Last weekend, the DEF CON hacker conference in Las Vegas unveiled serious vulnerabilities in various election machines, casting doubts on the security and reliability of these systems as the U.S. approaches the November elections.
Just The News reported that at DEF CON in Las Vegas, hackers exposed significant vulnerabilities in several election machines, posing risks ahead of the forthcoming U.S. elections.
At the conference, hackers explored a range of voting equipment including voting machines, e-poll books, and ballot tabulators from various manufacturers. Their findings were alarming; they revealed multiple security flaws, some of which have been unresolved for years.
The U.S. Election Assistance Commission (EAC) acknowledged that these systems, scheduled for the November elections, lack comprehensive third-party testing.
Georgia specifically is set to use outdated voting machines. These machines accompany new software that has yet to be tested on a global scale, and any updates are only planned after the election.
This decision, influenced by legal and logistical constraints, even in the face of known vulnerabilities, raises questions about the manageability of election integrity.
Gabriel Sterling from Georgia’s secretary of state's office defended the state's decision citing, “Legally, logistically, and just risk management wise, this was the safest wisest course.”
However, the broader implications for election security remain concerning. The EAC vice chair, Donald Palmer, noted that the systems tested are not the frontline systems but did confirm issues regarding updating Georgia’s Dominion Voting Systems due to resource constraints.
The forthcoming detailed report from DEF CON is expected to highlight persistent, unaddressed vulnerabilities. Harri Hursti, a co-founder of the DEF CON Voting Village, expressed frustration over the continuing security issues, noting, “There’s so much basic stuff that should be happening and is not happening… and I’m also angry about it.”
Historically, deficiencies in election system transparency and vulnerability management have been significant. Phill Kline, director of the Amistad Project and former Kansas attorney general, emphasized the systemic problems, stating, “There’s no way to ensure they’re fixed because people who should have the authority – local election officials – have no legal authority to do the job nor understanding of how to do it.”
The SECURE IT Act currently discussed in Congress aims to mandate third-party testing of current voting systems. This would be a significant shift from the EAC’s current process, which while including penetration testing to resolve known vulnerabilities, does not actively seek new vulnerabilities.
The EAC has hinted at potential changes to allow independent researchers to conduct annual vulnerability assessments.
Their Engineering Change Order process also allows quick updates to the software for addressing identified vulnerabilities, although this does not necessarily translate to immediate action on a national scale.
The concerns highlighted at DEF CON extend beyond the U.S. borders. Hursti emphasized the global implications of the vulnerabilities, “If you don’t think this kind of place is running 24/7 in China, Russia, you’re kidding yourselves. We are here only for two and a half days, and we find stuff… it would be stupid to assume that the adversaries don’t have absolute access to everything,” highlighting the international dimension of election security.
The issues raised at DEF CON emphasize the need for a comprehensive reevaluation of how voting equipment is certified and updated. As security experts and lawmakers navigate these contentious waters, confidence in an inherently democratic process hangs in balance, urging a reformed approach to safeguard election integrity.