As we rang in the New Year, we welcomed a new Congress, as well as a new Speaker of the House: Nancy Pelosi (D-CA). The Democrats now have the House majority and say they are determined to reduce the cyber risk related to the U.S. election system. They wasted no time in rolling out a bill aimed at improving election security. The “For the People Act” promises $120 million for new voting machines and provides a stipulation the new machines must use paper ballot. The successful attacks on the nation makes this requirement a common-sense approach. However, Senate approval may stand in the way of this important next step to secure our elections, and our democracy.
The “For the People Act”, was proposed just days into the new Congress. Given the country’s recent epidemic with election hacking, the Democrats are hoping to minimize the disruption to our longstanding free and fair election mechanism. Hackers, foreign and domestic, have been successful accessing voter polls. Therefore, election security should be a no-brainer for cybersecurity professionals, as well as everyone on Capitol Hill. Clearly, states don’t have the appropriate means to defend themselves against sophisticated cyberattacks launched by the Chinese, Russians, and many other nation-state actors. With the enactment of this bill the federal government will have provided support under their role of government responsibilities. However, it will also show a seriousness of all leaders on the Hill to protecting the most important part of any democracy.
The U.S. can’t claim to be a democratic nation if its election system is not secure. If someone can become the President by hacking into the election system with the help of hacktivists, then is it right to call it a democracy any longer? Democracy comes from the will of the people and if people are there just to be governed, a democratic nation sits on shaky digital ground. This is why this bill presents yet another opportunity for citizens. We all should be reaching out to political representatives and expressing our hope they will vote to protect elections.
Our system doesn’t stop at the local level of government, that is where it starts. The local government is an attractive target for a cyberattack that can produce social and economic disruption. It is also the point of entry hackers looking to affect U.S. balance and sway opinion. Polling places and local practices reside in and feed into a broader national system dependent on local official managing operations according to national election laws. And, whereas local officials have adequate law enforcement support, cyber protections are usually based on minimal resources supported by states that have few technical resources.
This all means that to protect national elections and assure the integrity of local elections there must be the proper support from the federal government. Aging voting machines and a lack of funds supporting appropriate inspections creates a vulnerability. Additionally, an inability to count votes by a method other than the digital counting mechanism of the voting machine may call into question the fairness of an election. Providing a receipt to the voter and collecting a paper record supports transparency. Not having readily available results inserting doubt in a challenged election. This is a top ingredient for a recipe to undermining democracy.
Cyber Protection for States
States had their first taste of highly publicized nation-state cyber-attacks in 2016 when election systems were hacked across the nation. Some states and cities are understanding the gravity of the threats much better now. But, unfortunately there are still local Governments who see cybersecurity as a choice.
Paper ballots produced by machines that are also digitally counting are a minimal requirement for protecting both our elections and the democracy free elections represents. The paper ballot is our stopgap. If the hacker were to access election systems and change election counts or data, the paper ballot assures we have media to perform a secondary count. Paper ballots also present an opportunity to calm public sentiment should a recount be required. A hacker’s ability to reduce confidence in the system is as powerful as his ability to actually change data or force mechanical failure.
The whole of Community Approach
The citizens are critical to assuring their leaders act appropriately when it comes to cyber protections of elections. Cybersecurity is a team sport. Pennsylvania’s Venango County suffered from a lethal cyberattack in 2011. In this act of cyberterrorism, the voting machines apparently flipped those candidates that the citizens had originally voted for to the other candidate. Citizen detected the issue as opposed to an official monitoring system. When they cast their votes for candidates on the ballot, the confirmation screen showed a completely different vote than the one submitted.
In addition to other mentioned requirements, the act would establish a bug bounty program that offers cash rewards to ethical hackers for finding vulnerabilities in voting systems. This provides a new opportunity for citizens to participate. A bug bounty rewards are incentives already offered by many of the largest companies. The programs offer an opportunity to researchers and hackers to receive recognition and compensation for discovering and reporting software bugs. The amounts increase with the discovery of major vulnerabilities or open channels for cyber exploits. These programs allow the developers to discover and resolve bugs before the general public is aware of them effectively preventing incidents of widespread abuse. Some of the companies implementing them include Mozilla, Facebook, Yahoo!, and Google. This is not a bad gig for talented millennials and Generation “Z” folks who are regularly glued to computers. Many are up to speed on the inner-working of computer code and will find a great opportunity to contribute to the resiliency of our democracy.
The paper ballots proposition was met with enthusiasm from some election security experts who claim that this would tighten security loopholes. Recording votes digitally is convenient and easy. It goes together with our technological advancement and streamlines the election process. However, the smart use of technology is an important role of government. The fundamental role of a legislator is the protection of the nation and its people. And, as we now understand the consequences of election hacking and cyber threats, assuring a method of recounting every vote should be a priority.
The For the People Act will undoubtedly face opposition from the Republican-controlled Senate, as well as the Department of Homeland Security (DHS). It is true that paper ballots don’t guarantee the accuracy of the votes cast. A hacker could also program machines to record a digital vote and record a supporting paper ballot. However, every risk-reducing step we take is one in the right direction.
Previous House bills requiring paper ballots gained traction only among the Democrats, while not one Republican co-sponsored such a bill. The Republicans claim they steer away from imposing too many security mandates on states to not undermine a constitutional balance of power allowing states to oversee their own elections. This does make sense because it is important that we maintain this long-standing balance between the federal government and states. However, we clearly crossed a new threshold with cyber-attacks to election mechanisms in the local jurisdiction in 2016. Any party polarization regarding protection of local elections should have dissipated, but apparently it hasn’t.