US election security: still a dumpster fire

Securing Our Cyber Future, Stanford Cyber Policy Center's new report on election security, depicts a US electoral system whose glaring vulnerabilities are still in place, three years after the chaos of the 2016 elections.

It's not all terrible: digital-only voting machines are dwindling away, with the majority of voting machines delivering a voter-verified paper ballot that can be manually recounted by auditors or if there is a question of fraud or malfunction, but there are still plenty of digital-only systems in the field, and across the board, voting machines are aging, error- and fault-prone, and generally insecure, with vendors who would prefer to bluster and threaten critics than fix their products.

There's some progress on eliminating the voting-machine business altogether, with a free/open source system emerging from Los Angeles County's election authorities -- LA County is a national leader in election security and inclusiveness, with an 11-day voting window, available paper ballots for all, and a slate of accessibility features in its machines.

But LA County is an exception, and between the poor-quality systems in place nationwide, intransigence from Senate Republicans on allocating funds for election security, and the diplomatic chaos that has failed to produce any international norms on election meddling, 2020 is looking like a potential shitshow to put 2016 to shame.

Replacing insecure and aging voting machines around the country, introducing post-election audits in the dozens of states that don’t yet have them, shoring up election network defenses, and expanding security personnel all take money. And while independent, locally adjudicated elections are a cornerstone of US democracy, researchers say that federal funding is still badly needed to make sure all election systems around the country have high-caliber security defenses in place.

Securing Our Cyber Future, Stanford Cyber Policy Center's new report on election security, depicts a US electoral system whose glaring vulnerabilities are still in place, three years after the chaos of the 2016 elections.

It's not all terrible: digital-only voting machines are dwindling away, with the majority of voting machines delivering a voter-verified paper ballot that can be manually recounted by auditors or if there is a question of fraud or malfunction, but there are still plenty of digital-only systems in the field, and across the board, voting machines are aging, error- and fault-prone, and generally insecure, with vendors who would prefer to bluster and threaten critics than fix their products.

There's some progress on eliminating the voting-machine business altogether, with a free/open source system emerging from Los Angeles County's election authorities -- LA County is a national leader in election security and inclusiveness, with an 11-day voting window, available paper ballots for all, and a slate of accessibility features in its machines.

But LA County is an exception, and between the poor-quality systems in place nationwide, intransigence from Senate Republicans on allocating funds for election security, and the diplomatic chaos that has failed to produce any international norms on election meddling, 2020 is looking like a potential shitshow to put 2016 to shame.

Replacing insecure and aging voting machines around the country, introducing post-election audits in the dozens of states that don’t yet have them, shoring up election network defenses, and expanding security personnel all take money. And while independent, locally adjudicated elections are a cornerstone of US democracy, researchers say that federal funding is still badly needed to make sure all election systems around the country have high-caliber security defenses in place.

In March 2018, Congress appropriated $380 million to states for election infrastructure and security upgrades through the 2002 Help America Vote Act. And just this week, a House Appropriations subcommittee preliminarily approved a 2020 funding bill that includes a much-needed $600 million for the Election Assistance Commission, which facilitates election infrastructure improvements and disperses federal funds to states. The bill has a long way to go before passage, but amidst other disputes, the election funding didn't specifically draw criticism from lawmakers in early discussions.

Secure election advocates say, though, that federal funding has not come quickly enough and that it needs to be consistent and reliable over time, rather than a one-off investment every decade or so.

Securing Our Cyber Future [Stanford Cyber Policy Center]

Election Security Is Still Hurting at Every Level [Lily Hay Newman/Wired]

(via Schneier)

(Image: @NOLAFireDept)