In the 2005 documentary “Hacking Democracy,” voting security expert Harri Hursti easily alters the results of a mock election by modifying a voting machine’s memory card. This same model has been approved for use by 20 states this November. In “Kill Chain: The Cyber War on America’s Elections,” Hursti exposes more flaws in the technicalities of the dysfunctional American voting process — in both election administration and equipment — and warns viewers not to underestimate the role they play in the preservation of democracy.
For example, instead of being held to one nationwide standard, rules about early voting, mail-in voting, paper ballots and election equipment vary by state and county. To compound the disorganization, precincts all over the country can choose from various types of voting machines, which are manufactured by three different private companies, each with its own testing and security procedures. In interviews with election officials, hackers, and transparency advocates, “Kill Chain” uses past incidents of voting malpractice to demonstrate the ways in which elections can be compromised when computers are the middleman between voters and their respective votes and reveals how these incidents are part of a growing threat to American democracy.
When it comes to maintaining election transparency, the devil is truly in the details, which are shrouded in secrecy by private companies for reasons that may not be as innocent as mere security. “Kill Chain” covers the 2016 election in Florida, for which there is evidence of Russian interference in multiple counties. Russia’s hack into the Election Assistance Commission database in 2016 is no secret and no surprise, considering that Russia has rigged elections in nearly every country in NATO.
However, as cyber warfare expert Mikko Hypponen, who helped study and publish a cyber espionage report on Russia, tells Hursti in “Kill Chain,” Russia made no attempt to hide its involvement and has faced no repercussions. Since then, Florida has done little to address the attack, instead forming a partnership called the Joint Elections Security Initiative, which requires election supervisors in every county to sign non-disclosure agreements as a quid pro quo to continue receiving state money. If supervisors learn that the integrity of an election is compromised, they are legally bound to keep quiet.
Despite the great responsibility placed on them, election officials have very little power. One of their duties is copying ballot information and instructions for counting votes onto individual voting machines using removable USB sticks and memory cards similar to the one Hursti hacked 15 years ago. Thus, they can unknowingly introduce malicious code to more than one apparatus. Additionally, because voting machines are connected to the internet, this code can be spread or altered outside precincts as demonstrated in the documentary’s coverage of DefCon, a 2019 hacking conference. Using tests that were more comprehensive than those practiced by manufacturing companies, participants easily manipulated the results of mock elections.
Not only are the machines themselves vulnerable, but elections in swing states and tight races, where flipping outcomes can be difficult to detect, are soft targets for attacks. “Kill Chain” uses the 2018 Georgia gubernatorial race as an example, in which corrupt conservative Brian Kemp defeated his opponent, Stacey Abrams, by a margin of less than 1.4%. Kemp’s office had already altered voter registration data to skew the election in his favor. Kemp’s subsequent appointment of an Election Systems & Software lobbyist as his chief of staff suggests that his campaign may have cooperated with the voting equipment company to further control the results of the election. To make matters worse, Georgia residents will soon use new machines that convert used ballots into barcodes, which are, by design, impossible for a person to read or check for accuracy.
Also in 2018, CyberZeist, an anonymous India-based hacker, took advantage of a poorly-secured Alaskan elections website to access voter information and the GEMS system, which hosts live voting data. While the hacker did not reveal any motivations in his “Kill Chain” interview, this form of attack is most often an attempt to put a specific candidate in power or, as in the case of Russia, to disrupt a society’s peace by destabilizing its government — indeed, “Kill Chain” gets its name from the idea that separate incidents of voting malpractice are part of a 2,000-year-old concept called a “kill chain,” or sequences of events that lead to eventual societal collapse. Kill chains will wreak havoc until a link is broken. In this case, the only way to break the chain is election reform.
Despite the country’s dire need for election reform, the co-sponsors of the Secure Elections Act, senators Amy Klobuchar and James Lankford, told the “Kill Chain” team that bipartisan efforts for election security have been consistently blocked by the Senate majority leader, Mitch McConnell. The act had called for the use of paper ballots and risk-limiting audits, two cautionary measures “Kill Chain” advocates as feasible ways to achieve election transparency. Voting with machines means surrendering human control of votes to computers that are fallible and vulnerable to attack. Tallying errors are easier to spot using paper trails, where all original votes are visible to the human eye. Therefore, public risk-limiting audits ensure greater election transparency due to its reliance on paper records. These audits confirm that the outcomes on paper and on a computer are the same by selecting a random sample of ballots to be hand-counted until it is possible to conclude with high statistical confidence that the electronic outcome is true.
Unfortunately, paper ballots are only required in 14 states. Without paper trails, there is no guarantee that elections will be fair until security reform efforts are successful. In the meantime, “Kill Chain” calls for voting malpractice awareness and urges viewers to push their representatives to support bipartisan voting reform.
Next time you vote, request a mail-in or paper ballot.
