Hack the vote: terrifying film shows how vulnerable US elections are
Even as much of America grinds to a halt, coronavirus has yet to derail the date of the 2020 election. Which introduces a perhaps underestimated terror, as explained in one of the more deceptively scary documentaries to drop in recent weeks: the vulnerable voting machine. That seemingly benign piece of equipment – the hardware of American democracy – is, as several experts explain in HBO’s Kill Chain: The Cyber War on America’s Elections, nothing more than an obsolete computer. And these machines’ vulnerabilities to hacking are “terrifying”, Sarah Teale, codirector along with Simon Ardizzone and Russell Michaels, told the Guardian. America’s current election infrastructure is, as Kill Chain explains, a prescription for disaster – an outdated, willfully naive system no more prepared for attack than four years ago.
Like After Truth: Disinformation and the Cost of Fake News, another HBO documentary which premiered last week and focused on the threat of disinformation on American democracy, Kill Chain re-examines foreign interference in the 2016 election with critical and scientific distance. The film follows the liabilities of the American democratic system even further than fake news, to its basic infrastructure: the machines in poll booths across the country, the very method through which votes are tallied, the databases in which voter data – name, address, eligibility – are stored.
The process of voting in the United States is idiosyncratic and often chaotic, but no matter how each polling station is managed, the vast majority rely on electronic machines produced by three companies with removable hardware such as USB flash drives or memory cards. Individual incidences of alleged voting malpractice – for example, the purge of 340,000 voters, mostly people of color, from the Georgia rolls in 2018 – are thus part of a pattern of election vulnerabilities across the country known in cyberwarfare as a kill chain, as the voting security expert and veteran hacker Harri Hursti explains in the film. Most Americans vaguely know of Russian interference in 2016, but Kill Chain offers forensics on specific events in this pattern: the scanning and examining of state election registration databases; the hacking of the Election Assistance Commission, in which an unknown Russian actor accessed and sold information from a federal database on election technology throughout the country. Teale interviews a young man in India known online as “Cyberzeist”, who hacked into an Alaskan election website in 2016 and claimed to be able to alter votes and voter data.
Hursti, who is originally from Finland, has been studying weaknesses in the American election system for more than 15 years. He first appeared on HBO in 2006, in Teale’s documentary Hacking Democracy; in a clip replayed in Kill Chain, a young and somewhat smug Hursti shocks the supervisor of elections in Leon county, Florida, when he easily hacks the county’s Di
ebold voting machine with just a tampered memory card. Hursti realized then that “this is way worse than I would’ve ever believed”, he told the Guardian. But 15 years later, little has changed; the Diebold machines are still in use in 20 states. “If somebody would try to explain to me everything I have seen and experienced and learned myself, I wouldn’t believe it,” Hursti said, characterizing America’s election infrastructure as “ridiculously broken”.
“We started pitching this film [in 2016] because nothing has really changed since 2005,” Teale said. Back then, the machines’ producers brushed off criticism as slander. But in 2017, Hursti could purchase an AccuVote TSx, one of the most common machines in the country, from an Ohio warehouse for $225 to test its hackability. The machine became part of the
Voting Village, an initiative Hursti coleads at the hacker conference DefCon, in which participants can attempt to hack various models of voting machines in use in the United States. In 2019’s conference, all were found to be easily hackable.
“Adversaries are fast to adapt,” said Hursti, who laid out the underlying issue as one of pace: “If you take the most magnificent hack you can imagine today – six months down the road, it is just a good hack. And two years later, it’s just average.” Voting machines, meanwhile, are kept in service for decades; a new “secure” batch purchased for $107m by the state of Georgia came installed with dead-on-arrival Windows 7, said Hursti, “so you see how hopelessly this conversation is outdated”. And until recently, there were no cybersecurity experts on staff at the machines’ manufacturers, an oversight Teale called “mind-blowing”.
“I hope ordinary Americans will come to the understanding that if any part of the election was connected to the internet it is vulnerable, and that these machines are vulnerable to hacking,” said Teale. Both Teale and Hursti are concerned with recent confidence in new measures such as ballot-marking machines or individual bar codes – both of which put yet another computer, and thus another hacking vulnerability, between the voter and the vote. “If they cannot see how they voted, if there isn’t a piece of paper with that clearly on it, it can be changed,” said Teale.
But Kill Chain also offers some areas of promise, especially in the form of paper ballots, which present a clear trail of evidence, and mandatory risk-limiting audits in which a random, small yet statistically significant sample of the votes are hand-counted to ensure an uncompromised process. And the film includes interviews with three senators – Democrats Amy Klobuchar of Minnesota and Mark Warner Virginia and Republican James Lankford of Oklahoma – who are awake to the vulnerabilities of America’s elections and the risk of another attack in 2020. Klobuchar and Lankford co-sponsored the Secure Elections Act, a bipartisan bill which would require states to keep back-up paper ballots and conduct the risk-limit audit. The measure has not passed Congress; the Senate majority leader, Mitch McConnell, a Republican from Kentucky, has refused to bring it to the floor, citing lack of need.
Both Teale and Hursti maintain that it’s not all reason to despair. Teale encourages insisting on paper voting at individual polling stations and advocating for mail-in ballots. And above all, said Hursti, vote. “Voting apathy is as bad a problem – nothing in this should be discouraging you to vote.”
And vote all the way down the ballot, which usually gets less attention and votes and is thus easier to rig – “that’s where the money and motivation for local adversaries are,” said Hursti. And if you really care, get involved as a poll worker. “Right now, the population of poll workers is very old and they’re not technologically savvy,” he said. “They need help.”
Even in the context of a pandemic, Teale said, Americans should wonder how we’re going to pick who will lead the country in the next crisis. “How are we going to vote in the primaries, and how are we going to vote in November?” she said. “I think we should all be pushing on our election officials to be thinking ahead.”
Kill Chain: The Cyber War on America’s elections will premiere on HBO on 26 March and in the UK at a later date