Voting machines still easy prey for determined hackers

A security exercise to demonstrate voting machine vulnerabilities has captured the attention of some in Congress, but one Democratic chairman said "it's all for naught" if Republicans aren't on board.

Rep. Bennie Thompson (D-Miss.) inspects a voting machine at Voting Village in 2019. (Photo credit: Derek B. Johnson/FCW)

Rep. Bennie Thompson (D-Miss.) inspects a voting machine at Voting Village in 2019. (Photo credit: Derek B. Johnson/FCW)

Security researchers showed lawmakers and reporters how easy it is to compromise voting machines in what has become an annual event at the U.S. Capitol.

The Washington, D.C., version of the Voting Village event at the DefCon security conference in Las Vegas gives policymakers a hands-on glimpse of the technology that powers U.S. democracy. This year's report is consistent with prior exercises: virtually every machine experts can get their hands on can be easily exploited in a number of different ways.

What has changed in recent years, said Voting Village Co-founder Harri Hursti, is that the community of security researchers with first-hand experience working with these machines has grown from less than a dozen to thousands. Even though the annual event has been held for several years, fresh researchers have discovered of new vulnerabilities and attack vectors.

"In this area, it's always mind-blowing how these machines keep giving," Hursti told FCW.

The group has spent years tearing down what it views as harmful myths that have prevented more serious reforms in voting technology: that voting machines are not connected to the internet and that they are subject to strict chains of custody that leave no room for bad actors to get physical access.

One criticism that has been consistently lobbed by vendors and skeptics over the years is that the machines compromised at Voting Village events do not accurately mirror real-world conditions and amount to publicity stunts.

Hursti and co-founder Matt Blaze told FCW the issue has never been about the environment under which these machines are handled on Election Day, because most machine compromises would happen well before that. Rather, they argue the myriad of vulnerabilities that exist throughout a machine's lifecycle, such as the supply chain of parts and components, can be easily exploited by well-resourced and creative foreign intelligence agencies who have multiple tools and resources to get the necessary access.

Blaze told FCW he found that line of argument from voting machine vendors and others "utterly baffling" and that it amounts to arguing that it's not worth addressing until after an election is stolen. Every area of complex security research, he said, involves making some assumption about the capabilities of intruders who may try to break in. Voting machine vendors and their defenders are "essentially trying to turn around the normal standard for security" wherein major vulnerabilities that can be demonstrably identified deserve to be fixed, because eventually attackers will find a way to exploit it.

"The real adversary will figure it out, and real adversaries will weaponize the vulnerability and figure out how to deliver it in a real environment," said Hursti. "That's not our job, our job is to tell you this is a problem we need to fix."

Blaze told reporters that his group has reached out multiple times to major voting system vendors in an effort to address some of the vulnerabilities they've discovered but the response has been "resounding silence."

"We've certainly made sure they have copies of it and they haven't threatened to sue us, which I suppose is an improvement," he said.

A number of Democratic members of Congress stopped by to view the compromised machines, ask questions and talk to organizers about pending legislative proposals. Rep. Cedric Richmond (D-La.), who chairs the House Homeland Security Cybersecurity, Infrastructure Protection and Innovation Subcommittee, told FCW that he would like to see more pressure put on voting machine vendors to improve the security of their products.

"Sometimes if you can't get the legislation done, either holding the vendors accountable or creating potential exposure or liability for them is another way to motivate them to make sure that their stuff is a little bit better, and a lot bit better in this case," he said.

Conspicuously absent from the event were any Republican lawmakers. Some in the caucus have co-sponsored election security legislation or supported giving more money to states, but many have adopted Senate Majority Leader Mitch McConnell's (R-Ky.) view that the proposals on the table right now represent partisan power grabs by congressional Democrats and argue they would not improve security.

While the Senate has proposed another tranche of $250 million for states, experts believe that is a relative pittance compared to what is needed to address the deficiencies in voting and election infrastructure. Further, the lack of any real mandates contrast with the House proposal, which would open up $600 million in funding to states under the condition that they purchase machines with paper ballots and implement risk-limiting audits.

Rep. Bennie Thompson (D-Miss.), chair of the House Homeland Security Committee, told reporters his committee would look to hold hearings with voting machine vendors and use its oversight powers to move the needle where it could, but he acknowledged that meaningful improvement over the status quo will require passing legislation and buy-in from Republicans.

"It's all for naught if our colleagues on the other side choose to do nothing," said Thompson.

Maggie MacAlpine, an election auditing specialist who has co-authored numerous Voting Village reports, told FCW that more money to states without any strings could actually set baseline security back. She noted that many jurisdictions purchased their machines under the 2002 Help America Vote Act when network connectivity was not nearly as prevalent as it is today. Simply updating to newer machines could burn what few federal resources Congress has made available on equipment that carries the same security vulnerabilities but are easier to connect to the internet.

"I think it wouldn't just perpetuate what we have, I think it might make the situation much worse," she said.

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.