Hacking Voting Systems: A Reality Check

Can the national election really be hacked? Anything is possible, but the likelihood of votes being changed is far lower than other methods of thwarting a fair and complete vote. First, we need to clarify the word "hacked." If you’re hacking the vote, what are you trying to achieve?

An attacker might try to influence the outcome of the voting process by compromising voting machines — something that’s improbable but not impossible. It would also be an extremely costly, high-risk, and incredibly complicated endeavor that would have to be executed flawlessly without detection within a very short window.

However, we’re not out of the woods. Attackers have lower-risk, lower-cost ways to influence the outcome of an election than trying to rewire voting machines to change votes.

Let’s have a look at what it would take to hack the vote, and then consider the other possibilities.

Current US Voting Infrastructure
Most voting technology in use today is either fundamentally paper-based or uses a paper backup to direct recording electronic (DRE) systems. Doing a bit of research, one can learn that about 14% of electoral votes are in swing states where some percentage of voting machines are DRE without a paper backup — specifically Florida, Virginia, and Pennsylvania. But even in those cases, some paper ballots and DRE with paper backups are in use. Only one state, Louisiana (which has eight electoral votes), uses DRE with no paper backup at all. This means that irregularities in vote counts, either by compromising the voting machine or election management software (the "back end" to voting machines), would be recognized in spot checks or manual verification counts, which many states still perform.

Hacking into Voting Machines
Physical access to a voting machine is usually needed to compromise it. Replacing a chip in a voting machine with "seven minutes and a screwdriver" has been demonstrated, but from the practical perspective of an attacker, the number of machines and types of machines would be prohibitive to meaningful subversion.

As of this writing, there are over a dozen voting machine manufactures worldwide, each having multiple versions of multiple products. A broad compromise of the voting system would require a large number of different compromises being developed for each version of each vendor product in use, and then having a person with a screwdriver and seven minutes to get to a critical mass of them.

The devices themselves could be better (e.g., meeting FIPS standards for the physical security of critical cryptographic devices) but in the context of Election Day, the physical security of voting systems is very tight and the machines are protected with tamper-detecting seals. The cost, logistics, and risk of failure are very high. And then there's getting all your cronies to keep their mouths shut about it — and good luck there.

So the voting process is safe and sound, right? 

Not exactly.

Is Democratic Doomsday a Possibility?
If I were somehow swayed by a mind-control device to develop a strategy for hacking the vote, my approach would be to disrupt voting in the swing states and other key voting areas by compromising online voter databases well before the election. Federal law requiring voter records to be unified online actually make this easier for an attacker because there's only one place to go per state (for instance, California's VoteCal system).

Ponder what would happen if an attacker were able to separate physical signatures from the voter records. Or perhaps randomly scramble the last six digits of someone's Social Security number. Or mark a significant number of voters as deceased. Or some combination of the above tactics, along with others.

If done too broadly, this would cause pandemonium at a voting site. But with the right amount and consistency, blame could land on bad administration or voters who misregistered. By invalidating the ability for my opponent's voters to cast their ballots, I could significantly and broadly disrupt voting and their overall voting count. Let's face it...have you logged in to verify that all your voter registration data is correct?

So, is the esoteric scenario of foreign agents infiltrating voting sites nationwide in the first hours of Election Day a probability? No.

Is our voting system safe? Also no.

We're not on the brink of democracy's digital implosion, but we have a lot of work left to do. In any case, it's about much more than just the voting machines, so let's not get myopic and lose track of the bigger picture.

Related Content: