American voting relies heavily on technology. Voting machines and ballot counters have sped up the formerly tedious process of counting votes. Yet long-standing research shows that these technologies are susceptible to errors and manipulation that could elect the wrong person. In the 2016 presidential election, those concerns made their way into public consciousness, worrying both sides of the political fence. The uncertainty led to a set of last-minute, expensive state recounts—most of which were incomplete or blocked by courts. But we could ensure that all elections are fair and accurate with one simple low-tech fix: risk-limiting audits. Risk-limiting audits are specific to elections, but they are very similar to the audits that are routinely required of corporate America. Under them, a random sample of ballots is chosen and then hand-counted. That sample, plus a little applied math, can tell us whether the machines picked the right winner.
Verified Voting in the News
Editorials: Internet voting and paperless machines have got to go | Barbara Simons/Minneapolis Star Tribune
“They’ll be back in 2020, they may be back in 2018, and one of the lessons they may draw from this is that they were successful because they introduced chaos and division and discord and sowed doubt about the nature of this amazing country of ours and our democratic process.” — Former FBI Director James Comey, testifying about the Russian government before a House Intelligence Committee hearing, March 20, 2017
We are facing a major national security threat. As former Director Comey stated, we know that Russia attacked our 2016 election, and there is every reason to expect further attacks on our elections from nations, criminals and others until we repair our badly broken voting systems. Despite a decade of warnings from computer security experts, 33 states allow internet voting for some or all voters, and a quarter of our country still votes on computerized, paperless voting machines that cannot be recounted and for which there have been demonstrated hacks. If we know how to hack these voting systems, so do the Russians and Chinese and North Koreans and Iranians and ….
… J. Alex Halderman, a computer science professor at the University of Michigan, and Ph.D. student Matt Bernhard have assembled a number of reasons that they say render US voting machines susceptible to outside interference that could affect the accuracy of their tallies. In 2002, after the chaotic presidential election two years before, Congress passed the Help America Vote Act. The legislation provided funding for several private electronic voting machine manufacturers, including Diebold. Voting machines today fall predominantly into two categories. Optical scanners can be small, like the ones used at local polls or huge, or like the ones used at central voting centers to read absentee ballots. Direct Recording Electronic machines are touch screen devices that may or may not have a printer attached that makes a hard copy of the votes cast so they can be verified. According to Verified Voting, more than 20% of the DREs in use in the United States lack printers, making it impossible to detect fraudulent activity. “These machines are just so poorly engineered, the only real way to secure them is to destroy them and start over,” says the University of Michigan’s Matt Bernhard. In fact, their operating systems are often based on obsolete platforms such as Windows 98 or Vista.
A report released by legislative auditors Friday says the State Board of Elections needlessly exposed the full Social Security numbers of almost 600,000 voters to potential hacking, risking theft of those voters’ identities. The determination that election officials did not fully protect voters’ personal information was one of several highly critical findings in the report. The audit also faulted state election officials’ handling of issues including ballot security, disaster preparedness, contracting and balancing its books. State lawmakers called for a hearing in response to the Office of Legislative Audits report, which prompted strong reaction from critics of the board and its longtime administrator, Linda H. Lamone.
A Victorian parliamentary inquiry has backed the roll out of Internet-based voting for state elections, but only in limited circumstances. A report by the state parliament’s Electoral Matters Committee on the issue was tabled yesterday. The inquiry endorsed the use of remote electronic voting for electors who are blind or have low vision, suffer motor impairment, have insufficient language or literacy skills, or who are eligible to vote but interstate or overseas. Internet-based voting should be backed by the “most rigorous security standards available” to the Victorian Electoral Commission (VEC), the report recommended.
On May 25, 2014, Russian state broadcaster Channel One reported the winner of the day’s presidential election in Ukraine: with a surprising 37 percent plurality, Dmytro Yarosh, leader of the extreme-right paramilitary group Right Sector, would be the new Ukrainian president. According to Channel One, previous favorite Petro Poroshenko received only 29 percent of the vote. These numbers were particularly unexpected because only 0.7 percent of voters had voted for Yarosh, versus the 54.7 percent who had voted for Poroshenko — numbers that news outlets in Ukraine and elsewhere were accurately reporting. Barely a half-hour prior to the announcement of the election results, a cybersecurity team at Ukraine’s Central Election Commission (CEC) removed a virus that had been deployed in its computers. That virus was designed to total 37 percent of votes for Yarosh, and 29 percent for Poroshenko.
As the State Department works to gain international support for its cybersecurity framework, experts said that global norms and deterrence won’t be enough to convince state actors not to influence elections through cyber means in the future. Robert Axelrod, Walgreen Professor for the study of human understanding at the University of Michigan, compared the Democratic National Committee (DNC) hacks to Watergate. Both incidents involved the theft of information. The difference is that in Watergate, the incident was handled by domestic law enforcement and the president resigned. In the DNC hacks the incident was handled by international powers and there was “minor retaliation,” according to Axelrod. … “I think we’re going to see a lot more attacks like them in future campaigns,” said J. Alex Halderman, professor of computer science and engineering at the University of Michigan. Halderman said that most people think that the United States’ voting machines are secure because they are different in each county and they aren’t connected to the Internet. “In fact, many of these things break down,” said Halderman.
Early last month, someone reportedly hacked into the voting records database at Kennesaw State University’s Center for Election Systems, which is contracted to maintain and program all of Georgia’s 100% unverifiable touch-screen Diebold voting systems and electronic poll books. The state still uses the same unverifiable 2002 voting systems that, as we reported more than a decade ago, were hacked in a minute’s time by researchers at Princeton University, where they were able to implant a virus that could pass itself from machine to machine and flip the results of an election with little or no possibility of detection. The recent hack at Georgia’s KSU, which the Atlanta Journal-Constitution described at the time as possibly compromising some 7.5 million voter records, resulted in a quiet FBI investigation, and comes as special elections are about to be held in a number of states to fill U.S. House seats vacated by Republican members of Congress tapped to serve in the Trump Administration. … Longtime computer scientist and voting systems expert Barbara Simons of VerifiedVoting.org joins me today to explain the ongoing concerns about the still-mysterious Georgia hack, Verified Voting’s effort to get answers about it from GA’s Republican Sec. of State Brian Kemp; the group’s request to have him to offer paper ballots to voters in the wake of the reported “massive data breach”; and this weekend’s similarly cryptic news that the FBI has now concluded its investigation.
Editorials: The great electronic voting machine debate: Convincing the losers that they lost | Poorvi L Vora/Scroll.in
Accusations about the tampering of Electronic Voting Machines continue to be in news. India’s EVMs have been carefully designed to avoid some of the well-known security problems with electronic voting machines in the West. But it is difficult to agree with Former Chief Election Commissioner SY Quraishi’s assertion that all the Election Commission needs to do is double down and more forcefully insist that the EVMs are secure because that is what they believe. It is not about what insiders trust to be true about voting technology, but about what has been demonstrated to be true to the public about a particular election. Besides, no EVM, including the Indian ones, can be assumed to be invulnerable to a determined attacker. While India’s EVM design makes it harder to implement large-scale attacks, all EVMs do not have to be rigged. Machines judiciously chosen in constituencies that are more favorable to rigging, with the collusion of local individuals, after the random allocation described by Quraishi, could be sufficient. Additionally, in a country with a very efficient counterfeit mafia, we cannot expect that printed paper seals will always expose tampering efforts, because they can be replaced with counterfeit ones.
A group of technology experts said Tuesday that Georgia’s top elections officials should stop using electronic voting machines as the FBI reviews a suspected data breach. Secretary of State Brian Kemp and Kennesaw State University this month confirmed a federal investigation focused on the school’s Center for Election Systems. The center tests and certifies Georgia’s voting machines and electronic polling books used to check in voters at polling locations. Employees also format ballots for every election held in the state. The center isn’t part of Kemp’s office or connected to its networks, including Georgia’s database of registered voters maintained by the secretary of state’s office. The Atlanta Journal-Constitution first reported the investigation into the suspected cyberattack. In a letter to Kemp on Tuesday, 20 technology experts and computer science professors affiliated with the national Verified Voting organization said paper ballots will preserve voters’ confidence in the results of an upcoming special election to fill Georgia’s 6th District congressional seat. The letter said using equipment maintained by the center while it is the focus of a criminal investigation “can raise deep concerns.”