Laws regulating voting systems, including voting machines and other election infrastructure, exist primarily at the state and local levels. However, the federal government maintains significant authority over elections and plays an important role in safeguarding election infrastructure. In that regard, Congress has passed legislation that sets forth requirements for voting systems. The Help America Vote Act of 2002 (HAVA; 52 U.S.C. §§ 20901-21145), in particular, includes among other things, federal requirements for voting systems (52 U.S.C. § 21081). As authorized by HAVA, the U.S. Election Assistance Commission (EAC) promulgates voluntary federal guidelines to assist states in implementing these requirements for their voting systems. Additionally, Congress has passed several federal criminal laws prohibiting the intrusion into or misuse of voting systems.
Criminal Laws
The Computer Fraud and Abuse Act (CFAA) prohibits, among other things, a number of activities involving accessing a protected computer "without authorization" or accessing a protected computer that exceeds authorization. In 2020, Congress amended the CFAA to broaden the definition of a "protected computer" to include a computer that is part of a voting system and that either is used for a federal election or has moved in or otherwise affected interstate or foreign commerce (18 U.S.C. § 1030(e)(2)(C)). Since its enactment, § 1030(e)(2)(C) prohibits unauthorized individuals from accessing a voting system and transmitting or retaining protected information. Another provision, 18 U.S.C. § 371, prohibits persons from conspiring to commit an offense against or to defraud the United States. Among recent criminal cases related to elections systems brought by the Department of Justice (DOJ) using these provisions include a 2021 case brought against two Iranian nationals, where they were principally charged under 18 U.S.C. § 1030 with computer intrusion related to the 2020 presidential election. In 2018, DOJ secured indictments against twelve Russian nationals, charging them with computer intrusion and conspiracy related to the 2016 election under 18 U.S.C. §§ 1030 and 371.
Several other criminal laws may arise in the context of intrusion into or misuse of voting systems, including
Help America Vote Act of 2002 (HAVA)
Under HAVA, a voting system is defined as "the total combination of mechanical, electromechanical, or electronic equipment (including the software, firmware, and documentation required to program, control, and support the equipment) that is used to define ballots; to cast and count votes; to report or display election results; and to maintain and produce any audit trail information" as well as the "practices and associated documentation used" to test and maintain the system. (52 U.S.C. § 21081). HAVA's voting system requirements for federal elections include machines that can produce a permanent paper record with a manual audit capacity and that have accessibility features for other languages and individuals with disabilities. For more information on HAVA, please see CRS Report R46949, The Help America Vote Act of 2002 (HAVA): Overview and Ongoing Role in Election Administration Policy, by Karen L. Shanton.
Voluntary Voting Systems Guidelines (VVSG)
As part of its advisory role to state and local governments, HAVA requires the EAC to develop and maintain a set of guidelines called the Voluntary Voting System Guidelines (VVSG). The VVSG are specifications for voting systems, including basic functionality, accessibility, and security capabilities. In addition, 52 U.S.C. § 20971 further requires the EAC to provide for the testing, certification, decertification, and recertification of voting systems technology by accredited laboratories.
While many states have adopted aspects of the VVSG, the guidelines are voluntary, and states may choose which federal guidelines, testing, or certification processes to adopt under their own state laws. According to a February 2021 EAC press release, at least 38 states "use the standards in some way" for their elections.
Legal Issues
Under HAVA, the Attorney General "may bring a civil action against any State or jurisdiction in an appropriate United States District Court for such declaratory and injunctive relief (including a temporary restraining order, a permanent or temporary injunction, or other order) as may be necessary to carry out [HAVA's] uniform and nondiscriminatory election technology and administration requirements." (52 U.S.C. § 21111). HAVA does not explicitly provide a private right of action. While some federal courts have found rights of action for provisions of HAVA enforceable under 42 U.S.C. § 1983, which provides a cause of action against any person who, under color of state law, abridges constitutionally-protected rights (see e.g., Colon-Marrero v. Velez, 813 F.3d 1, 16-20 (1st Cir. 2016); Sandusky County Democratic Party v. Blackwell, 387 F.3d 565, 572 (6th Cir. 2004)), other courts have declined to do so (Crowley v. Nevada ex. rel. Nevada Secretary of State, 678 F.3d 730, 735 (9th Cir. 2012); Taylor v. Onorato, 428 F.Supp. 2d 384, 386 (W.D. Pa. 2006)). Additionally, 52 U.S.C. § 21112 requires states to establish administrative complaint procedures for individuals who believe a HAVA requirement has been violated.
Federal courts generally give broad deference to state election administration policies, with the Supreme Court acknowledging in Storer v. Brown, 415 U.S. 724 (1974) that, "as a practical matter, there must be a substantial regulation of elections if they are to be fair and honest and if some sort of order, rather than chaos, is to accompany the democratic processes." However, voting systems administered by states must still comply with federal requirements, including HAVA, the Voting Rights Act of 1965 (VRA), the National Voter Registration Act of 1993 (NVRA), and the First, Fourteenth, and Fifteenth Amendments of the U.S. Constitution.
Executive Branch Developments in Securing Election Infrastructure
In 2017, the U.S. Department of Homeland Security (DHS) designated election equipment as "critical infrastructure" deemed "so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters[.]" According to DHS, the designation allows the federal government to better prioritize election infrastructure in policy planning. However, the Department emphasized that the designation "does nothing to change the role state and local governments have in administering and running elections." Additionally, DHS, through its Cybersecurity and Infrastructure Security Agency, provides services to state and local governments to assist them in reducing risk to their election systems and facilities.
Considerations for Congress
Article 1, Section 4, cl. 1, of the U.S. Constitution, the Elections Clause, states, "The Times, Places and Manner of holding Elections for Senators and Representatives, shall be prescribed in each State by the Legislature thereof; but the Congress may at any time by Law make or alter such Regulations, except as to the Places of chusing Senators." Article II, Section 1, cl. 4, provides that in presidential elections, "Congress may determine the Time of chusing the Electors, and the Day on which they shall give their Votes; which Day shall be the same throughout the United States." Congress does not have general regulatory authority over state and local elections, but it may still exercise its power over such entities in several contexts. For instance, Congress has the authority to prevent unconstitutional voter disenfranchisement in state and local elections. Congress's authority to legislate regarding these issues derives principally from the Fourteenth and Fifteenth Amendments. Relying on its Spending Clause authority (U.S. Const. art. I, § 8, cl. 1), Congress may also condition the receipt of federal funds for state or local elections on compliance with federal requirements.
Voting systems incidents—like delays, misuse, or cyberattacks—can invite attempts to discredit the electoral process, reduce voter turnout, and create political instability. Congress may consider several different types of requirements for voting systems beyond those currently existing in federal law. For example, Congress may expand existing voting system requirements in HAVA, make the guidelines under the VVSG mandatory, or create new criminal penalties for conduct specifically targeting election infrastructure.
Proposed legislation in the 118th Congress to address voting systems includes S. 2344/H.R. 11, the Freedom to Vote Act, which would amend HAVA to include additional voting systems requirements and provide federal grants to state and local governments for election infrastructure. Among these requirements, the proposal would direct states to "seek to ensure" that any voting machine used in an election for federal office is manufactured in the United States. Additionally, the bill would create an explicit private right of action for HAVA and amend 52 U.S.C. § 21081 to require states to replace paperless voting machines with voting systems that provide voter-verified paper ballots for federal elections. Another example is H.R. 4563, the American Confidence in Elections Act, which would, among other things, direct the EAC to issue voluntary considerations for states about various aspects of election administration such as voter registration list maintenance. For additional information, consult CRS In Focus IF12453, H.R. 4563, the American Confidence in Elections Act (ACE Act): Legal Background, by L. Paige Whitaker.