The Race to Secure Our Elections: Are We Ready for November?

In my last article I highlighted the most important advancements in election security. This post examines the next logical steps:

• Is all this progress enough?  
• Will our upcoming elections be more resistant to attack than they were in 2016?

The answer is somewhat qualified: "Yes, but not as much as we had hoped."

There are many ways to attack elections. Russia has several tools at its disposal such as disinformation campaigns and illegal campaign finance they can use to sabotage America’s elections. Even disregarding the broader democracy ecosystem in which elections operate, American elections remain vulnerable to cyber operations. 

Resolving long-standing architectural flaws in America’s voting systems before the November midterms will not happen. However, a broad consensus among election experts is developing that two policies can drastically improve election security in the short-term: voter-verified paper ballots and post-election audits.

Awareness of these factors has risen, but implementation trails behind. Multiple states still rely on voting systems without paper trails, and most states do not require post-election audits to ensure the validity of their results. Having a paper trail and audit capabilities are at best a deterrent if they are not used.

There are efforts underway to try and bring states up to par, most notably the Senate-proposed Secure Elections Act (SEA). The bill, if passed, would mandate three policy objectives:

1. reportage of cyber incidents,
2. voter-verified paper ballots that produce an auditable paper trail, and
3. post-election audits.

To be clear, the SEA would not prevent all foreign interference in America’s elections. Information operations, foreign financing of elections, and attacks against campaigns or voter registration databases would still be possible.  However, the SEA would give America’s voting systems a tolerable level of security from cyber-attacks.  It would be a Band-Aid for voting systems.

But time is running out.  Replacing voting systems and training election officials is not a quick task. If federal and local governments do not act soon, America’s voting systems will remain vulnerable.

The situation may seem dire, and to a large extent it is. However, there is some cause for hope. In 2017 Virginia, which faced a similar situation to what the entire nation faces now, was able to replace their paperless voting machines within 59 days of a statewide election. And Under Secretary Krebs recently testified before the House Committee on Homeland Security that he has “confidence in the resiliency of the system.” He also told members of the Committee that he had seen no evidence of a robust cyber operation like the one Russian carried out in 2016.

We should not leave legitimacy of our political system, let alone our democracy, up to the disposition of foreign adversaries.  Our election infrastructure is currently highly vulnerable to attack in several states, and we are running out of time to remedy that.

So, let's recap:

1. Some types of attack or interference efforts such as discredit attacks will persist nearly no matter what; a lie can circle the globe before the truth can find the keypad (e.g., unfounded claims of rigging, tampering or hacking). Countering these simply requires a proactive completely transparent messaging strategy.
2. Disruption attacks are more addressable, but they require ensuring cybersecurity steps have been implemented to protect vulnerable elements, combined with (again) a proactive completely transparent messaging strategy.  For instance, disruption attacks can cause polling place chaos (e.g., poll book errors and lengthy wait times).  For this type of attack, I believe on the whole, the nation's election operators are ready for this; they're locking systems down, putting in accountability and verification loops, preparing public messaging and tightening processes and protocols.
3. However, the third type of interference, subversion attacks; that is, actually making attempts to compromise voting system components or processes (i.e., counting and tabulation being the richest target, not individual ballot casting devices), which depend on computers of one form or another, will continue to be the most worrisome threat. On this point, America's election infrastructure security will, to a certain extent, twist in the wind until more trustworthy technology can be produced. 

To the extent of what unclassified (intelligence) information can tell us, we know the risks are real, but awareness and visibility are the most helpful means of mitigation.  Beyond what we can know today, it is clear that longer term we need a new technology design without the current inherent vulnerabilities.