No state received a perfect score in this report. With few exceptions, most states fell in the middle of the spectrum: No state received an A; 11 states received a B; 23 states received a C; 12 states received a D; and five states received an F.
Arkansas allows voting using machines that do not provide a paper record and fails to mandate post-election audits, which does not provide confirmation that ballots are cast as the voter intends and counted as cast. Despite numerous attempts to speak to someone in state government about the cybersecurity standards for the
state’s voter registration system, state officials did not respond to our requests for information and comments and we were unable to locate it independently. If Arkansas is adhering to all of the minimum cybersecurity best practices for voter registration systems, it would receive a “good” score—worth 3 points—for that
category, bringing its grade up to a D. The state exercises good practices by requiring that all voting machines be tested to EAC Voluntary Voting System Guidelines prior to being purchased or used in the state, and by requiring election officials to carry out pre-election logic and accuracy testing on all voting machines that will be used in an upcoming election. The fact that the state prohibits voters stationed or living overseas from returning voted ballots electronically is also commendable.
In Arkansas, all voted ballots must be returned by mail or delivered in person.
To improve its overall election security, Arkansas should stop using paperless DRE machines in some jurisdictions and should require mandatory post-election audits in all jurisdictions. Until Arkansas requires statewide use of paper ballots and robust post-election audits that test the accuracy of election outcomes with
a high degree of confidence, its elections will remain a potential target of sophisticated nation-states. Arkansas should also strengthen its post-election ballot accounting and reconciliation procedures by enacting precinct-level accounting requirements for DRE machines that mirror those required for jurisdictions with
ballot tabulators. Whereas state law currently requires ballot tabulating precincts to compare the number of ballots cast with the number of voters who signed into the polling place, it is unclear whether the same is true for jurisdictions using DRE machines.