Cybersecurity 202: Voting machines vulnerable to hacking

These voting machines are coming to New York unless we act. 

Contact the governor :

https://www.governor.ny.gov/content/governor-contact-form

Dear Governor Cuomo:  Do not approve any BMD voting machines for New York.  They are vulnerable to hacking.  Stay with our current system of hand marked paper ballots for those who are able, with separate scanners to protect our vote count.

Contact your state legislator

Dear [Your Legislator]:  

Please cosponsor  A8597/Amy Paulin or S06733/Myrie banning hybrid voting machines .  Do not approve any BMD voting machines for New York.  They are vulnerable to hacking.  Stay with our current system of hand marked paper ballots for those who are able, with separate scanners to protect our vote count.

…………………………………………………………………

“...BMDs, .. at least 18 percent of the country's districts will use as their default voting machines in November. The results are a major blow for voting machine companies and election officials, who have touted BMDs as a secure option in the wake of Russia’s 2016 efforts to compromise U.S. election infrastructure.

"The implication of our study is that it’s extremely unsafe [to use BMDs], especially in close elections,” Alex Halderman, … one of seven authors of the study

"...The findings come as election security groups in Pennsylvania are already suing to block some counties from using a specific brand of BMDs, the ExpressVote XL machines designed by Election Systems & Software, over hacking fears. The same machines also went haywire and called the wrong winner in a Pennsylvania county judge's race in November.  "

…………………………………………………………………………

https://www.washingtonpost.com/news/powerpost/paloma/the-cybersecurity-202/2020/01/08/the-cybersecurity-202-voting-machines-touted-as-secure-option-are-actually-vulnerable-to-hacking-study-finds/5e14cc6e602ff125ce5bd747/

PowerPost

The Cybersecurity 202: Voting machines touted as secure option are actually vulnerable to hacking, study finds
By Joseph Marks
January 8 at 7:41 AM

The ImageCast X ballot marking device is displayed at the Sacramento County Department of Voter Registration and Elections on March 5, 2018 in Sacramento, California. (Photo by Justin Sullivan/Getty Images)


New voting machines that hundreds of districts will use for the first time in 2020 don’t have enough safeguards against hacking by Russia and other U.S. adversaries, according to a study out this morning from researchers at the University of Michigan. 

The study marks the first major independent review of the machines called ballot-marking devices, or BMDs, which at least 18 percent of the country's districts will use as their default voting machines in November. The results are a major blow for voting machine companies and election officials, who have touted BMDs as a secure option in the wake of Russia’s 2016 efforts to compromise U.S. election infrastructure.

“The implication of our study is that it’s extremely unsafe [to use BMDs], especially in close elections,” Alex Halderman, a University of Michigan computer science professor and one of seven authors of the study, said in an interview. 

People who use BMDs cast their votes using a computer touch screen, but the machine spits out a paper record of those votes. That is usually used to tally the results and can be saved for audits that ensure votes were tallied correctly. 

The machines were touted by election officials as a compromise between paperless voting machines, which experts uniformly agree are far too vulnerable to hacking, and hand-marked paper ballots, which serious cybersecurity hawks favor but which can be tougher to tally and are inaccessible for many people with disabilities.

But only a handful of people who vote on BMDs are likely to check that their votes were recorded accurately, the researchers found – meaning that if hackers succeed in altering even a small percentage of electronic votes, they might be able to change the outcome of a close election without being detected. 

“There's been a lot of discussion in the election security community about whether BMD verification works as a defense against hacking, but nobody really had any hard numbers,” Halderman told me. “Now, for the first time, we have an experimental data point and, unfortunately, the results confirm some of our worst fears.”

The findings come as election security groups in Pennsylvania are already suing to block some counties from using a specific brand of BMDs, the ExpressVote XL machines designed by Election Systems & Software, over hacking fears. The same machines also went haywire and called the wrong winner in a Pennsylvania county judge's race in November. 

ES&S told me by email it would review the the study "for insight into how we can assist election officials in ensuring a smooth voting process."

The researchers list several recommendations for how election officials can use BMDs as safely as possible, but the clear lesson is that voting jurisdictions should switch to hand-marked paper ballots if at all possible, Halderman told me. 

“There is a strong security reasons to prefer hand-marked paper ballots,” he said. 

The researchers watched 241 people vote on a BMD machine in a simulated election — all of whom had at least one of their votes changed on the printed-out ballot. They found only 40 percent of voters reviewed their ballots at all and only about 7 percent told a poll worker something was wrong. At those rates, it's highly likely that if hackers changed just 1 or 2 percent of votes in a close election, they wouldn't be discovered, they said. 

The researchers also tried several methods to get voters to check their ballots for errors, including postings signs and having poll workers urge them to review the ballots — but none of them improved error detection “to the point that BMDs can be used safely in close or small elections,” the researchers found. 

Congress, however, has steered clear of mandating that states use specific voting equipment, such as machines with paper ballots, or to conduct post-election security audits. Lawmakers have appropriated about $900 million for election security since 2016, including $425 million in December, but none of it has come with any of those specific cybersecurity mandates favored by Democrats.

Yet even most Democrats don’t insist that voters should use use hand-marked paper ballots rather than BMDs. Only one major bill, sponsored by Sen. Ron Wyden (D-Ore.), would mandate that hand-marked ballots are the default for voters. That bill also includes $250 million to develop secure BMDs for people with disabilities who cannot use hand-marked paper ballots. 

This story has been updated to add comment from ES&S.