The Independent View: Election Security Groups Warn of Cyber Vulnerabilities for Emailed Ballots

Election Security Groups are sounding the Alarm about Emailed Ballots ahead of the November Midterm Elections, warning in a New Report that PDF and JPEG Ballot Attachments sent to Election Officials could be Exploited by Hackers. The Organizations, including Watchdog Group Common Cause, issued a Report Wednesday that found Election Workers who receive Emailed Ballots are at risk of Clicking on Unsafe Attachments, sent from unknown Sources, that could contain Malware.

"In jurisdictions that receive ballots by PDF or JPEG attachment, election workers must routinely click on documents from unknown sources to process emailed or faxed ballots, exposing the computer receiving the ballots — and any other devices on the same network — to a host of cyberattacks that could be launched from a false ballot laden with malicious software," the report says. "An infected false ballot would enter the server like any other ballot, but once opened, it would download malware that could give attackers backdoor access to the elections office’s network."

The Association for Computing Machinery's Technology Policy Committee, the National Election Defense Coalition, and the R Street Institute were among the Report's Co-authors.

Experts from both the Private and Public Sector have Warned about the Vulnerabilities of Online Voting for years, but the Report comes at a time of heightened Alarm about Election Interference from Hostile Nation-States or Cyber Criminals. Trump Administration Officials have said that Russia targeted Election-related Systems in 21 States leading up to the 2016 Presidential Election. They have also maintained that Hackers did not Target Systems involved in Vote-Tallying, and that there is No Evidence any Vote Tallies were Changed.

At least 100,000 People Voted Online in 2016, according to Data collected by the U.S. Election Assistance Commission (EAC). Hackers could attempt to Damage or Disrupt Elections through Internet Voting through Server Penetration, Client-Device Malware, Distributed Denial of Service Attacks (DDS), or Disruption Attacks, according to Wednesday's Report.

"Receiving ballots by email or fax can also expose a state or county election system to systemic election system attacks," the Report says. "Sophisticated attackers can spoof a legitimate voter’s emails and use fake ballots to deliver malware that can be used to gain entry into county or state election infrastructure."

Agencies and Entities like the Department of Homeland Security (DHS) and the National Association of Election Officials have Not Provided sufficient Guidance for Workers who are Dealing with Emailed Ballots, according to the Report, which Recommended that Election Administrators ensure that Computer Networks being used to receive Ballots are not Connected to the Voting Machine Network, in the event they Fall Victim to a Spear-Phishing Attack.

And if they receive a Ballot by Electronic means, Administrators should Print them out for Counting "and not electronically transmitted to the [Election Management System] for tallying," the Report recommends, while also calling for Voters to Instead Snail Mail in their Ballots and Print Out Copies of Electronically Submitted Ballots as Backup.