Voting machines still easy prey for determined hackers

Rep. Bennie Thompson (D-Miss.) inspects a voting machine at Voting Village in 2019. (Photo credit: Derek B. Johnson/FCW)

Security researchers showed lawmakers and reporters how easy it is to compromise voting machines in what has become an annual event at the U.S. Capitol.

The Washington, D.C., version of the Voting Village event at the DefCon security conference in Las Vegas gives policymakers a hands-on glimpse of the technology that powers U.S. democracy. This year's report is consistent with prior exercises: virtually every machine experts can get their hands on can be easily exploited in a number of different ways.

What has changed in recent years, said Voting Village Co-founder Harri Hursti, is that the community of security researchers with first-hand experience working with these machines has grown from less than a dozen to thousands. Even though the annual event has been held for several years, fresh researchers have discovered of new vulnerabilities and attack vectors.

"In this area, it's always mind-blowing how these machines keep giving," Hursti told FCW.

The group has spent years tearing down what it views as harmful myths that have prevented more serious reforms in voting technology: that voting machines are not connected to the internet and that they are subject to strict chains of custody that leave no room for bad actors to get physical access.

One criticism that has been consistently lobbed by vendors and skeptics over the years is that the machines compromised at Voting Village events do not accurately mirror real-world conditions and amount to publicity stunts.

Hursti and co-founder Matt Blaze told FCW the issue has never been about the environment under which these machines are handled on Election Day, because most machine compromises would happen well before that. Rather, they argue the myriad of vulnerabilities that exist throughout a machine's lifecycle, such as the supply chain of parts and components, can be easily exploited by well-resourced and creative foreign intelligence agencies who have multiple tools and resources to get the necessary access.

Blaze told FCW he found that line of argument from voting machine vendors and others "utterly baffling" and that it amounts to arguing that it's not worth addressing until after an election is stolen. Every area of complex security research, he said, involves making some assumption about the capabilities of intruders who may try to break in. Voting machine vendors and their defenders are "essentially trying to turn around the normal standard for security" wherein major vulnerabilities that can be demonstrably identified deserve to be fixed, because eventually attackers will find a way to exploit it.

"The real adversary will figure it out, and real adversaries will weaponize the vulnerability and figure out how to deliver it in a real environment," said Hursti. "That's not our job, our job is to tell you this is a problem we need to fix."

Blaze told reporters that his group has reached out multiple times to major voting system vendors in an effort to address some of the vulnerabilities they've discovered but the response has been "resounding silence."

"We've certainly made sure they have copies of it and they haven't threatened to sue us, which I suppose is an improvement," he said.

A number of Democratic members of Congress stopped by to view the compromised machines, ask questions and talk to organizers about pending legislative proposals. Rep. Cedric Richmond (D-La.), who chairs the House Homeland Security Cybersecurity, Infrastructure Protection and Innovation Subcommittee, told FCW that he would like to see more pressure put on voting machine vendors to improve the security of their products.

"Sometimes if you can't get the legislation done, either holding the vendors accountable or creating potential exposure or liability for them is another way to motivate them to make sure that their stuff is a little bit better, and a lot bit better in this case," he said.

Conspicuously absent from the event were any Republican lawmakers. Some in the caucus have co-sponsored election security legislation or supported giving more money to states, but many have adopted Senate Majority Leader Mitch McConnell's (R-Ky.) view that the proposals on the table right now represent partisan power grabs by congressional Democrats and argue they would not improve security.

While the Senate has proposed another tranche of $250 million for states, experts believe that is a relative pittance compared to what is needed to address the deficiencies in voting and election infrastructure. Further, the lack of any real mandates contrast with the House proposal, which would open up $600 million in funding to states under the condition that they purchase machines with paper ballots and implement risk-limiting audits.

Rep. Bennie Thompson (D-Miss.), chair of the House Homeland Security Committee, told reporters his committee would look to hold hearings with voting machine vendors and use its oversight powers to move the needle where it could, but he acknowledged that meaningful improvement over the status quo will require passing legislation and buy-in from Republicans.

"It's all for naught if our colleagues on the other side choose to do nothing," said Thompson.

Maggie MacAlpine, an election auditing specialist who has co-authored numerous Voting Village reports, told FCW that more money to states without any strings could actually set baseline security back. She noted that many jurisdictions purchased their machines under the 2002 Help America Vote Act when network connectivity was not nearly as prevalent as it is today. Simply updating to newer machines could burn what few federal resources Congress has made available on equipment that carries the same security vulnerabilities but are easier to connect to the internet.

"I think it wouldn't just perpetuate what we have, I think it might make the situation much worse," she said.