After DNC Hack, Cybersecurity Experts Worry About Old Machines, Vote Tampering

Aug 20, 2016
Originally published on August 20, 2016 11:21 am

Security experts say that Russian hackers have broken into the computers of not only the Democratic National Committee but other targets as well.

This has raised a new wave of concerns that on Election Day, the votes themselves could be compromised by hackers, potentially tipping the results. Most states have returned to paper-backed voting systems in recent years, but that still leaves vulnerable a number of states that rely solely on machines.

Zeynep Tufekci, a professor at the University of North Carolina's School of Information and Library Science, tells NPR's Scott Simon that without these paper-backed systems, up to 15 states could be putting their election results at risk. That's a possible reach of 60 million voters — "enough to swing an election," Tufekci says.


Interview Highlights

On how easy it is to tamper with voting machines

Unfortunately, too easy. And this has been demonstrated again and again by security researchers around the country.

In my old workplace — at Princeton University at the Center for Information Technology Policy — we had this lounging area with comfy couches, and researchers had decorated the place with a voting machine that had been hacked to play Pac-Man instead of counting votes. ... And when they hacked this, the machine had been in use in jurisdictions around the country with more than 9 million voters.

The worry is, in a lot of states that are critical to the election — swing states — they don't even have a paper trail that you can audit with. That's really worrisome given how crucial elections are.

On how vote-tampering might happen in the upcoming election

It's not a straightforward thing, in the sense that the doomsday scenario where some foreign power or some domestic player hacks all of them, because the election machines we have are a patchwork of different systems. It's kind of hard to pull off a centralized hack.

But let's consider Georgia, which is running electronic-only machines — there's no paper trail. ... And the machines they're using are more than a decade old, so the hardware is falling apart. And the operating system they're using is Windows 2000, which hasn't been updated for security for years, which means it's a sitting duck. Georgia traditionally votes for the Republican presidential candidate. Now this year, some polls are suggesting a close race. And let's assume there's an upset and there's a 1 percent win by Hillary Clinton, and let's assume that people are objecting, because this is kind of unexpected. There's no way to check.

I feel this is such an important, crucial thing that security experts have been warning for 10 years, and maybe this attention with the DNC hack can get us focused on this issue that is not new but keeps not getting fixed.

On the importance of paper trails

Fraud comes in many ways, and there's no question that there are ways to steal elections based on paper, but it's easier and more possible to describe tamperproof paper protocols and to implement them. Because of security experts' concerns, a lot of states have moved to paper trails. The number of states that don't have it include all of Georgia, parts of Pennsylvania, a few places even in Florida. And Ohio does have a paper trail but experts say it's not a reliable and worthy one.

On foreign powers tampering with U.S. elections

I don't find the foreign power meddling in U.S. elections that likely, because the stakes are so high. I mean, if a foreign country ... meddles in U.S. elections, they know the U.S. will retaliate very hard against something like that. So I'm not that worried that it's going to be a foreign power.

But the lack of security means a corrupt official ... a teenage hacker, or just losing votes and not even knowing you lost the votes — all of those are very real possibilities. So while we imagine these apocalyptic scenarios of some foreign power meddling, the real issue is we have the thing falling apart in 10 different ways that we're not fixing.

Copyright 2018 NPR. To see more, visit http://www.npr.org/.

SCOTT SIMON, HOST:

Security experts say that Russian government hackers tapped into the database of the Democratic National Committee and probably other targets. But some officials are worried that votes themselves could be compromised by hackers and potentially tip the results. Now, most states have moved back to paper-backed systems in recent years, but that still leaves a number of states vulnerable, including some political swing states. Zeynep Tufekci is a professor at the University of North Carolina where she studies the social impact of technology. Professor Tufekci joins us now from the university. Thanks so much for being with us.

ZEYNEP TUFEKCI: Thank you for inviting me.

SIMON: How easy is it to hack into an electronic voting machine?

TUFEKCI: Unfortunately, too easy, and this has been demonstrated again and again by security researchers around the country. In my old workplace at Princeton University at the Center for Information Technology Policy, we had this lounging area with comfy couches and the researchers had decorated the place with a voting machine that had been hacked to play Pac-Man instead of counting votes (laughter). And they had done this without even...

SIMON: You zany tech people.

TUFEKCI: Well, they had done this without even tampering with the, you know, no-tamper protections the system was supposed to have had. And when they hacked this, the machine had been in use in jurisdictions around the country with more than 9 million voters. And the worry is in a lot of states that are critical to the election - swing states - they don't even have a paper trail that you can audit with. That's really worrisome given how crucial elections are.

SIMON: Well, I mean, let me state this to you then this baldly - is it possible that election results could be tampered with?

TUFEKCI: It's not a straightforward thing in the sense that, you know, the doomsday scenario where some foreign power or some domestic player hacks all of them because the machines as a - the election machines we have are a patchwork of different systems. It's kind of hard to pull off a centralized hack.

SIMON: Yeah.

TUFEKCI: But let's consider Georgia, which is running electronic-only machines. There's no paper trail. And the systems there...

SIMON: This is the state of Georgia, not the country.

TUFEKCI: It's the state of Georgia, of course, and the machines they're using are more than a decade old, so the hardware is falling apart. And the operating system they're using is Windows 2000, which hasn't been updated for security for years, which means it's a sitting duck. And Georgia traditionally votes for the Republican presidential candidate.

Now, this year, some polls are suggesting a close race. And let's assume there's an upset, and there's a 1 percent win by Hillary Clinton. And let's assume that people are objecting because this is kind of unexpected. There's no way to check. I feel this is such an important, crucial thing that security experts have been warning for 10 years, and maybe this attention with the DNC hack can get us focused on this issue that is not new but keeps not getting fix.

SIMON: Well, I say this as a Chicagoan - there was - there has been vote fraud with paper ballots, too.

TUFEKCI: Yes. Fraud comes in many ways, and there's no question that there are ways to steal elections based on paper. But it's easier and more possible to describe tamperproof paper protocols and to implement them. And because of security experts' concerns, a lot of states have moved to paper trails.

The number of states that don't have it include all of Georgia, parts of Pennsylvania, few places even in Florida. And Ohio does have a paper trail, but experts say it's not a reliable and worthy one. So the number of states that are still affected in part or in full by having no paper trail number 12 to 15, depending on how you count, and potentially up to 60 million voters, enough to swing an election.

SIMON: I guess we're thinking of foreign hackers or somebody with an interest in the election, but the way you describe it, it could also be a couple of 17-year-old students at - new to your high school.

TUFEKCI: I don't find the foreign power meddling in U.S. elections that likely because the stakes are so high. I mean, if a foreign country comes, meddles in U.S. elections, they know the U.S. will retaliate very hard against something like that. So I'm not that worried that it's going to be a foreign power, but this lack of security means a corrupt official, as you say, a teenage hacker.

We're just losing votes and not even knowing that you lost the votes. All of those are very real possibilities. So while we imagine these apocalyptic scenarios of some foreign power meddling, the real issue is we have the thing falling apart in 10 different ways that we're not fixing.

SIMON: Zeynep Tufekci is a professor at the University of North Carolina. Thanks very much for being with us.

TUFEKCI: Thank you for inviting me. Transcript provided by NPR, Copyright NPR.