Hacking the ballot: How safe is your vote this November?

The idea that votes could be manipulated causes “panic in the public.” Could it happen in Ohio?

Voting system security at the Montgomery County Board of Elections

  • Voting and tabulation machines are never connected to the internet.
  • Voting machines and encrypted memory cards are stored in double-locked rooms requiring one Democrat and one Republican to open.
  • Cameras monitor all areas.
  • Employee access is controlled with badges, passwords and logs.
  • Machines fully tested before deployment.
  • The number of ballots cast must match the number of voters who signed in at polls.
  • Memory cards containing votes are carried to board office by Republican-Democrat teams.

Source: Montgomery County Board of Election

Efforts by hackers to infiltrate elections systems in Arizona and Illinois this summer, and the successful hack of the Democratic National Committee emails — allegedly by Russians — have officials and voters on edge as the Nov. 8 election nears.

“It causes panic in the public,” said Tim Mattice, executive director of The Election Center, which represents 1,300 state and local election officials and vendors. “People think, ‘Oh my goodness, … my vote is not going to count.”

Statements by Donald Trump, the Republican nominee for president, that only a rigged result could cost him the election have brought a strong response from officials like Ohio Secretary of State Jon Husted, who runs elections in the state.

Husted and national elections experts say a number of safeguards protect ballots from outside interference, including a federal law prohibiting connecting any voting machine or vote tabulation machine to the internet, which would appear to thwart hacking.

But officials fear that voter confidence is being shaken in an election year that is highly unusual if not unprecedented.

“We want to reassure the public that our election infrastructure is set up in a way that it is votes and votes alone that will determine the outcome of our election,” said Kay Stimson, communications director for the National Association of Secretaries of State.

Local officials say multiple levels of security — human, mechanical and technical — are in place to protect the machines from tampering, catch malfunctions and ensure all legitimate votes are counted.

“Your vote will count if you cast it in the United States,” said Jocelyn Bucaro, deputy director of the Butler County Board of Elections.

“There are checks and balances throughout the way,” said Jason Baker, Clark County Board of Elections Director.


Elections system researcher Merle King said he is confident in the country’s voting systems.

“I have not gone to DEFCON 3 yet,” said King, executive director of the Center for Election Systems at Kennesaw State University in Georgia. “I don’t think we are going to see attacks and hacks that alter the outcome of the election that are undetectable.”

Credit: Steve Lopez

Credit: Steve Lopez

But King and others said there are vulnerabilities in other parts of the the nation’s election systems, specifically voter registration, online ballot delivery and Election Night vote reporting, which does use the internet. Of particular concern is that online voter registration rolls could be vulnerable to hackers and experts say more needs to be done to make sure that the information in those databases is not compromised or used for fraudulent purposes on Election Day.

“That’s our worst nightmare,” said Matt Roberts, spokesman for Arizona Secretary of State Michele Reagan. “Because if somebody were to manipulate data within the registration database — say somebody just changes everybody’s name to Lucille Ball — that would be a big problem. It would be a catastrophe for elections officials, especially around an election.”

The FBI is investigating hack attempts of elections systems in Arizona and Illinois that occurred in June and and led to temporary shutdowns of both states' online voter registration systems.

In Arizona the hacker never got beyond the Gila County elections office computer, which had a compromised user name and password. In Illinois, interlopers penetrated the state’s online voter registration system but were caught that same day as they attempted to pull data, said Ken Menzel, general counsel for the Illinois Board of Elections. He said no voter information was changed in what was the first incursion in the decade the database has existed.

“They’ve been trying for 10 years,” said Menzel. “It’s been constant all along. I think any entity that has personal or financial information is subject to a similar sort of thing.”

Voter registration databases contain a trove of public but personal information that could be valuable to hackers interested not just in election mischief but also identity theft. The hacks were a “wake-up call” to state officials, said Stimson, and she anticipates states will increase efforts to protect against incursions.

Multiple backups

Husted said hack attempts are one reason why states like Ohio should be cautious in heeding calls to allow online voting.

He did note that official registration records are not online, and even when the state begins allowing people to register online in 2017, the local board offices will maintain the official record.

The electronic poll books used on Election Day are loaded with each county’s voter registration information prior to the election and never connected to the internet, said Steve Harsman, deputy director of the Montgomery County Board of Elections. If an attempted hack occurred to the data, it would likely be discovered and corrected before ePoll books were used on Election Day, Harsman said.

Matt Masterson, a commissioner at the U.S. Election Assistance Commission, said election night reporting of results — where local boards send their results to the state or otherwise share them publicly — is another area of concern. The danger is that hackers could somehow overwhelm the system and keep results from posting or tamper with them, said Masterson, a former staffer in Husted’s office.

However, such an attempt would not change the actual election results, he said, because the records would still be maintained at local elections offices.

Ohio is one 45 states that have paper backups of election results. Ohio’s results are also electronically backed up in multiple places, including two copies that are taken to off-site locations, officials said.

In 2012 the FBI alerted Montgomery County of an attempt to overload the board’s website with traffic to keep results from being reported, Harsman said. The data processing department monitored traffic and the threat did not materialize.

Ohio has an additional safeguard. To get local results onto the Secretary of State website on election night Husted distributes thumb drives, which are inserted into the vote tabulation machine only once and then used to upload the latest election results to a secure computer controlled by his office. The thumb drives cannot be used again.

Stimson said the practice has become standard throughout the United States.

“Ohio is certainly a state that we recommend other states talk to, not only because it is regarded as a state that runs elections well but also because they’ve been scrutinized so well for so many years,” she said. “They’re tested.”

Aging machines

Some elections officials are growing increasingly concerned about aging voting machines causing Election Day malfunctions, such as vote flipping on poorly calibrated touch screens that cause people to cast unintended votes.

“Technology has changed dramatically in the last decade, but America’s voting machines are rapidly aging out,” said a 2015 report by the Brennan Center for Justice at New York University School of Law.

The current crop of voting machines is mostly a mix of electronic touch screen and optical scanning equipment used with printed ballots. Much of the equipment dates to 2006, when federal funding covered much of the cost after punch ballots went out of favor in the wake of the disputed 2000 Presidential election and the famous “hanging chads.”

But unlike punch ballots — essentially a paper ballot loaded into a plastic frame — the new voting equipment is electronic and has a shelf-life. Replacing the equipment could cost an estimated $1 billion nationwide, according to the Brennan Center, and officials say there is no federal money in sight.

In Ohio elections and state officials are working on a plan that would replace the machines in 2018 or 2020, with the state and counties sharing the replacement costs. Husted estimated the cost statewide to be as high as $150 million.

Battleground Ohio

Ohio has been a battleground for legislative and judicial fights over voter restrictions, with Republicans saying they are attempting to protect against fraud while Democrats say the real motivation is limiting turnout by groups who typically vote Democratic.

Last week the U.S. Supreme Court refused to intervene to overturn a lower court ruling that upheld cuts in the number of early voting days that was enacted by the Republican-led legislature and the elimination of “Golden Week,” which allowed Ohioans to register and vote and the same time.

Early voting now starts Oct. 12, the day after registration for the election closes.

Husted argues that Ohio makes it easy to vote and hard to cheat, and he criticizes Democrats for suggesting that groups are being disenfranchised.

But critics of the bushel of voting restrictions added to the books in Ohio and elsewhere point to multiple studies showing that incidents of voter fraud are extremely rare. In a new report on voter fraud, the Brennan Center found most reported incidents are actually “clerical errors or bad data-matching practices.”

A review of voter fraud studies “found incident rates between 0.00004 percent and 0.00009 percent,” according to the center.

“Given this tiny incident rate for voter impersonation fraud,” it is more likely that an American “will be struck by lightning than that he will impersonate another voter at the polls,” the report said.

The report also disputed the notion that fraud could be used to “rig” an election.

Trump’s campaign team isn’t so sure. When Husted called Trump’s comments about a rigged election “ridiculous,” this newspaper sought a response from the Trump campaign.

The response was that Hillary Clinton “has made it clear that she plays by different rules than average Americans. She has shown a willingness to pull every lever of government in the rigged system in Washington that she represents to achieve her political goals,” said Seth Unger, spokesman for the Trump campaign in Ohio.

Unger said the campaign will be “vigilant to ensure that all rules are enforced and elections are secure this November.”

Clinton’s Ohio spokesman declined to comment.

Aaron Ockerman, executive director of the Ohio Association of Election Officials, said the decentralized setup in Ohio is yet another safeguard protecting the state’s vote.

With each of Ohio’s 88 counties running their own elections “to rig a statewide election you are not rigging one election, you would have to rig 88 county elections,” Ockerman said. “It would take a mass conspiracy.”

Voting system security at the Montgomery County Board of Elections

  • Voting and tabulation machines are never connected to the internet.
  • Voting machines and encrypted memory cards are stored in double-locked rooms requiring one Democrat and one Republican to open.
  • Cameras monitor all areas.
  • Employee access is controlled with badges, passwords and logs.
  • Machines fully tested before deployment.
  • The number of ballots cast must match the number of voters who signed in at polls.
  • Memory cards containing votes are carried to board office by Republican-Democrat teams.

About the Author