As various cyber-security researchers unveil claims of how electronic voting machines could be hacked, we asked, where is the election system vulnerable and what are the likely scenarios for an attack?
Hacking of voting machines has become a major concern in the US election, as supporters for both major candidates worry that the results could be skewed in vital “swing” states. Hacking, or even allegations of widespread hacking, could skew the results or undermine faith in the democratic process.
One company, Cylance, has come under fire for its claims that a particular brand of voting machine, which depends on an unencrypted internal flash card, could be hacked in mere minutes, provided the attacker had physical access to the machine.
In its video, it shows that two counters – the Public Counter and the Protective Counter – can both be manipulated to change the names of the candidates and their total vote tally.
Cylance is not the only one to express concerns about security: Symantec, the MacKeeper blog and Contrast Security among others have published research on security issues in voting machines. In total, some 278 vulnerabilities in voting machines have been uncovered.
It's not the fact that the company revealed the weaknesses in the Sequoia AVC Edge Mk1 voting machine that rankles Cylance's critics – there are hundreds of well-known vulnerabilities in many different models of voting machine – but that Cylance produced a video to publicise its claim and that it made the claim so close to the election.
Katie Moussouris, a bug-bounty expert, is quoted on The Verge, saying: “Releasing this publicly, after DHS and states have been aware of these types of attacks for years, only serves to fuel the fires of doubting the election results. This is a case of not helping security while simultaneously undermining the democratic process.”
Cylance defended the bug report, pointing out that there are old systems being used in multiple states which are “unfit for use based on simple security issues”. Meanwhile, flaws discovered by other security researchers ten years ago have still not been fixed. Cylance has withheld details of exactly how the hack works (though presumably a competent programmer could work out the details) and provided the details to both the manufacturer and election officials.
The company said, “The units in question are known to be in use in numerous polling locations across the country. According to the VerifiedVoting.org website, the DRE-Touchscreen system manufactured by Sequoia will be used by 8,170,477 registered voters in 22,368 precincts. The discovery of the exploitation this week combined with the simplicity in which it was discovered (3-4 days) and the real potential for an adversary to compromise the voting machine's integrity, compelled us to announce the research findings in advance of the 2016 elections.”
Regardless of Cylance's motivations – whether altruistic or commercial – such is the febrile atmosphere around the election that all news is weighed not on the balance of fact and fiction but how it might impact the election.
Against this backdrop and amidst claims that the Russian government is attempting to influence public opinion and perhaps even the outcome of the election, US authorities have put the world on notice that they are standing by with cyber-offensive capabilities to strike back against would-be attackers.
In September, a US congressional committee on information technology heard from experts who said that the election system was fundamentally sound despite 43 out of the 50 states using voting machines that are more than 10 years old and run on Windows CE, Windows XP, Windows 2000 (all of which Microsoft had stopped supporting by 2014), Linux and others, all of which can't be updated with anti-virus patches.
This led Bev Harris, founder of election watchdog Black Box Voting to tell SCMagazine.com, “[The federal government] seems to believe their job is to instill confidence. That's dangerous.”
There's a belief among US election officials that hacking voting machines is a non-issue because they aren't connected to the internet. The focus of their public statements on the subject appear to be aimed at reassuring the public that the integrity of the election results is not in question.