US Election Security Depends on Verifiability Beyond Voting Machines
Summary
An analysis of voting-machine and AI-driven influence risks argues for verifiable, auditable election systems and layered safeguards. It notes there is no evidence machine tampering has changed a US election outcome.
Key points
- The article describes EAC-certified voting machines, paper ballots, and post-election audits as safeguards, while noting that processes vary by state and county.
- Sequent CEO Shai Bargil argues certification schedules can leave machine software unpatched; he also claims machines tested with hands-on access at DEF CON’s Voting Village have been hacked.
- The article questions whether voters can verify the data counted when ballots use barcodes or QR codes, and presents independent verification as important.
- Recommendations include open-source voting software, encrypted independently verifiable vote records, layered safeguards, access controls, and verifiable backups.
- Experts say election influence efforts may target public trust through disinformation, impersonation, phishing, and disruption rather than changing votes directly.
- The article cites reported Russian influence efforts around the 2016 election, a 2024 hack-and-leak operation attributed to Iran by US agencies, and a 2024 Biden-impersonation robocall in New Hampshire that it says failed.
Article Details
- Topic
- Cybersecurity risks to US elections, including voting-machine integrity, election infrastructure, and AI-enabled influence campaigns.
MITRE ATT&CK
People
Adam MarrèFormer FBI special agent and CISO at Arctic Wolf; discussed geopolitical election influence activity and its effects on public trust.Alex QuiliciCEO at YouMail; discussed targeted robocalls and robotexts as methods for suppressing voter participation and cited the 2024 Biden-impersonation robocall.Bobby FordChief strategy and experience officer at Doppel; discussed impersonation, fake websites, and AI-generated misinformation as ways to influence public perception.Casey EriksonDirector of penetration testing at NRLabs; discussed election-security tradeoffs, access control, verifiable backups, and redundancy.Christiaan BeekVP of cyber intelligence at Rapid7; recommended treating voting machines as components of a potentially hostile system and limiting and detecting compromise.Dave GerryCEO at Bugcrowd; said adversaries focus on election-related operational systems such as voter registration databases, county websites, and election workers’ email accounts.Shai BargilCo-founder and CEO at Sequent; discussed voting-machine certification and patching risks and recommended open-source software and verifiable vote records.
Vendors
MicrosoftInterestingly, the Microsoft ElectionGuard project, designed to help governments run secure, auditable and trustworthy elections, also proposes homomorphic encryption of the votes. This could ensure that all votes areSequentShai Bargil, co-founder and CEO at Sequent, is doubtful. There is no direct correlation of the certification process to the four-year election cycle and certification can occur in any of the four years. The
Products
Countries
IranMore recently, in 2024, US intelligence agencies attributed a hack-and-leak operation targeting the Trump campaign to Iran.RussiaMultiple sources claimed that Russia ran a pro-Trump multi-faceted influence campaign prior to the 2016 election. In 2017, the US intelligence community (CIA, NSA and FBI) said so. In 2019, special counsel RobertUnited StatesReceived wisdom is that foreign nations attempt to disrupt US elections with influence campaigns targeting the voters. It is believed the primary motivation is to undermine confidence in democratic institutions. This is