In 2016, an unusual number of voters in Riverside, California, showed up at the polls during the primary and were turned away. Their registration information had been changed. Riverside County District Attorney Mike Hestrin investigated and concluded that hackers had tampered with the records of dozens of people.
Hestrin said in 2020 that federal officials confirmed his suspicion in a private conversation but told him the details were classified. A year earlier, the cybersecurity firm RiskIQ had found a flaw in the county’s voter registration lookup system that it believed could have been the source of the breach. It resembled a vulnerability that appears to have let Russian military hackers, U.S. officials told NBC News, into the voter rolls of two Florida counties. RiskIQ analysts said a similar hole may still exist in Riverside and elsewhere. They could only be sure by attempting a hack, which they were not authorized to do. The registrar’s office did not answer NBC’s requests for comment.
“I’m very concerned,” Hestrin said. “I think that our current system has numerous vulnerabilities.”
A system with no center
The trouble is partly structural. American elections are not run from one place. Balloting is often handled by county governments, which leaves a vast number of what experts call attack surfaces. Gregory Touhill, a former Homeland Security cybersecurity official, put numbers on it: “54 states and territories, over 3,000 counties, tens of thousands of precincts. The risk landscape is pretty broad.”
The Defending Digital Democracy Project at Harvard’s Belfer Center reached a similar view after six months of research. Its team visited 34 state and local election offices, observed the November 2017 elections in three states and surveyed 37 states and territories. Its conclusion: in the United States, elections are among the most complex and decentralized operations in either the public or private sector, and every state and locality is different.
Federal agencies were not sitting still in 2020. The FBI and Homeland Security said they had not seen a significant effort by Russian state actors to target election infrastructure that year, and Homeland Security’s top cybersecurity official called it the “most protected, most secure” election in American history. Experts said CISA had made unprecedented strides and that large-scale tampering with voting machines looked remote. Intelligence officials named disinformation as the main Russian threat, a shift from 2016, when operatives paired social media efforts with a hacking campaign aimed at voting systems in all 50 states.
Where the gaps were
Many state and local election websites were not covered by the “Albert sensors” that CISA uses to detect intrusions. Third-party vendors were another weak point. Government documents say Russians hacked VR Systems in 2016 to gain access in Florida; the company has disputed that its network was breached.
RiskIQ also found that many internet-exposed election systems had no protection against distributed denial of service attacks, even though Google, Cloudflare and Akamai offer free services. A DDoS attack knocked out the Knox County, Tennessee, Election Commission’s results site on election night in May 2018. Ed Amoroso, CEO of TAG Cyber and a former top IT official at AT&T, warned that attacks on several results sites at once would overwhelm internet providers. “If it goes beyond a handful, then the ISPs wouldn’t be able to handle it,” he said.
Ransomware worried experts too. Emsisoft counted at least 966 government agencies, schools and healthcare providers hit in the previous year. Tyler Technologies, a Texas company that sells software to state and local governments, disclosed its own ransomware attack the week before NBC’s report and said it was working with the FBI.
What the experts recommend
The Belfer playbook is aimed at state and local election officials and stresses that leadership matters most. Secretaries of state and election directors, it says, set the tone for whether staff treat security as a priority.
Policy ideas from experts and advocacy groups include hand-marked paper ballots read by optical scanners, a voter-verified paper audit trail, and certification rules that phase out the most vulnerable direct-recording electronic devices. Others call for risk-limiting audits, which are statistical checks done before final results are certified, along with ballot reconciliation and pre-election logic and accuracy testing. Some also want elections designated as critical infrastructure with funding for upgrades, and outside experts, including white-hat hackers, brought in for cyber assessments.
Sources
- The State and Local Election Cybersecurity Playbook
- U.S. state, local election computer networks still vulnerable to hacks
