Auditor General DePasquale Issues Audit of Voter Registration System, Calls for Changes at Pennsylvania Department of State

Encourages voters to verify their registration information online now

December 19 2019

Auditor General DePasquale Issues Audit of Voter Registration System, Calls for Changes at Pennsylvania Department of State

Encourages voters to verify their registration information online now

Printer friendly news release

Audit Report

HARRISBURG (Dec. 19, 2019) – Auditor General Eugene DePasquale today said the Department of State must continue to work with counties to improve the accuracy of Pennsylvania’s voter registration records, based on an audit released by his office.

Conducted at the request of the Department of State, DePasquale’s audit of the Statewide Uniform Registry of Electors (SURE) found more than 50,000 cases of potentially inaccurate voter records.

“The Department of State must work harder to verify that registration records are accurate and up-to-date,” DePasquale said. “My audit team found too many instances of potentially bad data and sloppy recordkeeping that requires guidance from the state to help counties resolve issues throughout the year.”

Although Pennsylvania counties own voter registration records, federal law requires the state to ensure the data held by the SURE system is accurate and secure.

DePasquale said the Department of State does not adequately document that it regularly monitors each county’s work to verify data is entered correctly or that the system has enough tools to help prevent data entry errors.

DePasquale said his audit team reported the following key findings:

• Weaknesses in the voter registration application process and the maintenance of voter records in the SURE system resulted in instances of potentially inaccurate voter record information.
• Data analysis identified tens of thousands of potential duplicate and inaccurate voter records, as well as nearly three thousand records for potentially deceased voters that need to be verified.
• A combination of a lack of cooperation by four county election offices and PennDOT, as well as source documents not being available for the majority of test samples, inhibited the ability to verify the accuracy of most records tested during the audit.
• The Department of State must continue to implement leading information technology security practices and information technology controls to protect the SURE system and ensure the reliability of voter registration records.
• Incorporating edit checks and other improvements into the design of the replacement system for SURE will reduce data errors and improve accuracy.

DePasquale’s team provided 50 recommendations to strengthen the Department of State’s policies and management controls. One of the key recommendations is for the Department of State to work with counties to resolve records management issues such as duplicate voter records.

“We found that different counties tend to approach this job in different ways,” DePasquale said. “Some counties review voter registration records for accuracy daily or weekly, but others perform reviews only occasionally – and that must change. The Department of State needs to provide clearer guidance to help counties ensure the accuracy of voter records.”

DePasquale noted that some of the issues his auditors found will be addressed by a new system that will replace the SURE system, which is now more than 15 years old. 

“I’m glad the Department of State listened to our suggestions and added our ideas to its plans for the new voter registration system,” he added. “The new system will be stronger as a result of our work.”

DePasquale encouraged all Pennsylvania voters to check their own voter registration data online using the “Check your registration status” link at www.VotesPA.com.

He also urged the public to be alert to continuing efforts by foreign entities to influence our elections through the spread of disinformation and propaganda.

“Please resist the urge to further spread disinformation, especially on social media where it is so prevalent,” DePasquale said. “Before clicking ‘share,’ please take the time to verify the information by seeking out facts from trusted, reliable sources.”

Review the SURE audit report and learn more about the Department of the Auditor General online at www.PaAuditor.gov.  

# # #

EDITOR’S NOTE: The following are the top 10 recommendations contained in the SURE system audit released by the Department of the Auditor General (DAG):

1. Evaluate the lists of voter registration records with the same driver’s license numbers and potential duplicate cases provided by DAG and work with the county election offices to investigate and eliminate the specific duplicate information identified during the audit.
2. Evaluate the lists of potentially deceased voters provided by DAG and instruct the counties to investigate and take appropriate action to cancel deceased voters’ records in SURE.
3. Consider an additional periodic comparison of the cumulative file of deaths received from the Department of Health to records in SURE to identify any voters that may have been missed during past reviews. Department of State (DOS) should consider performing the match using data analysis techniques and provide matching records to the counties for follow-up.    
4. Continue with plans to replace the SURE system with a more up-to-date system that includes current leading security features.            
5. Move forward with plans to utilize all information available from the Electronic Registration Information Center (ERIC) to assist in improving the accuracy of voter registration records.    
6. Coordinate with Office of Administration/Office of Information Technology (OA/OIT) to develop a governance structure that will provide clear lines of authority in operation, maintenance, and security of the SURE system and its supporting infrastructure. This control structure should address all parties with access to and/or responsibility for the SURE system and its supporting infrastructure and should be formalized in a governance document that is formally adopted by DOS and OA/OIT.
7. Arrange for independent audits of all parts of the SURE system, supporting architecture, and connected systems using a comprehensive framework of security standards, which includes tests of IT general controls, tests of cybersecurity controls, vulnerability assessments, and penetration testing. These audits should be performed annually and build on security assessments already performed.
8. Incorporate the following information technology enhancements into its design of the replacement SURE system and consider the feasibility of making some or all of these enhancements into the current SURE system:

1. A Geographic Information System (GIS) feature and related enhancements that would check addresses to ensure the address is within the county identified on the application. This would help to ensure that electronic applications are forwarded to the correct county for processing and in the case of paper applications, county staff are immediately alerted if the address they are posting to SURE is not within the county listed on the application.
2. An edit check that would alert or prevent county staff from approving applications that have non-Pennsylvania states and/or ZIP codes within their residential addresses.
3. A “Read Only” feature for certain data fields that should not change, such as date of birth, driver’s license number, and Social Security number to prevent unintended edits, but enable these “Read Only” fields to be edited by designated management staff along with documenting the reason for the edit.
4. A hard-stop feature in the SURE system that would prevent county staff from cancelling voter records using unallowable codes within 90 days of an election.
5. A declination notice to be automatically generated and mailed to individuals that are not currently registered to vote but submit a change of address request for their voter registration record. This will assist in notifying those individuals that they are not registered to vote.
6. The ability for DOS and county staff to build and run their own reports, rather than having to obtain reports from the Help Desk.

1. Emphasize to the counties the vital need and importance of having a second person review the data entered into SURE to reduce data entry errors and increase the accuracy of voter records.
2.  Develop a policy requiring the counties to scan all voter registration-related documents that are received via hard copy to the voter’s record. This will allow for access to the original documents that support information entered into a voter’s record in SURE and to help ensure uniformity across all counties.