An association of state officials has published an open letter that seeks to strengthen public confidence in the electoral process, in light of research that has raised questions about the security of voting machines.
The National Association of Secretaries of State's (NASS) letter calls on Congress to avoid using political rhetoric or proposing legislation that may damage confidence in the election systems. State officials are “working overtime to help the public understand the components of our election process and some of the built-in safeguards that exist,” the letter stated. “Voting systems are spread out in a highly-decentralized structure covering more than 9,000 election jurisdictions and hundreds of thousands of polling locations.”
Despite NASS's argument that the decentralized structure of election systems creates added security, a series of reports on voting machine infrastructure suggests another view. In an email to SCMagazine.com, James Scott, senior fellow at the Institute for Critical Infrastructure Technology (ICIT), noted that the lack of a centralized system creates added risks. “The lack of a National system just means that some states manage secure election systems while others lack the resources or expertise to do so,” he wrote. “An attacker only needs to compromise the results of one or two pivotal states in order to alter the results of the election.”
Indeed, a recent report by the Brennan Center for Justice titled “America's Voting Machines at Risk” highlighted several local areas that provide case studies the risk of vulnerabilities in swing states. The report, written by Brennan Center deputy director of the democracy program Lawrence Norden and voting rights researcher Christopher Famighetti warned of series flaws in Los Angeles County; Travis County, Texas; and Denver.
There could be potentially damaging cybersecurity risks to the upcoming US election process, according to Michael Patterson, founder and CEO of Plixer. He noted in an email to SCMagazine.com that while not all states use Direct Recording Electronic (DRE) voting machines, “many do.”
Patterson noted that the devices could be vulnerable to hackers or malware if connected to the Internet and could allow an attacker to alter vote tallies or launch denial-of-service attacks that would render voting impossible. “Either scenario would be unprecedented and without clear remediation action plans, the outcome of the election would be left very much in doubt,” he wrote.
While the association noted that voting machines are standalone and do not connect to the Internet, ICIT's James Scott wrote to SCMagazine.com that the “soundbite tossed around by defensive election officials is that voting machines are not connected to the internet” is not always accurate.
Scott is a co-author of ICIT's “Hacking Elections is Easy!” research series. He noted that individual machines could be connected to the device of a volunteer at the Judge's Booth Controller (JBC), which may have an active connection. He also wrote that “air-gapped local level machines may be infected via a poisoned vendor update that is installed on the machine by a trusted vendor.”
The focus on local vs. centralized systems underscores a simmering debate between state and federal officials. Last month, Homeland Security Secretary Jeh Johnson said DHS would assist state voting systems by providing inspection of state systems for vulnerabilities or potential exploit methods. Some state officials have been reluctant to accept assistance from DHS, signaling that the offer may be a covert federal power grab.
Georgia has relied on state officials to secure election machine systems. Georgia's Secretary of State said last month that designating voting machines as critical infrastructure would be “vast federal overreach.”
The NASS letter voices these concerns, noting that “members have raised questions about how it would be possible to maintain public confidence in our elections, which are built on transparency and public access, if they are intermingled with national security agencies that understandably depend upon secrecy in their function.”
Plixer director of IT and services Thomas Pore told SCMagazine.com that “no code is infallible.” A vulnerability or exploit “could come out close to the election or even after the election” that could raise questions about election results. “There is no question that state sponsored actors may be motivated for economic or even political gains,” he said.
