Guest Columnist

Miller: Saying I-Voters is secure is not enough

Valerie Smith, elections outreach coordinator for Linn County, sets up voting booths for early voting in special elections at the auditor’s office at the Jean Oxley Linn County Public Service Center in Cedar Rapids on Wednesday, March 14, 2018. Early voting has begun for April 3 elections to fill a city council seat in Alburnett and decide public measures in two school districts. The deadline to request an absentee ballot is 11 days before the election under new absentee voting rules, shortening the period to request by one week. (Liz Martin/The Gazette)
Valerie Smith, elections outreach coordinator for Linn County, sets up voting booths for early voting in special elections at the auditor’s office at the Jean Oxley Linn County Public Service Center in Cedar Rapids on Wednesday, March 14, 2018. Early voting has begun for April 3 elections to fill a city council seat in Alburnett and decide public measures in two school districts. The deadline to request an absentee ballot is 11 days before the election under new absentee voting rules, shortening the period to request by one week. (Liz Martin/The Gazette)

I am writing in response to Iowa Secretary of State Paul Pate’s July 30 guest column “A model for election security.” And my purpose is to explain I-Voters and why you should be concerned about it.

I-Voters is our statewide voter registration system. It is a computer system maintained and operated by the Secretary of State’s Office. Currently, the voter registration records for over 2 million voters are stored in I-Voters.

Every county is required to store its voter registration records on I-Voters and every county is required to pay the secretary of state an annual fee to maintain I-Voters. Normally, when you pay someone a fee, you are entitled to know what you are getting in return. That is not the case with I-Voters.

I-Voters went into service in Iowa in 2006. Cyber security did not become a hot topic until 2016, ten years later. Although I-Voters is running on newer hardware than it did in 2006, that just means the old software, including its flaws, is running faster — not more securely.

Let me explain one flaw, which others view as a feature.

Imagine you show up to vote on Election Day and your name is not on the election register. You swear you voted at your precinct in the last election. Heck, you swear you voted in this precinct for the last 30 years. Some of the precinct officials know you and cannot explain why you are not listed on the election register. Yes, you can still vote. Unfortunately, you have to go through the Election Day registration process to register before you can vote.

That takes time and requires proof of who you are and where you reside. What if you don’t have time? Or proof? Now multiply this scenario by ten thousand voters across the state.

How could your name disappear from the election register? One feature of I-Voters is that it allows an election employee — an I-Voters user — in one county to pull your voter registration record from the losing county to the gaining county, e.g., when you relocate from Cedar Rapids to Iowa City.

ARTICLE CONTINUES BELOW ADVERTISEMENT

One flaw of I-Voters is that one employee — not two employees — can pull your voter registration record from Cedar Rapids to Iowa City, i.e., from Linn County to Johnson County. What used to be a “feature” before the age of cyber warfare is now a “flaw.”

I do not know how many other flaws I-Voters has, but that is the one that keeps me awake at night.

When you pay someone a fee, you are entitled to know what you are getting in return. Unfortunately, I do not know what Pate is doing with the millions of dollars he has received to upgrade I-Voters. I thought I-Voters would be upgraded before the 2020 presidential election. On July 19, the Associated Press reported it would not be upgraded until after the 2020 elections.

I-Voters is the Achilles’ heel of elections in Iowa. Maliciously remove or relocate a thousand voter registration records in the system just before Election Day, and chaos will ensue.

Time is of the essence Mr. Secretary.

Telling Iowa’s voters, taxpayers, and county auditors that I-Voters is “secure” is not enough. County auditors do not know what is going on with I-Voters and they are entitled to know.

I request that you hire a third party, independent cyber security firm to assess I-Voters and determine if it is ready for the 2020 elections. In addition, let me and my fellow county auditors on your Auditors’ Advisory Panel observe the assessment, see the results, and monitor the fixes. Nothing is more important.

• Joel Miller is Linn County auditor.

Give us feedback

We value your trust and work hard to provide fair, accurate coverage. If you have found an error or omission in our reporting, tell us here.

Or if you have a story idea we should look into? Tell us here.

Give us feedback

We value your trust and work hard to provide fair, accurate coverage. If you have found an error or omission in our reporting, tell us here.

Or if you have a story idea we should look into? Tell us here.