North Carolina

Two weeks ago, Politico reported on a Florida-based election software company that may be unwittingly involved in election security problems in North Carolina. The company was targeted by Russian hackers in 2016 and this effort may have given the hackers remote access to a computer in Durham County that managed a voter list management tool. Now, North Carolina officials are delaying approval of new voting machines for use in the 2020 elections—due to uncertainty over the ownership of the machine suppliers in question. This underscores something that’s only recently come to the forefront of American attention: The abysmal state of election security in the United States. Many countries still use paper ballots to count votes. But in the United States, this isn’t required by law. Many states use electronic devices to count votes in elections. And their security is terrible.  At a 2018 conference, security expert Rachel Tobac showed how easily one can gain administrative access to an electronic voting machine, in-person, in under two minutes. Dozens of kids, at the same event, were likewise able to quickly gain illicit access to replica voting websites.

The Mueller report released Thursday found that Russian spies successfully hacked into a U.S. voting software company during the 2016 elections, and North Carolina officials think there’s a chance it was software that’s in use here. The N.C. Board of Elections now has sent a letter to VR Systems, whose voting software was used by 21 North Carolina counties in 2016. The letter, which was first reported by WRAL, asks the company to “provide immediate, written insurance regarding the security of your network.” The Mueller report didn’t specifically name the company. But VR Systems confirmed in a written statement that it’s the company in question. The company’s software can’t be used to count or change votes. Instead, it manages the electronic polling books used to check in voters, to make sure people don’t vote twice. The Mueller report found that “Russian cyber actors in 2016 targeted” the company, and “installed malware on the company network.” Durham County, which had numerous problems and delays in the 2016 elections, was using the company’s check-in software at the time. The Mueller report does not go into the full extent of the hacking, and while it does say at least one Florida county was hacked, the report does not name any North Carolina successes for the hackers.