Audit: Utah election systems largely disconnected from internet but needs tighter controls; committee opens bill file

A legislative audit released to the Government Operations Interim Committee found Utah’s voting systems are not connected to the internet but said state law and practice could be strengthened to reduce remaining cyber risk.

Jake Dinsdale, senior supervisor with the Office of the Legislative Auditor General, told the committee, “there’s a lot more going right with elections in Utah than wrong.” He said auditors confirmed voting machines they examined were appropriately disconnected but identified areas for improvement.

The nuts and bolts of the report recommended removing wireless capability where it remains possible, tightening user account privileges, improving password management and correcting physical storage or access issues in a small number of counties. “We are making a recommendation that statute go beyond where it currently is, prohibiting connections,” Dinsdale said, noting similar steps taken in other states.

The audit team said it physically inspected equipment, scanned local networks for wireless signals, reviewed hardware internals with vendor cooperation, and attended hash validations that compare installed software to known-good fingerprints. The report delegated that, while current protections are strong — multi‑factor authentication, public audits, hash checks and software certification — some user accounts had configuration access not necessary for election workers.

Weber County Clerk Ricky Hatch, speaking for county clerks, urged the committee to view the audit as constructive. He said clerks “remain steadfast in our commitment to safeguarding the integrity of our elections” and noted counties had already implemented many recommendations, including recent cybersecurity training and steps to replace older equipment with wireless capability disabled.

Committee members raised implementation concerns tied to cost and procurement. Representative Paul Cutler cautioned that removing embedded wireless capability could increase equipment costs where radio hardware is integrated on modern chipsets. Several members urged collaboration with counties before drafting statutory changes.

After discussion, Representative Lisa Shepherd moved that the committee open a bill file to address the audit’s recommendations; the motion passed unanimously. Staff were directed to draft language and coordinate with county clerks and the Lieutenant Governor’s office on specifics before bringing a bill draft back to the committee.

The committee’s action creates a formal path to consider proposals including statutory language to prohibit wireless capability on voting equipment, standardized user‑access rules, and minimum physical security practices for county election offices.