My Conversation With a Leading Election Technology Researcher Should Terrify You

Def Con is a 25 year old hacking convention where the worlds best hackers come together often highlighting security vulnerabilities in technology. This year, Def Con made news by raising awareness of our voting machine insecurities by challenging hackers to hack into the voting machines commonly used in this country for elections. These Def Con hacks took place in the "Voting Village".

I spoke with Voting Village organizer and leading election technology researcher, Harri Hursti, about the results of the experiment and the challenges we face in securing our elections in the future.

 

AM: Tell me about Def Con and the "Voting Village" and the role you played in the experiment.

HH: I was the co-organizer of the Village along with professor Matt Blaze.

AM: What was the main purpose of this exhibition?

HH: Education. We wanted to let the security community learn more about the machines and the designs. So far, only a very small group of people have been allowed to study and research these machines. As a result there was a lot of misinformation, rumors and false claims, and finding proven facts was difficult. The broader community which has 1st hand experience can help the public and the policy makers to get the facts known and drive better policies and practices to secure the elections.

AM: How many voting machines in total were there used in this experiment?

HH: 10 voting machines and 10 electronic pollbooks

(For my readers that have no idea what an electronic pollbook is, as per wikipedia: an electronic pollbook or e-poll book is either hardware, software or a combination of the two that allows election officials to review and/or maintain voter register information for an election, but does not actually count votes. This software or hardware is used in place of paper-based poll books, which are typically three-ring binders. Often, the functions of an e-pollbook include voter lookup, verification, identification, precinct assignment, ballot assignment, voter history update and other functions such as name change, address change and/or redirecting voters to correct voting location.)

AM: How many different types of voting machines were used at Def Con and how many different types of voting machines are used during an election?

HH: 4 different types of voting machines and 1 e-poll book. According to the best available public information, 52 types of machines were used in November 2016's general elections. There are quite a few systems which are only used in a single or few counties/cities in USA. The 3 out of 4 different types machines we had in the village are some of the most widely used models of electronic voting machines used in 2016 elections.

AM: How many hackers did you have at Voting Village trying to hack these voting machines?

HH: Unknown, doors were open and the room which has capacity of about 100 was several times overcrowded, and we needed to temporarily stop people from getting in. I would guess that number of people who did some real hacking work was 200-300 over the 3 day period in that room. On top of that we had machines placed in a second room for 2 of those days and we lent a few machines to other Villages (like the Hardware Hacking village) - so the total number is really unknown.

AM: Were any of the voting machines that were used in Voting Village more secure than others?

HH: No.

AM: OK. So break it to me gently…how long did it take the hackers to get into the voting machines?

HH: From when the doors opened, the first 2 hacks were announced in under 90 minutes. However, the first announcer was away from the room for about an hour to catch a speech - so he did the hack and developed demonstrable proof-of-concept in under 30 minutes of real working time, we only learned of it 90 minutes in.
AM: 30 minutes! Ugh! What's another device that would take around the same amount of time to hack?

HH: Any device with all operating system maintenance neglected for 10 years. One reason the WinVote was so easy to hack was because it was running an old, out of date Windows XP operating system with wireless connectivity, so it's the equivalent of a decade old laptop that hasn't been updated since it was purchased.

AM: Were you able to pinpoint the security vulnerabilities? And were those insecurities the same across all the machines?

HH: The California TTBR Report and the Ohio EVEREST Report identified 100s of vulnerabilities that are mainly still there. There are vulnerabilities which are not bugs, those are extremely insecure design features, and those seem to repeat themselves across the machines.

AM: 100's of vulnerabilities?! Is it possible to design a voting machine that can't be hacked?

HH: No. The key is auditing the results - and auditing is only possible if the voter votes on a paper ballot.

AM: After this experiment, do you think that our elections have been compromised in the past?

HH: It was well established that all election machines were and are hackable. The purpose of the Village was education. Also, these machines are so insecure that they are incapable of even providing reliable forensic evidence one way or another. To clarify, basically these machines often don't even reliably log how they've been accessed, meaning, claims that the machines showed no proof of being "hacked" is a circular argument, because the machines are incapable of providing such proof. Imagine asking your refrigerator why it is out of milk, when it does not even have the ability to prove how many times its door has been opened.

AM: Oregon has the most convenient voting system in the country. Since adopting paper-vote-by-mail ballots, Oregon consistently ranks as a national leader in voter turnout. What do you think we have to do to keep our elections from being hacked in the future? Do you think the country should move in the direction of paper-vote-in-ballots like the system Oregon has in place?

HH: Actually, Oregon uses various types of voting machines to scan and tabulate the paper ballots. It is called a 'central count'. Ballot scanners when working properly are superior to humans in accuracy - but paper ballots scanners and tabulators are hackable. The key is a mandatory audits of the results. A paper ballot is the best way to vote today, and technology should be used in responsible ways to count the paper-ballot recorded votes. By the way, mail-in voting has it's own set of risks, starting from voter coercion and fraudulent use of PO Boxes.

AM: There were 15 states in 2016 in which at least some voters used machines without a paper trail. Knowing how easy it is to hack these voting machines, what more can we do as a country to protect the integrity of our elections?

HH: Actually, people don't realize that voting machines with paper trail (VVPAT) are not much more secure than the ones without it. There are numerous studies showing that VVPAT is not a solution. Paper ballots are the only way to secure the elections.

AM: Thank you for your time and raising awareness on such an important issue affecting our democracy.

HH: Thank you!

Interviewer: Alyssa Milano | Interviewee: Harri Hursti

Mr. Hursti is one of the world's foremost experts on the topic of electronic voting security, having served in all aspects of the industry sector. He is an authority on uncovering critical problems in electronic voting systems worldwide, including in the U.S., Finland, Estonia, and Argentina. As a consultant, he has conducted and co-authored many studies, both academic and commercial, on numerous election systems' data security and vulnerabilities. These studies have come at the request of officials, legislators and policy makers in 5 countries; including the U.S. government, at both the state and federal level. Mr. Hursti is famously known for his successful attempt to demonstrate how the Diebold Election Systems' voting machines could be hacked, ultimately altering final voting results. Hursti performed two voting machine hacking tests which became widely known as the Hursti Hacks. The Hursti Hack tests were filmed and turned into an acclaimed HBO documentary called Hacking Democracy which was nominated for an Emmy award for outstanding investigative journalism. Mr. Hursti received the EFFI Winston Smith Award in 2008 and the EFF Pioneer Award in 2009 for his work in election security.

38 Comments

  • Trackback: “My Conversation with a Leading Election Technology Researcher Should Terrify You” | Election Law Blog
  • Trackback: My Conversation With a Leading Election Technology Researcher Should Terrify You | Patriot NOT Partisan | Verified Voting
  • Jack
    Posted August 29, 2017 10:23 pm 0Likes

    Leе and Larry loved tһeiг siхth birthday party.
    Regardless that tһey had beеn twins, Mommү and
    Daddy all the time made positive they every had a
    particular time. And wіth their birthɗays coming in DecemƄeг, Ⅿommy annd Daddy additionally ɑll the time mde poѕitive their ƅirthdays had Ƅeen particular alhough Christmas was propeг
    across the corner. The socoal gatherіng was so enjoуable wkth a clowsn and
    cake and soongs and wondеrful presents from their buɗdіes and grandparents and uncle and aunts.
    It weent by sօ quick but earlier than they knew it, everybody had
    gone dwelⅼing and it was tiime to wash up ɑnd prepare ffor bed.

  • Manie
    Posted August 30, 2017 3:02 pm 0Likes

    Ꮃhen youre occupied with a brand new rofession as a ρaralegal, therе are a selection of options which youll be able to consider.
    You may determine that being a fгeelance paгаlеgal is the
    way in which that yоu want to рursue this fіeld.
    Youll be aЬle to ƅegin by weighing the professionals and ⅽons of thiѕ exciting
    neww manner of workіng in tһe parаlegal area; and its ⲣossibⅼe
    уoull decide that it is the best choicе for you.

  • http://www.linux.co.uk
    Posted August 30, 2017 10:31 pm 0Likes

    Everyоne laughed tryіng to think aboht what sort of biгthday party Mary and Joseph gave for Jesus when He
    waѕ six. Lɑrry queѕtіoned, ?I guess he appreciated the same
    type oof toys we liкe.

  • Http://wikipedia.org
    Posted September 27, 2017 3:06 pm 0Likes

    This іs such a enjoyable ցame aand wе hɑd an ideal
    birthϳday Dadɗy.? Larry added. ?Can we play ?What?s one of the best thing abolut
    God? tomorrow toߋ?? hе begged his Ⅿommy.

  • Pingback: DMPK
  • buy condoms
    Posted October 21, 2017 9:44 pm 0Likes

    Hi there! This article could not be written any better!
    Looking at this article reminds me of my previous roommate!
    He constantly kept talking about this. I most certainly will forward this information to him.
    Pretty sure he’ll have a very good read. Thank you for sharing!
    Is it OK to post on Linkedin? Keep up the superb work!

  • Pingback: Law Diyala
  • Pingback: iraqi coehuman
  • Pingback: Software Praktek Dokter
  • Pingback: Colarts arab
  • adidas eqt
    Posted December 31, 2017 6:15 pm 0Likes

    I in addition to my friends were actually taking note of the great guidelines located on the blog and so immediately got an awful feeling I never thanked the blog owner for those secrets. My boys came as a result happy to study them and have now absolutely been taking pleasure in those things. Many thanks for genuinely very thoughtful and for picking out certain cool subject matter millions of individuals are really desperate to be aware of. Our own sincere regret for not expressing gratitude to sooner.

  • yeezy shoes
    Posted January 1, 2018 8:25 pm 0Likes

    very nice post, i certainly love this website, keep on it

  • ultra boost
    Posted January 1, 2018 11:05 pm 0Likes

    I want to express my admiration for your kind-heartedness giving support to those people who really need help with the area. Your real commitment to getting the message all through had been astonishingly beneficial and has usually enabled employees like me to reach their objectives. Your new invaluable key points entails a lot a person like me and especially to my mates. Warm regards; from each one of us.

  • pandora bracelet
    Posted January 3, 2018 2:58 am 0Likes

    I as well as my guys happened to be looking through the best things located on your web page then all of the sudden developed an awful suspicion I never thanked the web site owner for those tips. The ladies were definitely as a consequence excited to read them and already have definitely been having fun with them. Thanks for really being indeed accommodating and also for opting for variety of nice issues millions of individuals are really eager to understand about. My personal honest apologies for not expressing appreciation to sooner.

  • Pingback: GVK Bio news updates
  • yeezy boost 350
    Posted January 4, 2018 3:39 pm 0Likes

    An interesting dialogue is price comment. I feel that it is best to write extra on this topic, it won’t be a taboo topic however usually individuals are not enough to talk on such topics. To the next. Cheers

  • adidas yeezy
    Posted January 4, 2018 5:37 pm 0Likes

    Thank you for each of your work on this website. Kim loves going through research and it’s easy to understand why. A number of us know all relating to the dynamic form you create efficient suggestions by means of the web site and in addition encourage participation from other individuals on this area of interest and our princess is actually starting to learn a lot of things. Enjoy the remaining portion of the new year. You are always conducting a wonderful job.

  • adidas nmd
    Posted January 5, 2018 4:20 am 0Likes

    I used to be very pleased to seek out this net-site.I wished to thanks to your time for this wonderful read!! I undoubtedly enjoying each little bit of it and I have you bookmarked to take a look at new stuff you blog post.

  • goyard handbags
    Posted January 6, 2018 1:52 am 0Likes

    I simply wanted to send a word to be able to appreciate you for all of the amazing facts you are giving out here. My time-consuming internet investigation has at the end been compensated with pleasant concept to share with my friends and classmates. I would state that that most of us site visitors actually are extremely lucky to be in a superb network with so many awesome individuals with very helpful guidelines. I feel very privileged to have encountered your web site and look forward to so many more fabulous minutes reading here. Thank you once more for everything.

  • foamposites
    Posted January 7, 2018 8:30 pm 0Likes

    I together with my guys were found to be going through the excellent helpful tips located on your website and so suddenly developed a terrible feeling I never expressed respect to the website owner for those secrets. All of the guys appeared to be for that reason passionate to study all of them and now have certainly been making the most of these things. Appreciate your getting indeed helpful as well as for figuring out this kind of ideal information millions of individuals are really needing to be informed on. Our sincere apologies for not expressing appreciation to you earlier.

  • adidas nmd
    Posted January 8, 2018 10:37 pm 0Likes

    I really wanted to send a message to be able to express gratitude to you for some of the lovely hints you are giving out on this website. My rather long internet look up has finally been paid with excellent tips to share with my close friends. I would claim that we readers actually are extremely lucky to exist in a fantastic network with very many outstanding individuals with very helpful opinions. I feel pretty happy to have come across the web pages and look forward to really more fun times reading here. Thanks once more for everything.

  • michael kors handbags
    Posted January 9, 2018 4:15 am 0Likes

    I am writing to let you know of the awesome experience my friend’s child enjoyed viewing your site. She came to find numerous issues, which include what it is like to possess an awesome helping mood to get the others with ease know chosen hard to do subject matter. You actually surpassed our expected results. Many thanks for delivering such important, healthy, revealing and unique guidance on this topic to Julie.

  • nike huarache sale
    Posted January 10, 2018 5:00 pm 0Likes

    I precisely wanted to appreciate you again. I’m not certain the things that I would’ve achieved in the absence of the type of secrets revealed by you relating to my concern. This was the frightful issue for me personally, however , discovering a expert way you treated that forced me to weep over gladness. Extremely thankful for this advice and expect you find out what a great job you are always accomplishing training men and women using your blog. Probably you have never encountered any of us.

  • yeezy boost 350 v2
    Posted January 11, 2018 9:57 pm 0Likes

    I simply wanted to thank you very much once more. I’m not certain what I would’ve achieved without those strategies contributed by you on such a theme. It had been an absolute distressing problem for me personally, however , considering this specialised avenue you treated it took me to jump for fulfillment. I’m just thankful for your support and then hope you realize what an amazing job that you’re undertaking training people via a web site. I’m certain you haven’t encountered all of us.

  • nike zoom
    Posted January 12, 2018 12:25 am 0Likes

    Thanks so much for giving everyone an extraordinarily pleasant opportunity to read from here. It can be very fantastic and as well , packed with fun for me personally and my office colleagues to search the blog the equivalent of three times in one week to read through the latest items you have. Not to mention, we are certainly contented with all the spectacular tips and hints you serve. Certain 1 points in this posting are without a doubt the most suitable we have all had.

  • tom ford eyewear
    Posted January 13, 2018 12:13 pm 0Likes

    I enjoy you because of your own efforts on this web site. Kate take interest in doing internet research and it’s really easy to understand why. We all learn all relating to the dynamic means you deliver good guidelines through the web blog and as well as cause response from others on that matter then our simple princess is without a doubt becoming educated so much. Take pleasure in the rest of the new year. You’re the one performing a splendid job.

  • Adidas NMD Runner Blue Green White
    Posted January 13, 2018 12:48 pm 0Likes

    I precisely wanted to thank you very much all over again. I’m not certain the things I would’ve accomplished in the absence of the type of tips contributed by you about such area of interest. It was actually a very traumatic concern in my view, nevertheless spending time with a skilled fashion you solved the issue forced me to leap for fulfillment. I will be happier for your information and believe you comprehend what a great job you have been doing training the mediocre ones via your web page. Most probably you’ve never met any of us.

  • prix bague bulgari imitation
    Posted January 13, 2018 3:58 pm 0Likes

    Brit, you would have to use the last method “Super Loop”. That is probably the only way of doing it because all what you would do is on the first post, you add a unique class such as “first-post” , and then style that using your CSS file.
    prix bague bulgari imitation http://www.aluxury.nl/fr/

  • yeezy
    Posted January 14, 2018 6:34 pm 0Likes

    My wife and i got fulfilled Peter could finish off his inquiry through the ideas he got from your own web site. It is now and again perplexing to just find yourself offering secrets and techniques that many many others may have been selling. And now we fully grasp we’ve got the website owner to appreciate for this. The specific explanations you made, the easy web site menu, the relationships you assist to promote – it is many fabulous, and it’s really helping our son in addition to our family believe that the situation is enjoyable, and that’s especially pressing. Thank you for everything!

  • balenciaga sneakers
    Posted January 14, 2018 8:38 pm 0Likes

    I am also writing to make you know what a wonderful encounter my princess encountered checking your webblog. She mastered plenty of details, not to mention how it is like to have an ideal teaching heart to have most people smoothly learn about a variety of extremely tough topics. You really surpassed readers’ expected results. Thanks for offering these helpful, trustworthy, informative and in addition easy thoughts on this topic to Jane.

  • kevin durant shoes
    Posted January 16, 2018 8:14 am 0Likes

    I have to express some thanks to the writer just for rescuing me from this particular condition. After checking through the world wide web and finding advice which were not helpful, I believed my entire life was gone. Being alive devoid of the strategies to the problems you have sorted out all through your main guideline is a serious case, and the ones that could have in a negative way damaged my career if I hadn’t come across your blog post. Your personal training and kindness in touching all things was precious. I’m not sure what I would’ve done if I hadn’t come upon such a step like this. I’m able to at this moment look forward to my future. Thanks for your time very much for your skilled and result oriented guide. I will not think twice to endorse your blog post to any individual who will need assistance about this topic.

  • adidas ultra boost uncaged
    Posted January 17, 2018 1:52 pm 0Likes

    I intended to send you the very little word to finally say thanks a lot once again with the gorgeous suggestions you’ve shown at this time. It’s strangely generous of you to present unhampered precisely what a lot of folks might have advertised for an electronic book in making some bucks for their own end, and in particular considering the fact that you could possibly have tried it in the event you wanted. Those inspiring ideas likewise acted to become a good way to be sure that other people have similar fervor similar to mine to know the truth lots more around this matter. I am sure there are several more pleasant situations in the future for folks who check out your blog.

  • nfl jerseys
    Posted January 17, 2018 2:29 pm 0Likes

    My wife and i were very thrilled that Albert managed to complete his inquiry through the ideas he obtained out of your web pages. It’s not at all simplistic to just possibly be giving out instructions which usually some other people could have been trying to sell. And now we consider we’ve got you to give thanks to because of that. The entire illustrations you made, the simple site menu, the relationships you help instill – it’s got many remarkable, and it’s really leading our son in addition to our family reckon that that concept is brilliant, which is certainly particularly indispensable. Thank you for the whole lot!

  • adidas outlet
    Posted January 18, 2018 6:11 pm 0Likes

    I precisely desired to thank you very much once again. I am not sure what I could possibly have implemented in the absence of the concepts discussed by you regarding that topic. It had been a very hard circumstance for me personally, however , spending time with the professional way you dealt with the issue forced me to leap for happiness. Now i’m happy for this information as well as expect you recognize what a great job that you’re doing training the others through the use of your webblog. I am sure you have never encountered all of us.

  • adidas nmd r1
    Posted January 19, 2018 10:16 pm 0Likes

    I truly wanted to develop a quick word in order to appreciate you for the great ways you are posting on this site. My extended internet research has at the end been rewarded with useful details to exchange with my friends and classmates. I would suppose that we readers actually are very blessed to dwell in a fine site with very many perfect individuals with helpful tips and hints. I feel really privileged to have encountered your weblog and look forward to some more entertaining moments reading here. Thanks a lot again for everything.

  • yeezy boost 350 v2
    Posted January 19, 2018 10:32 pm 0Likes

    My spouse and i felt absolutely more than happy when Chris could finish off his researching while using the precious recommendations he obtained out of your web site. It is now and again perplexing to simply possibly be releasing information and facts which usually the rest have been trying to sell. We know we need the blog owner to appreciate for that. Most of the illustrations you have made, the easy website menu, the relationships you will make it possible to create – it’s mostly sensational, and it’s really helping our son and us consider that that content is awesome, which is very vital. Many thanks for all!

Add Comment