In a gloomy report this week in the New York Times Magazine, a host of computer security experts argued that voting machine hacking is a disaster in waiting. The confidence of manufacturers and voting authorities, they said, masks deep vulnerabilities — a combination of user error, poorly designed systems and the fact that no system, however vetted, is necessarily safe from competent intruders.
Hacking the voting infrastructure isn’t a theoretical concern. The Associated Press reported that hackers, believed to be working for Russia, unsuccessfully attempted to access the election-related computer systems of 21 states before the 2016 election.
Most election systems are supposed to be air-gapped, or disconnected entirely from the internet. According to the experts who spoke to the Times, it offers a false sense of security. Malicious outsiders could intercept the phone signal that accesses the machines via a modem, for example, in order to install malware or tamper with the results. Published research from earlier this month showed that air-gapped machines can, in fact, be hacked by a couple of different methods using malware that signals through magnetic fields.
A piece from the Lawfare blog Friday pointed out that tampering doesn’t even necessarily have to happen to votes themselves: Targeted voter de-registration in contentious districts through hacking could be enough to sway the results without raising any major red flags. Lawfare points out it is possible to make systems more robust by saving results to append-only media, like a rewritable DVD, to make it harder to hide traces of tampering.
But intruders wouldn’t need to successfully disrupt an election to sow chaos. Once the possibility enters the public consciousness, or a few failed attempts are detected, losing candidates could start to invoke it to delegitimize the results of any election. After the 2016 election, Donald Trump falsely claimed that voter fraud cost him millions of votes.
Sometimes, simply injecting the possibility of doubt is enough to destabilize a system.
