Threats remain to US voting system – and voters' perceptions of reality
- Written by Richard Forno, Senior Lecturer, Cybersecurity & Internet Researcher, University of Maryland, Baltimore County
As the 2018 midterms proceed, there are still significant risks to the integrity of the voting system – and information warfare continues to try to influence the American public’s choices when they cast their ballots.
On the day of the election, there were a number of early hitches in voting at individual polling places[1], such as polling places opening late[2] and vote-counting machines not plugged in. But there seem not – at least not yet – to be major problems across the country[3].
However, not all the election-related news and information voters have been encountering in recent days and weeks is accurate, and some of it is deliberately misleading. As this election’s results come back, they will reveal whether the misinformation and propaganda campaigns conducted alongside the political ones were effective.
Securing election systems
America’s electoral process remains highly fragmented, because of the country’s cherished tradition of decentralized government and local control. While this may leave some individual communities’ voting equipment potentially vulnerable to attack, the nation’s voting process overall may be more trustworthy as a result of this fragmentation. With no unified government agency or office to provide, administer and protect election technologies, there’s not one central national element that could fail or be attacked.
Across the country, though, many districts’ voters will cast ballots with the help of machines[4] that have long-standing[5] security concerns[6]. Fortunately, 45 states[7] keep a paper record of each vote cast – whether for fear of threats to voting integrity or just budget constraints preventing purchase[8] of newer gear. But that means five states[9] – Louisiana, Georgia, South Carolina, New Jersey and Delaware – don’t keep paper records of their voters’ choices.
Voting machine vendors have been reluctant[10] to appear before Congress to explain their systems’ security practices – and shortcomings[11]. However, federal agencies have helped some states[12] reduce the likelihood of voting machines being hacked or physically tampered with.
Beyond voting machines
Election security is about much more than voting machines and vote-counting systems, though they are the most visible technologies at work on Election Day. State systems that track voter registrations, or allow users to register online, are enticing targets for hackers, too. Security firm Carbon Black reported that 81 million voter records from 20 states[13] are available in online forums. This data, obtained by hacking various official and corporate databases, could be used to facilitate voter fraud or sow confusion at polling places on Election Day: How would you feel if you were told that someone using your name and address had already voted?
There are security concerns even in states like Oregon, where everyone votes on paper and mails in their ballots in advance of Election Day. That state’s election officials were targeted by hackers[14] seeking to gain access to state email and database systems[15]. With that access, attackers might be able to digitally impersonate a government official to send false or confusing emails, press releases or other notifications to citizens, journalists or poll workers.
Also at risk are public-facing official websites that carry election information. Merely changing the reported location of polling places or voting hours could prevent some people from voting. Also vulnerable are states’ methods of announcing preliminary election results. At a major internet security conference in August, children were able to compromise replicas of several states’ election-reporting systems. The most remarkable was that in just 10 minutes, an 11-year-old boy cracked the security[16] on a copy of the Florida secretary of state’s website and was able to change the publicly announced vote totals for candidates. That could be enough to cast doubt on whatever was later reported as the official results – and the integrity of the system itself.
Managing information on social media
A more difficult threat to defend against is information warfare[17], which doesn’t attack voting machines or election officials’ computers. Rather, it targets voters’ perceptions and decisions[18], seeking to influence how they vote.
Long before the 2016 U.S. presidential election, information warfare was influencing elections around the world, including in Ukraine[19], Myanmar[20] and Egypt[21]. But after 2016, Facebook and Twitter came under intense scrutiny[22] for their role in providing digital environments that facilitated the spread of misinformation to sow discontent, and special counsel Robert Mueller began investigating Russians’ influence efforts[23].
In the run-up to the 2018 midterms, Russians and others were still hard at work trying to influence Americans to vote in ways that help foreign interests. In October, the U.S. Department of Justice charged a Russian woman with creating thousands of fake social media accounts[24] allegedly representing American citizens to “create and amplify divisive social media and political content[25]” before the election.
This year, though, unlike two years ago, social media companies are taking action[26]. Twitter and Facebook have both deleted thousands of accounts[27] they identified[28] as engaging in propaganda and influence-peddling[29]. And they have made other efforts[30] to identify and fight falsehoods[31] on their platforms, too.
Nevertheless, online misinformation continues to thrive. More than 80 percent[32] of the Twitter accounts that often shared links to false and misleading information in 2016 are still active today. And the amount of online misinformation[33] is higher than it was[34] two years ago.
Investigating alleged wrongdoing
U.S. intelligence and police agencies are concerned about the potential effects of misinformation[35] on the American electorate. But large proportions of the country don’t trust those organizations[36] to be politically independent[37]. It doesn’t help that the White House continues to claim, without evidence[38], that voter fraud[39] is a significant problem.
Mainstream news organizations can find themselves under scrutiny too, either for reporting falsehoods[40] that appear to gain traction online[41] or for failing to filter out or properly identify inaccurate information[42] for their readers.
Looking ahead
Protecting democracy is a huge challenge. I’ve written before that it involves more than technical solutions[43] to computer problems. The U.S. government, and the people it serves, must find the desire and the drive to establish secure and trustworthy procedures for running elections across the country. Education is also key, teaching people from an early age how to recognize propaganda and misinformation, and think critically about the information they encounter. Facts are not subject to alternative views; without widespread agreement on common objective realities, society and government cannot function well.
Technology continues to evolve, presenting challenges to individuals and society alike. Emerging “deepfake[44]” technology is already helping create convincing videos of people appearing to say[45] and do things they never said or did. In addition, intelligent social media bots are becoming more human-like[46], making identifying and blocking them much more difficult. That’s just some of the challenges that democracies will face in the future.
Many of these problems will not have a clearly defined fix, because they involve a nuanced balancing of individual rights and social necessities. Real and lasting solutions must come from civil discourse by rational and objectively informed people who have, above all, the actual honest desire to do it right.
References
- ^ early hitches in voting at individual polling places (www.propublica.org)
- ^ polling places opening late (bklyner.com)
- ^ problems across the country (www.propublica.org)
- ^ help of machines (www.pewresearch.org)
- ^ long-standing (theconversation.com)
- ^ security concerns (theconversation.com)
- ^ 45 states (www.axios.com)
- ^ budget constraints preventing purchase (www.the-parallax.com)
- ^ five states (www.pewresearch.org)
- ^ Voting machine vendors have been reluctant (www.politico.com)
- ^ and shortcomings (www.usatoday.com)
- ^ federal agencies have helped some states (fcw.com)
- ^ 81 million voter records from 20 states (www.forbes.com)
- ^ state’s election officials were targeted by hackers (lmtribune.com)
- ^ state email and database systems (arstechnica.com)
- ^ 11-year-old boy cracked the security (www.pbs.org)
- ^ information warfare (theconversation.com)
- ^ targets voters’ perceptions and decisions (theconversation.com)
- ^ Ukraine (www.washingtonpost.com)
- ^ Myanmar (www.nytimes.com)
- ^ Egypt (www.wired.co.uk)
- ^ Facebook and Twitter came under intense scrutiny (www.theverge.com)
- ^ investigating Russians’ influence efforts (theconversation.com)
- ^ creating thousands of fake social media accounts (thehill.com)
- ^ create and amplify divisive social media and political content (www.justice.gov)
- ^ social media companies are taking action (www.nytimes.com)
- ^ deleted thousands of accounts (theconversation.com)
- ^ they identified (theconversation.com)
- ^ propaganda and influence-peddling (theconversation.com)
- ^ made other efforts (www.theguardian.com)
- ^ identify and fight falsehoods (www.wired.com)
- ^ More than 80 percent (www.knightfoundation.org)
- ^ amount of online misinformation (theconversation.com)
- ^ higher than it was (comprop.oii.ox.ac.uk)
- ^ potential effects of misinformation (thehill.com)
- ^ trust those organizations (www.newsmax.com)
- ^ politically independent (arstechnica.com)
- ^ claim, without evidence (www.washingtonpost.com)
- ^ voter fraud (www.cnn.com)
- ^ reporting falsehoods (www.washingtonpost.com)
- ^ appear to gain traction online (www.pbs.org)
- ^ filter out or properly identify inaccurate information (www.poynter.org)
- ^ more than technical solutions (theconversation.com)
- ^ deepfake (theconversation.com)
- ^ create convincing videos of people appearing to say (www.lawfareblog.com)
- ^ bots are becoming more human-like (www.theverge.com)
Authors: Richard Forno, Senior Lecturer, Cybersecurity & Internet Researcher, University of Maryland, Baltimore County
