Elections security experts have discovered new ways to manipulate the type of voting machine used in Vermont, but local elections officials say it's unlikely that bad actors could exploit those vulnerabilities to change the results of an election.
At a recent technology conference in Las Vegas, ethical hackers from across the country tried to infiltrate some of the voting machines used in U.S. elections.
Probing for vulnerabilities in ballot tabulators is an annual tradition at the DEF CON Hacking Conference. This year, however, hackers tried to gain access to the same type of voting machine used by 135 towns in Vermont.
Montpelier City Clerk John Odum retrieved one of the machines from a vault last week and placed it on a desk in his office. It's a pretty ancient-looking piece of technology — like something you might have seen in a middle school computer room in the early 1990s.
"As I understand it, the memory cards that we use, the technology was originally developed for the original Tandy laptops," Odum said, "so this is some old stuff."
The machine is called an AccuVote, and its name is clearly meant to inspire confidence in the results it spits out. But when white-hat hackers set to work on this tabulator at DEF CON earlier this month, they quickly found all kinds of ways to manipulate results.
"Say this thing has been running all day; it's maybe collected, you know, 600 votes. I come up and I press these buttons, suddenly the memory card says we're at zero," Odum said, pointing to two black buttons underneath a locking mechanism he'd opened up.
Or, a would-be saboteur could run a so-called "ender card" through the AccuVote, to make the machine think the election was over. If that happened, Odum said, the tabulator would stop counting votes, even if there were several hours left for citizens to cast their ballots.
Odum, a certified ethical hacker himself, was one of the tech gurus in Vegas trying to compromise the very same machines he uses to administer elections in Montpelier. Despite all the vulnerabilities, Odum said there's no need to panic.
"All of these things, if we're doing everything right, are manageable," Odum said.
In order to corrupt the vote count on an AccuVote machine, you'd need physical access to its mechanical innards; Odum said Vermont's elections security protocols make the machines a pretty tough target to infiltrate.
Secretary of State Jim Condos agrees.
"Someone's not going to be able to come up and try to plug into it or take a screwdriver and pop it open to get into the thing," Condos said last week.
Even if someone managed to surreptitiously gain access to the AccuVote and alter the results, Condos said Vermont — unlike some states — has a surefire backstop against that particular type of election fraud.
"Vermont has a voter-marked paper ballot for every vote that's cast," Condos said. "Those votes, those ballots, are kept in a sealed bag in the town clerk's office vault for 22 months before they're destroyed."
More from Vermont Edition — Securing Vermont's Voting System For 2020 [June 14]
Odum said elections protocols would almost certainly set off the alarm bells needed to trigger a hand count if someone did compromise a voting machine. If someone zeroed out the vote count midway through the election, for instance, Odum said it would become apparent that something was amiss when the clerk cross-referenced the vote count against actual turnout.
"One of these procedures that we have is going to trigger that there's something wrong," Odum said, "so the worst-case scenario is we'd have to wait several more weeks before we get the final result."
Still, Odum said elections officials need to understand where the vulnerabilities are in order to prevent someone from exploiting them. He said that's why the sort of testing done at DEF CON this year needs to continue happening.
Odum said he plans to purchase his own AccuVote soon, so he can learn even more about how the machine works and whether there are other vulnerabilities yet to be discovered.
"And, you know, in a practical sense, we've got to do that," Odum said. "We cannot be comfortable that we are secure if we don't know the true boundaries of what security is."
Condos said the "race" for elections security "doesn't have a finish line" — and with a major presidential election coming up next year, he said Vermont needs to keep pace with whoever seeks to manipulate it.
Copyright 2019 Vermont Public Radio
