Protecting election systems from cyber and physical attacks was only one battle within the election security war in 2020 — the other, more difficult conflict was defending mindsets against false narratives about what had taken place.
“We spent three and a half years working on threat modeling, trying to figure out every possible disruption that could be launched against the election,” Krebs said. ”We were thinking through, ‘You know, it's not the technical attacks that are keeping us up at night, because we think we've got a pretty resilient system with good indicators’ … It came down to the perception hack that we were most worried about.”
Stakes remain high in upcoming elections, and forthcoming 2022 midterms will decide who assumes 84 percent of U.S. state legislative posts, per Ballotpedia.
FIGHTING FOR TRUST
As fear spreads, it can quickly transform into real-world threats, with this summer’s ransomware attack on Colonial Pipeline serving as a prime example, Krebs said. When the pipeline shut down, a panicked public made runs on gas supplies, accelerating shortages and exacerbating the problem.
Eroded trust in elections continues to plague the nation, and Krebs said innocuous mistakes can become misinterpreted and blown up into allegations of malicious interference. Every election encounters disruptions; for example, some precincts’ election systems have been knocked offline after nearby roadwork severed Internet fiber. This kind of everyday accident could be spun up into a tale of conspiracy.
Election or security officials seeking to combat falsehoods should avoid directly replying to social media users who post disinformation, as this approach can draw more attention to untruthful claims, Krebs said. The better practice is to push out truthful information from reliable sources.
Some states have been redoubling efforts to head off election confusion and falsehoods. This year, Virginia set aside about $2 million to fuel initiatives educating voters about elections. Fairfax County, Va., elections director Scott Konopasek told Stateline that officials can do a lot to dispel incorrect assumptions by offering residents opportunities to visit county offices to observe security measures and vote-counting processes.
SOCIAL MEDIA
Social media platforms are central stage in any discussion about fighting dis- and misinformation. Experts have highlighted how such platforms not only host inaccurate content but also actively amplify and spread falsehoods.
Krebs said regulations are necessary but difficult to craft because the platforms’ algorithms and inner workings are shrouded in so much secrecy. Regulators' first steps may need to be passing policies that require better disclosure and give researchers visibility into platform operations.
“I honestly don't think we know enough about how the platforms operate right now to make meaningful regulation,” he said. “We haven't had the appropriate disclosures and transparency into the business operations and financial models that the algorithms, the moderation, the targeting, the advertisements, the sponsored content, all these things.”
Will change come? The platforms have repeatedly drawn fire from both sides of the political aisle, yet congressional gridlock remains strong. Krebs predicted such a climate would allow for small, but existent, progress.
“I think something will get done. It’ll disappoint everybody, but it will move the ball forward,” he said.
He also recommended creating a federal agency focused on digital privacy, trust and safety.
ELECTION MACHINES
Election officials must also examine their equipment choices and ensure that their systems allow for appropriate audits to verify results.
Ballot counting machines are shown to tally ballots with more accuracy than human personnel counting everything by hand, Krebs said. But polling places should use systems that leave paper trails to enable auditing — a trend that is growing, but still not universal.
“We need as close to 100 percent paper as possible,” he said.
Nonpartisan nonprofit Verified Voting estimates that slightly more than 6 percent of voters in the November 2022 election will cast votes on machines that lack a mechanism for leaving paper records. Use of direct recording electronic (DRE) machines without paper trails is expected to be particularly high in certain states: Verified Voting estimates that all Louisiana voters, nearly 51 percent of Mississippi voters and nearly 15 percent of Texans will only be able to use such machines.
Citizens using DRE machines input their selections on the machines — rather than on paper ballots that get scanned into digital systems — and the machines store the votes. Some but not all DRE machines are equipped with voter-verified paper audit trails (VVPATs), which mark down the digitally entered vote on a paper record that the ballot-caster can review before confirming.
Other election systems that are easier to audit include ballot marking devices (BMDs). BMDs have users make their votes on the devices, then print out paper ballots with the selections indicated. BMDs don't store voting details in their memory and are often provided to support citizens with physical difficulties that would prevent them from marking paper ballots.
Verified Voting finds that about 68 percent of U.S. voters are in jurisdictions that primarily use hand-marked paper ballots while providing BMDs or DRE machines with VVPATs to serve citizens with accessibility needs, and slightly more than 19 percent of voters are in jurisdictions that provide BMDs to all voters.
Some BMDs’ methods of printing out votes are more transparent than others. Printouts might display votes so the ballot-casters can easily confirm their choices or may only show barcodes or QR codes, which cannot be parsed at a glance. A current lawsuit in Georgia aims to stop the state from using a BMD that prints codes, with plaintiffs arguing that this prevents voters from checking if their votes were recorded correctly.
