Delaware Audits 2 Voting Systems Ahead of Midterms [2026]

Delaware’s Election Taskforce sat down on Thursday, October 16, 2026, to pick apart the software and hardware that will run the state’s polling places during the 2026 midterms. The session was not a political hearing in the usual sense. It was closer to a code review, with officials walking through audit logs, network restrictions, and a 2025 software update that now sits at the center of the state’s voting infrastructure.

That distinction matters. Election security conversations in 2026 increasingly sound like software engineering conversations, not just policy ones. Delaware’s review, first reported by Delaware Public Media, offers a rare look at how one state’s taskforce actually interrogates the code, logs, and network posture behind the machines voters will touch in a few weeks.

Google · Preferred Sources

Don't miss new tech stories on Google

Add TrendinTech once in the Google app and our stories appear in your news suggestions.

Add Now

What Delaware’s Election Taskforce Actually Reviewed on October 16

According to Delaware Public Media, the Election Taskforce used Thursday’s session to examine how the state’s voter technology functions and whether it still complies with federal systems requirements. The review covered the two pieces of hardware that carry the most weight on election day: the ExpressVote XL machines used at polling places, and the DS450 units used for high-speed central scanning of mail-in ballots and recounts.

This was not a one-time check. Delaware updated its voting software in 2025, and Thursday’s taskforce session functioned as a kind of pre-midterm regression test, confirming that the updated code still produces the audit trail regulators and voters expect. The taskforce’s full official name, its complete membership, and the companies behind the ExpressVote XL and DS450 products were not detailed in the Delaware Public Media report, so this piece sticks to what was confirmed rather than filling in gaps with guesswork.

What was confirmed is enough to matter. Election software that handles millions of dollars in public trust, as recent breaches at government agencies elsewhere have shown, lives or dies on whether its logging and access controls actually work the way vendors claim.

Inside the ExpressVote XL: Delaware’s Polling-Place Hardware

The ExpressVote XL is the machine Delaware voters interact with directly at polling locations. Delaware Public Media’s reporting confirms this is the system deployed statewide for in-person voting, but the report does not include technical specifications, unit counts, or manufacturer branding beyond the product name itself. That restraint is worth preserving here too: plenty of coverage of voting machines drifts into unverified claims about internal architecture, and this review avoids repeating anything not actually confirmed by the outlet that broke the story.

What matters for this story is not the machine’s form factor but its software behavior. Every polling-place system that produces a vote also produces a record of that action, and the taskforce’s questions on Thursday centered on whether that record-keeping held up after last year’s software changes.

Why Polling-Place Software Gets This Much Scrutiny

Polling-place machines are the most visible part of election infrastructure, which makes them the most scrutinized. A bug in a code editor or a database tool costs a company money and time. A bug in a voting machine’s logging layer costs public confidence, which is far harder to rebuild. That asymmetry is why Delaware’s taskforce treats a routine audit log review as taskforce-level business rather than a back-office IT task.

The DS450: Central Scanning for Mail Ballots and Recounts

The second system under review, the DS450, handles a different job entirely. Delaware Public Media’s report confirms it is used for high-speed central scanning of mail-in ballots and for recounts, meaning it processes ballots in bulk rather than one voter at a time. That bulk-processing role makes its software behavior arguably more consequential than the polling-place machines, since a single configuration issue could affect thousands of ballots in one pass rather than one voter’s single transaction.

Central-count scanning has become more central to American elections generally as mail voting has grown since 2020, a trend StateScoop has tracked in its coverage of how costly and disruptive last-minute changes to election systems can be for the officials who run them. Delaware’s decision to review the DS450 alongside the ExpressVote XL, rather than treating them as separate concerns, reflects that growing weight.

Why Delaware Rebuilt Its Voting Software in 2025

Delaware Public Media’s reporting confirms the state updated its voting software in 2025, ahead of this year’s midterm cycle. The outlet did not detail every change included in that update, so this article will not speculate about version numbers, feature lists, or vendor names that were not part of the confirmed record. What is clear is the sequencing: update first, then audit. Thursday’s taskforce session was effectively a verification pass on code that had already shipped.

That sequencing mirrors a pattern familiar to anyone who has shipped software into a regulated environment. A platform update happens on its own timeline, often driven by maintenance needs, hardware end-of-life, or compliance deadlines. The audit happens afterward, closer to the event the software actually has to support. In Delaware’s case, that event is the 2026 midterms, and the gap between the 2025 update and the October 2026 review gave the taskforce roughly a year of runtime to observe the software in production conditions before trusting it on election day.

Audit Logs and Timestamps: The Paper Trail Inside the Code

The clearest technical thread running through Thursday’s review was logging. Delaware Public Media’s report confirms that the state’s election systems record audit logs and timestamps on every individual system, and that this logging is what the taskforce leaned on to evaluate the 2025 software update.

Tolan, addressing the review as quoted by Delaware Public Media, put it plainly: “In each individual system, there’s audit logs.” Tolan went on to describe what that logging actually captures, saying the logs and timestamps show “what’s been done, who’s done what, or made changes.”

That is a modest-sounding claim, but it is the backbone of modern election software assurance. Without a reliable log of who touched a system and when, an audit is just a guess dressed up in official language. With it, a taskforce can reconstruct the sequence of events around any disputed result, which is exactly the capability election officials nationwide have been racing to build since concerns about voting system integrity became a fixture of American politics after 2016.

Offline by Design: Why Delaware Blocks Network Access

Alongside the logging layer, Delaware Public Media confirmed that the state restricts network access on its election systems, blocks unknown applications, and runs the voting software offline. That combination, an offline network posture plus application allowlisting, is a deliberate reduction of attack surface rather than a side effect of old hardware.

It is the same logic that shows up in general-purpose security tooling. A properly configured endpoint protection setup blocks unrecognized executables for the same reason Delaware blocks unknown applications on its voting machines: unfamiliar code is the easiest vector for an attacker to exploit, and the cheapest way to close that door is to simply refuse to run anything that was not explicitly approved. Keeping the systems off the network closes the other obvious door, the one that remote attackers would need to reach the machines at all.

This approach is not unique to Delaware, but it is a meaningful counterpoint to concerns raised elsewhere in the country. The Christian Science Monitor has reported on Georgia’s separate struggle with a voting equipment vulnerability tied to ballot secrecy, a reminder that not every state’s hardware and software stack carries the same risk profile. Delaware’s offline-by-default posture is one way of managing that risk; other states are still working through their own.

The National Pressure Behind the Review

Delaware’s taskforce session did not happen in a vacuum. The Washington Post has reported that state election officials across the country say they are not getting enough federal support heading into the 2026 midterms, even as threats to election infrastructure continue to be a talking point in national politics. That friction between state-level election administrators and federal agencies adds weight to any state taskforce that can show its own house is in order, independent of what Washington does or does not provide.

StateTech Magazine has covered the broader pattern of state and local governments taking matters into their own hands on election security, treating it as an IT governance problem as much as a political one. Delaware’s taskforce format, pulling in the people who actually run the audit logs rather than only policy staff, fits that trend. It also puts Delaware in the position of being able to point to a documented, dated review when questions about the 2026 results inevitably surface, as they have in nearly every contested race since 2020.

Historical Context: From HAVA to Risk-Limiting Audits

Election technology oversight in the United States did not start with the 2026 midterms, and it is worth placing Delaware’s review in a longer arc. Congress passed the Help America Vote Act in 2002 after the 2000 Florida recount exposed how fragile punch-card and lever-machine systems could be under pressure, funding a nationwide shift toward electronic systems. The Election Assistance Commission followed with its first Voluntary Voting System Guidelines in 2005, setting baseline technical standards that vendors like the ones behind the ExpressVote XL and DS450 still build against.

The pace of scrutiny accelerated again after 2016, when reports of foreign interference pushed states toward auditable systems with voter-verifiable paper trails, and again in 2020, when a pandemic-driven surge in mail voting made central-count scanners like the DS450 far more important to the overall process than they had been a decade earlier. Delaware’s 2025 software update and its October 2026 taskforce review are the latest entries in that same timeline, not an isolated event.

Public confidence has tracked unevenly with that technical progress. Pew Research Center found that in 2024, 95% of voters were expected to use a voting system with a voter-verifiable paper trail, a dramatic shift from the punch-card era. Yet the same Pew Research Center analysis found that overall, only 52% of voters were at least somewhat confident that U.S. election systems were secure from hacking and other technological threats, which you can read in full on Pew’s 2024 election security survey. That gap between technical capability and public trust is exactly what audit sessions like Delaware’s are designed to close.

The gap is not new. Pew Research Center’s earlier work found that in 2018, 67% of Americans said it was very or somewhat likely that Russia or other foreign governments would try to influence that year’s midterm elections, detailed in Pew’s 2018 elections report, while only 45% of Americans at the time were confident election systems nationwide were secure from hacking. Confidence has moved, slowly, but the underlying anxiety has proven durable across three midterm cycles.

Market Impact: Election Technology Vendors Face a Compliance Crunch

For the companies that build and maintain election systems, reviews like Delaware’s carry real commercial weight. A taskforce that walks away satisfied with a vendor’s audit logging and offline architecture becomes a reference case other states can point to during procurement. A taskforce that finds gaps creates the opposite: a documented reason for other states to delay renewals or open new bids.

That dynamic puts pressure on vendors to treat logging, timestamping, and offline network design as core product features rather than compliance checkboxes bolted on after the fact. It is the same pressure that has pushed software vendors in other regulated spaces toward building security and auditability directly into their platform updates rather than patching them in later. Election software vendors that can show a clean, continuous audit trail across a software update cycle, the way Delaware’s 2025 update appears to have done, hold a real advantage over competitors that cannot.

There is also a cautionary angle. StateScoop’s reporting on the high cost of last-minute election system overhauls is a reminder that states making changes too close to an election create operational risk, regardless of how good the underlying software is. Delaware’s timing, updating in 2025 and auditing a year before the midterms rather than weeks before, reflects an awareness of that risk that not every state has managed to replicate.

Competitive Comparison: How Delaware’s Setup Stacks Up Nationally

No two states run identical election technology stacks, which makes direct comparisons tricky. What can be compared fairly is architecture philosophy: ballot-marking devices paired with central scanners, like Delaware’s ExpressVote XL and DS450 combination, versus hand-marked paper ballots counted on precinct-level scanners, which other states favor. Each approach has different audit characteristics, and Delaware’s taskforce review focused specifically on strengthening the audit trail of its chosen architecture rather than switching to a different one.

Component	Primary Function	Where Used	Confirmed Audit Feature	Confirmed Network Posture
ExpressVote XL	Ballot marking and casting	Polling places statewide	Generates audit logs and timestamps	Operates offline, no open network access
DS450	High-speed central ballot scanning	Mail-in ballot processing and recounts	Generates audit logs and timestamps	Operates offline, restricted network access
Election software (2025 update)	Coordinates machine operations statewide	All polling and counting locations	Records who made changes and when	Blocks unknown applications, no outside network access

What stands out in that comparison is consistency. Every confirmed piece of Delaware’s stack shares the same two properties, audit logging and offline operation, rather than mixing systems with different security postures. That uniformity is likely what let Thursday’s taskforce review move efficiently through both the polling-place and central-count systems in a single session.

Software Supply Chain Lessons for Election System Vendors

Election software sits in an unusual spot in the broader software supply chain conversation. It gets far less public scrutiny day-to-day than consumer or enterprise software, but it faces a far higher bar when it is reviewed, precisely because the review windows are so public and so time-boxed around election dates. A zero-day disclosed in a consumer product can be patched over weeks. A flaw discovered in voting software a month before an election has nowhere near that runway, a dynamic not unlike the pressure created when a chained vulnerability forces emergency patching in enterprise network infrastructure.

That compressed timeline is part of why Delaware’s decision to update in 2025, rather than in the months immediately before the midterms, looks disciplined in retrospect. It gave the state’s taskforce an actual production track record to review on October 16 instead of a theoretical one. Vendors serving other states would do well to treat that cadence, update early, audit later, as the baseline rather than the exception.

What the Review Does Not Settle

It is worth being direct about the limits of what Thursday’s session accomplished. Delaware Public Media’s report does not include a pass or fail verdict from the taskforce, nor does it list specific vulnerabilities found or fixed. It also does not name every taskforce member or confirm the manufacturers behind the ExpressVote XL and DS450 product lines. Those are open questions, and this article is not going to manufacture answers to them.

What the session does establish is that Delaware has a working, confirmed process: audit logs exist, timestamps exist, the network is restricted, and officials are willing to walk through that architecture in a public taskforce setting a few weeks before voters head to the polls. That is a meaningfully different posture than silence, which is the more common response election officials in other states have faced when the Washington Post and similar outlets have asked about federal support gaps this cycle.

Data Table: Election Technology Oversight Timeline

Year	Milestone
2000	Florida recount exposes flaws in punch-card ballot systems
2002	Help America Vote Act funds a national shift away from lever and punch-card machines
2005	Election Assistance Commission issues first Voluntary Voting System Guidelines
2016	Reports of foreign interference push states toward auditable, paper-trail systems
2020	Pandemic-driven mail voting surge raises reliance on central-count scanners
2025	Delaware updates its election software ahead of the 2026 midterms
2026	Delaware’s Election Taskforce reviews voting technology and federal compliance on October 16

Predictions: Where Election Software Audits Go Next

A few trends look likely to extend beyond Delaware’s October review, based on how election technology oversight has moved over the past several cycles.

More states will likely hold public taskforce sessions that resemble software audits rather than closed-door briefings, following Delaware’s format of walking through logging and network architecture in public.
Vendors behind systems like the ExpressVote XL and DS450 will probably face growing pressure to publish more detail about update cycles, even if full technical specifications stay restricted for security reasons.
Offline-by-default architecture, already standard in Delaware, is likely to become the expected baseline nationally rather than a differentiator, as more states respond to the same pressure that pushed Delaware toward it.
Expect continued friction between state election officials and federal agencies over support levels heading into November 2026, echoing the gap the Washington Post has already reported this cycle.
Audit logging standards will likely tighten further after the 2026 midterms conclude, regardless of the outcome, as officials look to shorten the gap between a disputed claim and a documented answer.

None of these are certainties. They are reasonable extrapolations from a pattern that has held since 2016, and Delaware’s October 16 session fits that pattern closely enough to make the extrapolation worth stating plainly.

Why This Story Matters Beyond Delaware

Delaware is a small state, and its election infrastructure will never carry the national weight of a swing state’s systems. But small states often move first on governance questions precisely because the stakes of getting it wrong are lower, which makes them useful test cases for the rest of the country. A taskforce review that confirms working audit logs, restricted networks, and a disciplined update cycle is a template other states can borrow, whether or not they ever cite Delaware by name.

It is also a reminder that the most consequential software decisions in American elections are rarely about flashy new technology. They are about logging, timestamps, and who gets to touch a system and when, the unglamorous plumbing that every other piece of election security coverage tends to skip past in favor of more dramatic claims about hacking and foreign interference.

Frequently Asked Questions

What did Delaware’s Election Taskforce review on October 16, 2026?
The taskforce reviewed how the state’s voter technology functions and whether it complies with federal systems requirements, focusing on the ExpressVote XL polling-place machines and the DS450 central scanning units, according to Delaware Public Media.

What is the ExpressVote XL used for in Delaware?
It is the machine Delaware voters use at polling places to mark and cast ballots. Delaware Public Media’s report confirms it is used statewide but does not detail its internal specifications.

What does the DS450 do?
The DS450 is used for high-speed central scanning of mail-in ballots and for recounts, processing ballots in bulk rather than one at a time.

Did Delaware find problems with its voting software?
Delaware Public Media’s report does not state that the taskforce found specific problems. The session focused on confirming audit logging, timestamps, and network restrictions following the state’s 2025 software update.

Why does Delaware keep its voting software offline?
Officials restrict network access and block unknown applications to reduce the systems’ exposure to remote attacks, a standard security practice also used in general-purpose endpoint protection tools.

Who is Tolan and what did they say about the audit logs?
Tolan is quoted by Delaware Public Media discussing the state’s election systems, saying “In each individual system, there’s audit logs” and that those logs show “what’s been done, who’s done what, or made changes.” The report does not confirm Tolan’s full title or role.

When did Delaware last update its voting software?
Delaware updated its voting software in 2025, ahead of the 2026 midterm election cycle.

Are other states reviewing their voting technology the same way?
Coverage from outlets including StateTech Magazine and StateScoop shows other states are also examining their election technology ahead of the 2026 midterms, though specific review formats vary by state.

Delaware Audits 2025 Voting Software Before Midterms [2026]