Verified Voting Blog

This blog contains posts authored by the Verified Voting Team and by members of the Verified Voting Board of Advisors.

Verified Voting Blog: American elections are too easy to hack. We must take action now. | Bruce Schneier/The Guardian

This article was published by The Guardian on April 18, 2018Bruce Schneier is a fellow and lecturer at Harvard Kennedy School and is on the advisory board of Verified Voting.

Elections serve two purposes. The first, and obvious, purpose is to accurately choose the winner. But the second is equally important: to convince the loser. To the extent that an election system is not transparently and auditably accurate, it fails in that second purpose. Our election systems are failing, and we need to fix them.

Today, we conduct our elections on computers. Our registration lists are in computer databases. We vote on computerized voting machines. And our tabulation and reporting is done on computers. We do this for a lot of good reasons, but a side effect is that elections now have all the insecurities inherent in computers. The only way to reliably protect elections from both malice and accident is to use something that is not hackable or unreliable at scale; the best way to do that is to back up as much of the system as possible with paper.

Recently, there have been two graphic demonstrations of how bad our computerized voting system is. In 2007, the states of California and Ohio conducted audits of their electronic voting machines. Expert review teams found exploitable vulnerabilities in almost every component they examined. The researchers were able to undetectably alter vote tallies, erase audit logs, and load malware on to the systems. Some of their attacks could be implemented by a single individual with no greater access than a normal poll worker; others could be done remotely.

Full Article: American elections are too easy to hack. We must take action now | Bruce Schneier | Opinion | The Guardian.

Verified Voting Blog: Verified Voting Hacks into Voting Machine in New Video from the New York Times

Demonstration Shows Vulnerability of Voting Machines With No Paper Backup

The New York Times published an interactive piece on election security today that included a video featuring Verified Voting fellow, Alex Halderman. The piece, “I Hacked an Election. So Can the Russians,” was the result of a months-long collaboration between Verified Voting and the New York Times.

How Will My Vote Be Counted?

“Alex Halderman, along with the New York Times, successfully demonstrated how vulnerable these voting machines can be,” said Marian K. Schneider, president of Verified Voting. “We want people to understand in a visual way how something like this might happen. Although it is only a risk and not a certainty that something like this could occur, we need to be prepared and able to recover. These machines don’t allow us to do that. It’s time we prepare to monitor, detect, respond and recover from any potential attacks that undermine our democracy.”

“All cyber security experts who have given electronic voting machines any thought agree, these machines have got to go,” said Alex Halderman in the video. “Paper plus audits; all elections should be done this way,”

During the four-minute video, Alex Halderman demonstrates how to hack into electronic voting machines while holding a mock election at the University of Michigan. After students were asked to choose between their own university and rival Ohio State, Alex is able to manipulate the vote causing Ohio State to win.

The demonstration shows voting machines’ vulnerability and why using paper ballots and implementing widespread, statistically sound audits like RLA’s is needed to verify our vote.

MEDIA CONTACT: Aurora Matthews 

Verified Voting is a national non-partisan, non-profit educational and advocacy organization committed to safeguarding elections in the digital age. Founded by computer scientists, Verified Voting advocates for the responsible use of emerging technologies to ensure that Americans can be confident their votes will be cast as intended and counted as cast. We promote auditable, accessible and resilient voting for all eligible citizens.

Verified Voting Blog: Proposed election security panel for Netroots Nation 2018

Election security is the way we protect our elections from interference and allow voters to feel confident that their vote is being counted. Being able to trust election results is a cornerstone of democracy. 2016 was a harsh reminder of what can happen when we don’t have secure election systems- and demonstrates the need for us to act quickly. Luckily, we can all ensure the safety of our elections, by working with our local and state election officials to make sure all of our votes are counted.

The key takeaways are that the reforms (paper ballots and robust audits) are not only totally possible, but super important. Every major reform that has been passed at the state level has been lead by grassroots activists who knew how important it was to make sure our votes are counted. The progressive movement, in light of the interference in the 2016 election, has been calling on us to understand how to advocate for these campaigns.Election Security is often seen as a wonky, insider issue. Over the past year, the Secure Our Vote coalition has trained hundreds of local leaders to work with their election officials to demand better election machines and audits. The connection between these issues and passing a progressive agenda is clear, as only if we trust our votes will be counted if we have secure systems. We want to build upon that work to make the connections clear to the leading progressive activists.

Verified Voting Blog: Federal Funds for Election Security: Will They Cover the Costs of Voter Marked Paper Ballots?

Download the Brennan Center/Verified Voting Full Report (PDF)

Under the terms of the omnibus spending bill voted on by the House, states will receive $380 million within months to start to strengthen the security of our nation’s election infrastructure. This near-term funding is the product of tireless work by members of both parties, and a critical acknowledgment from Congress that protecting our elections is a matter of national security. States can use the funding immediately to begin deploying paper ballots, post-election audits, and other essential cybersecurity improvements. However, the new funding is only a first step, as many in Congress have acknowledged, and further Congressional action will be necessary in order to ensure that future elections are secure.

Most significantly, the omnibus funding as allocated to the states under the Help America Vote Act (HAVA) will not be enough for some states to replace their insecure voting machines. Because paperless electronic voting systems are highly vulnerable to cyberattacks, it is urgent that those systems be replaced as soon as possible, as the Senate Select Committee on Intelligence (SSCI) recommended earlier this week. Until this is done, it will be impossible to ensure that election results as reported by the voting system have not been corrupted by a cyberattack.

Thirteen states, including key swing states like Pennsylvania, continue to use paperless voting today. One of the main reasons is cost: cash-strapped states simply can’t afford to replace this aging equipment. Unfortunately, our analysis shows that under the new federal funding, five of the 13 states with paperless machines will receive less than 25 percent of the money they may need to replace them. Moreover, most states will also need to use some of the new funding to pay for improved auditing and other security measures, leaving even less for crucial technology upgrades.

Verified Voting Blog: Pennsylvania Takes Critical Steps Toward Election Security by Purchasing Voter-Verifiable Paper Systems

Marian K. Schneider: “We applaud this decision today to increase the integrity of Pennsylvanias elections and its move to safeguard elections.”

The following is a statement from Marian K. Schneider, president of Verified Voting, formerly Deputy Secretary for Elections and Administration in the Pennsylvania Department of State, on Pennsylvania’s announcement that it will no longer purchase paperless DREs and that going forward all new voting machines must have a voter-verifiable paper ballot or paper record. For additional media inquires, please contact aurora@newheightscommunications.com 

“Pennsylvania is taking a critical step towards safeguarding elections by replacing its aging voting systems and restoring voters’ faith that their votes will be counted as cast. The only way to address the risk of software problems is to require a physical paper ballot that can be used to check the computer-generated votes.

“Since 2006, 83 percent of Pennsylvanians have voted on unverifiable direct recording electronic (DRE) systems. This directive begins to change that. As the Commonwealth moves forward with these steps to increase security, it also serves as an example for other states to do the same. But it shouldn’t stop there. Pennsylvania needs to continue this momentum by decertifying all its remaining DREs and only certify voting systems that include a paper record of voter’s choices.

“We applaud Governor Wolf’s commitment to ensuring the integrity of Pennsylvania’s elections.  The administration’s move to safeguard Pennsylvania elections by requiring counties to purchase these new voting systems will allow jurisdictions to detect any problems with the election outcome and recover from them. This is exactly why security experts recommend that voting machines are resilient. Pennsylvania’s actions reflect the understanding that our election infrastructure must be secure.”

Verified Voting Blog: It’s time to safeguard our elections | Marian K. Schneider

This oped was originally published in the York Dispatch on February 1, 2018.

An oversight in York County, Pennsylvania on the eve of last November’s Election Day questioned the rightful winner of the election, but thankfully the potential damage stopped there. Still, the discovery of a technical error — one that allowed voters to cast multiple votes for a candidate in races with cross-filed candidates — risked the integrity of the election. This could’ve been easily preventable with paper ballots.

Most Pennsylvania voters are using paperless electronic voting machines to cast their ballot. The problem is that these outdated machines — also known as direct recording electronic (DRE) systems —are unverifiable. DREs, or voting machines without paper ballot back-up, have been the source of controversy for years because of their inability to allow anyone to verify the results. Instilling confidence in election outcomes can only occur by replacing these systems with newer ones that provide a software independent record of voter intent and implementing statistically meaningful audits of those records.

We know there was foreign interference during the 2016 election cycle, and that similar acts to undermine faith in America’s democratic systems are a possibility. Security experts agree that safeguarding and protecting election systems is important and that no system is completely secure. That’s why security experts recommend ensuring that all computer-based systems, including voting machines are resilient, that is, they have the ability to identify a problem and recover from it. Replacing the outdated voting systems with resilient machines is imperative before the 2018 elections because, for more than 80 percent of Pennsylvania voters in 50 counties, no one has any way of knowing whether the paperless voting machines correctly captured voter intent.

Full Article: OPED: It's time to safeguard our elections.

Media Release: Verified Voting Says Paper Ballots and Post-Election Audits Can Safeguard our Elections as State and Local Election Officials Discuss Election Security

Marian K. Schneider: “Passing the bipartisan Security Elections Act will advance our nation’s efforts to protect and ensure trustworthy elections.”

The following is a statement from Marian K. Schneider, president of Verified Voting, regarding the U.S. Election Assistance Commission (EAC) summit held today in Washington, D.C. For additional media inquires, please contact aurora@newheightscommunications.com  

“As officials look to address the risks our elections face today, it is essential that voter-verified paper ballots and post-election audits are recognized as the best way – given current technology – to ensure that an attack on our voting systems can be detected and the outcome verified. With midterm elections quickly approaching, it’s time we also prepare to monitor, detect, respond and recover from these potential attacks. The good news is that we can, and Congress has a bill that goes a long way in doing so.

“The bipartisan Secure Elections Act, introduced late last month by Sen. James Lankford (R-OK) and co-sponsored by Sen. Amy Klobuchar (D-MN), Sen. Lindsey Graham (R-SC), Sen. Kamala Harris (D-CA), Sen, Susan Collins (R-ME) and Sen. Martin Heinrich, (D-NM), aims to provide states with the resources needed to implement these safeguards. 

Media Release: Verified Voting Urges Congress to Pass the Secure Elections Act; Bipartisan Legislation Empowers States to Protect Themselves

Marian K. Schneider: “Passing the bipartisan Secure Elections Act will advance our nation’s efforts to protect and ensure trustworthy elections.”

The following is a statement from Marian K. Schneider, president of Verified Voting, on the Secure Elections Act, which was introduced by Sen. James Lankford (R-OK) and co-sponsored by Sen. Amy Klobuchar (D-MN), Sen. Lindsey Graham (R-SC),Sen. Kamala Harris (D-CA), Sen, Susan Collins (R-ME) and Sen. Martin Heinrich,(D-NM) on December 21, 2017.

“The Secure Elections Act addresses the new reality that our election infrastructure must be protected as matter of national security. At a time when our democracy needs increased protection, Congress should fast-track the newly introduced Secure Elections Act to provide resources for states to safeguard our voting systems and ensure election infrastructure is resilient.

“This bipartisan legislation establishes a structured grant program that creates incentives for states to adopt good cyber hygiene measures in accordance with guidelines developed by an advisory panel of experts. Coupling grants to the states with effective guidelines on spending will ensure the money is used well and moves toward strengthening our elections. In addition, the bill improves the exchange of information about security threats among the different levels of government to allow timely response and action.

Verified Voting Public Commentary: Verified Voting Testimony before the Pennsylvania State Senate Senate State Government Committee: Voting System Technology and Security

Download as PDF

The security of election infrastructure has taken on increased significance in the aftermath of the 2016 election cycle. During the 2016 election cycle, a nation-state conducted systematic, coordinated attacks on America’s election infrastructure, with the apparent aim of disrupting the election and undermining faith in America’s democratic institutions. Intelligence reports that have been published in 2017 demonstrate that state databases and third-party vendors not only were targeted for attack, but were breached.1 Regardless of the success of hacking attempts in 2016, the consensus among the intelligence community is that future attacks on American elections are inevitable.2 The inevitability of attacks is a key concept in cyber security, that is, it’s not whether a system will be attacked, but when.

The existence and national significance of this threat have escalated the priority of securing Pennsylvania’s elections infrastructure. Two primary areas that require immediate and sustained attention are 1) securing both the state and county networks, databases and data transmission infrastructure that touch elections; and 2) instilling confidence in election outcomes by replacing legacy voting systems with new systems that permit reliable recounts and audits.

During the time that I served the Commonwealth as Deputy Secretary for Elections and Administration and Special Advisor to the Governor on Election Policy, I worked with the Office of Administration-Office of Information Technology to protect the Commonwealth’s networks that touch elections and to implement procedures to recover from any potential attacks. These efforts complied with cyber security best practices to monitor, detect, respond and recover. OA-OIT’s experienced staff is continuing this effort, and along with the Department of State, they have engaged county CIOs and technology staff to coordinate similar efforts at the counties working through the Commonwealth’s relationship with the County Commissioners Association of Pennsylvania (CCAP). Assuming the administration receives support from the General Assembly, the Commonwealth is on the right track to taking the necessary steps to monitor, detect, respond and recover from cyber attacks.

Verified Voting Blog: Testimony of Verified Voting to the Georgia House of Representatives House Science and Technology Committee

Download as PDF

Georgia’s voting machines need an update. The lifespan of voting machines has been estimated at 10-15 years.1 Purchased in 2002 Georgia’s voting machines are at the outside of that estimate. As voting systems age they are more susceptible to error, malfunction or security threats potentially losing or miscounting votes.

Georgia is one of only a handful of States that is still casting votes on entirely electronic voting systems, known as Direct Record Electronics (DREs). These machines record votes only in digital form; if the digital records are corrupted, either by benign error or malicious attack, there are no backup records and no way to know whether votes have been corrupted. When Georgia purchased these machines in 2002, the national trend was toward paperless touchscreen voting machines. Since then, however, most states moved away from paperless voting systems, driven by mounting research establishing these machines’ security flaws and some high profile and costly machine failures.2 Most of the nation has adopted voting systems that rely on a voter-marked paper ballot, an election safeguard recognized as essential by election officials and computer security experts alike.

A paper ballot provides a durable, physical record that is out of reach of a cyber attack and cannot be lost by a digital malfunction or programming error. Paper ballots can be used in a recount or to perform a post-election audit or check on the election results to help ensure the election outcome is correct. Today roughly 70% of voters in our nation mark a paper ballot which is counted by an electronic scanner.

Verified Voting Blog: Testimony of Verified Voting to the New York State Assembly Standing Committee on Election Law

Download as PDF

In 2016 the threat of cyber attacks on our elections from foreign entities became an alarming reality. We learned that an adversarial nation was targeting our election systems with the intent to disrupt and undermine the legitimacy of our free, democratic government. In the declassified report “Assessing Russian Activities and Intentions in Recent U.S. Elections” the U.S. Intelligence Community warned that “Russian intelligence obtained and maintained access to elements of multiple US state or local electoral boards.”1 Several months ago we learned that the U.S. Department of Homeland Security (DHS) contacted officials in twenty-one states to notify them that their election systems had been targeted by Russian hackers. When asked at a June hearing of the Senate Select Committee of Intelligence if we should expect continued cyber attacks on our election infrastructure, then FBI director James Comey stated emphatically, “[t]hey will be back.”2 The gravity of this threat cannot be overstated. It is critical that we take every precaution to protect our election systems.

The stealth, skill and sophistication of today’s state-level cyber attackers should not be underestimated. Cyber security experts have warned that attacks today continue to outpace our ability to defend against them. The unending list of high profile and well-defended enterprises that have fallen victim to cyber attacks3 demonstrates the impracticality of trying to defend any computer system absolutely. Further complicating the problem, our election offices are typically under-resourced and understaffed. Though the New York State Board of Elections currently has in place some of the more advanced cyber security and cyber hygiene requirements for election systems, we cannot expect our county election offices to defend against cyber attacks from a state-level attacker.

Verified Voting Blog: Verified Voting Testimony for the New Jersey State Assembly Judiciary Committee

Verified Voting is a national non-partisan, not for profit research and advocacy organization founded by computer scientists and committed to safeguarding democracy in the digital age. We promote technology and policies that ensure auditable, accessible and resilient voting for all eligible citizens. We urge you to adopt the proposed amendments and vote “YES” on A-4619.

New Jersey is one of only a handful of states whose voters are still casting votes on entirely electronic voting systems, direct recording electronic (DREs). Because these systems record votes directly onto computer memory without any independent paper record of the vote, they are especially vulnerable to undetectable and uncorrectable errors in the vote count.

Numerous studies and security evaluations of DRE systems over the years have found that the DREs in use in New Jersey have insecurities making them vulnerable to undetectable manipulation and tampering.1 Because DRE systems prevent anyone from verifying that the electronic tally accurately reflects voter intent, many States have discontinued the use of electronic DRE voting systems in favor of paper ballots. In 2006 only 25% of voters nationwide cast their ballots on paper but in 2017 more than 70% of U.S. voters marked a paper ballot.2

Verified Voting Blog: Verified Voting Names Voting Rights Lawyer and Pennsylvania Election Official Marian K. Schneider New President

Schneider: “Now more than ever, we need to secure our voting systems, and Verified Voting is leading the way.”

Nearly a year after intelligence agencies confirmed foreign interference in our elections – and with midterm primaries just around the corner – the U.S. is looking to safeguard its elections infrastructure. To that end, Verified Voting, the leading national organization focused solely on making our voting technology secure, has named voting rights lawyer and former Pennsylvania election official Marian K.  Schneider as its new president. Schneider, who most recently served as the special advisor to Pennsylvania Governor Tom Wolf on election policy, will focus on restoring faith in the democratic process of voting by securing our elections.

A lawyer with expertise in voting rights and election law, Schneider has extensive experience with state government administration as well as in the nonprofit social justice sector.

“Marian brings an uncommon mix of passion and experience as an on-the-ground election official and as an advocate to Verified Voting, and we couldn’t be more pleased to have her join,” said Barbara Simons who served as Interim President and will now return to her role as Board Chair. “We are confident that under Marian’s leadership, Verified Voting can achieve its goals to secure future elections.”

Verified Voting Blog: Yes, Voting Machines Can Be Hacked – Now the Hard Work Begins

DEFCON Report on Machine Vulnerabilities Critical First Step in Raising Awareness, But to Secure Election Systems, States Must Adopt Paper Ballots

A new report on cyber vulnerabilities of our elections systems raises awareness of a critical issue, but in order to secure our elections, we need fundamental changes made at the state and local level. Verified Voting collaborated on the DEFCON Hacker Village to raise awareness of a chilling reality: our enemies have the will, intention and ability to tamper with our election infrastructure, potentially delegitimizing our elections and destabilizing our government. Verified Voting has known of this frightening possibility for years—we were founded in 2004, in the wake of election irregularities, to secure our democracy by ensuring that Americans’ votes would be counted the way they intended to cast them.

We know from deep experience: protecting our election infrastructure is a national security issue, and if we don’t act now, as former FBI Director James Comey has stated, ‘They’ll be back.’ That’s why Verified Voting has worked continuously with state election officials to safeguard their systems. Just last month, Verified Voting worked closely with Virginia’s Board of Elections in their move to decertify and remove its insecure, untrustworthy paperless voting machines and replace them with voter-marked paper ballots. 

Verified Voting Blog: Verified Voting Is Seeking a New President

Download this announcement in PDF format.

Verified Voting Foundation (a 501(c)(3) organization) and VerifiedVoting.org (a 501(c)(4) organization) are nonprofit, nonpartisan organizations founded over a decade ago by election security experts. We strive to guarantee the accuracy, transparency, and verifiability of elections, so that citizens rightly can trust election outcomes. We are the only national organization with the exclusive mission of protecting the security of elections in the digital age.

This is an exciting time to be Verified Voting President. Citizens and policy makers are finally becoming aware of major security vulnerabilities of our election systems. The President of Verified Voting, who is the Chief Executive Officer of both organizations, will have a platform that can have significant national impact.

Verified Voting is a leading election security organization in the U.S., earning widespread respect among activists, academics, election officials, and other officials at all levels of government. We specialize in election technology and procedures, and we are the most trusted source of impartial information and expertise on these topics. Our Board and Advisory Board are comprised of a who’s who of election security and cybersecurity experts, as well as election officials and attorneys.

Verified Voting Blog: Verified Voting Letter to the US Senate Select Committee on Intelligence

This letter was sent to the US Senate Select Committee on Intelligence following a hearing on June 21, 2017. (Download PDF)

Verified Voting vigorously applauds the Senate Select Committee on Intelligence for its leadership and commitment to securing our elections. With clear evidence that foreign attackers sought to attack our 2016 elections through various means, our intelligence agencies warn that hostile attackers will be back to attack future elections. Congress and the most vulnerable states should act with urgency to fund and implement protective reforms that will make our election systems resilient against cyber attack: funding the adoption of paper ballots and accessible ballot marking systems, and implementing robust, manual post-election audits of the votes.

The June 21 hearing is an important first step toward those reforms, providing valuable information through witness testimony and questions of the Senators. We wish to expand on several key points that were raised in the hearing to ensure a clear understanding of the challenges we face in securing our elections.

It is crucial to understand that further reforms are urgently needed to bolster the mitigations currently in place so that it is possible to detect and correct a cyber attack on the vote count.

Some testimony asserted that pre-election testing and post-election audits currently in place would catch errors in vote tallies caused by a malicious attacker or software failure. Unfortunately, pre-election testing, though helpful for ensuring the completeness of ballot programming, can be defeated by malicious software designed to detect when the system is in test mode. This is what happened with Volkswagen diesels cars: the software caused the cars’ emissions systems to behave correctly during testing, but then allowed them to pollute under non-testing conditions.

Verified Voting Blog: Alex Halderman: Expert Testimony before the US Senate Select Committee on Intelligence

This testimony was delivered at a hearing on June 21, 2017. (Download PDF)

Chairman Burr, Vice Chairman Warner, and members of the Committee, thank you for inviting me to speak today about the security of U.S. elections. I’m here to tell you not just what I think, but about concerns shared by hundreds of experts from across cybersecurity research and industry. Such expertise is relevant because elections—the bedrock of our democracy—are now on the front lines of cybersecurity, and they face increasingly serious threats. Our interest in this matter is decidedly non-partisan; our focus is on the integrity of the democratic process, and the ability of the voting system to record, tabulate, and report the results of elections accurately.

My research in computer science and cybersecurity tackles a broad range of security challenges.1 I study attacks and defenses for the Internet protocols we all rely on every day to keep our personal and financial information safe. I also study the capabilities and limitations of the world’s most powerful attackers, including sophisticated criminal gangs and hostile nation states. A large part of my work over the last ten years has been studying the computer technology that our election system relies on.2 In this work, I often lead the “red team,” playing the role of a potential attacker to find where systems and practices are vulnerable and learn how to make them stronger.

I know firsthand how easy it can be to manipulate computerized voting machines. As part of security testing, I’ve performed attacks on widely used voting machines, and I’ve had students successfully attack machines under my supervision.

US Voting Machines Are Vulnerable

As you know, states choose their own voting technology.3 Today, the vast majority of votes are cast using one of two computerized methods. Most states and most voters use the first type, called optical scan ballots, in which the voter fills out a paper ballot that is then scanned and counted by a computer. The other widely used approach has voters interact directly with a computer, rather than marking a choice on paper. It’s called DRE, or direct-recording electronic, voting. With DRE voting machines, the primary records of the vote are stored i n computer memory.4

Both optical scanners and DRE voting machines are computers. Under the hood, they’re not so different from your laptop or smartphone, although they tend to use much older technology—sometimes decades out of date.5 Fundamentally, they suffer from security weaknesses similar to those of other computer devices. I know because I’ve developed ways to attack many of them myself as part of my research into election security threats.

Ten years ago, I was part of the first academic team to conduct a comprehensive security analysis of a DRE voting machine. We examined what was at that time the most widely used touch-screen DRE i n the country,6 and spent several months probing it for vulnerabilities. What we found was disturbing: we could reprogram the machine to invisibly cause any candidate to win. We also created malicious software—vote-stealing code—that could spread from machine-to-machine like a computer virus, and silently change the election outcome.7

Vulnerabilities like these are endemic throughout our election system. Cybersecurity experts have studied a wide range of U.S. voting machines—including both DREs and optical scanners—and in every†single†case¨†they’ve found severe vulnerabilities that would allow attackers to sabotage machines and to alter votes.8 That’s why there is overwhelming consensus in the cybersecurity and election integrity research communities that our elections are at risk.

Cyberattacks Could Compromise Elections

Of course, interfering in a state or national election is a bigger job than just attacking a single machine. Some say the decentralized nature of the U.S. voting system and the fact that voting machines aren’t directly connected to the Internet make changing a state or national election outcome impossible. Unfortunately, that is not true.9

Some election functions are actually quite centralized. A small number of election technology vendors and support contractors service the systems used by many local governments. Attackers could target one or a few of these companies and spread malicious code to election equipment that serves millions of voters.

Furthermore, in close elections, decentralization can actually work against us. An attacker can probe different areas of the most important “swing states” for vulnerabilities, find the areas that have the weakest protection, and strike there.10 In a close election, changing a few votes may be enough to tip the result, and an attacker can choose where—and on which equipment—to steal those votes. State and local elections are also at risk.

Our election infrastructure is not as distant from the Internet as it may seem.11 Before every election, voting machines need to be programmed with the design of the ballot, the races, and candidates. This programming is created on a desktop computer called an election management system, or EMS, and then transferred to voting machines using USB sticks or memory cards. These systems are generally run by county IT personnel or by private contractors.12 Unfortunately, election management systems are not adequately protected, and they are not always properly isolated from the Internet. Attackers who compromise an election management system can spread vote-stealing malware to large numbers of machines.13

Russian Attack Attempts: The Threats Are Real

The key lesson from 2016 is that hacking threats are real.

This month, we’ve seen reports detailing Russian efforts to target voter registration systems i n up to 39 states14 and to develop a capability to spread an attack from an election technology vendor to local election offices.15 Attacking the IT systems of vendors and municipalities could put the Russians in a position to sabotage equipment on election day, causing voting machines or electronic poll books to fail, resulting in long lines or other disruptions. The Russians could even have engineered this chaos to have a partisan effect, by targeting localities that lean heavily towards one candidate or another.

Successful infiltration of election IT systems also could have put the Russians in a position to spread an attack to the voting machines and potentially steal votes. Although the registration systems involved were generally maintained at the state level, and most pre-election programming is performed by counties or outside vendors, counties tend to be even less well defended than state governments. They typically have few IT support staff and little, if any, cybersecurity expertise.

Another approach that the Russians might have been planning is to tamper with the voting system in an obvious, easily discovered way, such as causing reporting systems to send the news media incorrect initial results on election night. Even if the problem was corrected and no actual votes were changed, this would cause uncertainty in the results and widespread distrust of the system, which would injure our democratic processes. If voters cannot trust that their votes are counted honestly, they will have reason to doubt the validity of elections.16

I don’t know how far the Russians got in their effort to penetrate our election infrastructure, nor whether they interfered with equipment on election day. (As far as the public knows, no voting equipment has been forensically examined to check whether it was successfully attacked.) But there is no doubt that Russia has the technical ability to commit widescale attacks against our voting system, as do other hostile nations. As James Comey testified here two weeks ago, we know “They’re coming after America,” and “They’ll be back.”17

Practical Steps to Defend Election Infrastructure

We must start preparing now to better defend our election infrastructure and protect it from cyberattacks before the elections in 2018 and 2020. The good news is, we know how to accomplish this. Paper ballots, audits, and other straightforward steps can make elections much harder to attack.

I have entered into the record a letter from over 100 computer scientists, security experts, and election officials. This letter recommends three essential measures that can safeguard U.S. elections:

● First, we need to replace obsolete and vulnerable voting machines, such as paperless systems, with optical scanners and paper ballots—a technology that 36 states already use. Paper provides a resilient physical record of the vote18 that simply can’t be compromised by a cyberattack. President Trump made this point well shortly before the election in an interview with Fox News. “There’s something really nice about the old paper-ballot system,” he said. “You don’t worry about hacking. You don’t worry about all the problems that you’re seeing.”19

● Second, we need to consistently and routinely check that our election results are accurate, by inspecting enough of the paper ballots to tell whether the computer results are right.20 This can be done with what’s known as risk-limiting audits.21 Such audits are a common-sense quality control.22 By manually checking a relatively small random sample of the ballots, officials can quickly and affordably provide high assurance that the election outcome was correct.

Optical scan ballots paired with risk-limiting audits provide a practical way to detect and correct vote-changing cyberattacks. They may seem low-tech, but they are a reliable, cost-effective defense.23

● Lastly, we need to raise the bar for attacks of all sorts including both vote tampering and sabotage by conducting comprehensive threat assessments and by applying cybersecurity best practices to the design of voting equipment24 and the management of elections.

These fixes aren’t expensive. Replacing insecure paperless systems nationwide would cost between $130 million and $400 million.25 Running risk-limiting audits nationally for federal elections would cost less than $20 million a year.26 These amounts are vanishingly small compared to the national security improvement the investment buys. Yet such measures could address a prime cyber challenge, boost voter confidence, and significantly strengthen a crucial element of our national security. They would also send a firm response to any adversaries contemplating interfering with our election system.

Election officials have an extremely difficult job, even without having to worry about cyberattacks by hostile governments. The federal government can make prudent and cost-effective investments to help them defend our election infrastructure and uphold voters’ confidence. With leadership from across the aisle, and action in partnership with the states, our elections can be well protected in time for 2018 and 2020.

Thank you for the opportunity to testify. I look forward to answering any questions.

––––––––––––––––––––––––––

1 My curriculum vitae and research publications are available online at https://jhalderm.com .

2 For an accessible introduction to the security risks and future potential of computer voting technologies, see my online course, Securing†Digital†Democracy†, which is available for free on Coursera: https://www. coursera.org/learn/digital-democracy .

3 In many states, the technology in use even differs from county to county. Verified Voting maintains an online database of the equipment in use in each locality: https://www.verifiedvoting.org/verifier/ .

4 Some DREs also produce a printed record of the vote and show it briefly to the voter, using a mechanism called a voter-verifiable paper audit trail, or VVPAT. While VVPAT records provide a physical record of the vote that is a valuable safeguard against cyberattacks, research has shown that VVPAT records are difficult to accurately audit and that voters often fail to notice if the printed record doesn’t match their votes. For these reasons, most election security experts favor optical scan paper ballots. See: S. Goggin and M. Byrne, “An Examination of the Auditability of Voter Verified Paper Audit Trail (VVPAT) Ballots.” In Proceedings†of†the†2007†USENIXØACCURATE†Electronic†Voting†Technology Workshop†, August 2007. Available at: http://www.accurate-voting.org/wp-content/uploads/2007/08/evt07-goggin.pdf . See also: B. Campbell and M. Byrne, “Now Do Voters Notice Review Screen Anomalies?” In Proceedings of the 2009 USENIX/ACCURATE/IAVoSS Electronic Voting Technology Workshop, August 2009. Available at: http://chil.rice.edu/research/pdf/CampbellByrne_EVT_(2009).pdf .

5 In 2016, 43 states used computer voting machines that were at least 10 years old—close to the end of their design lifespans. Older hardware and software generally lacks defenses that guard against more modern attack techniques. See: L. Norden and C. Famighetti, “America’s Voting Machines at Risk,” Brennan Center, 2015. https://www.brennancenter.org/publication/americas-voting-machines-risk See also: S. Checkoway, A. Feldman, B. Kantor, J. A. Halderman, E. W. Felten, and H. Shacham, “Can DREs Provide Long-Lasting Security? The Case of Return-Oriented Programming and the AVC Advantage.” In Proceedings of the 2009 USENIX/ACCURATE/IAVoSS Electronic Voting Technology Workshop, August 2009. Available at: https://jhalderm.com/pub/papers/avc-evt09.pdf .

6 The machine was the Diebold AccuVote TS, which is still used statewide in Georgia in 2017.

7 A. J. Feldman, J. A. Halderman, and E. W. Felten, “Security Analysis of the Diebold AccuVote-TS Voting Machine.” In Proceedings of the 2007 USENIX/ACCURATE Electronic Voting Technology Workshop (EVT), August 2007. The research paper and an explanatory video are available at: https://citp.princeton.edu/research/voting/ .

8 For a partial bibliography of voting machine attack research, see: J. A Halderman, “Practical Attacks on Real-world E-voting.” In F. Hao and P. Y. A. Ryan (eds.), Real-World Electronic Voting: Design¨ Analysis and Deployment , CRC Press, December 2016. Available at: https://jhalderm.com/pub/papers/ch7-evoting-attacks-2016.pdf .

9 I explained how attackers can bypass these obstacles in a recent congressional briefing: Strengthening Election Cybersecurity , May 15, 2017. The video is available at https://www.electiondefense.org/congressional-briefings-cyber-security/ .

10 For a more detailed description of how adversaries might select targets, see J. A. Halderman, “Want to Know if the Election was Hacked? Look at the Ballots,” November 2016, available at: medium.com/@jhalderm/want-to-know-if-the-election-was-hacked-look-at-the-ballots-c61a6113b0ba .

11 Fortunately, the U.S. has resisted widespread use of Internet voting—a development that would paint a fresh bull’s eye on our democratic system. I myself have demonstrated attacks against Internet voting systems in Washington, D.C., Estonia, and Australia. See: S. Wolchok, E. Wustrow, D. Isabel, and J. A. Halderman, “Attacking the Washington, D.C. Internet Voting System.” In Proceedings of the 16th Intl Conference on Financial Cryptography and Data Security, February 2012. Available at: https://jhalderm.com/pub/papers/dcvoting-fc12.pdf D. Springall, T. Finkenauer, Z. Durumeric, J. Kitcat, H. Hursti, M. MacAlpine, and J. A. Halderman, “Security Analysis of the Estonian Internet Voting System.” In Proceedings of the 21st ACM Conference on Computer and Communications Security (CCS), November 2014. Available at: https://jhalderm.com/pub/papers/ivoting-ccs14.pdf J. A. Halderman and V. Teague, “The New South Wales iVote System: Security Failures and Verification Flaws in a Live Online Election.” In Proceedings of the 5th International Conference on E-voting and Identity, September 2015. Available at: https://arxiv.org/pdf/1504.05646v2.pdf . For a broader discussion of why secure Internet voting systems are likely decades away, see: R. Cunningham, M. Bernhard, and J. A. Halderman, “The Security Challenges of Online Voting Have Not Gone Away.” IEEE Spectrum, November 3, 2016. http://spectrum.ieee.org/tech-talk/telecom/security/thesecurity-challenges-of-online-voting-have-not-gone-away .

12 In my own state, Michigan, about 75% of counties outsource pre-election programming to a pair of independent service providers. These are small companies with 10–20 employees that are primarily in the business of selling election supplies, including ballot boxes and “I Voted” stickers.

13 See, for example, J. Calandrino, et al., “Source Code Review of the Diebold Voting System,” part of the California Secretary of State’s “Top-to-Bottom” Voting Systems Review, July 2007. Available at: https://jhalderm.com/pub/papers/diebold-ttbr07.pdf .

14 M. Riley and J. Robertson, “Russian Cyber Hacks on U.S. Electoral System Far Wider Than Previously Known.” Bloomberg†, June 13, 2017. https://www.bloomberg.com/politics/articles/2017-06-13/russianbreach-of-39-states-threatens-future-u-s-elections .

15 M. Cole, R. Esposito, S. Biddle, and R. Grim, “Top-secret NSA Report Details Russian Hacking Efforts Days Before 2016 Election.” The†Intercept†, June 5, 2017. https://theintercept.com/2017/06/05/top-secretnsa-report-details-russian-hacking-effort-days-before-2016-election/ .

16 See, as one example, E. H. Spafford, “Voter Assurance.” NAE The†Bridge†, December 2008. https://www.nae.edu/19582/Bridge/VotingTechnologies/VoterAssurance.aspx .

17 Testimony of former FBI Director James B. Comey before the Senate Select Committee on Intelligence, June 8, 2017.

18 Of course, paper ballots can be tampered with too, by people handling them. Optical scan tabulation has the advantage that it produces both paper and electronic records. As long as officials check that both sets of records agree, it would be very difficult for criminals to alter the election outcome without being detected, whether by a cyberattack or by old-fashioned ballot manipulation.

19 See: http://www.businessinsider.com/donald-trump- election-day-fox-news-2016-11 .

20 At least 29 states already require some form of post-election audit. However, since the procedures in most states are not designed as a cyber defense, the number of ballots that are audited may be much too low or geographically localized to reliably detect an attack. Some states also allow auditing by rescanning paper ballots through the same potentially compromised machines. Results from paperless DRE voting machines cannot be strongly audited, since there is no physical record to check. For state-by-state details, see National Conference of State Legislatures, “Post-election Audits,” June 2017. Available at: http://www.ncsl.org/research/elections-and-campaigns/post-election-audits635926066.aspx .

21 For a detailed explanation of risk-limiting audits, see J. Bretschneider et al., “Risk-Limiting Post-Election Audits: Why and How.” Available at: https://www.stat.berkeley.edu/~stark/Preprints/RLAwhitepaper12.pdf New Mexico already requires something similar to a risk-limiting audit, and Colorado is implementing risk-limiting audits starting in 2017. Risk-limiting audits have been tested in real elections in California, Colorado, and Ohio.

22 One of the reasons why post-election audits are essential is that pre-election “logic and accuracy” testing can be defeated by malicious software running on voting machines. Vote-stealing code can be designed to detect when it’s being tested and refuse to cheat while under test. Volkswagen’s emission-control software did something similar to hide the fact that it was cheating during EPA tests.

23 Former CIA director James Woolsey and Lt. Col. Tony Shaffer call for paper ballots and auditing in a May 12, 2017 op-ed in Fox News: “Ultimately, we believe the solution to election insecurity lies in President Reagan’s famous old adage: ‘trust but verify’.” http://www.foxnews.com/opinion/2017/05/12/america-s-voting-systems-need-security-upgrades-it-s-time-to-beef-up-cybersecurity.html .

24 One notable effort to develop secure voting equipment is STAR-Vote, a collaboration between security researchers and the Travis County, Texas elections office. STAR-Vote integrates a range of modern defenses, including end-to-end cryptography and risk limiting audits. See S. Bell et al., “STAR-Vote: A Secure, Transparent, Auditable, and Reliable Voting System.” USENIX Journal of Election Technology and Systems (JETS) 1(1), August 2013. https://www.usenix.org/system/files/conference/evtwote13/jets-0101-bell.pdf .

25 Brennan Center, “Estimate for the Cost of Replacing Paperless, Computerized Voting Machines,” June 2017. https://www.brennancenter.org/sites/default/files/analysis/New_Machines_Cost_Across_Paperless_Jurisdictions%20%282%29.pdf . This cost might be significantly reduced by developing voting equipment based on open-source software and commercial off-the-shelf (COTS) hardware.

26 This estimate assumes that auditing a federal race will have an average cost similar to manually recounting 10% of precincts. In a risk-limiting audit, the actual number of ballots that must be checked varies with, among other factors, the margin of victory.

Verified Voting Blog: Technology Experts’ Second Letter to Georgia Secretary of State Brian Kemp

This letter was sent to Georgia Secretary of State Brian Kemp on May 24, 2017. Download PDF

On March 14th we sent a letter to you expressing grave concerns regarding the security of Georgia’s voting systems and requesting transparency from your office concerning key questions about the reported breach at Kennesaw State University Center for Election Systems (KSU).

The FBI has reportedly closed its investigation into the breach at KSU and will not be pressing federal charges1 but regrettably little more is known. We remain profoundly concerned about the security of Georgia’s votes and the continued reliance on Diebold paperless touchscreen voting machines for upcoming elections.2

The FBI’s decision not to press charges should not be mistaken for a confirmation that the voting systems are secure. The FBI’s responsibility is to investigate and determine if evidence exists indicating that federal laws were broken. Just because the FBI concluded this hacker did not cross that line does not mean that any number of other, more sophisticated attackers could not or did not exploit the same vulnerability to plant malicious software that could be activated on command. Moreover, the FBI’s statement should not be misinterpreted to conclude that KSU or the Georgia voting system do not have other security vulnerabilities that could be exploited by malicious actors to manipulate votes.

Any breach at KSU’s Election Center must be treated as a national security issue with all seriousness and intensity. We urge you to engage the Department of Homeland Security and the US Computer Emergency Readiness Team (CERT) to conduct a full forensic investigation. We cannot ignore the very real possibility that foreign actors may be targeting our election infrastructure.

Verified Voting Blog: Amid Cybersecurity Concerns, France Abandons Plans for Internet Voting in Upcoming Elections

Earlier this month, the French government announced that it was cancelling plans to allow citizens abroad to vote over the Internet in legislative elections this June. Calling allegations of Russian hacking in western countries worrisome, the National Cybersecurity Agency of France (ANSSI) described the current risk of cyberattack as “extremely high,” and advised “that it would be better to take no risk that might jeopardize the legislative vote for French citizens residing abroad.”

In February Emmanuel Macron’s En Marche (Onwards!) party alleged that their campaign was the target of ‘fake news’ put out by Russian news agencies and they had been victims of cyberattacks. Following these allegations, outgoing president Bernard Hollande called a meeting of the French Defense Council and asked for a report on “specific monitoring and protection measures, including in the cyber domain, to be taken during the election campaign.”

Verified Voting Blog: Technology Experts’ Letter to Georgia Secretary of State Brian Kemp

This letter was sent to Georgia Secretary of State Brian Kemp on March 14, 2017. Download PDF

On March 3rd it was reported that the Federal Bureau of Investigations is conducting a criminal investigation into an alleged cyber attack of the Kennesaw State University Center for Election Systems. According to the KSU Center for Election Systems’ website, “the Secretary of State authorized KSU to create a Center for Election Systems, dedicated to assisting with the deployment of the Direct Record Electronic (DRE) voting technology and providing ongoing support.”[1] The Center is responsible for ensuring the integrity of the voting systems and developing and implementing security procedures for the election management software installed in all county election offices and voting systems.

The Center has access to most if not all voting systems and software used in Georgia. It also is responsible for programming these systems and accessing and validating the software on these systems. It is our understanding that the Center also programs and populates with voter records the electronic poll books used in polling places statewide. A security breach at the Center could have dire security consequences for the integrity of the technology and all elections carried out in Georgia.

In order for citizens to have faith and confidence in their elections, transparency is crucial, including about events such as the KSU breach, and its extent and severity. While we understand that this investigation is ongoing and that it will take time for the full picture to emerge, we request that you be as forthcoming and transparent as possible regarding critical information about the breach and the investigation, as such leadership not only will be respected in Georgia but also emulated in other states where such a breach could occur. We expect that you are already pursuing questions such as the following, regarding the breach, and trust that you will make public the results of such inquiry:

  1. Can you estimate when the attacker breached KSU’s system?
  2. How did the attacker breach KSU’s system?
  3. How was the breach discovered?
  4. Which files were accessed?
  5. Were any files accessed that related to software or “hashes” for the voting machines?
  6. Is there any evidence that files were modified?  If so, which files?
  7. Had KSU begun ballot builds for the upcoming special election?
  8. To whom are these attacks being attributed? Could this be an insider attack? Has the FBI identified any suspects or persons of interest?
  9. Has the FBI examined removable media for the possibility of implanted malware?
  10. Has the FBI examined the hash or verification program for tampering? \
  11. What mitigations are planned for the near- and long-term?

In any state an attack on a vendor providing software and system support with such far-reaching responsibilities would be devastating. This situation is especially fragile, because of the reliance on DRE voting machines that do not provide an independent paper record of verified voter intent. KSU has instead sought to verify the validity of the software on the voting machines by running a hash program on all machines before and after elections in an effort to confirm that the software has not been altered.  However, if KSU’s election programming were compromised, it is also possible that the verification program could have been modified to affirm that the software is correct, even if it were not. This is a risk of using software to check the correctness of software.

Of course all Georgia elections are important. This month and next include special elections as well. If these upcoming elections are to be run on DREs and e-pollbooks that are maintained and programmed by KSU while the KSU Center for Election Systems is itself the subject of an ongoing criminal investigation, it can raise deep concerns. And today’s cyber risk climate is not likely to improve any time soon.

We urge you to provide Georgia’s citizens with information they need to confirm before going to vote that their name will appear correctly on the voter rolls, as well as back-up printed voter lists in case anomalies appear. Most importantly, we urge you to act with all haste to move Georgia to a system of voter-verified paper ballots and to conduct post-election manual audits of election results going forward to provide integrity and transparency to all of Georgia’s elections. We would be strongly supportive of such efforts and would be willing to help in any way we can.

Sincerely,

Dr. Andrew W. Appel
Eugene Higgins Professor of Computer Science,
Princeton University

Dr. Duncan Buell
Professor, Department of Computer Science & Engineering, NCR Chair of Computer Science & Engineering,
University of South Carolina

Dr. Larry Diamond
Senior Fellow, Hoover Institute and Freeman Spogli Institute,
Stanford University

Dr. David L. Dill
Professor of Computer Science,
Stanford University

Dr. Richard DeMillo
Charlotte B, and Roger C. Warren Professor of Computing
Georgia Institute of Technology

Dr. Michael Fischer
Professor of Computer Science,
Yale University

Dr. J. Alex Halderman
Professor, Computer Science and Engineering
Director, Center for Computer Security and Society
University of Michigan

Dr. Joseph Lorenzo Hall
Chief Technologist,
Center for Democracy & Technology

Martin E. Hellman
Professor Emeritus of Electrical Engineering,
Stanford University

Candice Hoke
Co-Director, Center for Cybersecurity & Privacy Protection and Professor of Law,
Cleveland State University

Harri Hursti
Chief Technology Officer and co-founder, Zyptonite,
founding partner, Nordic Innovation Labs

Dr. David Jefferson
Lawrence Livermore National Laboratory

Dr. Douglas W. Jones
Department of Computer Science
University of Iowa

Dr. Joseph Kiniry
Principal Investigator, Galois
Principled CEO and Chief Scientist, Free & Fair

Dr. Justin Moore
Software Engineer, Google

Dr. Peter G. Neumann
Senior Principal Scientist, SRI International Computer Science Lab, and moderator of the ACM Risks Forum

Dr. Ronald L. Rivest
MIT Institute Professor

Dr. John E. Savage
An Wang Professor of Computer Science,
Brown University

Bruce Schneier
Fellow and lecturer
Harvard Kennedy School of Government

Dr. Barbara Simons
IBM Research (retired),
former President Association for Computing Machinery (ACM)

Dr. Philip Stark
Associate Dean, Division of Mathematics and Physical Sciences,
University of California, Berkeley

Dr. Vanessa Teague
Department of Computing & Information Systems,
University of Melbourne

Affiliations are for identification purposes only, they do not imply institutional endorsements.

[1] http://elections.kennesaw.edu/about/history.php