Determined hackers will crack voting machines, security researchers say
Connecting state and local government leaders
Voting Village co-founders argue the myriad vulnerabilities that exist throughout a machine's lifecycle can be easily exploited by well-resourced and creative hackers.
Most voting machine compromises would happen well before election day, according to the founders of the Voting Village, the annual event at the DefCon security conference in Las Vegas that gives security researchers a change to probe equipment for compromises.
Voting Village co-founders Harri Hursti and Matt Blaze argue the myriad of vulnerabilities that exist throughout a machine's lifecycle, such as the supply chain of parts and components, can be easily exploited by well-resourced and creative foreign intelligence agencies that have multiple tools and resources to get the necessary access.
The group has spent years tearing down what it views as harmful myths that have prevented more serious reforms in voting technology: that voting machines are not connected to the internet; that they are subject to strict chains of custody that leave no room for bad actors to get physical access; and that the Voting Village events do not accurately mirror real-world conditions and amount to publicity stunts.
Blaze said he found defenses from voting machine vendors and others "utterly baffling" and that it amounts to arguing that problems are not worth addressing until after an election is stolen. Every area of complex security research, he said, involves making some assumption about the capabilities of intruders who may try to break in. Voting machine vendors and their defenders are "essentially trying to turn around the normal standard for security" wherein major vulnerabilities that can be demonstrably identified deserve to be fixed, because eventually attackers will find a way to exploit it.
"Real adversaries will weaponize the vulnerability and figure out how to deliver it in a real environment," said Hursti. "That's not our job, our job is to tell you this is a problem we need to fix."
Blaze told reporters at a recent Washington, D.C., version of the Voting Village event that his group has reached out multiple times to major voting system vendors in an effort to address some of the vulnerabilities they've discovered, but the response has been "resounding silence."
While the Senate has proposed another tranche of $250 million for states to address vulnerabilities in voting system infrastructure, experts believe that is a relative pittance compared to what is needed to address the deficiencies in voting and election infrastructure. Further, the lack of any real mandates contrast with the House proposal, which would open up $600 million in funding to states under the condition that they purchase machines with paper ballots and implement risk-limiting audits.
Rep. Bennie Thompson (D-Miss.), chair of the House Homeland Security Committee, told reporters his committee would look to hold hearings with voting machine vendors and use its oversight powers to move the needle where it could, but he acknowledged that meaningful improvement over the status quo will require passing legislation and buy-in from Republicans.
"It's all for naught if our colleagues on the other side choose to do nothing," said Thompson.
Maggie MacAlpine, an election auditing specialist who has co-authored numerous Voting Village reports, said that more money to states without any strings could actually set baseline security back. She noted that many jurisdictions purchased their machines under the 2002 Help America Vote Act when network connectivity was not nearly as prevalent as it is today. Simply updating to newer machines could burn what few federal resources Congress has made available on equipment that carries the same security vulnerabilities but are easier to connect to the internet.
"I think it wouldn't just perpetuate what we have, I think it might make the situation much worse," she said.
A longer version of this article was first posted to FCW, a sibling site to GCN.
NEXT STORY: An identity crisis no more