Are US Voting Machines Secure From Hackers?

Some key swing states have declined an offer from the Homeland Security Department to scan voting systems for hackers ahead of the presidential elections.

As suspected Russian-sponsored attackers compromise Democratic Party and other US political data allegedly to sway voter opinion, some security experts say it wouldn’t even take the resources of a foreign nation to manipulate actual votes using this country’s antiquated tallying systems.

Against this backdrop, Homeland Security Secretary Jeh Johnson during an Aug. 15 call with state election officials, offered states DHS services that can inspect voting systems for bugs and other hacker entryways. Earlier in the month, he also suggested the federal government label election systems as official US critical infrastructure, like the power grid.

But some battleground states, including Georgia and Pennsylvania, say they will rely on in-house security crews to maintain the integrity of voter data.

“The question remains whether the federal government will subvert the Constitution to achieve the goal of federalizing elections under the guise of security,” Georgia Secretary of State Brian Kemp told Nextgov in an email. “Designating voting systems or any other election system as critical infrastructure would be a vast federal overreach, the cost of which would not equally improve the security of elections in the United States.”

Georgia, where some projections show presidential contenders Hillary Clinton and Donald Trump neck and neck, reportedly could use a vote machine reboot.

“Georgia, which is running electronic-only machines—there’s no paper trail. … And the machines they’re using are more than a decade old, so the hardware is falling apart. And the operating system they’re using is Windows 2000, which hasn’t been updated for security for years, which means it’s a sitting duck,” Zeynep Tufekci, a University of North Carolina information and library science professor, told NPR on recently.  

There is no evidence ballot manipulation has ever occurred in the United States, and, per Johnson, DHS is not aware of any credible cyber-threats related to 2016 general election systems.

All the same, vote machine hacks are all the rage among researchers at Las Vegas hacker confabs.  

Even top White House tech privacy adviser Ed Felten helped demonstrate the weaknesses of digital voting booths in his previous life as a Princeton University academic. In a 2009 paper Felten co-authored, researchers commanded an AVC Advantage voting machine, the kind still deployed in Pennsylvania and other states, to steal votes. No Internet required. They altered a pretend election by inserting a malicious memory cartridge the size of a paperback book that would typically be used for recording votes. The tainted device combined snippets of authorized code inside the system to cause the unauthorized behavior.   

“An attacker who has access to the machine the night before an election can use our techniques to affect the outcome of an election by replacing the election program with another whose visible behavior is nearly indistinguishable from the legitimate program but that adds, removes or changes votes as the attacker wishes,” Felten and colleagues from Princeton, University of California at San Diego and the University of Michigan wrote in “Proceedings of the 2009 Electronic Voting Technology Workshop.”

No Recounts

Because of hacking concerns, many states are keeping a paper trail to audit the vote count, but not all. In addition to Georgia, parts of Pennsylvania, another tossup state, do not maintain paper backups in the event of a hack, Tufekci said.

Pennsylvania officials say cybersecurity experts from the commonwealth’s IT shop work closely with the state elections team to secure voting-related infrastructure. “Pennsylvania has implemented policies, technologies, best practices and procedures around the safeguarding of data and the protection of our applications, systems and resources,” Pennsylvania Department of State spokeswoman Wanda Murren said. “We constantly monitor our data and systems for vulnerabilities and attempted attacks in order to keep pace with the rapidly evolving threat landscape.”
She declined to go into specifics as a matter of policy.

A Homeland Security spokesman told Nextgov on background “several states” currently use DHS hygiene scans and assessment services for voting systems. He would not disclose the names of any jurisdictions.

Florida, where Trump has been down nine points, declined to say whether it will ask DHS to scan local voting machines but did participate in the national teleconference with Johnson.

The Florida secretary of State Department “is engaged with DHS, in addition to all of our other state and federal stakeholders, on an ongoing basis to help ensure the security and integrity of Florida elections,” department spokeswoman Meredith M. Beatrice said.

Ohio, where Clinton has a narrow advantage over Trump, appears to be taking advantage of some DHS support for election cybersecurity.

“The Ohio Department of Homeland Security is working with their federal counterparts, so we are working through them to perform the needed scans,” Ohio secretary of state spokesman Joshua Eck told Nextgov in an email.

Richard Clarke, a former National Security Council adviser under presidents Bill Clinton and both of the George Bushes, cautions it could be hard to detect a slight manipulation of voter data in some swing precincts.

“Smart malware can be programmed to switch only a small percentage of votes from what the voters intended. That may be all that is needed,” Clarke, now an ABC News consultant, commented recently.

DefenseOne

« Islamic State Members Embedded In Government
UAE Using Israeli Spy Technology »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Malwarebytes

Malwarebytes

Malwarebytes provides artificial intelligence-powered technology that stops cyberattacks before they can compromise computers and endpoints.

Engage Black

Engage Black

Engage Black provides solutions for securing and protecting cryptographic keys, data at rest, and data in motion.

ShadowDragon

ShadowDragon

ShadowDragon develops digital tools that simplify the complexities of modern investigations that involve multiple online environments and technologies.

Zerocopter

Zerocopter

Zerocopter enables you to confidently leverage the skills of the world's most knowledgable ethical hackers to secure your applications.

Elemendar

Elemendar

Elemendar Artificial Intelligence reads cyber threat reports written by humans and translates them into industry-standard, machine-readable and machine-actionable data.

iProov

iProov

iProov delivers authentication and verification simply and securely, based on a genuine one-time biometric.

International Cybersecurity Institute (ICSI)

International Cybersecurity Institute (ICSI)

ICSI is a UK company offering specialized and accredited professional qualifications in cybersecurity for young IT graduates as well as mature professionals.

Orchestra Group

Orchestra Group

Orchestra Group offer a unique integrated cybersecurity defense platform with proactive security policy management and enforcement orchestration.

MyDocSafe

MyDocSafe

MyDocSafe is an all-in-one document security and e-sign software.

stackArmor

stackArmor

stackArmor specializes in compliance and security-focused solutions delivered using our Agile Cloud Transformation (ACT) methodology.

Certo Software

Certo Software

Certo are trusted experts in mobile security. At Certo, mobile security is not an afterthought, it’s what we do.

Cerby

Cerby

Your team uses unmanageable applications that put you, your company, and your data at risk. Protect, secure, and accelerate your business automatically with Cerby.

Lab 1

Lab 1

Lab 1 turns criminal data breaches and attacks into insights. Get alerts of data breaches or ransomware attack incidents as they happen.

RB42

RB42

RB42 (formerly Nexa Technologies) provide cyber defense solutions (ComUnity, secure and encrypted messaging, detection of interception tools, etc) and cyber defense consultancy service.

Chestnut Hill Technologies (CHT)

Chestnut Hill Technologies (CHT)

CHT provide Best Practices IT Cybersecurity and Technology Solutions and Consulting Support to the Mid Cap through Fortune 1000 Nationwide.

Reco AI

Reco AI

Reco is an identity-centric SaaS security solution that empowers organizations with full visibility into every app, identity, and their actions to control risk in their SaaS ecosystem.