This article was originally posted at Freedom to Tinker on August 18, 2016.
State and county election officials across the country employ thousands of computers in election administration, most of them are connected (from time to time) to the internet (or exchange data cartridges with machines that are connected). In my previous post I explained how we must audit elections independently of the computers, so we can trust the results even if the computers are hacked.
Still, if state and county election computers were hacked, it would be an enormous headache and it would certainly cast a shadow on the legitimacy of the election. So, should the DHS designate election computers as “critical cyber infrastructure?”
This question betrays a fundamental misunderstanding of how computer security really works. You as an individual buy your computers and operating systems from reputable vendors (Apple, Microsoft, IBM, Google/Samsung, HP, Dell, etc.). Businesses and banks (and the Democratic National Committee, and the Republican National Committee) buy their computers and software from the same vendors. Your security, and the security of all the businesses you deal with, is improved when these hardware and software vendors build products without security bugs in them. Election administrators use computers that run Windows (or MacOS, or Linux) bought from the same vendors.