Voting open to foreign hacking
Experts warn U.S. to upgrade systems
Washington — Even as it is consumed by political fallout from Russia’s meddling in the 2016 election, Washington is still struggling to respond to what many officials see as an imminent national security threat: a network of voting systems alarmingly vulnerable to foreign attack.
As hackers abroad plot increasingly brazen and sophisticated assaults, the United States’ creaky polling stations and outdated voter registration technology are not up to the task of fighting them off, according to elections officials and independent experts.
Senior national security officials have repeatedly said that the U.S. should prepare for more foreign efforts to interfere with elections. On Tuesday, President Donald Trump’s top intelligence adviser warned a Senate committee that Russia is moving to build on its earlier efforts to interfere with U.S. elections, which included a sustained campaign of propaganda and the unleashing of cyberoperatives.
“There should be no doubt that Russia perceives its past efforts as successful and views the 2018 U.S. midterm elections as a potential target,” said Dan Coats, the director of national intelligence. The administration’s top national security officials have all warned about the Russian threat, although Trump, himself, continues to minimize it.
Elections officials are daunted by the challenge of fortifying their defenses. Many still use outdated software that has fewer security protections than a decade-old cellphone. Millions of Americans vote on easily
corruptible machines that provide no paper trail — an essential component for auditors to verify that tampering did not take place, experts say.
Although no evidence has surfaced to indicate that Russian hackers succeeded in directly tinkering with votes in 2016 — as opposed to propaganda efforts aimed at swaying public opinion — experts warn that the U.S. can’t count on that holding true next time.
“Are we going to be prepared to prevent something more egregious from happening?” said David Salvo, a resident fellow at the Alliance for Securing Democracy, a bipartisan initiative guided by some of the nation’s top national security experts. “We’re all a little skeptical.”
Congress has so far balked at providing resources to upgrade voting systems, despite the urging of some of the nation’s most influential national security voices. Many states are too broke to take up the slack. The lumbering bureaucracies charged with inoculating elections against attack don’t always talk to one another. Department of Homeland Security officials remain reluctant to share intelligence tips with the espionage neophytes on local elections boards.
“They will say, ‘We may have information, but if you don’t have proper clearance, we can’t share it,’” said California Secretary of State Alex Padilla. “Well, let’s do something about it.”
“I wish the federal government would realize the magnitude and scope of these threats and act on them,” he said.
Anxiety about the risk is shared at the highest levels of government. Secretary of State Rex Tillerson recently expressed doubt that the U.S. is any better prepared to deal with foreign election meddling now than it was two years ago. A bipartisan letter signed by a former Homeland Security secretary, CIA director and House Intelligence Committee chairman warned that failure to help local elections boards upgrade their equipment could have “catastrophic consequences.”
The warnings come as 500 elections officials in 41 states reported in a new survey by the Brennan Center for Justice at NYU Law School that the voting systems they use are more than a decade old. Many of them agree that the machines need replacing, but reported they don’t have the money to do it.
“We’re cannibalizing (voting) booths that no longer function to pull parts,” said Neal Kelley, the Orange County, Calif., registrar of voters. Kelley said he never imagined when he took the job 14 years ago that fighting off Russian hackers would become a central part of his duties.
“This is absolutely top of mind for us,” he said. At least Orange County, like all other jurisdictions in California, keeps a paper trail of votes that can be audited. Cybersecurity experts say paper — if audited properly — is ultimately the best defense against hackers. Roughly one in five voters in the U.S. casts a ballot with no such backup.
How vulnerable our elections are to tampering is a matter of dispute. Elections officials tell a concerning story. Cybersecurity experts and “white glove” hackers who have probed the machines offer an even more worrisome account.
When hackers were unleashed on 30 different voting systems at the DEF CON 25 conference in Las Vegas over the summer, every single one was penetrated. Some within minutes. In one case, a 16-yearold acting alone was able to hack into a machine in less than an hour. Some machines were compromised without a trace of evidence left behind.
“These systems are uniformly vulnerable,” said Jeremy Epstein, deputy division director for computer and network systems research at the National Science Foundation. “Any cybersecurity expert would come to that conclusion,” he said in an interview, offering his personal view, not speaking for the agency.
While Homeland Security has taken encouraging steps to confront the risk — sending teams to election districts to conduct security scans and sharing more intelligence information with the states — “anyone who thinks that is enough is not looking close enough,” he said.
“Imagine hiring someone to see how resistant your house was to burglars, and they just twisted the front doorknob to make sure it was locked,” he added, offering an analogy for the lack of thoroughness of the security tests currently being done.
Homeland Security officials take issue with such characterizations. The security training sessions and assessments they conduct are having a big impact, and new channels of communication have been opened to share threat alerts with local elections supervisors, department officials said.
“There is no question we are making real and meaningful progress,” said a statement from Jeanette Manfra, assistant secretary for the Office of Cybersecurity and Communications at the DHS.
The government’s Elections Assistance Commission has been moving aggressively to make local officials aware of the severity of the threat, prepare them to confront it and increase their access to federal intelligence. It has encouraged local officials to take part in election war games run by Harvard’s Belfer Center for Science and International Affairs, which simulate a foreign cyberattack and require officials to figure out how to keep Election Day from melting down.
It’s a stressful exercise. Participants are confronted with the prospect of their decisions leading to mass protest, aggravated by a concurrent social-media propaganda campaign launched by the hackers.
Elections officials increasingly find themselves in a job they never signed up for: information technology managers tasked with protecting some of the most sensitive computer systems in the world. Yet they don’t have the defenses of a major retailer like Target or a financial institution like Citigroup — and even those operations are getting breached.