Merle King on Election "Hacking" Fears

[Image via YouTube courtesy of NCSL]

Like many people in the election community, I have been troubled by the intense attention in the media to allegations that the American voting system could be hacked. I’ve wanted to weigh in on the issue, but it’s sufficiently complex – and the coverage sufficiently unfocused – that I hardly knew where to start.

Thank goodness for Merle King.

Merle gave a lengthy set of comments to the Washington Post’s “The Fix” blog yesterday about hacking concerns, and they’re so good I wanted to share them here:

Political campaigns are all about numbers. If you get more votes than the competition, you win. One hundred is greater than 99, and so 100 becomes mayor or governor or president.

It’s the determination of those numbers that’s always been the point of concern in the integrity of elections. The famous saying that it’s not the voter but the person who counts the votes that matters (usually incorrectly attributed to Joseph Stalin) reinforces the point: If 100 votes are cast but only 90 counted, the system breaks down.

This presidential election cycle, that integrity has been questioned. First, the Republican front-runnersuggested without evidence that an eventual loss in Pennsylvania would be the result of voter fraud. Second, and much more substantially, the FBI warned state elections officials this week of possible attempts to hack state election systems after breaches in Arizona and Illinois. The likely culprits were agents of the Russian government, putting the alleged Stalin motto into practice.

That news prompted a flurry of news stories and administration attention. The White House has asked an intelligence task force to look at Russia’s repeated hacks of political systems. FBI director James B. Comey said his agency took “very seriously” any attempt to “influence the conduct of affairs in our country.”

That’s the question at its root: Could hackers change the numbers to change our elections? The Fix spoke by phone and email with Merle King, executive director of the Center for Election Systems at Kennesaw State University to get an answer. In summary: It would be harder than we think — in part because we tend to conflate a number of very different election systems.

“One of the challenges the public has in sorting through the various threads of the current election cycle’s stories is understanding the differences between a campaign system, an election system and a voting system,” King told us.

The campaign system is the tool set used by candidates or parties to get people elected. The election system covers voter registration systems and other data centralization and is specific to jurisdictions. The voting system is the actual process of voting: the machines, the ballots and the designations of who votes where and on what. Information flows between these systems, but not always in two directions: Campaigns, for example, use voter registration data from the elections system but don’t send information back to it. So if a campaign is hacked (or if the Democratic National Committee is), there’s no risk to the voter registration database.

Confusing these systems can mean misunderstanding the threat — and the intent of the hackers. Take what happened in Arizona or Illinois, where voter files were lifted from the election system.

“When I hear about a hack, and it’s attributed to a Russian IP address, my first reaction is it’s identity theft,” King said. “They’re looking for large lists of critical information that can be used to create identities for credit card theft, etc. I don’t instinctively think it’s an attack on our election system.”

The important point King makes is that hacking the elections system and the voting system are very different in nature and effect. “If the election systems were hacked, there are paper backups of the electors list — every precinct has to maintain a paper copy of the voter list — so you could disrupt an election by attacking those election systems,” he said. “But most importantly, you could not alter the outcome of the election by hacking those systems. That would have to occur in the voting system” — the actual process of casting ballots. And that’s harder than it seems.

The Fix piece goes on to cite the recent letter published by Florida officials laying out their procedures for securing the system:

After the stories about the hacks of election systems came out, the Florida State Association of Supervisors of Elections [FSASE] wrote a letter to voters in that state explaining how it protects the voting system itself. The steps delineated are:

1. Before each election, a public test of the tabulating system is conducted to ensure that the machines are functioning as expected. King describes this process (which is not unique to Florida) as “an opportunity for members of the public and media to come and observe the ballot is correct and it can capture voter intent correctly and can tabulate it.”
2. On election night, results are encoded with multiple layers of encryption and transmitted to a central gathering point.
3. Voting machines themselves are not connected to the Internet, preventing them all from being hacked at once.
4. Thumb drives with results are also transmitted to the central location. Those drives are digitally signed and secured before Election Day, preventing their being replaced with a drive from somewhere else.
5. If there are any corrupted or unusually slow results transmitted to the central location, the results from the thumb drives are used.
6. Election night totals are transmitted to the state as unofficial results via both an encrypted device and over a separate network system.
7. A week after the election, the results in each precinct are reviewed by looking at the paper totals. Any discrepancies are “researched and noted.” The Florida vote is backed up by paper ballots (which isn’t the case everywhere), facilitating that research.

Only once those checks are complete is the result certified.

That’s the process that needs to be hacked to directly change the results of the election, not a hack of the voter registration database. There are hundreds of similar setups in all 50 states that similarly flow upward to state agencies. That distribution is an asset, not a flaw.

The system isn’t without some vulnerabilities, but the piece highlights the distinction between the threat of tampering and the risk (likelihood) it could occur:

There are caveats, of course. For one thing, a hack of the voter registration database could make it easier to identify voters who could be used as targets of fraud (people who are dead or who don’t vote often). There can be tampering by campaign officials. And no system, no matter how well-protected, is unhackable, including the listed process above.

Each of those caveats is very unlikely for a number of reasons. Voter fraud is far, far harder than it seems, requiring a lot of people to break federal law for it to approach any sort of meaningful scale. Sure, some elections are won by a few hundred votes — but tipping that election means finding a few hundred people to cast ballots in the right place ahead of time. That’s harder than it may sound. Campaign officials can and have toyed with results, but being caught means losing a job and prison time — with the problem of scale still looming. The process above could conceivably be hacked, I guess, but if you can figure out how to do it without being caught, you could probably get a lucrative job somewhere else much more easily.

Merle also puts his finger on a key challenge for election officials: how to respond to allegations which can’t be disproved:

“As an election official, I frequently find myself challenged to prove the negative,” he said. “The conspiracists never have to prove their theories, but the election official has to prove the negative, which we know is impossible to prove. Can I prove that the Arizona system was not hacked by Russian state operatives? I cannot.”

All that can be done in these situations is to remind voters of the many steps that election officials take to safeguard the voting process – and invite them to observe or participate as the see fit. [If there’s one silver lining in all of this, it’s the opportunity election officials are taking to encourage people to serve as poll workers in order to get a first-hand, inside view of the process.]

This piece is important for two reasons: first, it takes a critical look at some of the rather breathless coverage that “hacking” has received in recent weeks, and second, it actually talks to someone who works in elections about what (if anything) it means. Thanks to the Post for this story – and thanks especially to Merle King and FSASE for their dedication to the field and their willingness to address “hacking” allegations in a thoughtful way.

Will we start to see other pieces that talk to election officials about the election system? I sure hope so – stay tuned …