Oh Were These Election Systems Not Supposed To Be On The Internet? Oh Dear.

Did we mention those systems aren't supposed to be on the internet? That's the bad part.

Motherboard broke a story about election security yesterday that may not quite rise to the level of pants-pissing OMG panic, but which ought to have people good and concerned. You see, one of the reasons we're supposed to not worry too much about hacking of election systems is that election officials and the companies who sell the elections systems assure us those systems aren't on the internet, so they can't be hacked. Except, oops!

[A] group of election security experts have found what they believe to be nearly three dozen backend election systems in 10 states connected to the internet over the last year, including some in critical swing states. These include  systems in nine Wisconsin counties, in four Michigan counties, and in seven Florida counties—all states that are perennial battlegrounds in presidential elections.

The research project started about a year ago, and some of the systems were on the internet all that time. The researchers notified a Homeland Security information-sharing group about the problem last year, and some systems got off the internet, yay them. But! "[A]t least 19 of the systems, including one in Florida's Miami-Dade County, were still connected to the internet this week," according to the researchers.

The article reminds us frequently that all the researchers found were potential vulnerabilities, some ways the election systems might be open to hacking -- not any evidence of actual tampering. In fact, as long as all the state and county election systems are set up with exactly the right safeguards recommended by the systems' manufacturers, then no baddies should be able to get in.

Problem is, one big hairy security recommendation is that election systems not be connected to the internet at all, so maybe there's not much cause for confidence about the rest of the possible vulnerabilities, either. Hi-ho!

The particular systems the researchers looked at are made by the nation's biggest vendor of voting machines, Election Systems & Software (ES&S). (We'll leave you to discover ES&S's long fine history of ARE YOU KIDDING ME for yourselves.) And we're not even talking electronic vote machines -- these are optical scan machines with paper ballots. Here's what we hope will be the most technical stuff in this post:

Generally, votes are stored on memory cards inside the voting machines at polling places. After an election, poll workers remove these and drive them to county election offices. But some counties want to get their results faster, so they use wireless modems, either embedded in the voting machines or externally connected to them, to transmit the votes electronically. The system that receives these votes, called an SFTP server, is connected to the internet behind a Cisco firewall.

For security reasons, the SFTP server and firewall are only supposed to be connected to the internet for a couple of minutes before an election to test the transmission, and then for long enough after an election to transmit the votes. But the researchers found some of the systems connected to the internet for months at a time, and year-round for others, making them vulnerable to hackers.

That sounds like a bit of an oversight! Worse, other important systems are connected to the firewall, like the magic elf machines that tabulate votes and "the  election-management system that is used in some counties to program voting machines before elections." If hackers manage to get through those firewalls, very bad things could happen:

The researchers said that gaining access through the firewall to these systems could potentially allow a hacker to alter official election results or subvert the election-management system to distribute malware to voting machines through the USB flash drives that pass between this system and the voting machines.

If the voting machines themselves could be infected with malware, that could be very bad for vote-counting, since that could even affect a recount: Ballots would be run through the scanners again, but if the scanning machines themselves are corrupted, yikes.

And how secure are those firewalls? If they're configured correctly, they're very secure! Unfortunately, the piece notes, "misconfigured firewalls are one of the most common ways hackers penetrate supposedly protected systems" -- which is how the recent Capital One hack happened.

Thank goodness, we bet most state and county elections systems are more carefully maintained than that big old bank, probably. Haha, don't be silly; lots of places just let the vendors install the systems and then assume they work just fine. If there's a problem, they can always reinstall Windows Vista, right?

Motherboard talked to a computer expert who isn't all that sanguine about the chances that elections officials are on top of their own tech:

"If they did everything correctly [with the ES&S systems] as they say they do, there is no danger," Robert Graham, CEO of Errata Security, told Motherboard. "These are all secure technologies that if [configured] correctly work just fine. It's just that we have no faith that they are done correctly. And the fact that [election officials are] saying they aren't on the internet and yet they are on the internet shows us that we have every reason to distrust them."

That's a pretty bold take for a guy who talks with that many [brackets]!

Again, while there's nothing to suggest any of these systems have been hacked, the fact that they could be ought to be keeping some elections officials awake at night, at least when they're not too busy trying to keep minorities from voting.

Sen. Ron Wyden, (D-Oregon) is one unhappy geek about all this, and says election security shouldn't be left up to for-profit election machine vendors. He's also not a fan of leaving cybersecurity solely up to "county election offices, many of whom do not employ a single cybersecurity specialist."

Says Wyden, "Not only should ballot tallying systems not be connected to the internet, they shouldn't be anywhere near the internet." To that end, Wyden would like to see a couple of bills make it past Mitch McConnell's blockade of election security:

the SAFE Act and a Wyden bill called PAVE Act [which] would e  ffectively ban transmission of votes via modem and prohibit connecting any election-reporting or election-management system to the internet or to a telecommunications network at any time.

But there's a lot of money to be made selling and maintaining such systems, so let's not get our hopes up too much, shall we?

[ Motherboard ]

Yr Wonkette is supported 100 percent by reader donations. Please send us money to help us keep you connected to news and dick jokes!