The Virginia State Board of Elections has belatedly decided that all electronic touchscreen voting machines still in use throughout the commonwealth cannot be used for the Nov. 7 general election because they are vulnerable to hacking, even though they are not connected to the internet. This revelation is not new. For more than a decade, computer scientists at Princeton, Johns Hopkins, and other top universities have demonstrated that hackers can surreptitiously change votes on these machines without leaving a trace. In 2005, Finnish computer programmer Harri Hursti successfully hacked into Diebold voting machines that were in a locked warehouse in Leon County, Fla., under the watchful eyes of elections officials, a feat still referred to today as the Hursti Hack. But it took another demonstration of successful hacking at the DEFcon cybersecurity conference in Las Vegas this summer to finally convince board members that they needed to immediately decertify all touchscreen voting machines still in use in Virginia. Better late than never, as the old saying goes, but that left 22 cities and counties that still use them to tabulate election results in the lurch. Decertification should have happened years ago.
A September 2016 report titled “Hacking Elections Is Easy!” by the Institute for Critical Infrastructure Technology concluded that electronic voting machines are not secure. “Despite proven vulnerabilities and a demonstrative lack of security, manufacturers and officials have not improved e-voting systems,” the report stated.
After the contested 2000 presidential election in which “hanging chads” became a household term, Congress passed the Help America Vote Act of 2002, which authorized $3.5 billion to help states modernize their voting systems through fiscal year 2016.
Unfortunately, most states—including Virginia—used the federal money to purchase direct recording electronic (DRE) voting machines that were vulnerable to tampering. And without a paper trail to check against the electronic vote totals, no recount could be done.