The hacking of election results, rumored to have occurred in 2016 and feared to be possible now and in the future, can happen here, say experts. They worry that New Jersey’s current voting process is vulnerable, and the state’s ballot system has been graded among the least secure in the country.
Still, the state’s chief election and security officials are confident in the integrity of New Jersey’s voting procedures. Since voting machines are not connected to the Internet, they believe there is no cause for concern. They have no plans to replace equipment that were put into service 15 years ago or longer.
Despite this, some legislators and advocacy groups are not convinced. They point out the voting machines in use are relatively antiquated and do not meet recommendations of national experts.
Security claims incorrect
“Although it’s great to see New Jersey taking steps to improve the security of its voter registration system and continuing it partnership with DHS (the U.S. Department of Homeland Security) in assessing election infrastructure, the idea that the state’s electronic paperless machines are secure because they’re not connected to the internet just isn’t true,” said Danielle Root, voting rights manager with the Center for American Progress.
The center gave New Jersey a grade of D on its election security scorecard, ranking the state among the 17 with the least-secure balloting systems. Voting machines must provide a paper trail, they said, in order to conduct post-election audits to confirm the accuracy of tallies.
“Given the threat posed by sophisticated nation-states seeking to disrupt U.S. elections, it is imperative that post-election audits test the accuracy of election outcomes and detect any possible manipulation,” CAP’s report on New Jersey’s election system states.”
Root said that confidence in the machines is misplaced because officials do not recognize their vulnerabilities.
“The fact of the matter is that the majority of machines today aren’t connected to the Internet, but they can still be hacked and manipulated by way of compromised flash drives and remote access software, among other things,” Root said. “We know of some malware, for example, that can compromise ‘air-gapped’ or offline technology. This is why it’s important elections be carried out with paper ballots that provide a verified record of a voter’s intent, along with strong post-election audits that can confirm the accuracy of election results.”
An ongoing process
State officials, however, say they are continuing to work on the process. “The Department of State is working to ensure that every individual able to cast a ballot in November can do so knowing the state affords a safe and secure system,” said Secretary of State Tahesha Way in a statement. “The Division of Elections has been and continues to work with federal partners at the Department of Homeland Security, the New Jersey Office of Homeland Security and Preparedness, and other third-party security experts to continuously improve our security posture as the threat landscape evolves.”
To date, there has been no verified instance of the hacking of any election results, although federal officials say they believe the goal of Russian hackers is to undermine the American system of democracy and changing election results would be one way to do that. Federal officials have reported that Russians were able to access the online voter systems of 21 states, with one of those — Illinois — having its registration system hacked, though no records were changed. There were other incidents as well, with breaches of security in the Arizona election, an election-system provider, and the federal agency in charge of overseeing the security of voting machines.
Kirstjen Nielson, who heads the U.S. Department of Homeland Security testified to U.S. Senate Intelligence Committee that the inability to audit election results in states like New Jersey is a “national security concern.”
While it seems counterintuitive, experts say that low-tech paper ballots — when used with higher-tech scanners — are more secure than computerized machines that do not include any paper backup. New Jersey is one of only five remaining states that use machines in which votes are recorded directly onto a computer drive without any paper trail.
Upgrading voting machines
New Jersey’s voting machines were upgraded shortly after the 2000 presidential election using federal grant money available at the time. Even then, the new electronic voting machines were the subject of a lawsuit by a group of citizens who complained about potential security risks and the lack of a paper trail. As part of the suit, a team of scientists from Princeton and Lehigh universities was able to study the most commonly used machine, the Sequoia AVC Advantage. In 2008, they presented their results, concluding the machines were “easily hacked” and urging the state to use a different method with an “auditable paper trail.” In the end, the state added some security devices and the court allowed the continued use of the machines.
Still, a Princeton professor made news in 2016 when he demonstrated how to hack a machine within seven minutes by replacing one of its computer chips with a chip that included programming to manipulate election results. That would be difficult to do, but not impossible, he said at the time, given voting machines are typically delivered to polling places days before an election and are left unguarded during that time.
Last year, several legislators introduced a bill that would have required all new voting machines purchased to have a paper trail. Although the bill was discussed in committee, it was not voted on. That bill has been reintroduced in the current session as A-1889. Sens. Nia Gill (D-Essex) and Shirley Turner (D-Mercer) also have put in a bill ([http://www.njleg.state.nj.us/2018/Bills/S1500/1113_I1.HTM|S1113]) that seeks to change machines in time for the June 5 primary, the timing of which would be difficult at this point.
One major roadblock to the change is the cost. While no fiscal notes have been prepared on the New Jersey bills, a report last month from the Brennan Center for Justice estimated it would cost New Jersey between $40 million and $63.5 million to replace all of the state’s machines. New Jersey is eligible to get $9.8 million through the 2018 Help America Vote Act Election Security Grant Program. Among the permitted uses for the funds are replacing older machines with ones that include a paper record and implementing a post-election audit.
A spokesman for the secretary of state said the office was given 90 days to decide how to use the money and is still considering its options.
Assemblyman Vincent Mazzeo (D-Atlantic), ajd chairman of the committee that hears election-related matters, said he is concerned enough about the issue that he plans to hold a hearing on it and may introduce legislation, as well, depending on what he learns.
“I think New Jersey probably does a good job, but are we doing everything we can so we don’t have people hacking our voting privilege?” Mazzeo said. He noted the new federal grant would be “good seed money” toward ensuring the security of the results. “Sometimes in Trenton we are reacting to things, maybe we need to be proactive on this one.”
Others feel more confident.
“Based on the incidents and ongoing federal investigation into the meddling of the 2016 presidential election, the Camden County Board of Elections has been working closely with the Department of State and the state Division of Elections to ensure the integrity, security, and honesty of all voting done in our jurisdiction,” said Dan Keashen, a county spokesman.
“First and foremost, and probably most importantly, county voting machines cannot be hacked remotely and there is no way for a foreign government or perpetrator to gain access to them without physically breaking a seal protocol. We operate our election machines on proprietary software and the machines are also surrounded by both board workers and other election officials during the day of the voting event. In addition, we meet all the standards and mandates laid out by the state of New Jersey.”
New Jersey is one of a number of states that have been working with federal homeland security officials to guarantee the system is safe from attacks.
“We are working with county and municipal election officials to offer security services and continuously monitor our systems,” said New Jersey Office of Homeland Security and Preparedness Director Jared Maples. “To that end, the New Jersey Cybersecurity and Communications Integration Cell provides near real-time awareness of cyberthreats and analysis, shares information on sound digital resilience and risk mitigation practices, and acts as a resource for cybersecurity incident reporting.”
Jesse Burns, executive director of the League of Women Voters of New Jersey, agrees that the balloting process is protected but supports upgrading to newer, safer machines.
“The state currently has systems in place to safeguard the integrity of our elections, including protocols to guarantee the security of voting machines, but our machines are aging, need improvement, and need replacing,” Burns said. “As counties look to purchase new voting machines, they will hopefully work alongside voting rights advocates and other experts to consider recent research and recommendations for systems that are secure, accessible, include a voter-verified paper trail, and can be used for audits and recounts.”
According to Root, there is no question that the state needs to change its election machines and quickly: “Simply put, New Jersey’s elections will remain vulnerable until the state replaces its paperless electronic voting machines with a paper-based system.”