Election Security Insights – August 2018

Hackers congregated in Las Vegas last week for the annual Defcon convention, and the topic of election cybersecurity was front and center. As the November US midterm elections draw closer, the reality of Russian interference in the 2016 election has moved election cybersecurity from a relatively niche technical issue to a high profile subject that warrants its own specialized event at the conference. For the second year, Defcon has hosted "Voting Village" giving hackers an opportunity to do their best to break into and/or defend election machines.

The result was similar to last year - hackers successfully infiltrated voting equipment which outlined issues with voting machines and emphasized that upgrades, patching, and having appropriate staff are still the best answers to addressing vulnerabilities. However, the "Voting Village" exercises were able to explore only a few of the many complex components involved in the elections ecosystem. While they exposed that there are critical elements that need to be fixed, it would be overreaching and overreacting to say it means the elections infrastructure is incompetent.

Here's why. It's difficult to simulate the reality of the elections ecosystem. First, it's much broader than voting machines, which Defcon attempted to demonstrate this year by adding mock election office networks and voter registration databases for participants to defend and/or hack. Secondly, election process elements, like networks, databases, voter check-in and results publishing, are widely disconnected from one another, both logically and geographically. Yet, out of logistical necessity, these elements were connected at Defcon which provided unfettered access and interconnectivity that doesn't exist in the real world.

The key takeaway is there are important distinctions between the issues that surfaced at Defcon and their outcomes in real life conditions. It doesn't mean that there is nothing to learn from a meeting like this, but it does mean we need to properly understand the context. Election officials are right to point out that the hacks are unrealistic, but the heightened awareness generated by these exercises have helped spur action by lawmakers who have begun to introduce election security legislation. If a singular message exists, its the need to be proactive and advocate for resources to fix the issues.