(AP Photo/Bill Clark/CQ Roll Call)
Of all the disturbing questions raised by Russia's interference in last year's election, the most alarming may be how a foreign power might hack into the nation's voting infrastructure.
So far there's no evidence that Russian cyberattacks altered U.S. vote totals in any way. But recent disclosures make clear that Russian intelligence intrusions were much broader and deeper than initially known. And the U.S. election system, while it has strengths, remains vulnerable on several fronts. Aging voting machines, the absence of a paper trail in some states, and spotty audits are all weaknesses that could be exploited in 2018 and 2020.
The threat posed by foreign meddling in American voting is a rare point of bipartisan agreement on Capitol Hill, where the Senate Intelligence Committee held a hearing Wednesday on Russian election intrusions. The panel's GOP chairman, North Carolina's Richard Burr, and its top Democrat, Virginia's Mark Warner, called the hearing jointly, and both pressed intelligence and homeland security officials on what steps they are taking to better secure U.S. elections.
A big concern for Warner is federal officials' failure to fully disclose the extent of Russian cyber operations. Intelligence officials confirmed as early as last year that Russia had engaged in malicious cyber activity to assist in Donald Trump's election, including hacking into and leaking Democratic National Committee emails.
The apparent aim was both to sow chaos and undermine public confidence in the election, and to tamper with voter rolls and possibly even gain access to voting machines.
Federal Bureau of Investigation and Department of Homeland Security officials last year reported Russian intrusions into state and local election boards in just two states. In Arizona, a hacker tried to obtain voter-registration data but was blocked; in Illinois, voter files were accessed but not altered.
But a classified National Security Agency report leaked to The Intercept this month describes a Russian military intelligence cyberattack on a U.S. election systems vendor, and a far-reaching phishing scheme to lure election officials into opening Word documents tainted with malware in multiple states. The operation targeted voter-registration systems in 39 states, according to Bloomberg.
All this came as news to many state and local election officials, who last year received FBI and DHS warnings to strengthen their security systems and be on guard for cyber intrusions, but did not know the operation's sweep. That's a big problem, says Warner, who this week wrote to DHS Secretary John Kelly to press him to disclose the full scope of foreign attempts at election interference, and to disclose publicly exactly which states were targeted.
"I don't believe our country is made safer by holding this information back from the American public," said Warner at Wednesday's hearing. Pressed for details, a DHS official told Warner Wednesday that 21 states had been targeted.
Warner has commended DHS for designating the nation's voting system as critical infrastructure, not unlike the nation's electrical grid or health-care system, but has also demanded specifics on exactly how that will translate into assistance for states.
The good news, say election officials, is that the nation's decentralized system makes it extremely difficult to penetrate. There are 10,000 election jurisdictions in the United States, each using different machines, protocols, and security systems. State election officials have been at pains to reassure voters that election registration databases are not linked to vote counting, and that U.S. voting machines are not connected to the internet. More than half the states, moreover-33 in all-took DHS up on the agency's offer last year to help troubleshoot and improve their election security systems.
"The decentralization makes it very, very difficult," says David Becker, executive director of the Center for Election Innovation and Research. "One hack isn't going to do it. You need to hack into dozens or hundreds of jurisdictions to make this work."
The bad news is that the system's decentralization also makes for inconsistency, and has historically sapped election budgets.
A full 43 states are using voting machines that are at least a decade old and nearing obsolescence, making them vulnerable to malfunctions and crashes, according to the Brennan Center for Justice.
While most states-36 all told-use machines that produce a paper record, that still leaves 14 states that still operate machines with no voter verifiable paper trail. The absence of paper makes it virtually impossible to cross-check and confirm results after the fact.
And even states that use voting machines with paper trails don't make full use of them. Only 26 states require paper audits, according to the Brennan Center. Some security experts, moreover, argue that American voting systems are much more vulnerable than they appear. University of Michigan computer science and engineering professor J. Alex Halderman told the Intelligence Committee Wednesday that he knows America's voting machines are vulnerable, because he and his colleagues have attacked them repeatedly.
"While some states are doing well with security, others are alarmingly vulnerable," Halderman testified. Voting machines are not actually walled off from the internet, Halderman added, as ballots must be programmed via master computers before Election Day. Halderman placed the cost of replacing aging voting machines at $130 million to $400 million, and the cost of instituting robust post-election audits in all states at less than $20 million-a relative pittance.
Halderman warned that there's no doubt that Russia has the technical ability to commit hostile attacks against the U.S. election system. He echoed former FBI Director James Comey's prediction before the same committee earlier this month that Russia will be back. Said Halderman: "If we fail to act, I think it's only a matter of time before a major election is disrupted or stolen as the result of a cyberattack."
