Explained: Why US Elections Are So Vulnerable to Russian Hacking
WHY YOU SHOULD CARE
Time is running out to safeguard election systems against another attack, and the president doesn’t seem to much care.
As the body overseeing America’s campaign finance laws meets this week in another likely vain attempt to limit foreign spending, it’s clear our mishmash of election systems remains vulnerable to another attack. And with just more than four months until the hugely consequential midterms, the head of the executive branch appears uninterested in doing anything about it.
There is no longer any doubt that Russia meddled in our 2016 election in an effort to damage Hillary Clinton and boost Donald Trump, so a key question hanging over this year is whether we can detect and deter such interference this time. Given that local election officials and Washington policymakers were slow to react, improvements and safeguards are hard to measure and appear modest compared to the continuing threat.
The midterms could be our most telling election in decades. With the country sharply divided, the world will be watching to see if American voters affirm the agenda President Trump has pushed in his first 18 months or whether the country will swing sharply away from him.
There has been some modest progress on defense against Russian meddling. But the advantage always goes to the offense.
Why are the elections still vulnerable to foreign meddling?
First, elections in the U.S. are complex and decentralized, and much of the process occurs online. Attackers can seek to enter at numerous points, from voter registration to the casting of votes to their tabulation. They can also seek to penetrate companies that manufacture voting machines with the aim of corrupting their software. Moreover, in our federal system, the states jealously guard their independent control. Many turned away offers of Washington help during the Obama administration. The voting is actually administered by a total of 3,142 counties or county equivalents across the land. Cooperation and sharing of best practices among all these entities is improving but not enough to neutralize the threat.
States at this point use a variety of procedures. Some depend mostly on digital systems, some have digital with paper ballot backups and some have gone to just paper ballots, the surest way to guard against meddling. As of early this year, five states still had no paper ballot or paper ballot backup: Delaware, Louisiana, Georgia, South Carolina and New Jersey.
Federal security officials have testified that Russia will again try to interfere. Special Counsel Robert Mueller, seeking to deny evidence to lawyers representing one of the Russian firms he indicted for 2016 meddling, reported this month that Russia still has active “influence operations” aimed at U.S. elections. Director of National Intelligence Dan Coats said this month that he expected Russia to try to exert influence once again, echoing what Secretary of State Mike Pompeo told Congress last month.
One of the major impediments to progress is President Trump’s continuing cry that the various Russia investigations amount to a “rigged witch hunt.” He went so far last month as to claim that Mueller and his team of “12 angry Democrats” would actually be the ones meddling in the midterms. So even though many federal officials are working to lock out the Russians, the executive branch in our system never gets fully mobilized or works with total commitment unless the president gives a strong personal push to its efforts — and it’s clear Trump has no such intention.
On top of that, there is no one person or agency completely in charge. Responsibilities are divided widely, including among the Department of Homeland Security (DHS), law enforcement officials, localities and groups like the Federal Election Commission (FEC). There is no one running this at the White House, which in May eliminated its cybersecurity coordinator. The Federal Electoral Commission’s two-day open meeting this week is yet another attempt to agree on rules to limit foreign spending on U.S. elections, so far opposed by the Republican members.
Despite the absence of a presidential push, DHS has developed a number of programs aimed at safeguarding elections. Local participation is voluntary, acknowledging state control of balloting. But DHS deserves credit for pushing enhanced information sharing, security clearances for local officials and two-factor authentication for access to election databases. Congress, for its part, sent $380 million to augment such efforts. While some states say the federal government has left them in the dark, election officials from Indiana, Missouri, Vermont and Minnesota testifying in Congress last week seemed generally pleased with the cooperation and DHS support. But it is too soon to know the cumulative effect of these efforts across 50 states and more than 3,000 localities.
Social media companies such as Facebook and Twitter, under pressure from Congress and the public, claim to have taken some steps to limit Russia’s well-documented use of them for influence operations in the 2016 election. Facebook, which has acknowledged that 150 million Americans were exposed to Russian propaganda on its platform, last month required “paid for” labels on election advertising. Twitter says it will ban high-volume automated tweeting, such as those used by Russian bots (automated message programs that imitate humans). Clever operators, however, will still find ways to use these platforms for malign purposes. And there is little evidence of coordination among social media giants who are in many respects competitors.
The bottom line: There has been some modest progress on defense against Russian meddling. But the advantage always goes to the offense, and there is not the slightest evidence that Russia intends to back off. There is still no proof that it was able to physically alter votes cast in 2016. But it almost certainly affected voter attitudes on a range of issues, stoked partisan hostilities and may have reduced confidence in election integrity. Heading into the 2018 balloting, these are still the greatest dangers.