Hack the Election? Local Officials Say Their Systems Are Secure

By Lynda Gonzalez

Reporting Texas

News reports about cyberattacks on some state voter registration systems and the Democratic National Committee have stirred up concerns about whether hackers could tamper with voting systems on Election Day.

Travis County Clerk Dana DeBeauvoir said her county’s voting machines are secure against tampering, and that the real “hack” is the fear that those incidents have generated about the accuracy of the vote count.

Republican presidential candidate Donald Trump also has been asserting that the election will be “rigged” and that thousands of dead people will vote, without offering any evidence.

DeBeauvoir and other local officials say such comments undermine public confidence in the voting process.

Travis County uses extensive security measures to ensure the integrity of the election, and DeBeauvoir said the machines it uses are never connected to the internet, eliminating the opportunity for hackers to tamper with them.

“It is my assumption that they’re probably in the top one percent in the country in being ready for trouble,” security researcher Joe Kiniry said. “That doesn’t say anything bad about any other jurisdictions, other than the fact that they haven’t thought about it as early as Travis County has.”

Kiniry, an expert in election integrity, has spent the past 15 years pushing for more secure elections. He works for computer security company Galois in Portland, Ore., and is CEO of a subsidiary, Free and Fair, which provides election services and systems. He’s familiar with Travis County’s voting systems because he’s been following DeBeauvoir’s plans to pilot a new system in the future.

Kiniry said election-related cyber attacks have created a “perfect storm of people being concerned about election security.”

“I don’t have deep concerns about November in terms of an election executing well,” Kiniry said. “I have deep concerns about public perception or party perception about the election running well.”

Travis County uses direct-recording electronic voting machines that are not connected to the Internet, DeBeauvoir said. The county also uses physical security and safe computing practices to protect the machines against tampering. A protocol spells out who is authorized to handle the equipment at various stages.

“We keep our equipment under very serious lock and key,” she said. “It’s password-controlled, it’s under video security cameras, and that’s for every single step of the way — when it’s just sitting dormant in a warehouse all the way through all of the preparations and testing and deployment into the field.”

The state requires that voting machines be tested to ensure they record votes correctly, but DeBeauvoir said Travis County conducts additional tests on its machines.

During the tests, officials select at random several machines for a mock vote that workers videotape over an entire day. That allows officials to detect whether the equipment miscalculates votes or contains hidden malware, which would mean that someone physically tampered with the machines.

DeBeauvoir said her office has never discovered a problem with machines while running those tests. She said the process is tedious and costly but is crucial to assuring voters that the machines have not been tampered with.

However, it is possible to tamper with an internet-based voter registration system. Dan Wallach, a computer science professor at Rice University, testified in September before the U.S. House Committee on Space, Science & Technology that voter registration databases are the biggest vulnerability to hacking.

However, each of Texas’ 254 counties maintains its own voter registration list. Williamson County Elections Administrator Christopher Davis said each county is responsible for updating local lists and uploading a mirrored version to the statewide voter registry.

“That many separate voter registration lists for those counties…that’s a robust security circumstance,” he told the committee, according to a hearing transcript. “It protects against a one-list hacking.”

DeBeauvoir said the lists are updated on a continuous basis, so anyone who managed to get access would have only a snapshot of the county database at a particular moment. Even if someone hacked into the system, she said voters still would be able to vote for two reasons.

“One, you’ve got extra copies (of the registration list) that were generated independently and went out” to polling places, DeBeauvoir said, referring to offline downloads or paper  lists. “Two, even if your copy that went out into the field had errors in it,” voters still will have their registration cards.

According to DeBeauvoir, every state has a law that allows voters with registration cards but whose names do not appear on registration rolls to “go right ahead and vote.”

However, those provisional ballots are not added to the vote count until county officials are able to verify the voter’s identity and that they voted in the correct precinct. That process can take several days.

This year’s election could produce record turnout. In Texas, more than 15 million voters have registered, a record. In Travis County, more than 720,111 registrations had been tallied by Oct. 18, also an all-time high. The previous record, in 2012, was 635,000 registered voters.

That alone could cause long lines at polling stations. Any sign that registration lists were tampered with in any way could cause havoc by “mucking up” the process, Kiniry said.

DeBeauvoir said Texans should take advantage of early voting, which starts Oct. 24, to avoid the prospect of long lines on Election Day. Voters should also verify their registration in advance.

While Texas has suspended its strict voter identification law for this election because of a federal court ruling, she said people should bring a photo ID just in case. Voters without one of the approved forms of photo ID can sign an affidavit at the polls saying they were unable to obtain one, and can submit other documents, such as a bank statement, any government document or a certified birth certificate, according to the Texas secretary of state’s office.

To DeBeauvoir, the success of the election process ultimately depends on voters thinking critically about whatever they hear about cyberattacks and alleged “rigged” systems.

“There are things that can be done about specific threats,” DeBeauvoir said. “When all you’re doing is generally promoting discomfort, that is a successful attack on the election that nobody can do anything about except for the voters themselves.”