Securing elections to preserve voting access for all Americans
Hill Street Studios/Getty Images
Connecting state and local government leaders
Compromises to voter registration databases or voting information websites could disrupt an election and call into question the accuracy or legitimacy of the outcome.
A recent Nextgov article reports that the Cybersecurity and Infrastructure Security Agency believes election officials have been largely successful in deterring cyber threats, attributing this to public-private partnerships and intrusion detection sensors. This is great news, and I applaud CISA and the industry for their work implementing detection, scanning and testing tools to deter bad actors. Yet securing the nation’s election system, including all the data generated by voting machines, is a massive undertaking. I’m particularly concerned about the link between election security and assuring voting access to all voters, including disenfranchised populations.
The electronic files that house the rolls of eligible voters are the next likely targets for the same adversaries that would target electronic voting machines. Just as politicians have tried in the past to eliminate groups of eligible voters from exercising their voting rights, the manipulation of data, such as assigned voting location or precinct, or the removal of voters from the rolls, would disrupt an election and call into question the accuracy or legitimacy of the outcome. It’s possible this would not even be detected until election day itself, by which time it would be nearly impossible to implement an effective contingency plan or response.
Voter databases are typically stored on servers managed by each county, which may not be encrypted or protected by strong security measures and access controls. CISA's tips from 2020 acknowledge the vulnerability of these systems, noting: “Voter registration databases (VRDB) are rich targets and may be an attractive target for computer intrusions. This problem is not unique to individual states—it is shared across the Nation. The keys to good cybersecurity are awareness and constant vigilance.”
In previous elections, we had our eye on nation-states. However, any bad actor, including ones hired for political purposes, could attempt to manipulate VRDB data so that certain groups of voters are declared ineligible. Or, in a less blatant but still effective exclusion tactic, websites could be compromised so that, in specific jurisdictions, they showed the wrong information about hours or locations of polling places, essentially blocking certain groups of voters, including those that have been historically marginalized, from even getting to the polls.
The time it takes to arrive at a polling location and vote is often a limiting factor in a person’s ability to participate in an election – especially if that time must be taken away from work or childcare. This is especially true in low-income and minority communities where voters may have less flexibility in their work schedules or less access to childcare. All these factors contribute to security being a vital component of protecting the integrity of the democratic process.
A federal law passed in 2019 includes a provision that should help state, county and local jurisdictions prevent website spoofing – i.e., creating a fake website to fool voters. The provision states that the “.gov” top level domain will move to CISA and be available at no or negligible cost to U.S.-based government organizations – including federal, state, local tribal or territorial government sites. The .gov domain is a trusted, secure space certified by the U.S. government, and election jurisdictions would be wise to migrate to this site. This is a good first step, and the federal government should enact additional measures that would help over-burdened state and local election officials assure and audit election-related files and websites.
I continue to advocate for additional protections to secure the files of registered and eligible voters, for voting tabulation machines that have a paper ballot backup for validation and auditability and for enhancing the processes of making the voting process easier and more available, especially in those marginalized areas where access to in-person voting is difficult. This is true in both rural and metropolitan areas where access to in-person voting locations and the time required are often weighed against time away from work and lack of accessibility.
As we’ve seen with cybersecurity overall, election security is a wide-ranging set of concerns, and everyone must play a part. I urge both election officials and individuals to become more vigilant about protecting the rights of those we count on to choose our new leaders – all of us who are eligible to vote.
NEXT STORY: Florida Digital Service scales up cyber