The unknown, but credible risk of an election night cyber attack

The mix of digital and analogue systems to record, tabulate and transmit our votes on election day are as varied at the number of states we have, since the states administer and oversee their elections.  In this variation and diversity is protection against a systemic hack of electronic voting booths.

However, the problem is not simply limited to voting stations, but also includes voting transmission and tabulation systems, and voter registration databases too.

One famous white hat hacker, Billy Rios, said he simply does not know how to quantify the risk of an election day hack, but he did say individual states are vulnerable.  He knows because governors have asked his team to “red team” some of their most critical state systems.  In his work to successfully hack a voting machine to change its vote totals and paper records, he found he could buy for $12.00 an administrator chip card for one of these machines on the internet.

Ultimately, we are relying on the restraint of our adversaries not to hack us on election day.

The trouble is, the pay-off to a successful election hack is very high.  A large percentage of the planet Earth will be watching to see the outcome of the U.S. Presidency between the hours of 9 PM and midnight Nov. 8.

Delayed or not trusted election results due to a cyber-attack on a voter databases or transmission or tabulation or prediction system will be a global embarrassment for the United States, carried live on television across the planet.

The point of such an attack would be to mock and discredit voting for your leader and would serve as a clear message to legitimize authoritarian rule.

In addition, political instability and at times chaos would reign in the United States if one or more states, whose vote totals will decide the outcome of the U.S. Presidency cannot report their vote totals in a timely fashion, or do not have confidence in the vote totals.

The nation will be thrown into a crisis the likes have not been seen since hanging chads in Florida, except in this scenario would be a “cyber Florida.”

The eight person, four Democrat and four Republican Supreme Justices make a recipe for the U.S. House to select the U.S. President, if vote totals are so degraded and uncertain, that electors from key states cannot be seated.

Given the passions around Secretary Clinton and Mr. Trump, the country would be divided unlike any time since the civil war.

Databases are hacked every day in the United States and voter registrations are not immune, or in some special cyber quarantine. 

These systems are do not have military or intelligence community grade, or even high level corporate security – they were mostly built and designed without security in mind.

In states that provide voters with either a Republican or Democratic ballot, imagine if one in three or one in two of every one’s registration was reversed.  People asking for a Democratic ballot would get a Republican one, and as the number of voters whose registration had been changed swelled at the voting place, increasing doubt, anxiety, chaos and lack of confidence in the voting result would grow.

On a wide enough scale that successfully put the outcome in doubt, pulling off an systemic election day would dramatically, and globally de-legitimize our next President.

The White House obviously believes this is a credible scenario or it would not be making public threats warning Russia not to hack us on our election day.

Such attacks could take a variety of forms: 

• Voter registration lists could be corrupted, deleted, held for ransom, or its data changed leading to a lack of confidence (understandably) in the vote result, since many citizens would not be able to actually vote if the registration list is corrupted.
• Large number of voting machines in swing areas of battle ground states are “bricked” or “pawned,” meaning they are disabled or under the control of others.  They could be shut down or made to produce results so unbelievable that it would have the same effect – the results would not be believed or trusted.
• Fraudulent “certified results” could be circulated and transmitted rather than the actual results.

The reality is that the attack vectors on our voting systems are extremely varied and have been largely ignored until the last few weeks, leaving little time to actually do much to electronically harden our voting system.

We will be exceedingly lucky if election night comes and goes without a serious cyber-attack.

If one does occur, if the Vice President and Secretary of State are to be believed, other than the political uncertainty and instability in the United States over the outcome (which would also include the outcome of Senate and House seats in the states or regions impacted) we will strike back against Russia, and be in the world’s first overt cyber battle between nations.

Dan Perrin is the founder of the Council to Reduce Known Cyber Vulnerabilities.

The views expressed by authors are their own and not the views of The Hill.