When voters in Louisiana go to the polls during the 2020 presidential election, they will cast their ballots on aging electronic voting machines that the nation has largely abandoned over concerns that they have no paper record that could serve as a fail-safe if something goes wrong.

The state is moving toward getting new machines that will provide a paper record of votes, and Secretary of State Kyle Ardoin, the state’s chief elections official, had aimed to have them ready for the 2020 elections. But the contract with a private vendor selected by Ardoin’s office was cancelled after a challenge to the bid process, stalling delivery of the new machines.

Election security has taken on newfound importance in recent years, following Russian interference in the 2016 U.S. presidential election. And in Louisiana, a string of cyber attacks against state and local governments that crippled public-facing departments and cost millions of dollars has shone a light on cybersecurity more broadly.

Officials, including Ardoin, say they are more prepared to run secure elections in 2020 than ever before, following election interference in 2016 that caught many off guard and prompted reviews among federal and state policymakers.

Still, Louisiana’s aging machines invite a greater risk of malfunction than newer equipment that features a paper backup, experts say. And while Ardoin insists there is no risk of hacking because the machines are not connected to the internet and aren’t programmed with computers that are connected to the internet, it is impossible to eliminate the risk of malware entirely, especially if the computers used to program the machines were inadvertently connected to the internet.

“These systems make it very hard to detect if something has gone wrong and they don’t let you recover from it if something went wrong,” said Marian Schneider, president of Verified Voting, a nonprofit advocacy group. “The bottom line is, even if they were attacked you wouldn’t be able to detect it.”

Because voting machines aren’t connected to the internet, the main risk of hacking is through the computers that program the machines. Malware theoretically could be introduced to those computers if they were ever connected to the internet, and that malware could make the computers program the machines in a way that tampered with votes.

According to Verified Voting, Louisiana will be one of only a handful of states primarily using electronic machines with no paper backup – called direct recording electronic voting machines, or DREs. The federal government pushed states to start using DREs after the infamous presidential elections in 2000, when paper ballots caused problems in a razor-thin race in Florida.

In fact, according to the organization, Louisiana is the only state that will use the machines in every jurisdiction in 2020, as the state is in charge of buying and maintaining the equipment in Louisiana. Several other states are mostly using paperless machines, with a handful of counties using other equipment.

Schneider, along with other experts, have called for a move toward paper ballots or at least machines that offer a paper record of each vote. That way, officials can conduct rigorous post-election audits that check the machine record with the paper record. If a machine is found to have been tampered with or if it malfunctioned, officials could simply count the paper ballots to determine the real vote total.

With the contract for Louisiana’s new voting machines delayed, Ardoin leased new early voting machines for about $2.2 million for the 2019-2020 cycle, after the old machines showed “signs of aging.” Voters in the 2019 elections used those leased machines during early voting, then on election day cast ballots on the older machines.

Ardoin insisted Louisiana’s machines are at no risk of hacking because his staff programs the machines themselves, with computers that aren’t connected to the internet. Once they’re programmed, the state convenes a public meeting of a group of local party and election officials to test the machines to make sure they’re working properly. Before and after elections, the machines are stored in state-owned warehouses.

The leased machines, however, were previously programmed by people not in the elections office, though Ardoin said they have been programmed and certified by his staff.

The reason Ardoin said he is getting new machines that do have a paper record because the current machines are old, and it is increasingly difficult to find replacement parts when they break. But he brushed aside concerns that those old machines could malfunction, which election experts say is the primary issue with the equipment. The last round of machines Louisiana bought was in 2005.

“It's never slipped through the cracks because you have to test every machine with the local election board,” Ardoin said. “They would figure out if there's a problem with a machine right away. And second of all we've never had that kind of a problem. It doesn't exist.”

He said voters should start seeing the new machines a year from now, assuming the new bid process is completed by the end of 2020. The current machines are slated to be phased out over the next three years.

Gov. John Bel Edwards, speaking to reporters after warning a room full of local officials they are at risk of cyber attacks, echoed Ardoin and said he was confident in the security of Louisiana’s elections.

“I'm never going to say it's absolutely impossible for people to hack into our computers and interrupt the election process, but it wouldn't happen in the voting machines themselves,” Edwards said. “Potentially it would be the voter rolls or something like that.”

Edgardo Cortés, the former commissioner of elections in Virginia who now advises the Brennan Center on election security, said it’s good Louisiana’s machines are not connected to the internet – they should never be. But he called that the “wrong focus.”

“It’s all about what can they do to recover from a failure,” he said.

Old equipment tends to fail at higher rates, Cortés said, making malfunctioning machines a bigger concern than hackers. The risk is that a machine could fail and without a paper record, the votes could be lost.

Cortés lauded Louisiana for “moving in the right direction” by getting new machines, and he said the state should in the meantime be doing training and have emergency paper ballots on hand in case something goes wrong, among other things.

“States have been using paperless machines for years,” he said. “We’re saying this is not the ideal equipment to use. There is much better stuff out there to give you much more confidence in the elections and allow you to check the results afterwards.”

Last year, a U.S. Senate committee released its first of several reports on Russia’s effort to interfere in American elections in 2016. It found that beginning in 2014, the Russian government directed “extensive activity” against U.S. election infrastructure at the state and local level, possibly to find vulnerabilities to attack later or to undermine confidence in the integrity of the 2016 elections.

“Aging voting equipment, particularly voting machines that had no paper record of votes, were vulnerable to exploitation by a committed adversary,” the report said. “Despite the focus on this issue since 2016, some of these vulnerabilities remain.”

While the analysis found Russia did not change any votes, the heavily-redacted report did offer some clear guidance to election officials. Most voters should mark paper ballots, and “risk-limiting” audits to ensure the accuracy of the vote tallies should be required. It also said efforts by the U.S. Department of Homeland Security to strengthen cybersecurity of state election systems has helped make those systems more secure.

However, voting machines aren’t the only part of the electoral process that needs heightened security. If bad actors tampered with voter registration databases, the report suggested “chaos” could ensue, especially if voters showed up to the polls and their names were not on the rolls.

Steve Raborn, the registrar of voters in East Baton Rouge Parish, said Ardoin’s office has taken several steps to make his work more secure. The computers he uses to access the voter registration database can’t be connected to outside networks, and the state does mandatory cybersecurity training for registrars and staff, mainly on how to avoid phishing attacks.

Raborn’s office was at the center of perhaps the biggest election controversy in Louisiana last year. While most ballots in Louisiana are cast on electronic machines, there are also some– mainly absentee – that are cast the old fashioned way, on paper. A stack of those ballots in a hotly-contested Baton Rouge state Senate race was apparently double-counted on election night, and after Raborn’s office re-counted them, the results were an extraordinary tie between two Republicans for third-place. An historic three-way runoff loomed, putting the long Republican seat, once held by current U.S. Sen. Bill Cassidy, in jeopardy of flipping to a Democrat.

Eventually, one of the candidates requested a hand recount of the paper ballots – the type of remedy experts say should be used if there are problems with voting machines – and Franklin Foil emerged as the second-place finisher. He went on to beat Democrat Beverly Brooks Thompson in the runoff.

Ardoin’s office is in the process of “segregating” the IT systems for all registrars of voters across the state, something that has already been done for clerks of court, who handle the election-day voting. That is aimed at preventing potential ransomware attacks from spreading from local to state officials.

In November, two days after the general elections in Louisiana, the state government servers were hit with a ransomware attack that locked up data and demanded payment for its safe return. In response, state officials shut down all network traffic, halting any state government work that relied on the internet. Motor vehicle offices were shut down for weeks after the attack.

Several years ago, Ardoin’s office pushed back against an effort by then-Gov. Bobby Jindal’s administration to consolidate its IT systems with the rest of the state. As a result, Ardoin said his office was far less affected by the recent malware. Still, its website was briefly shut down.

If that happened in the midst of an election – when Ardoin is tasked with putting out results to the public – he said his office would erect a new website on the spot.

Email Sam Karlin at skarlin@theadvocate.com