Are You Concerned About Voting Machine Security?

What’s the story?

Voting machines are like any other computer—the older they get, the more vulnerable they become to novel cyberattacks.

In July 2019, the Senate Select Committee on Intelligence released its alarming report on “Russian efforts against election infrastructure,” which included this sentence:

“Given Russian intentions to undermine the credibility of the election process, states should take urgent steps to replace outdated and vulnerable voting systems.”

It continues: “Serious vulnerabilities…exist to this day. These vulnerabilities pose a direct and urgent threat to American democracy which demands immediate congressional action.”

Here’s what you need to know about voting security in the 2020 election.

Countable is compiling a dossier on all the issues that may affect the 2020 election, answering your questions and concerns about what to expect on Tuesday, November 3rd, 2020. We're calling the series "Foresight 2020". Check out our earlier piece on “deepfakes” and misinformation campaigns.

What happened in 2016?

• Russia launched a wave of coordinated cyberattacks against state election systems and the voting machines’ vendors. 

“Russian actors scanned databases for vulnerabilities, attempted intrusions, and in a small number of cases successfully penetrated a voter registration database,” a Senate intelligence report stated.

• The report – “Russian Targeting of Election Infrastructure During the 2016 Election” – found that at least 18 states had their election systems “targeted by Russian-affiliated cyber actors in some fashion.” A number of other states “saw suspicious or malicious behavior” that can’t be attributed to Russia.

What’s the concern for the 2020 election?

Paperless voting machines

• If Russia hacked an electronic voting machine, how would we know?
• The Senate Select Committee on Intelligence advised that states should replace outdated and vulnerable voting systems with “at minimum…a voter-verified paper trail.”
• Paper-based systems would allow voters – and election officials – to review their records.
• The Brennan Center for Justice estimates that in November 2018, “34% of all local election jurisdictions were using voting machines that were at least 10 years old as their primary polling place equipment.”
• In 2018, Congress provided $380 million for states to upgrade their voting machines, but security experts have said it’s not enough. Brennan found that “many election officials would like to replace their equipment before 2020 but do not currently have the funds to do so.”

E-pollbooks

• The electronic poll book is a computer system poll workers use to check people in on Election Day and verify their eligibility.
• The Mueller report claimed that Russian hackers successfully installed malware inside VR Systems’ e-pollbook system, using it to launch phishing attacks against state and local governments.
• Nearly half of all voters in 2016 signed in at their polling place using an e-pollbook, according to federal data.
• Because these e-pollbooks are connected to the Internet they’re vulnerable to a cyberattack. And as NPR notes:

“Unlike with equipment used to cast and count ballots, there are no federal regulations or even voluntary guidelines for how these machines need to work or how secure they need to be.”

What’s the worst-case scenario?

• A foreign power, or foreign actors, change voters’ ballots, throwing results in key races and causing the American electorate to question the veracity of all election results. Without a paper-trail, auditing the election results, and verifying the total, would be near impossible.
• Similarly, e-pollbooks could be hacked and people removed from the voting registry, denying them a vote on Election Day.

What are states doing?

• Nearly half of the states that used paperless voting machines in 2016 will replace their machines by the 2020 elections.

• California has approved plans to create an Office of Elections Cybersecurity that will address cyber threats to the state’s voting systems and flag social media posts spreading false information about the electoral process.

What is Congress doing?

• The Protecting American Votes and Elections Act would require that all state and local elections produce voter-verified paper ballots that can be cross-referenced. For all federal elections – contested or not - state and local governments would be required to conduct audits comparing digital ballots to a random selection of paper ballots.
• The Securing America’s Federal Elections (SAFE) Act contains a package of legislative reforms intended to modernize U.S. election infrastructure and improve its security against hacking. Among its measures, it would mandate the use of voter-verified ballots and authorize $600 million to update outdated election equipment. A detailed breakdown of its various provisions can be found below.
• The Defending the Integrity of Voting Systems Act would make it a federal crime to hack voting systems used in a federal election and allow the Dept. of Justice to pursue federal charges against anyone accused of such crimes. It was sponsored by Sens. Richard Blumenthal (D-CT) and Lindsey Graham (R-SC).
• The Defending Elections against Trolls from Enemy Regimes (DETER) Act  would make foreign nationals who engage in or seek to engage in improper interference with a U.S. election ineligible for admission or deportable. It was reintroduced by Sens. Dick Durbin (D-IL) and Lindsey Graham (R-SC) after passing the Judiciary Committee during the last Congress.
• Graham, Chairman of the Senate Judiciary Committee, said the bills were:

“A step in the right direction, but by no means a comprehensive solution to the problems we face with hacking and attacking our election systems.”

What is the government doing?

• The Department of Homeland Security (DHS) launched a National Risk Management Center in August 2018.
• The center is intended to protect the nation’s banks, energy companies, and other critical infrastructure from potentially crippling cyberattacks. Different industries will work with DHS and other agencies to identify and prioritize cyber-risks to critical national functions, like the financial system or power grid.

What do you think?

Roughly 16 million Americans are expected to cast votes that leave no paper record on November 3rd, 2020. Are you concerned about election security? Take action and tell your reps, then share your thoughts below.

—Josh Herman