Tue, Jan 07, 2020 - Page 9 News List

US voting machines tied to security risk of public Internet

Even a split second of Internet connectivity is enough for malware to propagate, but rules to make voting machines more secure will not arrive in time for the US presidential election in November

By Kartikay Mehrotra  /  Bloomberg

Illustration: Yusha

After Russian hackers made extensive efforts to infiltrate the American voting apparatus in 2016, some US states moved to restrict Internet access to their vote-counting systems. Colorado got rid of barcodes used to electronically read ballots. California tightened its rules for electronic voting machines that can go online. Ohio bought new voting machines that deliberately excluded wireless capabilities.

Michigan went in a different direction, authorizing as much as US$82 million for machines that rely on wireless modems to connect to the Internet. State officials justified the move by saying it is the best way to satisfy an impatient public that craves instantaneous results, even if they are unofficial.

The problem is, connecting election machines to the public Internet, especially wirelessly, leaves the whole system vulnerable, according to cybersecurity experts.

So Michigan’s new secretary of state is considering using some of the state’s US$10 million in federal election funds to rip out those modems before the presidential primary in March.

“The system we inherited is not optimal for security, since our election equipment can and has connected to the Internet,” said Jocelyn Benson, who won election as secretary of state and took office in January last year.

Benson convened a committee of cybersecurity experts to evaluate the state election system’s vulnerabilities.

“If that’s what the committee recommends, we’ll take them out,” she said.

Michigan’s experience illustrates a thorny challenge for state and local election officials as they try to update old and insecure equipment: Technology that has evolved over two decades to quickly transit election results from precincts to news organizations projecting winners has now been labeled a cybersecurity risk.

Michigan says its votes are safe from hackers, as its election system connects to the Internet only after votes have been counted. Cybersecurity experts differ.

Even brief exposure to the Internet can leave states vulnerable to infiltration and an attack on the credibility of their results, said Eddie Perez, global director of technology at the Open Source Election Technology Institute.

Part of the challenge of protecting this year’s vote is convincing localities to prioritize security over familiarity, convenience and accessibility.

Cybersecurity experts maintain that connecting election systems to the Internet, even briefly, exposes these machines to malicious attackers who might be intent on derailing or discrediting an election. It is not just voting machines that are vulnerable, but any piece of the election apparatus, including wireless-enabled printers, digital check-in tablets, tabulators and even the registration database, they said.

And yet, some local and state election officials remain committed to wireless-enabled machines, which allow them to quickly provide results to the public and more easily accommodate disabled voters. Heading into the US presidential election, Rhode Island, Wisconsin, Georgia and Florida are among at least 11 states that still allow voting jurisdictions to use wireless-enabled voting equipment.

“Connecting for a millisecond is enough to propagate malware through a system,” said Rich DeMillo, a computer science professor at the Georgia Institute of Technology and a member of Michigan’s election security panel. “Every weak link in the chain of network security is a problem, so opening the door to the Internet is just a bad idea in every conceivable scenario.”

Comments will be moderated. Keep comments relevant to the article. Remarks containing abusive and obscene language, personal attacks of any kind or promotion will be removed and the user banned. Final decision will be at the discretion of the Taipei Times.

TOP top