Expert hacks voting devices
ATLANTA — A rapt audience watched as professor Alex Halderman, an expert on electronic voting machines, changed votes in a hypothetical election before their eyes.
At a demonstration this week, Halderman showed how to rig an election by infecting voting machines with malware that guaranteed a candidate would always win.
Four people from the audience voted on the same kind of touch-screen machines used in real Georgia elections, casting ballots for either President George Washington or Benedict Arnold, the Revolutionary War general who defected to the British. Despite a 2-2 split in this election test run, the voting machine’s results showed Arnold won 3-1.
Halderman’s hack is a warning to Georgia, one of five states that relies entirely on electronic voting machines without an independent paper backup. Nationwide, 31 states use direct-recording electronic devices on Election Day to some extent.
“Voting is not as safe as it needs to be,” Halderman, a computer science professor at the University of Michigan, said. “The safest technology is to have voters vote on a piece of paper.”
The upcoming May 22 primary elections will continue to use these touch-screen machines, but state legislators are considering switching to a voting system with a paper record for accuracy, possibly in time for the 2020 presidential election.
There’s no evidence Georgia’s election systems have been affected. But Halderman said it’s only a matter of time before foreign countries such as China, Iran, North Korea or Russia try to undermine elections by penetrating voting infrastructure in the U.S.
Russian hackers already attempted to interfere with the 2016 presidential campaign by targeting election systems in 21 states, the U.S. Department of Homeland Security said in August 2016. Georgia wasn’t one of those states. In addition, 13 Russians were charged this year on allegations they tried to influence the election through social media propaganda.
For Halderman’s demonstration, he wrote a program to alter the results of elections recorded by AccuVote touch-screen voting machines. He installed that program on a rectangular memory card that fits into the side of the machine, allowing the card to infect the machine.
If a hacker penetrated the state’s computer servers, a similar malicious program could be copied to memory cards used for each of the 27,000 voting machines across the state, Halderman said. No one would ever know the results had been changed if the hacker wrote the program to erase itself after the election.
Candice Broce, a spokeswoman for Georgia Secretary of State Brian Kemp, said Halderman’s concerns are addressed by state law, regulations and security procedures. State election systems use data encryption and aren’t connected to the internet.
“We are prepared,” Broce said. “There are logical and physical safeguards in place for each aspect of the voting system. Halderman would be unable to replicate this outcome in Georgia’s current security environment.”