Limiting the cyber threat to elections infrastructure

Voter confidence in the integrity of elections is critical to a vibrant democracy. Recent cyberattacks by foreign state actors accompanied by disinformation campaigns aimed at U.S. voters have contributed to an erosion in the public's trust of electoral results. But there’s another set of issues just as concerning: persistent, preventable “seams” or vulnerabilities in election system tools, processes and guidelines.

E-voting machine vulnerabilities

E-voting machines are among the most prominent business technology solutions of the 21st century, yet they remain vulnerable to physical and data tampering and weaknesses in the chain of custody.

In a 2012 study, the Argonne National Laboratory's vulnerability assessment team discovered that attackers could exploit the integrity of an e-voting machine chassis with relative ease regardless of tamper-evident seals or locks. Data stored on e-voting machines was not encrypted, leaving it susceptible to interception, modification or deletion by an attacker. In the Argonne study, white-hat hackers used after-market wireless card adapters to intercept and alter communications exchanged between e-voting machines and the elections network infrastructure. The study concluded that successful tampering with just one in three voting machines is enough to change the outcome of an election.

Electronic poll books are also highly vulnerable to tampering. These electronic versions of the voter rolls are used to process voters at the polls instead of a paper-based list. Elections officials use voter registration portals to verify that a particular voter is registered and eligible to vote at the precinct in question. Attackers who defeat the portals’ cybersecurity protections can unregister voters, change their mailing addresses and deliberately misspell their names with just a few clicks. In many states, when incongruities exist in mailing addresses or the spelling of voters’ names, those ballots are flagged and disqualified for that election event. Other vulnerabilities in the portals’ design could permit attackers to wage distributed denial of service attacks against them. The result would be catastrophic. Crucial servers on the network would be overwhelmed, and election officials would be prevented from connecting to the voter registration database to verify voter eligibility.

Remedies

To increase e-voting machine protections, state election officials should utilize U.S. Elections Assistance Committee's Election Management Guidelines on physical security . These guidelines support the development of policies, procedures and processes that prescribe how county-level election officials and supporting IT staff will be trained to apply and audit e-voting machine tamper-evident seals and locks. So-called “zero reports” for voting infrastructure equipment are designed to ensure that the operating state of the machine has not changed since being received from the vendor or following retrieval from storage prior to the opening of the polls.

In addition, the EAC offers a virtual training environment for state elections personnel that focuses on promoting physical and logical cybersecurity. The EAC course materials prescribe that state elections officials and subordinate county elections offices adopt two-factor password authentication for all privileged voter registration system users, conduct real-time monitoring for unusual activity and maintain logs of all changes made online for the system. The EAC training resource is provided to state governments at no charge.

Fighting against attacks on election systems requires a collaborative approach that orchestrates people, process and technology. State Secretary of State Offices should coordinate with Certified Information Systems Auditors and the National Cybersecurity and Communications Integration Center to utilize their cybersecurity tools, assessment capabilities and incident response services. Together, prospective state election officials and their federal partners can develop a standardized methodology to manage independent, third-party security reviews and assessments of state and county voting system infrastructure environments. These assessments should focus on hardware, including tamper-detection and the response mechanism, as well as software and the supply chain process, including manufacturing and shipping to county elections offices. A key consideration for the assessment is the use of certified ethical hackers or penetration testers for any internet-facing services, such as voter registration systems and network connections. Remediation should be prioritized across host systems and the network, web application and static code as well as the voter registration enterprise database environment.

To mitigate the potential for tampering with electronic poll books, all digital data collected prior to, during and after an election event should be backed up or retained on redundant storage devices -- on the network or via network storage. Paper pollbooks can also serve as a backup to e-pollbooks.

Federal and state cooperation

The potential of cyberattacks disrupting a national or mid-term election have many election officials worried. Part of the remedy is improved partnership with the federal government to help reduce the existential threats to voting tools and processes. The Department of Homeland Security designated elections as critical infrastructure in 2018. The designation does not usurp state sovereignty on election systems; rather, it provides for assistance from DHS to audit state systems for cybersecurity vulnerabilities and more.

Ultimately, by increasing understanding of election system cybersecurity vulnerabilities, recruiting and training IT staff on how to identify and mitigate these vulnerabilities and working in a collaborative partnership with DHS and EAC, state and county election officials can help increase citizen confidence and improve the integrity of the American electronic voting process.