in this report show how the practices Ford County and the other counties we reviewed in our 2023 election security audit compared to best practices. Each figure contains 4 possible shades of blue. The darkest shade of blue indicates the best practices are mostly or totally present (75%-100%), and the lightest shade of blue indicates the best practices are mostly or totally absent (0%-25%). Overall, we thought a county was adequate if its practices fell into the 2 darkest shades of blue. This doesn’t necessarily mean they had no issues, simply that they had at least half the practices we looked for in each area.

Ford County generally had adequate practices in the area of overall process security.

• Overall process security refers to basic practices that set the stage for a secure election. This includes things like buying certified electronic equipment, inventorying it, and tracking anything that happens with it. These practices help ensure equipment meets national standards and will accurately record and tabulate votes.

• Figure 1 shows overall process security for Ford County and the other counties we reviewed in 2023. As Figure 1 shows, Ford County generally had adequate overall process security practices. For example, Ford County used paper ballots to confirm election results and ensured software on their voting machines was from a trusted source. However, they did not inventory and track all equipment, such as election results media.

• Ford County was like other counties in this area. Nearly all the counties we reviewed had adequate overall process security practices.

Ford County had a mix of adequate and inadequate practices in the areas of ballot security and voting and tabulation machine security.

• Ballot security refers to tracking ballot activity. This includes things like noting how many ballots are sent from the county election office to the polling places, comprehensively tracking how they’re used, and using controls to ensure all legal ballots are tallied. These practices help exclude any invalid ballots someone might try to add either at the polling place or during transfer.

• Figure 2 shows ballot security practices for Ford County and other counties we reviewed in 2023. As Figure 2 shows, Ford County had a mix of adequate and inadequate ballot security practices. For example, Ford County had a process for accounting for vote totals at the end of election day. However, poll workers did not always fully complete the documentation to show the correct number of ballots were cast and tabulated.

• Many of the other counties we reviewed also had a mix of adequate and inadequate ballot security practices.

• Voting and tabulation machine security refers to securing these machines, so they’ll accurately reflect voters’ choices on election day. This includes things like testing them when they’re first purchased, physically securing them while they’re stored between elections, and testing them again before they’re used. These practices help prevent intentional or accidental compromises that might cause things like votes being counted for the wrong candidates.

• Figure 3 shows voting and tabulation machine security practices for Ford County and other counties we reviewed in 2023. As Figure 3 shows, Ford County had a mix of adequate and inadequate voting and tabulation machine security practices. For example, Ford County had inadequate testing practices before and after the election. They did not test that tabulation machines returned the expected results from a mock election, which state law (K.S.A. 25-4411) requires. Conversely, Ford County had adequate practices for physically securing machines between elections.

• Many counties had inadequate testing practices, but adequate physical security practices. Ford County had stronger practices than several other counties regarding checking machines for physical damage when purchased.

Ford County’s election management computer security and transfer and movement security practices were generally inadequate and were Ford County’s weakest areas.

• Election management computer security refers to securing this computer so it’ll accurately aggregate countywide results. This includes things like physically securing it from unauthorized access, logging all computer activity, and keeping it disconnected from the Internet. These practices help prevent intentional or accidental compromises that might affect the election results.

• Figure 4 shows Ford County’s election management computer security practices for Ford County and other counties we reviewed in 2023. As Figure 4 shows, Ford County’s election management computer security practices were generally inadequate and weaker than most other counties. This is because election officials denied us access to the county’s election management system during our 2023 election security audit. They granted us access to the system in 2024, so we reviewed it to confirm it wasn’t connected to external networks and that no additional software was installed. Their system was located in the same locked room as it was in 2023. But we didn’t grant credit for the requirement that the election management system not be used for other functions because we couldn’t verify the information we saw in 2024 was true for the 2022 election. This is why Ford County’s score is the minimum possible on that practice.

• Most of the other counties we reviewed in 2023 had adequate election management computer security practices.

• Transfer and movement security refers to securing electronic equipment, election results media, and ballots during transfer from the county election office to the polling place and back. This includes hand carrying election results, tracking equipment and election results movement, and sealing equipment and election results during transfer. These practices help prevent intentional or accidental equipment compromises and tampering with ballots or election results media during transfer.

• Figure 5 shows transfer and movement security practices for Ford County and other counties we reviewed in 2023. As Figure 5 shows, Ford County had inadequate transfer and movement security practices. Ford County did not have documentation showing controls for ballot transfer and machine security. For example, Ford County did not document how election materials (e.g. blank ballots, voting equipment) were transferred to polling sites and back to the election office. However, we saw that Ford County created this documentation for the 2024 primary election.

• Most of the other counties we reviewed had a mix of adequate and inadequate transfer and movement security practices.

Ford County didn’t have adequate written security policies during the 2022 general election.

• We expected counties to have a comprehensive, regularly updated policy manual clearly outlining the county election officer’s expectations. Elections are complicated processes requiring many people, including county staff, election workers, and sometimes other county departments or contracted moving companies. They also happen infrequently, and county election officers in our 2023 audit described higher levels of turnover in recent years. Documenting required security practices is the first step to ensuring they happen.

• Ford County didn’t have written policies or templates for most of the criteria we reviewed. Ford County‘s written policies mainly focused on ballot security such as using the poll book sign-ins to reconcile ballots and monitoring the review of provisional ballots.

• In our 2023 audit, we concluded that none of the 15 counties we reviewed had adequate written election security policies or guidance.

Conclusion

The results from this audit reinforce that election security policies and practices vary by county. The adequacy of Ford County’s security practices is like many of the other counties we reviewed in our 2023 audit, especially smaller counties. Its strongest security practices were related to overall security, and it had mixed performance on ballot security and voting and tabulation machine security practices. However, it generally had weaker practices than other counties on election management security and transfer and movement security practices.

Overall, Ford County’s results don’t change our overarching conclusions from the 2023 audit. Most of the criteria we evaluated in these audits were best practices and not state law. We chose 55 to evaluate but there are many others including additional security factors like decentralization and redundant controls. It’s not realistic to expect counties of all sizes to achieve them all. Counties must balance election security against other competing demands like money and resources. However, these security practices are a goal to strive for and indicate counties, including Ford County, have room to improve their security practices.

Recommendations

In the 2023 election security audit that covered Ford County and 14 other counties, we made several recommendations directed at the Secretary of State regarding increased election security training for county election officials, helping counties develop security policies and templates, and clarifying instructions regarding contents of ballot containers.

1. The Ford County election officer should continue working with the Secretary of State’s office to revise and develop forms and policies to improve election security processes.

• Agency Response: I am continually working with the Secretary of State’s office to make templates for forms and security’s processes. I have now bought the test deck. I test every machine and CF cards. It is the CF cards that count the ballots. Every CF card is tested as well as the machines. 

Agency Response

On September 26, 2024 we provided the draft audit report to the Ford County Clerk’s Office. Agency officials responded to our recommendations, but did not submit any other written remarks.

Appendix A – Cited References

This appendix lists the major publications we relied on for this report.

1. Election Management Guidelines. U.S. Election Assistance Commission.
2. Voting Security Recommendations (August, 2020). National Institute of Standards and Technology, U.S. Department of Commerce.

Appendix B – Best Practices and State Laws

This appendix lists the best practices and state laws we reviewed for this report.

Overall Process Security

• Counties maintain inventory and tracking of voting machines, tabulation machines, and election results media.
  • There is an inventory of equipment that appears to have been updated.
  • The inventory of equipment includes quantities of equipment and electronic media.
  • The inventory of equipment includes permanent and unique serial numbers of equipment and electronic media.
  • The inventory of equipment includes tracking of equipment use (i.e., check-in and check-out documentation).
  • The inventory of equipment includes tracking of repairs.

• Only trusted software is installed on voting and tabulation machines and election management computers.
  • Software is EAC certified (i.e., meets voluntary voting system guidelines and was tested through a voting system test laboratory). (K.S.A. 25-4406 and 25-4613)
  • Software is directly obtained from a trusted source (e.g., the vendor, an authorized contractor).
  • All vendor modifications are required to be approved by the EAC.

• Paper ballots are available to confirm results.
  • Elections use paper ballots (either hand marked or printed from a voting machine). (K.S.A. 25-4403 and 25-4406)
  • Direct recording electronic voting machines should not be used.

Ballot Security

• Control totals are used to account for all ballots and ensure the correct number is tabulated.
  • Two-person integrity security measures are in place for recording daily ballot activity.
  • Election officials verify that voting and tabulation machines are secured during election day through checks that the number of voters processed matches the number of votes recorded.
  • End-of-day printed vote totals are accounted for using a two-person integrity security system.
  • Election officials compare the number of ballots tallied with the number of voters for each voting site on a site-by-site basis. (K.S.A. 25-4412)
  • Election officials comprehensively account for all ballots sent to polling places (i.e., voted, voted provisionally, spoiled, or unused).

• Controls are used to monitor the elimination of provisional ballots from tabulation.
  • Rejected ballots are reviewed by at least two people to confirm the rejection.
  • Officials document eligibility decisions for provisional ballots.

Voting and Tabulation Machine Security

• Voting and tabulation machines are checked to work properly and for physical damage when purchased.
  • Every voting machine unit has undergone an acceptance test that includes running a mock election and ensuring the counts are correct.
  • Every voting machine unit has undergone an acceptance test that includes verifying the machine’s physical integrity (e.g., no signs of physical damage; doors, locks, and hinges work well; hinge pins are not easily removed).

• Voting and tabulation machines are physically secured from unauthorized access while stored between elections.
  • Physical access to the storage facility is limited to authorized personnel.
  • Authorized personnel with access to the storage facility have unique codes for entry tracking.
  • The storage facility is video monitored.
  • Officials keep an updated key control list of all personnel with keys to the storage facility.
  • Election office staff have passed a background check.

• Voting and tabulation machine accuracy is verified before elections.
  • Logic and accuracy testing is performed by two or more people and documented.

• Tabulation machine accuracy is double-checked after elections. (K.S.A. 25-4411 and 25-4610)
  • Public post-election tests are conducted on each tabulation machine.
  • The public post-election tests process a pre-audited group of ballots for each candidate and each measure.
  • The public post-election tests include one or more ballots for each office that have more votes than allowed by law, thereby testing for the equipment’s ability to reject overvotes.

Election Management Computer Security

• Election management computer activity is monitored.
  • There is a well-defined procedure for monitoring each person with access to the election management computer.
  • The election management computer access monitoring procedure includes access logs.
  • The election management computer access monitoring procedure requires all work on the computer to be done in pairs (including by vendors, with election staff present).

• The election management computer cannot be used for other functions.
  • Election management computer software is the only software installed on the computer.

• The election management computer is secured from unauthorized physical or virtual access.
  • The election management computer is not connected to any networks. (K.S.A. 25-4403)
  • The election management computer access monitoring procedure limits access (passwords only for election officials and access only for the functions officials are authorized to perform).
  • The election management computer access monitoring procedure requires passwords to have length requirements.
  • The election management computer access monitoring procedure requires passwords to have complexity requirements.
  • Physical access to the area where the election management computer system is used is limited to authorized personnel.
  • Authorized personnel with access to the election management computer system have unique codes for entry tracking.
  • The area where the election management computer system is used is secured.

Transfer and Movement Security

• Controls are used to monitor the deployment of voting machines, tabulation machines, ballots, and election results media to polling places.
  • A record of election material transfer is kept for delivery of all supplies, including machines. (K.S.A. 25-2707)

• Controls are used to monitor the return of voting machines, tabulation machines, ballots, and election results media to the election office.
  • A record of election material transfer is kept for the return of all supplies, including machines. (K.S.A. 25-2707)
  • There is a chain of custody in place for ballots that ensures that ballots are in possession of two or more election officials of different parties at all times.
  • Election results storage media are accounted for using a two-person integrity security system.
  • End-of-day printed vote totals are transferred using a two-person integrity security system to the election office.
  • Election results storage media are transferred using a two-person integrity security system to the election office.

• Voting and tabulation machine software is secured from tampering when deployed for elections.
  • After logic and accuracy tests are completed, voting and tabulation machines are sealed with a tamperproof seal.
  • Tamperproof seal numbers are documented on a transmittal sheet.
  • Tamperproof seal numbers are checked against the transmittal sheet at each polling place by a two-person team.
  • Voting and tabulation machines are secured and sealed with a tamperproof seal during transportation to the polling place.
  • Opening zero proofs are printed for all tabulation machines.

• Voting and tabulation machines are physically secured from unauthorized access when deployed for elections.
  • There is a key control list of all personnel with keys and access to facilities where voting and tabulation machines are present.
  • Election officials verify that voting and tabulation machines are secured during election day through inspections for damage or tampering.

• Election results are secured from tampering during physical transfer to the election office.
  • Official results are always computed by media that is physically transported from the polling place to the election office.
  • End-of-day printed vote totals are transferred in numbered, sealed pouches to the election office.
  • Election results storage media are transferred in numbered, sealed pouches to the election office.