Kansas counties have many safeguards in place for protecting the security of elections, but they’re also deficient in some areas such as securing voting machines from tampering when deployed for elections, a new audit says.
In reviewing 13 counties statewide, the audit found that larger counties had stronger security practices than smaller counties, mostly likely because of their greater security needs and a wealth of resources and staff.
“Security isn’t as good as it could or should be,” the audit said.
“While election officers took security seriously, our conclusions were based not on what they told us, but on what we could observe or verify in documentation,” the audit said.
Kansas has a decentralized election system with just four of the state’s 105 counties overseen by the secretary of state, who appoints those election commissioners. Elected county clerks oversee elections in all of the other counties.
The audit, requested by the state Sen. Dennis Pyle of Hiawatha, wasn’t intended to search for evidence of voter fraud.
Rather, the audit focused on whether county election offices had adequate policies and practices to ensure the accuracy and security of voting machines, ballots and any machines used to tabulate ballots.
The audit relied on best practice standards established by the Election Assistance Commission, the federal agency that tests and certifies voting machines nationwide and publishes voluntary voting system guidelines.
The secretary of state’s office said it agreed “that many factors influence county election security practices, most notably, that the size and resources of a county are key drivers of practices across counties.”
Chief election officials “are in the best position to assess the security within their county, and structure their election security practices accordingly,” the agency said.
The secretary of state agreed there are areas where election security policies and procedures may be strengthened and said it’s committed to working with local election officials to improve those processes.
All seven of the larger counties reviewed in the audit had adequate overall security process practices, but two smaller counties did not have adequate practices, the audit said.
The same pattern generally was true for all the best practice categories that the auditors reviewed, according to the audit.
The audit said larger counties tend to have strong security practices because their elections require coordinating and overseeing more people and equipment.
“The sheer volume and complexity require larger counties to have more controls and better documentation to ensure things aren’t missed,” the audit said.
“Further, larger counties also have more financial and staff resources to dedicate to election,” the audit said.
Douglas and Johnson counties had the strongest practices, the audit found. Their practices were adequate in 15 of 17 best practice areas the auditors examined.
Meanwhile, just three of the smaller counties that were audited had adequate security practices in 10 or more of the areas reviewed.
Chautauqua (12 of 17), Dickinson (11 of 17), and Lincoln counties (10 of 16) performed best in the audit among the smaller counties.
But Jackson and Sheridan counties had the weakest security practices, the audit found. Jackson County’s practices were adequate in only five of 17 areas.
Auditors wanted to review 15 counties but could only examine 13 because election officials in two of the counties – Ford and Chase – sealed most of their 2022 election documents.
The counties sealed these documents in the same containers as their ballots. State law requires them to remain sealed.
Many counties audited had adequate ballot security, but they were generally weaker than counties’ overall process or election management security practices, the audit said.
About half of the counties audited had weak controls for accounting for all ballots and ensuring the correct number was tabulated, the audit said.
“Counties sometimes created standardized forms that could lead to robust ballot security practices if used properly,” the audit said.
“But many forms we reviewed weren’t filled out completely or correctly, undermining their value,” the audit reported.
The audit found that while counties generally physically secured their machines between elections, most counties had inadequate testing practices.
For example, the audit found that counties such as Douglas, Harvey, Johnson, Riley and Sedgwick stored voting and tabulation machines in locked, video-monitored rooms.
In those counties, staff are required to scan their badges to enter except for Harvey County, which used a fingerprint scanner instead.
Those systems logged each time someone entered the storage room.
However, the audit found that many counties didn’t provide documentation showing all their electronic equipment had undergone acceptance testing when the equipment was purchased.
The acceptance tests ensure that counties are receiving intact and correctly functioning machines when they first buy them, the audit said.
Officials from Chautauqua, Dickinson, Douglas, Harvey and Lincoln counties said they or their vendor completed testing but didn’t have documents to back up the claim.
Auditors also found problems with most counties’ logic and accuracy testing practices before elections were held.
“These tests are critical because they verify that voting and tabulation machines will accurately record and count votes on election day,” the audit said.
Officials in Chautauqua, Dickinson, Jackson, Lincoln, Riley and Sheridan counties didn’t provide documentation showing they conducted logic and accuracy testing on all the machines the auditors sampled.
“Some said they did this testing but didn’t document it, so we couldn’t verify this,” the audit said.
Meanwhile, Harvey, Russell, Sedgwick and Wyandotte counties provided documents showing they tested the machines the auditors sampled.
But only one person did the tests, and auditors said two people should perform logic and accuracy testing to ensure it’s done correctly and impartially.
The audit also homed in on security practices for moving and transferring voting equipment.
Johnson County, for instance, tracks who moves electronic equipment, paper ballots, election results media and other supplies.
Johnson County also applies tamper-proof seals to voting and tabulation machines and to the pouches used to transfer ballots from polling places.
The county’s election officials also document whether the seals have been broken to show they hadn’t been tampered with during transfer.
Some counties created standardized forms they said recorded the transfer or arrival of election results media both to and from the central election office.
But the auditors said it wasn’t always clear what the documents were supposed to show, the auditors said.
The audit found that Jackson, Lincoln, Miami and Russell counties provided chain-of-custody documents that had signatures but didn’t say they were confirming the arrival of election results storage media to the election office, the audit said.
“Such forms would make it easier for someone to sign while overlooking something they’re signing for, lessening its effectiveness as a control,” the audit said.
