Experts warn Trump's voting machine rhetoric is more dangerous than the actual vulnerabilities

Full text

Election officials in the U.S. are warning that President Donald Trump’s assertion that America’s voting machines aren’t safe is far more dangerous than the vulnerabilities he highlighted in his Thursday night address.

Flaws in electronic voting machines have been well-documented for more than a decade by researchers, and states have poured money into bolstering security. Still, none have ever been exploited by malicious actors to successfully change the outcome of an election.

Now officials are worried that Trump’s latest comments — when he claimed that “Americans were blatantly lied to about the security of our election infrastructure, including the security of electronic voting machines” — could undermine the electorate’s fundamental faith in voting. Without confidence in the system, the entire process could be called into question, as voters choose not to cast ballots or refuse to accept election results.

“There’s nothing wrong with pointing out vulnerabilities and therefore doing audits or therefore upgrading to a more modern system that uses a paper record,” said Gowri Ramachandran, director of elections and security at the Brennan Center for Justice’s Elections and Government Program. “What’s wrong is trying to use those vulnerabilities to spread distrust in elections.”

Colorado’s Democratic Secretary of State Jena Griswold stressed during a Center for American Progress event Friday that “nothing the president said was groundbreaking, new or actually a vulnerability that has been exploited or is not being addressed.”

There is no evidence that foreign or domestic hackers have ever exploited electronic voting machines to change votes or impact the outcome of an election. Investigators did find that Russian hackers successfully accessed the voter registration databases of a few U.S. states ahead of the 2016 elections, but they never changed any votes. To date, that’s the most intensive hacking effort documented by federal authorities involving U.S. elections.

Documents released by the White House on Thursday night did not back up Trump’s claims of widespread exploitation of electronic voting machines. One 2020 report from the National Intelligence Council detailed concerns that foreign hackers might seek to compromise U.S. election infrastructure, but did not conclude this occurred.

A separate report from the Cybersecurity and Infrastructure Security Agency also released Thursday night concluded that “U.S. election systems are subject to the same security concerns as most other software systems,” such as outdated certification efforts. CISA made no judgment calls on whether the machines had been compromised.

“I’m not aware of an incident in which a vote has been changed through a hack,” said Scott Algeier, executive director of the Information Technology Information Sharing and Analysis Center, which serves as a way for IT companies to share threat information. “There’s lots of opportunity for that to happen because we have lots of elections, and I think the fact that it hasn’t happened is an indication of how secure the overall election process is.”

But while electronic voting machines have not been exploited at scale, they do have vulnerabilities that researchers have pressed manufacturers and election officials alike to patch for more than 10 years.

Many of these vulnerabilities have been discovered during the annual Voting Village gathering at the DEFCON conference in Las Vegas, where hackers are able to physically rip apart some of the more common types of voting machines and poll books used across the country. Each time, they’ve found vulnerabilities.

At the 2017 event , each piece of equipment in the room was breached by participants within three days, including one electronic voting system that was hacked and remotely taken control of in minutes. Several machines were found to have Chinese hardware, raising concerns about supply chain vulnerabilities. In 2018 , a voting tabulator used in 23 states at the time was remotely hacked. And the 2020 NIC report released by the White House referenced the modification of a poll book at the 2019 Voting Village to run the video game Doom.

Harri Hursti, co-founder of the Voting Village, stressed Friday that the mere presence of vulnerabilities in the equipment — often found by hackers physically accessing them — does not mean any sort of widespread compromise has ever taken place.

“Every system on the planet is almost guaranteed to have some vulnerabilities — but that doesn’t mean that the vulnerabilities are exploitable,” Hursti said Friday. “All vulnerabilities should be fixed, and prioritizing exploitable ones first — but just the presence of vulnerabilities is not in any shape or form an indication that the system has been breached.”

The Russian hacking efforts in 2016 actually contributed to making it even harder for hackers to make a dent in U.S. election outcomes. It spurred election officials across the country to move towards either using paper ballots or electronic machines with paper trails. As a result, only around 4 percent of registered voters currently live in regions where only direct recording electronic systems are used for voting, ensuring that there is a paper trail documenting how the vast majority of Americans voted.

“These are machines that very few Americans actually vote on anymore, where they would pick their selections on a touchscreen, and then the computer would record the selection in its internal system and not actually provide any kind of paper record,” Ramachandran said.

And if even hackers were to access one type of voting machine, it would be virtually impossible to scale that attack up to change the outcome of an election, since U.S. elections are run differently by each state and are often segmented further between counties.

“Elections are so decentralized in the United States, and each state has its own laws on what type of equipment can be used in elections, what type of certification or process has to be followed before doing that,” Ramachandran said.

The Trump administration may aim to take further measures ahead of November to address election security concerns. Homeland Security Secretary Markwayne Mullin said in a speech Friday that DHS is “going to make our security enhancements mandatory,” noting that if states wanted federal election security grants, they would need to adhere to changes including using a federal database to check their voter rolls for noncitizens.

Griswold said Friday that blocking the funds from states that didn’t comply with DHS rules was “likely unlawful” given that states have jurisdiction over elections, and noted that these DHS funds were largely used by law enforcement groups, not for upgrading equipment.

“We are not reliant on these DHS grants to secure our elections, but Colorado will be less secure as a result of an unlawful maneuver by the federal government,” Griswold said.

States and localities have long struggled to fund upgrades to election equipment, including enhancing the cybersecurity of the voting process. Congress has stepped in and appropriated around $1 billion in election security funds to states since 2018, used to buy new secure equipment and provide cybersecurity training to poll workers. But those funds have not been divided out evenly over the years, and only $45 million was given to states in the most recent fiscal year.

The funds are managed by the Election Assistance Commission, which is currently without any leaders after Trump dismissed its three remaining commissioners last week. Former EAC Commissioner Benjamin Hovland said on the same panel as Griswold Friday that if Trump wants states to further secure their machines against cyber threats, more money is needed.

“Election experts have been saying for years … to invest in the infrastructure of our democracy, give money to support these things, and despite the rhetoric, you never see support for funding, and certainly not the funding levels that are needed,” Hovland said.