Story highlights
- Federal funding for new voting machines hasn’t happened since 2002
- As the 2018 Senate election approaches, voters should demand that state legislatures allocate money to update old machines, Emefa Agawu says
Russian hackers targeted voting systems in
39 states in the summer and fall of 2016, according to Bloomberg. This comes on the heels of a leaked National Security Agency document revealing details of a Russian hacking operation against US election systems — news which was quickly eclipsed by the highly anticipated testimony of fired FBI Director James Comey and the UK election. But the Russian activity should have served as a loud wake-up call to anyone concerned about US election security. With the 2018 elections just around the corner, we can’t afford for these urgent lessons to be lost in the din of this news cycle.
Remember, elections in the US are quirky and decentralized. With more than 9,000 voting jurisdictions and a patchwork of authority and procedures, the people who end up having the most control over
election security are state and local officials.
It looks like the Russian government figured that out, too.
Here’s about all of what we know for sure: According to the
leaked NSA report, Russian hackers specifically
targeted local election officials in the days leading up to the 2016 election. How? By compromising one of the many vendors local elections officials rely on to help with the massive task of running elections. It appears that Russian agents sent spear-phishing emails to employees of the Florida-based e-voting equipment vendor, VR Systems. They tricked employees into giving up their login credentials. From there, Russian hackers were able to steal materials they could use to help send convincing fake emails to local election officials that are used to receiving communication from VR. As the Intercept reports, the NSA document shows that in the days leading up to the election, Russian hackers “sent spear-phishing emails to 122 email addresses ‘associated with named local government organizations,’ probably to officials ‘involved in the management of voter registration systems.'” These emails contained Microsoft Word attachments that, if clicked on, would likely install malware onto the user’s computer.
‘);$vidEndSlate.removeClass(‘video__end-slate–inactive’).addClass(‘video__end-slate–active’);}};CNN.autoPlayVideoExist = (CNN.autoPlayVideoExist === true) ? true : false;var configObj = {thumb: ‘none’,video: ‘politics/2017/06/09/senator-angus-king-disturbed-by-trump-dismissal-of-russia-attack-sot-ac.cnn’,width: ‘100%’,height: ‘100%’,section: ‘domestic’,profile: ‘expansion’,network: ‘cnn’,markupId: ‘body-text_10’,adsection: ‘const-article-inpage’,frameWidth: ‘100%’,frameHeight: ‘100%’,posterImageOverride: {“mini”:{“height”:124,”width”:220,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-small-169.jpg”},”xsmall”:{“height”:173,”width”:307,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-medium-plus-169.jpg”},”small”:{“height”:259,”width”:460,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-large-169.jpg”},”medium”:{“height”:438,”width”:780,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-exlarge-169.jpg”},”large”:{“height”:619,”width”:1100,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-super-169.jpg”},”full16x9″:{“height”:900,”width”:1600,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-full-169.jpg”},”mini1x1″:{“height”:120,”width”:120,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170608212147-senator-angus-king-2-small-11.jpg”}}},autoStartVideo = false,callbackObj,containerEl,currentVideoCollection = [],currentVideoCollectionId = ”,isLivePlayer = false,moveToNextTimeout,mutePlayerEnabled = false,nextVideoId = ”,nextVideoUrl = ”,turnOnFlashMessaging = false,videoPinner,videoEndSlateImpl;if (CNN.autoPlayVideoExist === false) {autoStartVideo = false;if (autoStartVideo === true) {if (turnOnFlashMessaging === true) {autoStartVideo = false;containerEl = jQuery(document.getElementById(configObj.markupId));CNN.VideoPlayer.showFlashSlate(containerEl);} else {CNN.autoPlayVideoExist = true;}}}configObj.autostart = autoStartVideo;CNN.VideoPlayer.setPlayerProperties(configObj.markupId, autoStartVideo, isLivePlayer, mutePlayerEnabled);CNN.VideoPlayer.setFirstVideoInCollection(currentVideoCollection, configObj.markupId);videoEndSlateImpl = new CNN.VideoEndSlate(‘body-text_10’);/*** Finds the next video ID and URL in the current collection, if available.* @param currentVideoId The video that is currently playing* @param containerId The parent container Id of the video element*/function findNextVideo(currentVideoId) {var i,vidObj;if (currentVideoId && jQuery.isArray(currentVideoCollection) && currentVideoCollection.length > 0) {for (i = 0; i 0) {videoEndSlateImpl.showEndSlateForContainer();}}}callbackObj = {onPlayerReady: function (containerId) {CNN.VideoPlayer.handleInitialExpandableVideoState(containerId);CNN.VideoPlayer.handleAdOnCVPVisibilityChange(containerId, CNN.pageVis.isDocumentVisible());if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {var containerClassId = ‘#’ + containerId;if (jQuery(containerClassId).parents(‘.js-pg-rail-tall__head’).length) {videoPinner = new CNN.VideoPinner(containerClassId);videoPinner.init();} else {CNN.VideoPlayer.hideThumbnail(containerId);}}},/** Listen to the metadata event which fires right after the ad ends and the actual video playback begins*/onContentEntryLoad: function(containerId, playerId, contentid, isQueue) {CNN.VideoPlayer.showSpinner(containerId);},onContentMetadata: function (containerId, playerId, metadata, contentId, duration, width, height) {var endSlateLen = jQuery(document.getElementById(containerId)).parent().find(‘.js-video__end-slate’).eq(0).length;CNN.VideoSourceUtils.updateSource(containerId, metadata);if (endSlateLen > 0) {videoEndSlateImpl.fetchAndShowRecommendedVideos(metadata);}},onAdPlay: function (containerId, cvpId, token, mode, id, duration, blockId, adType) {clearTimeout(moveToNextTimeout);if (blockId === 0) {(new Image()).src = “http://traffic.outbrain.com/network/trackpxl?advid=814&action=view”;}CNN.VideoPlayer.hideSpinner(containerId);if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(true);videoPinner.animateDown();}}},onContentPlay: function (containerId, cvpId, event) {var playerInstance,prevVideoId;/** When the video content starts playing, inject analytics data* for Aspen (if enabled) and the companion ad layout* (if it was set when the ad played) should switch back to* epic ad layout. onContentPlay calls updateCompanionLayout* with the ‘restoreEpicAds’ layout to make this switch*/if (CNN.companion && typeof CNN.companion.updateCompanionLayout === ‘function’) {CNN.companion.updateCompanionLayout(‘restoreEpicAds’);}clearTimeout(moveToNextTimeout);CNN.VideoPlayer.hideSpinner(containerId);if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(true);videoPinner.animateDown();}}},onContentReplayRequest: function (containerId, cvpId, contentId) {if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(true);var $endSlate = jQuery(document.getElementById(containerId)).parent().find(‘.js-video__end-slate’).eq(0);if ($endSlate.length > 0) {$endSlate.removeClass(‘video__end-slate–active’).addClass(‘video__end-slate–inactive’);}}}},onContentBegin: function (containerId, cvpId, contentId) {CNN.VideoPlayer.mutePlayer(containerId);if (CNN.companion && typeof CNN.companion.updateCompanionLayout === ‘function’) {CNN.companion.updateCompanionLayout(‘removeEpicAds’);}CNN.VideoPlayer.hideSpinner(containerId);clearTimeout(moveToNextTimeout);CNN.VideoSourceUtils.clearSource(containerId);jQuery(document).triggerVideoContentStarted();},onContentComplete: function (containerId, cvpId, contentId) {if (CNN.companion && typeof CNN.companion.updateCompanionLayout === ‘function’) {CNN.companion.updateCompanionLayout(‘restoreFreewheel’);}navigateToNextVideo(contentId, containerId);},onContentEnd: function (containerId, cvpId, contentId) {if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(false);}}},onCVPVisibilityChange: function (containerId, cvpId, visible) {CNN.VideoPlayer.handleAdOnCVPVisibilityChange(containerId, visible);}};if (typeof configObj.context !== ‘string’ || configObj.context.length 0) {configObj.adsection = window.ssid;}CNN.autoPlayVideoExist = (CNN.autoPlayVideoExist === true) ? true : false;CNN.VideoPlayer.getLibrary(configObj, callbackObj, isLivePlayer);});/* videodemanddust is a default feature of the injector */CNN.INJECTOR.scriptComplete(‘videodemanddust’);
How bad is this? On the one hand, it could be worse. VR Systems, the compromised vendor, runs voter registration and voter roll verification systems, not actual voting machines. On the other hand, compromising a trusted third-party vendor could allow a malicious actor to more easily compromise elections officials who do actually program voting machines and tabulators. And, even compromising voter rolls or registration can do a lot of damage, considering one could strategically remove certain voters from logs.
To complicate matters, state officials are left in an awkward position. An important part of their job is to keep public faith in election results to preserve political stability. But, in order to motivate their state legislatures into action (for appropriating funds for new machines and other reforms) they need to be able to convey the seriousness and specificity of the threat. It’s a fine line to walk.
Right after the NSA leak, Senate intelligence committee ranking member Sen. Mark Warner
said of Russian penetration that “the extent of the attacks is much broader than has been reported so far” and that several states had been targeted.
Our voting systems clearly face serious threat. With the 2018 election rapidly approaching, there’s no time to waste.
Here are four things we should do right now:
1. Ensure a paper trail for every vote cast
Thankfully, the vast majority of votes cast in the 2016 election left some kind of a paper trail. But according to data from
Verified Voting, a nonprofit that promotes election accuracy and transparency, five states — New Jersey, Delaware, Louisiana, South Carolina, and Georgia — still use electronic voting machines with no paper trail statewide. In Georgia, this resulted in unverifiable election results, most recently in an April 2017 special election, which was preceded by
breaches at a center responsible for election integrity and security, and the physical theft of sensitive voting equipment. By 2018, we must ensure that every vote cast has a paper trail.
2. Set higher standards for post-election audits, and make them mandatory
It’s not enough to have a paper trail. You have to use it. If someone did manage to alter the electronic vote record by hacking a voting machine, our best first chance to discover that would be a
post-election audit that compares the electronic vote tally to the paper tally. You do not have to count every paper ballot in order to do this. The audit methods have gotten very sophisticated over the past decade, and we know how to compare a statistically significant percentage of paper ballots with electronic votes in order to achieve a very high degree of certainty that the electronic vote was not tampered with. Unfortunately, though many states do compare electronic and paper tallies, not all states conduct these audits, and some conduct audits of subpar quality. Post-election audits should conform to the highest statistical standards, and should be mandatory.
‘);$vidEndSlate.removeClass(‘video__end-slate–inactive’).addClass(‘video__end-slate–active’);}};CNN.autoPlayVideoExist = (CNN.autoPlayVideoExist === true) ? true : false;var configObj = {thumb: ‘none’,video: ‘politics/2017/06/14/mueller-briefing-senate-intelligence-chairs-raju-lead.cnn’,width: ‘100%’,height: ‘100%’,section: ‘domestic’,profile: ‘expansion’,network: ‘cnn’,markupId: ‘body-text_22’,adsection: ‘const-article-inpage’,frameWidth: ‘100%’,frameHeight: ‘100%’,posterImageOverride: {“mini”:{“height”:124,”width”:220,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-small-169.jpg”},”xsmall”:{“height”:173,”width”:307,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-medium-plus-169.jpg”},”small”:{“height”:259,”width”:460,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-large-169.jpg”},”medium”:{“height”:438,”width”:780,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-exlarge-169.jpg”},”large”:{“height”:619,”width”:1100,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-super-169.jpg”},”full16x9″:{“height”:900,”width”:1600,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-full-169.jpg”},”mini1x1″:{“height”:120,”width”:120,”type”:”jpg”,”uri”:”//i2.cdn.cnn.com/cnnnext/dam/assets/170613093845-09-robert-mueller-file-small-11.jpg”}}},autoStartVideo = false,callbackObj,containerEl,currentVideoCollection = [],currentVideoCollectionId = ”,isLivePlayer = false,moveToNextTimeout,mutePlayerEnabled = false,nextVideoId = ”,nextVideoUrl = ”,turnOnFlashMessaging = false,videoPinner,videoEndSlateImpl;if (CNN.autoPlayVideoExist === false) {autoStartVideo = false;if (autoStartVideo === true) {if (turnOnFlashMessaging === true) {autoStartVideo = false;containerEl = jQuery(document.getElementById(configObj.markupId));CNN.VideoPlayer.showFlashSlate(containerEl);} else {CNN.autoPlayVideoExist = true;}}}configObj.autostart = autoStartVideo;CNN.VideoPlayer.setPlayerProperties(configObj.markupId, autoStartVideo, isLivePlayer, mutePlayerEnabled);CNN.VideoPlayer.setFirstVideoInCollection(currentVideoCollection, configObj.markupId);videoEndSlateImpl = new CNN.VideoEndSlate(‘body-text_22’);/*** Finds the next video ID and URL in the current collection, if available.* @param currentVideoId The video that is currently playing* @param containerId The parent container Id of the video element*/function findNextVideo(currentVideoId) {var i,vidObj;if (currentVideoId && jQuery.isArray(currentVideoCollection) && currentVideoCollection.length > 0) {for (i = 0; i 0) {videoEndSlateImpl.showEndSlateForContainer();}}}callbackObj = {onPlayerReady: function (containerId) {CNN.VideoPlayer.handleInitialExpandableVideoState(containerId);CNN.VideoPlayer.handleAdOnCVPVisibilityChange(containerId, CNN.pageVis.isDocumentVisible());if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {var containerClassId = ‘#’ + containerId;if (jQuery(containerClassId).parents(‘.js-pg-rail-tall__head’).length) {videoPinner = new CNN.VideoPinner(containerClassId);videoPinner.init();} else {CNN.VideoPlayer.hideThumbnail(containerId);}}},/** Listen to the metadata event which fires right after the ad ends and the actual video playback begins*/onContentEntryLoad: function(containerId, playerId, contentid, isQueue) {CNN.VideoPlayer.showSpinner(containerId);},onContentMetadata: function (containerId, playerId, metadata, contentId, duration, width, height) {var endSlateLen = jQuery(document.getElementById(containerId)).parent().find(‘.js-video__end-slate’).eq(0).length;CNN.VideoSourceUtils.updateSource(containerId, metadata);if (endSlateLen > 0) {videoEndSlateImpl.fetchAndShowRecommendedVideos(metadata);}},onAdPlay: function (containerId, cvpId, token, mode, id, duration, blockId, adType) {clearTimeout(moveToNextTimeout);if (blockId === 0) {(new Image()).src = “http://traffic.outbrain.com/network/trackpxl?advid=814&action=view”;}CNN.VideoPlayer.hideSpinner(containerId);if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(true);videoPinner.animateDown();}}},onContentPlay: function (containerId, cvpId, event) {var playerInstance,prevVideoId;/** When the video content starts playing, inject analytics data* for Aspen (if enabled) and the companion ad layout* (if it was set when the ad played) should switch back to* epic ad layout. onContentPlay calls updateCompanionLayout* with the ‘restoreEpicAds’ layout to make this switch*/if (CNN.companion && typeof CNN.companion.updateCompanionLayout === ‘function’) {CNN.companion.updateCompanionLayout(‘restoreEpicAds’);}clearTimeout(moveToNextTimeout);CNN.VideoPlayer.hideSpinner(containerId);if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(true);videoPinner.animateDown();}}},onContentReplayRequest: function (containerId, cvpId, contentId) {if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(true);var $endSlate = jQuery(document.getElementById(containerId)).parent().find(‘.js-video__end-slate’).eq(0);if ($endSlate.length > 0) {$endSlate.removeClass(‘video__end-slate–active’).addClass(‘video__end-slate–inactive’);}}}},onContentBegin: function (containerId, cvpId, contentId) {CNN.VideoPlayer.mutePlayer(containerId);if (CNN.companion && typeof CNN.companion.updateCompanionLayout === ‘function’) {CNN.companion.updateCompanionLayout(‘removeEpicAds’);}CNN.VideoPlayer.hideSpinner(containerId);clearTimeout(moveToNextTimeout);CNN.VideoSourceUtils.clearSource(containerId);jQuery(document).triggerVideoContentStarted();},onContentComplete: function (containerId, cvpId, contentId) {if (CNN.companion && typeof CNN.companion.updateCompanionLayout === ‘function’) {CNN.companion.updateCompanionLayout(‘restoreFreewheel’);}navigateToNextVideo(contentId, containerId);},onContentEnd: function (containerId, cvpId, contentId) {if (Modernizr && !Modernizr.phone && !Modernizr.mobile && !Modernizr.tablet) {if (typeof videoPinner !== ‘undefined’ && videoPinner !== null) {videoPinner.setIsPlaying(false);}}},onCVPVisibilityChange: function (containerId, cvpId, visible) {CNN.VideoPlayer.handleAdOnCVPVisibilityChange(containerId, visible);}};if (typeof configObj.context !== ‘string’ || configObj.context.length 0) {configObj.adsection = window.ssid;}CNN.autoPlayVideoExist = (CNN.autoPlayVideoExist === true) ? true : false;CNN.VideoPlayer.getLibrary(configObj, callbackObj, isLivePlayer);});/* videodemanddust is a default feature of the injector */CNN.INJECTOR.scriptComplete(‘videodemanddust’);
There’s more work to be done beyond these four steps to address our election security long term. We need to devote serious attention to the next generation of voting technology, as well as the separate but urgent issue of disinformation campaigns. But if we start now with these steps, we could be ready for 2018. And if we don’t, well, we can’t say we weren’t warned.
