After Election Day two years ago, one thing became clear: foreign powers, notably Russia, had attempted to interfere in the American democratic process. They used various methods, and had varying degrees of success. Whether those efforts had a decisive impact is less certain. But such a brazen assault on U.S. elections by an adversarial nation left many Americans worrying: Can our elections be hacked?
The short answer to that question is, mostly likely, yes. But the longer answer concerns not just if voting machines can be compromised, but also how fear itself can work to undermine American democracy.
There’s more than one way to “hack” an election. There are misinformation campaigns, in which platforms like Facebook and Twitter are used to spread propaganda or sow discord among already-polarized Americans. Then there’s “real” hacking, wherein sophisticated actors target our actual election infrastructure, like voting machines, voter databases and state election websites. Nearly 8 out of 10 Americans are at least somewhat concerned about this sort of hacking, according to a poll conducted by the University of Chicago Harris School of Public Policy and the AP-NORC Center for Public Affairs Research. Imagine waking up the day after Election Day to find that voting tallies in key states can’t be trusted — and there’s no established “redo” process. It’s unclear how Americans’ faith in the electoral system would recover.
The fretting is not unfounded, as our voting systems have been targeted before. In the months before the 2016 presidential election, Russian agents probed the defenses of 21 state electoral systems, according to the Department of Homeland Security, while at least one U.S. voting software supplier, likely VR Systems, was targeted by Russian military intelligence, according to a classified NSA report obtained by The Intercept. The Russians reported successfully penetrated a number of states’ systems, including the Illinois voter registration system; DHS officials said that no records were actually changed.
Officials have since been working to strengthen the defenses of state election infrastructure. Many states upgraded their electoral databases and replaced voting machines seen as vulnerable to hacking. The Department of Homeland Security has conducted detailed vulnerability assessments of several state election systems and granted federal security clearances to many state elections officials, which can help them stay aware of the latest threat intelligence. This past March, Congress allocated $380 million to help states upgrade their voting systems.
Still, some say the efforts have not gone far enough. “Unfortunately, although we’ve made progress, the baseline was so bad in terms of the security of election infrastructure that we’ve got a very long way to go before we can say that our system is well-secured,” says Alex Halderman, a computer science professor at the University of Michigan.
At a recent hacking conference, he demonstrated how an attacker could compromise a computer in an election office, then use it to spread malicious software to a voting machine. On Election Day, the infected voting machine would quietly tally phony votes, all without ever being connected to the Internet. (Dominion Voting and ES&S, two voting machine manufacturers reached for comment, said they continue to support the secure use of their systems. Dominion said that one of the models Halderman hacked, the AccuVote TS and TSX, remains certified for use by the U.S. Election Assistance Commission.)
When it comes to protecting voting machines, experts have two main suggestions. First, they say states should move away from touchscreen direct-recording electronic (DRE) machines that don’t leave an un-hackable paper backup. Second, states should implement audits to ensure the validity of vote counts. Post-election auditors could examine randomly sampled paper ballots, either filled out by hand on Election Day, or printed and verified by voters using touchscreen voting machines. To deliver a statistically significant result, the number of ballots sampled would be determined by a mathematical formula based on the winner’s margin of victory. Paper ballots, experts say, remain hacker-resistant, when there is no paper trail, there is no way to definitively find out if an election has been hacked or not.
While some states have moved forward with these or similar suggestions, efforts to encourage change at the national level have not succeeded, in part because states run their own elections and tend to resist anything that looks like federal interference. In 2003, U.S. Representative Rush Holt (D-N.J.) introduced an ultimately unsuccessful provision that would have mandated manual random auditing and required all voting machines to produce a voter-verifiable paper trail. A similar effort in 2005 also failed after a lobbying effort on the part of voting-machine vendors. More failed attempts were made in 2007 and 2009.
More recently, the Secure Elections Act, a bipartisan bill co-sponsored by Senators James Lankford (R-O.K.) and Amy Klobuchar (D-M.N. (among others), gained traction following President Donald Trump’s press conference with Russian President Vladimir Putin. The proposed law would authorize the Department of Homeland Security to award grants for states to fix their cybersecurity vulnerabilities, replace at-risk voting machines and conduct post-election audits. But even this bill is being watered down amid state resistance to federal requirements. “We have folks that call in and say ‘I know you’re not trying to do mandates, but this looks like a mandate,’” says Lankford. The latest version would permit audits to be conducted by examining electronic ballot images instead of the paper ballots themselves — but those images are themselves subject to manipulation by hackers, and experts say the change undermines the auditing process.
Experts say new security measures can take years to implement — meaning we’ll still be facing the threat of election hacking well into the next decade, even if we act now. And that’s a problem. Elections can be close contests, and it might only take a few manipulated vote counts in key districts to swing a result.
There are reasons, though, for malicious actors to make these forays beyond actually changing voting tallies. Discerning Moscow’s intent is difficult, says Dr. Jessica Beyer, a researcher at the University of Washington and an expert on international cybersecurity issues. But it is possible to interpret some of Russia’s broad goals. In addition to seeking to promote leaders who may ease economic sanctions and ignore Russia’s aggression in Ukraine, Beyer says Moscow’s hacking attempts may be part of an effort “to systematically undermine trust in U.S. … institutions, exploiting our own divisions to create instability.”
Dr. Alina Polyakova, a fellow specializing in Russian foreign policy at the Brookings Institution and a professor at Johns Hopkins University, says that Russia’s desire to undermine American democracy is related to its inability to match up to the military and economic power of the West. “Given that imbalance, the Russian point of view is that you don’t have to be on top, you don’t have to win,” she says. “You just have to push everyone else down a little bit.”
That Americans fear election hacking is already something of a victory — unless the worriers resolve to reaffirm their faith in the nation’s democracy and not rebel against an outcome they dislike, at least until its election system’s defenses are made stronger. For now, even just the appearance of a rigged vote could be enough to undermine our country’s civic stability. Like the value of a dollar, election results are based on trust, and without that trust, the entire system is put at risk. “Our elections are very much based on faith, in the people, in the technology, in the design of the process, and they really ought to be based on evidence,” says Halderman. Without reliable evidence, our institutions’ legitimacy could be jeopardized. For Russia and other adversarial nations, that might be just as good as getting to hand pick a President.
