May 18, 2018 — Forget about whether Russians hacked election computers in 2016. We’ve got a bigger problem, and not much time to fix it. The November elections are less than six months away.
When the US Department of Homeland Security (DHS) and the Wisconsin Elections Commission (WEC) talk about “election security”, they talk only about the voter-registration system. WEC operates that system, and DHS can monitor it.
But the vote-counting system is separate. It resides on no computer that either of them can control, monitor, or inspect. It was outside their range of vision in 2016, and it’s outside their vision now. They don’t talk about voting-machine security because they don’t know.
Wisconsin’s vote-counting computers are controlled, protected, and monitored by our local election clerks and by three companies—ES&S, Dominion, and Command Central.
That’s all. No one else.
Local election clerks have exactly the level of IT sophistication you think they do. County clerks send our vote-counting software off to Nebraska or Colorado or Minnesota to be reprogrammed for each new election, with no way to notice if it comes back carrying malicious code. A few counties use an application supplied by those companies to reprogram the software themselves. They put a plastic seal on it when they’re done.
Wisconsin’s local election clerks will happily leave a service technician alone with a voting machine or the county’s election-management computer, with no way to notice if he installs malicious code or a wireless communications card. They put a plastic seal on the voting machines for Election Day.
Go ahead—ask them. They seal the software. They seal the machines. They seal the paper ballots that they could use—but don’t—to check the machines’ Election-Day accuracy.
And what about where the real danger lies—within the voting-machine companies? How well does their security guard against external hackers and corrupt insiders?
The companies themselves might not understand IT security. Professor Aviel Rubin of the Johns Hopkins University Information Security Institute checked with the major American voting-machine companies before the 2016 elections and discovered none employed “even one full-time trained expert in computer security.”
Congress, too, has been frustrated in its attempts to get straight answers about the companies’ security practices. When Congressman Ron Wyden tried to get answers from ES&S, he didn’t get a response from anyone with ‘security’ in their job title. Instead, a Senior Vice President for Governmental Relations replied, saying “At ES&S, security is the responsibility of not just one, but all who elect to work for our company.”
This governmental-relations expert reassured Rep. Wyden that ES&S had asked DHS “if they had knowledge of any such security issues involving ES&S to which they responded that they did not.” Well, whew.
ES&S—this company where every employee handles IT security and yet the vice president has to ask DHS to find out whether they’ve had a security breach—is the largest supplier of voting machines to Wisconsin. Just one of their machines—the DS200—counts more than 60% of Wisconsin’s votes, including votes from Milwaukee, Dane, Waukesha, and La Crosse Counties.
We cannot make the voting machine companies hire IT security staff before we elect a governor and a US senator in November.
And we cannot make our local election officials into IT sophisticates, ever.
But we can put an end to the honor system. That is, we can force our local election officials to use the paper ballots to detect and correct any miscounts before they declare election results final.
Our local election officials are the legal custodians of the paper ballots. They can unseal them anytime to count votes and make sure the voting machines counted right. At any time before the 2018 midterms, our local election officials could learn about results-audit practices already in use in other states and bring them to Wisconsin.
Do these three things today:
- Contact WEC. Tell them to exercise leadership in getting county clerks to audit election results during the canvass. Tell them to use some of the federal HAVA funds; they’ll know what that is.
- Contact your county clerk. Say you want the county canvass to make sure the voting machines identified the right winners before they certify the election results. If they don’t know how, tell them to contact the Election Verification Network or the Verified Voting Foundation.
- Contact your local newspaper editor. Tell him or her that you want to see local journalism take a sober look at voting-machine security right here in Wisconsin—and that doesn’t mean writing about plastic seals.