VoteAllegheny presents a report by Carnegie-Mellon researchers on the vulnerabilities in a single county in a swing state. The biggest takeaway for us is understanding that a top-down analysis of vulnerabilities can yield the most cost-effective areas to focus on preventing election fraud. Where we spend our resources can make a difference in the results!
American Progress Report: Election Security in All 50 States
The report gives every state grades based on some detailed criteria. Connecticut was graded ‘B’, which it shared with several other states as the highest grade awarded. Yet there are problems and limitations with such reports. We would give Connecticut lower grades in some areas, higher in others, and are uncomfortable with other grades.
The report is useful and provides directions for improvement in many areas in every state. Election officials, legislators, and voters should act to improve our voting systems and laws in the near term. We would give the authors A+ for effort and the report a grade of B.
Almost every day lately there is news on the potential of future and past hacking, including election hacking. Today we suggest three recent articles and a report.
The N.S.A. bans its analysts from using Kaspersky antivirus at the agency, in large part because the agency has exploited antivirus software for its own foreign hacking operations and knows the same technique is used by its adversaries.
If Russia can attack our election, so can others: Iran, North Korea, ISIS, or even criminal or extremist groups.
Exactly a year after U.S. intelligence issued a stern warning about Russian interference in the 2016 presidential election, the Trump administration has failed to fill key homeland security posts responsible for preventing another Kremlin assault on the voting system…
It sounds like science fiction, or at least “Ocean’s 11,” but cybersecurity experts are frantically waving their hands, trying to get Americans to see that in foreign capitals, the American voting system just looks like easy opportunity.
Recent events are a reminder that we must be eternally skeptical. We need to be especially skeptical of the mainstream media as well as other sources.
Today we add the most recent flurry about the “21 states hacked by Russia before the 2016 election”, and more. The story continues to fall apart, bit by bit. Yet, we suspect the truth is far from common knowledge.
And an Intercept story by Kim Zetter reviewing a report by Kaspersky Lab Masquerading Hackers Are Forcing a Rethink of How Attacks Are Traced. The title pretty much says it all. Attribution is difficult, yet often possible.
Citizen Audit: Two Blows to Connecticut Election Audits
Leave Them Weaker, Less Credible
From the Press Release:
In spite of growing national concerns about election integrity, election credibility in Connecticut has suffered two devastating blows:
The Connecticut General Assembly cut post-election audits in half from 10% to 5% of voting districts, and failed to fix glaring weaknesses in the state’s audit law.
Shockingly, Connecticut has become the first state to replace verifiable hand-count audits with unverifiable electronic audits. Now the public can’t verify audit results.
“It need not be this way. Electronic audits can be manually verified without sacrificing efficiency,” said Luther Weeks, Executive Director of Connecticut Citizen Election Audit. “Because audits are conducted by the same officials responsible for conducting elections, audits must be transparent and publicly verifiable,” he said.
The Citizen Election Audit also found continuing problems with how municipalities conducted audits. “The Secretary’s Office should take the lead in ensuring that audits are complete, credible, and publicly verifiable,” Weeks said. “The public, candidates, and Secretary Merrill should expect local election officials to organize audits that produce accurate audit reports,” he said.
We favor “Evidence Based Elections”. We recently reread this 2012 paper by Phil Stark and David Wagner, Evidence-Based Elections
It covers at a high level the requirements to provide the public and losing candidates the evidence necessary to convince that its very likely the candidate favored by the voters actually was declared the winner of an election (or determining, if possible, the winner).
Compared to all the states in the Union, Connecticut would rank slightly above average, yet far from approaching credible evidence-based elections. We have paper ballots, inadequate post-election audits, close-vote recanvasses, no compliance audits, and atrociously weak ballot security. This is a case where a rating/ranking should be the result of multiplying the factors, rather than adding them:
Paper Ballots(1.0) x Post-Election Audits(0.3) x Self-Correcting(0.4) x Compliance(0) = 0
Checks on State Voting Machines Do Not Make the Grade
Do Not Provide Confidence in Election System, Says Citizen Audit
From the Press Release:
Audits of the recent presidential primaries are so faulty that exact final vote tallies cannot be verified, says the non-partisan Connecticut Citizen Election Audit. Unless state and local election officials make changes, the same will be true for the November elections.
“State law requires audits to verify the accuracy of optical scanner voting machines as a check for errors and a deterrent to fraud. Local registrars gather officials to manually count paper ballots and compare their totals to the totals found by the scanners”, explains Luther Weeks, Executive Director of Connecticut Citizen Election Audit.
Issues reported by the group were:
Incomplete or missing official reports of vote counts from town registrars;
The lack of action on the part of the Secretary of the State’s Office to check that all required reports are submitted and all submitted reports are completed fully;
Of 169 municipalities required to submit lists of polling places before the election, the Secretary of the State’s Office recorded only 68, with 101 missing;
Poor security procedures to prohibit ballot tampering;
Not following procedures intended to ensure “double checking” and “blind counting” rather than having scanner counts as targets while counting manually;
“The public, candidates, and the Secretary of the State should expect local election officials to organize proper audits and produce accurate, complete audit reports. The public and candidates should expect the Secretary of the State’s Office to take the lead in ensuring the audits are complete. Yet, due to a lack of attention to detail and follow-through the audits do not prove or disprove the accuracy of the reported primary results,” Weeks said.
From the Institute for Critical Infrastructure Technology: Hacking Elections Is Easy <read>. It is the most layperson accessible comprehensive overview of the problems we face protecting our elections that I have seen in a long time. It is 23 pages yet very readable. The main points are:
We face multiple risks our elections: Registration systems, voting systems, reporting systems, and ballot security.
We face risks from multiple actors: Nations with interests in manipulating our elections, corporations, U.S. Government agencies, sophisticated hackers, and insiders at all levels.
For the unsophisticated, Hacking Is Easy. There are simple insider attacks, simple cyber attacks, and kits on the Internet to compromise results or simply disrupt elections.
Most election officials are of high integrity. Yet, blind trust in all officials, machines, and that hacking is difficult is perhaps our greatest risk.
Just a couple excerpts from the Introduction:
To hack an election, the adversary does not need to exploit a national network of election technology. By focusing on the machines in swing regions of swing states, an election can be hacked without drawing considerable notice. Voter machines, technically, are so riddled with vulnerabilities that even an upstart script kiddie could wreak havoc on a regional election, a hacktivist group could easily exploit a state election, an APT could effortlessly exploit a national election and any corrupt element with nothing more than the ability to describe the desired outcome could order layers of exploits on any of the multitude of deep web forums and marketplaces. Yes, hacking elections is easy…
A new report from the Electronic Privacy Information Center, articulates some of the risks of losing the the Secret Ballot: Secret Ballot At Risk: Recommendations for Protecting Democracy <Exec Summary> <Report>
We recommend reading the Executive Summary and at least the section of the report covering the history of and the need for the secret ballot, pages 4-9 and the section for your state, e.g. Connecticut pages 54-55.
