Paperless voting machines are just waiting to be hacked in 2020. We are a POLITICO cybersecurity reporter and a voting security expert – ask us anything.
Intelligence officials have repeatedly warned that Russian hackers will return to plague the 2020 presidential election, but the decentralized and underfunded U.S. election system has proven difficult to secure. While disinformation and breaches of political campaigns have deservedly received widespread attention, another important aspect is the security of voting machines themselves.
Hundreds of counties still use paperless voting machines, which cybersecurity experts say are extremely dangerous because they offer no reliable way to audit their results. Experts have urged these jurisdictions to upgrade to paper-based systems, and lawmakers in Washington and many state capitals are considering requiring the use of paper. But in many states, the responsibility for replacing insecure machines rests with county election officials, most of whom have lots of competing responsibilities, little money, and even less cyber expertise.
To understand how this voting machine upgrade process is playing out nationwide, Politico surveyed the roughly 600 jurisdictions — including state and county governments — that still use paperless machines, asking them whether they planned to upgrade and what steps they had taken. The findings are stark: More than 150 counties have already said that they plan to keep their existing paperless machines or buy new ones. For various reasons — from a lack of sufficient funding to a preference for a convenient experience — America’s voting machines won’t be completely secure any time soon.
Ask us anything. (Proof)
A bit more about us:
Eric Geller is the POLITICO cybersecurity reporter behind this project. His beat includes cyber policymaking at the Office of Management and Budget and the National Security Council; American cyber diplomacy efforts at the State Department; cybercrime prosecutions at the Justice Department; and digital security research at the Commerce Department. He has also covered global malware outbreaks and states’ efforts to secure their election systems. His first day at POLITICO was June 14, 2016, when news broke of a suspected Russian government hack of the Democratic National Committee. In the months that followed, Eric contributed to POLITICO’s reporting on perhaps the most significant cybersecurity story in American history, a story that continues to evolve and resonate to this day.
Before joining POLITICO, he covered technology policy, including the debate over the FCC’s net neutrality rules and the passage of hotly contested bills like the USA Freedom Act and the Cybersecurity Information Sharing Act. He covered the Obama administration’s IT security policies in the wake of the Office of Personnel Management hack, the landmark 2015 U.S.–China agreement on commercial hacking and the high-profile encryption battle between Apple and the FBI after the San Bernardino, Calif. terrorist attack. At the height of the controversy, he interviewed then-FBI Director James Comey about his perspective on encryption.
J. Alex Halderman is Professor of Computer Science and Engineering at the University of Michigan and Director of Michigan’s Center for Computer Security and Society. He has performed numerous security evaluations of real-world voting systems, both in the U.S. and around the world. He helped conduct California’s “top-to-bottom” electronic voting systems review, the first comprehensive election cybersecurity analysis commissioned by a U.S. state. He led the first independent review of election technology in India, and he organized the first independent security audit of Estonia’s national online voting system. In 2017, he testified to the U.S. Senate Select Committee on Intelligence regarding Russian Interference in the 2016 U.S. Elections. Prof. Halderman regularly teaches computer security at the graduate and undergraduate levels. He is the creator of Security Digital Democracy, a massive, open, online course that explores the security risks—and future potential—of electronic voting and Internet voting technologies.
Update: Thanks for all the questions, everyone. We're signing off for now but will check back throughout the day to answer some more, so keep them coming. We'll also recap some of the best Q&As from here in our cybersecurity newsletter tomorrow.