As the 2024 election looms and American voters remain rife with misinformation, major U.S. voting equipment manufacturers are recruiting cybersecurity experts to conduct additional stress tests on their systems. One of the program's goals is to combat conspiracy theories by increasing transparency about how election equipment is picked apart by security experts before it's shipped to polling stations.
In new cybersecurity testing programs unveiled Wednesday, three large voting equipment vendors -- Election Systems & Software, Hart InterCivic and Unisyn -- gave a group of vetted cybersecurity researchers access to their software and hardware for nearly two days to see if they could find a way to break into the systems. The IT-Information Sharing and Analysis Center (IT-Information Sharing and Analysis Center) is a group of technology vendors, including voting equipment vendors participating in the program. Miter Corporation, a federally funded nonprofit with a sprawling office in suburban Washington, D.C., is hosting the event.
Among other attack scenarios, researchers have attempted to stuff ballot boxes and take offline the electronic poll books used by polling stations to process voters. Results are still being processed, but election vendors say they are already adjusting security protocols based on test results.
After the 2020 election, voting equipment suppliers faced death threats after President Donald Trump and his allies falsely claimed that machines produced by Dominion Voting Systems were used to rig the election.
Since the 2020 election, voting equipment companies have had to walk a tightrope between publicly discussing vulnerabilities in their software and how to fix them, and emboldening conspiracy theorists to use the information to falsely claim voter fraud.
As election officials prepare for 2024, the environment remains ripe for misinformation. According to a July CNN poll, 69% of Republicans and Republican leaners still believe President Joe Biden's 2020 victory was illegitimate.
"There are natural risks, but there are greater risks in doing nothing," Sam Derheimer, director of government affairs at Hart InterCivic, said of voting vendors participating in plans to work with researchers to publicly disclose and fix software vulnerabilities.
The program being implemented by the voting vendors - known as "coordinated vulnerability disclosure" - is a common practice in many other industries, from defense to banking. But these industries don’t have the kind of public scrutiny and sometimes reviling that U.S. election officials have faced over the past three years.
It would take years to get voting equipment manufacturers to participate in such a cybersecurity program and to overcome their skepticism about outside researchers who want to help.
"I'm very grateful to the vendors and election officials who are here because sharing information could result in them receiving death threats," Matt Masterson, a former senior election security official at the Department of Homeland Security's cybersecurity agency, said Wednesday at a project unveiling event hosted by Miter.
Voting machine manufacturers conduct their own internal security testing and also have their equipment tested by cybersecurity experts at the U.S. government-funded Idaho National Laboratory.
"But that doesn't seem to be enough to satisfy many of our critics," said Chris Wlaschin, a cybersecurity executive at ES&S Inc., one of the largest U.S. voting technology vendors. "This is the next step, the next layer of security, and also to bring transparency to the testing process."