Hill Street Studios/Getty Images
Sign up for our newsletter.
Stay Connected
By
Government elections officials must do a better job of communicating the multilayered defense processes that ensure secure voting, election security experts said.
Speaking at an Sept. 1 Election Assistance Commission (EAC) event marking the 20th anniversary of the Help America Vote Act, panelists detailed changes in the last two decades that have made elections secure, starting with testing and certification procedures.
“The majority of states require that a voting system is either certified by the EAC or tested by a voting system test lab,” said Traci Mapps, vice president at SLI Compliance, a testing laboratory accredited by the EAC to ensure voting systems comply with federal standards. “Sharing that information with the public with their elections, officials, their voters, would be beneficial.”
The testing and certification process includes not just functional testing but also document review, hardware testing, secure source code reviews, trusted builds and targeted security testing, Mapps said. SLI has also worked with election officials to conduct “pre- and post-election configuration checks to verify that only certified or expected versions of the software — and no unauthorized software — is present on the election system that could compromise the integrity of the election process,” she said.
Certifications also can help address the newer, more sophisticated cybersecurity threats.
“Twenty years ago, if I told you that the adversary in our elections was a foreign nation state, that’s Russia or China or Iran or somebody else, you would have said, ‘That’s crazy!’” said Dan Wallach, a computer science and electrical and computer engineering professor at Rice University. “It creates an amazing challenge, but also an amazing opportunity to create these federal state and local partnerships to bring the expertise to bear on the problem.”
According to Mona Harrington, acting assistant director for National Risk Management Center at the Cybersecurity and Infrastructure Security Agency, “hundreds of election officials and private sector election infrastructure partners” have signed up for CISA’s cybersecurity services, which include scans for vulnerabilities on internet-connected infrastructure as well as in-depth penetration testing. Additionally, she said, all 50 states have deployed the intrusion detection sensors known as Albert sensors.
Because the role of election officials has greatly expanded beyond “simple election administration to a position more akin to technology and information managers and IT managers,” Harrington said, CISA resources have also been invaluable to state and local elections officials that don’t have the expertise to deal with increasing volume and complexity of cybersecurity threats.
Another way to boost confidence in election integrity would be if the public better understood the role of risk-limiting audits. These audits are based on the idea that when it comes to counting votes, computers are fast but hard to trust, Wallach said. Human vote counters, on the other hand, are “very secure” but very slow, especially when there are millions of votes to count.
Unless an election is very close – which often triggers a hand recount anyway – a risk-limiting audit can quickly and efficiently produce “a 95% confidence interval that you have the correct outcome,” Wallach said.
The math behind the technique shows that in a statistically relevant random sample of ballots, “you only have to prove that any possible error is smaller than the margin of victory,” he said. “As long as you can prove that to a high degree of statistical certainty, then you can say, ‘I’m confident we have the correct winner’ and do it with a lot less work.”
“It’s a really important way of improving election transparency that doesn’t require any really new technology,” Wallach said. Plus, it’s much faster. “If we can provide publicly visible procedure, then that can help mitigate some of the misinformation,” that surrounds the voting process, he said.
The multilayered, or defense-in-depth, approach to voting security means if an elections office is using the right policies and procedures, they can build resilience to different threats, Wallach said. “It’s not to say that somebody can’t hack the computer, but we’re going to make that harder. And it’s not to say that somebody can’t stuff the paper ballot box, but we’re going to make that harder too. But combining them together we can defend against both. And all of that raises the bar.”
NEXT STORY: NIST to launch new guidance on security risks of telehealth and smart home integration
Do Not Sell My Personal Information
When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.
Manage Consent Preferences
Strictly Necessary Cookies – Always Active
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data, Targeting & Social Media Cookies
Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link
If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.
Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.
If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.
Cookie List
A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:
Strictly Necessary Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Functional Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Performance Cookies
We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.
Sale of Personal Data
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Social Media Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Targeting Cookies
We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.
Help us tailor content specifically for you:
