The Facts About Election "Hacking" and a Plan to Counter the Threat

This morning, the Senate Intelligence Committee will hold a hearing on “Russian Interference in the 2016 Elections.” This comes in the context of recent revelations from former FBI Director James Comey, as well as multiple leaks and recent reports in The InterceptBloombergPolitico, and McClatchy, alleging widespread hacking of election systems. Some of these reports have claimed, without much information to support the allegations, that “Russian hackers hit systems in 39 states.”

My Statement to the U.N. re: Increasing Democratic Participation (or, What I Did With My Summer Vacation)...

As news continues to trickle out about efforts of other nations to interfere and tamper with American elections, the line between working in U.S. elections and working internationally is blurring, as cyber-security and other issues require us to consider threats that go beyond our borders. It is timely, then, that for the past two days, I've been privileged to represent the United States at a meeting convened by the United Nations High Commissioner on Human Rights, seeking guidelines regarding the international right to participate in public affairs. This particular meeting involved the Americas, and took place in Santiago, Chile. It has been an incredible experience, and I've learned so much from the other participants, representing about a dozen or so other nations in the Western Hemisphere. I also must rave about the beauty of Chile and the graciousness of the Chilean people (and perhaps as importantly, the food and the wine -- I highly recommend the carmenere!).

The format was informal, with a lot of discussion back and forth, but each of the experts brought in by the U.N. was asked to introduce a topic and recommendations in a statement. My statement is below, for those that might be interested:

 

STATEMENT OF DAVID J. BECKER

Executive Director and Founder of The Center for Election Innovation & Research

to the Office of the United Nations High Commissioner for Human Rights

Santiago, Chile, June 14, 2017

Newspaper stories in the United States, and around the world, are filled with attempts to hack into voting machines and voter lists, political manipulation through “fake news” and misinformation through social and other media, and alleged rampant voter fraud. While there’s no evidence to suggest the vote counts in the recent U.S. presidential election were hacked—and substantial evidence that voter fraud in the U.S. is an extremely rare occurrence—there is evidence that anti-democratic forces are a threat, using free speech and technology to undermine democratic institutions. This threat is having its likely intended effect—it is greatly damaging citizens’ confidence in the machinery of their democracy. But while this covert threat is somewhat new, it is also serving to amplify an existing threat to participatory democracy, one that has been building for some time, quietly, but entirely in the open.

For decades, the United States has seen steadily declining voter turnout, particularly in elections other than those for President. In presidential elections, the U.S. sees about 60% of eligible voters turn out, and that has held fairly steady over the years, sometimes dropping to around 55%, but rarely going higher. This is the high-water mark for voter participation in the U.S., with two out of five eligible voters sitting out of all elections, even those for President. And once every four years is the only time when even a bare majority of eligible voters show up to the polls in the U.S. In other elections, turnout is far lower, and declining. In November 2014, when every seat in the U.S. House of Representatives and over a third of the U.S. Senate, as well as most state governor and legislative seats were up for election, fewer than 36% of eligible voters cast a ballot. Nearly two in three citizens stayed home, including nearly 50 million who had voted only two years earlier. This represented the lowest turnout in a federal election in the United States since 1942, when 18- to 20-year-olds could not yet vote, and many young men were preparing to serve in World War II.

This low turnout was not the exception – it is the rule. Since 1972, the first election where 18-year-olds were permitted to vote in the U.S., turnout in non-presidential federal elections has been very low, never exceeding 42%. Turnout is even lower in primary and local elections. Only about 30% of eligible voters cast ballots in the partisan primaries for president in 2016, and primary turnout in non-presidential years is significantly lower. And then there are local elections—for mayor, city and county government, and in some cases, state government—which may not coincide with federal elections, and where turnout can sometimes dip below 10% of eligible voters. For instance, in March, 2017, barely over one in ten eligible voters turned out to vote for Mayor of Los Angeles, the second largest city in the U.S., just four months after the presidential election.

This remarkable decline begs the question – why? Why are so many voters in the U.S, one of the world’s oldest democracies, opting out of participating?

For many years, those of us who work in elections had thought that if we simply brought elections into the 21st century, making elections more convenient for voters, that alone would increase turnout. And in the U.S., over the last ten years, we’ve been enormously successful in modernizing our elections and offering voters more choices in how and when to vote. Two-thirds of the states allow citizens to register to vote or update their voter information entirely online at any time, day or night. More American voters than ever can register to vote even on Election Day itself. I helped found a state-of-the-art data center called the Electronic Registration Information Center, or “ERIC,” which almost half the states in the U.S. have joined. ERIC allows states to keep voter records up-to-date even as citizens move throughout the country, something that had previously frustrated efforts to keep accurate voter lists and get voters information on their elections. I can’t stress enough how much the right to vote is dependent upon maintaining a complete and accurate voter list.

In addition, election information is spread over social media and digital platforms as never before, with tens of millions of Americans getting information easily through Google, Facebook, and others. Most American voters have the option to easily cast a ballot early, in the weeks before Election Day, and can do so either in person, or by mail, if they choose. In fact, nearly 50 million ballots were cast before Election Day in November, over one-third of all votes cast. And we have been very successful in expanding voting options for voters with disabilities, those with need for assistance in languages other than English, and those residing abroad or serving in our military.

American elections are of course not perfect, but the fact remains that it is now easier to vote in the U.S. than ever before in our history, and yet, turnout is at an all-time low. Again, why? Is it due to sustained barriers? Is it because our ballots are longer and more complex than almost anywhere in the world, filled with pages of contests and referenda? Is it because we are so comfortable with democracy that we are now bored with it? Or, more likely, is it due to a much more complex combination of factors?

I hosted a meeting of Secretaries of State a year ago and asked them that same question. One of them suggested that the reason was simple—voters just don’t like the candidates, and they don’t think their votes make a difference. While there might be something to both points—particularly in this environment where powerful forces are arrayed to delegitimize the vote itself—I asked the secretaries in the room a simple question: how many of us had voted in an election in favor of a candidate we personally disliked greatly, and where we knew our single vote wouldn’t make a bit of difference in the outcome? Every single one of us raised a hand. Again, why? Why were those of us around that table, and presumably around this table, in the small number of citizens who would always vote, no matter what was on the ballot and no matter what outcome was likely.

The simple answer is that we have no idea. If we look at the decision of whether to vote as a “cost-benefit” analysis each of us is consciously or subconsciously making, we’ve focused so much on successfully reducing the “cost” of voting to the individual to nearly zero, while in most cases we haven’t demonstrated the “benefit” to citizens. If the perceived benefit is zero, or virtually zero, we won’t convince more citizens to participate no matter how easy we make it to vote. And if the benefit is solely communicated in terms of a particular partisan outcome, in a particular election, we will continue to fail to encourage more voters. We may create voters for one election—Obama voters, or Brexit voters, or anti-Obama or -Brexit voters—but we will not create voters, like that small number of citizens who will participate regardless of whether they can change the outcome or whether their passions have been inflamed.

What is the solution? How can we encourage more participation in democracy, even in the absence of a charismatic candidate, and even when one’s favored candidate might lose? There is reason for hope, and it comes from a strange place – citizens’ willingness to lie about whether they vote.

Pollsters and census-takers routinely ask Americans whether they are registered to vote and whether they voted, and Americans routinely over-report their participation. For instance, while nearly 90% of Americans say they are registered to vote, only about 75% actually are. There is similar over-reporting bias when they are asked whether they voted—and most Americans don’t realize that whether they voted is part of the public record. When I mention this, many will sigh or feel depressed about how sad this is for our democracy. But I am heartened. This means that citizens know they should vote, even when they aren’t, and this further means that it may be possible to move that “civic lever,” as I call it, to encourage them to see the benefits of voting.

Since most citizens already know there is inherent value in participating, even if only very little, this may not require massive efforts at persuasion. Rather, I hypothesize that constructive civic outreach by the entity that already contacts every voter before each election—government—can be the difference with millions of voters and making the difference between voting and not voting. We can test different civic and informational messages and different modes of outreach, including mail and electronic modes, to determine whether government can drive an increase in turnout. Importantly, each of these tests must be done with a control group, so we can isolate the effect against the many other factors that can impact turnout. We hope to begin some of these tests in the next couple of years. If successful, over time, we can persuade many non-voters to become occasional voters, and persuade occasional voters to become regular voters, and share these methods with anyone who would seek to engage with the electorate. This will not lead us to 100% turnout, or even 80% turnout (which the U.S. hasn’t seen since 1888, well before women and most minorities experienced full enfranchisement), but it could result in millions of more votes, and gradually lead to a larger, more representative electorate. If these efforts convince just one out of ten of those 50 million voters from 2016 who would otherwise have stayed home in 2018, we could see turnout increase by 5 million voters.

In summary, as to concrete recommendations, I suggest looking at this as a multi-stage process, with each stage involving a legal framework as well as technical and practical considerations.

First, we must all be vigilant against efforts to tamper with the machinery of elections, and as the efforts continue and perhaps expand, we must be sensitive to the impacts of those efforts on voter confidence. I encourage use of auditable technology with a permanent ballot record, independent of the voting technology, which usually means a paper ballot. This does not mean that we cannot encourage use of electronic interfaces, recognizing that such tools are particularly important for voters with disabilities or those who have need for assistance in minority languages, but that the ballot itself must be recorded in a way that is independently auditable, which again, usually means paper. And then we must encourage robust independent and transparent audits to confirm that technology counted the ballots properly. But we should also be careful about the language we use in discussing any such threats, making sure to rely only on facts, rather than hyperbole. If we convince our own voters that their votes don’t matter, we will have done the hackers work for them.

Second, we must improve the data and machinery of elections, ensuring that voter lists are complete and up-to-date, that ballots and voting systems are easy to use and understandable, and that voting is convenient and private. On these points, much great work has been done, and is proceeding.

But third, these recommendations alone will not be enough to change the dynamic of democratic participation. We must also engage with citizens to ensure they feel confident in that system, and that they see the value in participating. Government must partner in this effort, since governmental outreach is the most effective and most widespread. And these efforts to engage must be measured against a control group, so we can confirm whether they really work.

Democracy in this century will look different than democracy in previous centuries, and it will require a different legal, practical, and technological framework to guarantee free, fair, inclusive, and secure elections. Similarly, we will need to demonstrate the value of participating to the 21st century voter, so we can enjoy a broad, inclusive electorate. And the value we demonstrate must transcend partisan considerations in any particular election, and instead be based on citizen investment in governance itself. Democracy is strongest not when passions are inflamed and partisans can spend hundreds of millions of dollars to fan those flames. Democracy is strongest when citizens feel the responsibility to vote and participate in public affairs even when those flames have been reduced to mere embers.

What We Know and Don’t Know about Election “Hacks” in 2016

Yesterday, the Intercept reported on a leaked NSA document detailing Russian government efforts to hack election offices and voting technology. There are serious and disturbing claims in this report, most of which aren’t entirely new, but which add details to some concerns surround the 2016 election and deserve to be put into context.

WHAT WE KNOW

The threat is real, and it’s significant. Since even before the election, credible reports have confirmed that the Russian government has sought to interfere with the November 2016 election. They sought to do so in two ways:

o   First, through massive manipulation of news and facts surrounding our political process. These efforts sought to motivate the electorate by spreading disinformation and narratives, largely in support of then-candidate Trump. These efforts are not “election hacking,” but rather something more akin to political manipulation.

o   Second, through efforts to infiltrate election offices and technology. The decentralization of the system, with dozens of different types of technology running in thousands of different election jurisdictions nationwide, made this difficult, but there were efforts to obtain access to information, particularly voter registration information.

These threats likely had two purposes.

o   One, to hack the election itself, and deliver it to the candidate preferred by the Kremlin. But this goal was secondary for a few reasons:

-  Decentralization made this exceedingly difficult, as it would require being able to predict exactly which of the nearly 10,000 election jurisdictions should be hacked to maximize the chance of impacting the overall election results. For instance, the morning of November 8, 2016, few would have predicted that the key states in delivering the presidency would be Michigan, Pennsylvania, and Wisconsin.

-  Paper ballots and audits are more prevalent than they have been in years. Nearly 75% of all ballots nationally are cast on paper, and most states audit the paper ballots to confirm that the voting machines have reported the correct results. Even if hackers from Russia or anywhere else had successfully hacked the voting machines in one of the many states that votes with paper and conducts audits, including Florida, North Carolina, Ohio, Wisconsin, and several others, the hack would have been highly likely to be discovered.

o  More importantly, the hackers need not have successfully hacked into the voting systems themselves to achieve another important goal. Even when attempted hacks were unsuccessful, by making it known that the systems were under attack, the hackers successfully created doubt in the minds of many voters about our system of elections and the technology and professionals that protect the integrity of that system. By raising doubts about the security of election systems, and in some cases, inciting hysteria about election integrity overall, the Russian government has successfully caused many voters to wonder whether there’s any point in voting or otherwise participating in our democracy.

-  A possible example of the hackers recognition of this goal is their attempted attack on the American Samoan election office. While anyone with even a rudimentary knowledge of American elections would know that the results of voting in American Samoa have no impact on the presidential contest, an attack on any American election office would assist in creating an impression of overall insecurity in the system.

Information in voter registration systems was accessed.

o   As we’ve known since even before the election, hackers successfully accessed some voter registration data. In at least two states, hackers attempted to access voter registration data – Illinois, where data was successfully accessed, and Arizona, where it appears the breach was caught before information was compromised. And we’ve known about the hack of VR Systems since at least October.

o   We’ve now learned, thanks to the Intercept piece, that some of this data was used to launch further attacks on election system vendors and election offices. But we continue to have no evidence that any of these attacks had an impact on the election.

Voter registration systems are not the systems on which ballots are cast/counted.

o   A successful hack on a voter registration database, or on a vendor that solely works with voter registration systems and electronic pollbooks, like VR Systems, cannot, by itself, put the vote count at risk.

o   Voter registration data is routinely backed up and stored safely, in case of any system breakdown or hack.

o   Even if voter registration data is compromised, at exactly the right moment to create the greatest mischief, it would be detected, as it would result in longer lines and increased provisional ballots (as voters whose information was changed tried to vote at the polling places), or markedly increased requests for mail and absentee ballots from new voters. While this would be a problem during the election, we did not see any evidence of such problems.

o   Much, if not all, of the activity documented in the NSA report took place after October 27, after voter registration had closed in many states, including Florida, Georgia, Michigan, Nevada, North Carolina, Ohio, Pennsylvania, Virginia, among many others. In other words, the books in those states were closed well before October 27, meaning that any voter registration activity which took place after the voter registration deadline would have no effect on the voter lists for the presidential election.

There remains NO evidence that voting machines were hacked or that anyone tampered with the result of the election.

o   The leaked NSA analysis does not find any evidence of hacking of the vote counts, nor has any previous report or statement by the government or election officials.

WHAT WE DON’T KNOW

Which local election offices were targeted by the phishing attacks outlined in the NSA analysis

o   This is important to assess the risk. For instance:

-  If these offices were larger and more sophisticated, it would be more likely these offices would have extensive security protocols to prevent a successful phishing attack.

-  If these offices represented the majority of areas where voting was done on paper, with an audit of the ballots, any attempt to compromise the ballot counting would be highly likely to be detected.

-  If these offices represented smaller jurisdictions, it is unlikely that there would be a sufficient number of votes to sway a statewide election.

Whether voter registration systems were compromised in a way that could have affected the voting process in November

o   As discussed above, if a hack had been successful, it is virtually certain that we would have seen evidence of this, but more analysis could be helpful.

Whether any of these attacks was successful, and if so, whether vote tallying systems were compromised

o   To date, there is still no evidence of this.

o   Even if successful, we would want to investigate whether any hacks were perfectly placed so as to change the outcome of the election.

CONSTRUCTIVE NEXT STEPS

First, we should resist the instinct to jump to conclusions. We still have no evidence to suggest the results of the election were compromised, which continues to be exceedingly unlikely.

o   There is still overwhelming evidence that Trump won the majority of the vote in those states that comprised a majority of electoral votes.

o   Hysteria and misinformation does not help us get to the bottom of things.

-  For instance, our election system is highly decentralized, as discussed above, making it very difficult to launch a large-scale attack.

-  While the federal government does not run elections nationwide, there is a federal agency (the Election Assistance Commission, or EAC) which oversees certification of election equipment and serves as a resource to state and local election officials. The EAC works with many other federal agencies, including the Department of Homeland Security and the Department of Justice, to assist election offices in maintaining security and integrity. Unfortunately, the Intercept apparently made no effort to contact the EAC, the agency best suited to comment.

-  While the Intercept contacted the Federal Election Commission (FEC) for their report, the FEC has absolutely nothing to do with election administration or voting technology. Calling the FEC to ask about voting technology is akin to calling the Department of Labor to ask about delivering a baby.

Second – and I expect several states are already doing this – given recent allegations it is probably prudent at this point to engage in a thorough forensic analysis of voter registration activity in several states in the days leading up to the election. Specifically, I think it could be helpful to investigate the following data, among others, regarding the following activity from September, 2016 onward, and compare it to previous presidential elections:

o   Changes made to existing voter records, both online and by paper;

o   Registered voters, either new or existing, who requested a mail ballot be sent to an out-of-state or international address, or any address where multiple ballots were requested at the same address;

o   Provisional ballots requested/cast/counted due to an inaccurate voter record.

Third, election offices have been remarkably careful and resilient through this election cycle, dealing with threats and accusations in a highly professional way, but it would be wise to further review office security protocols, ensuring staff are trained to avoid scams like phishing, and that technical systems are in place to maximize security of internal systems. Again, many election offices are probably several steps ahead of us on this.

o   As part of this, election officials who aren’t already doing so should look into additional security protocols to prevent phishing like two-factor authentication.

Finally, these threats have highlighted how important it is for jurisdictions to employ auditable technology and effective post-election audits. Many states are looking to beef up the transparency and rigor of their post-election audits, and this should provide some momentum, for two primary reasons:

o   First, even in the unlikely event that hackers effectively tampered with vote counting systems, an effective audit of a paper or otherwise auditable ballot would detect the problem, enabling a recount of the paper ballots, and ensuring the correct result.

o   Second, public education about the existence of audits to protect against hacking could help restore the confidence so many voters have lost during this cycle, as concerns about hacking and unsubstantiated claims about voter fraud and vote rigging have been raised. It’s essential that voters know their votes in 2016 mattered and were counted properly, and that election officials are working to further improve security in future elections, even as these threats endure.

Reflections on President Trump’s Voter Fraud Commission

We’ve now had a weekend to ruminate on The President’s signing of an executive order last week, establishing a “Commission on Election Integrity.” Even with the perspective of some time, the order and the way it was approached leads to far more questions than answers. Specifically, why is this commission being formed, who will participate on it, and how will it operate? Some thoughts on the why, who, and how:

Just the Facts on Fraud

Six months after the election, there’s still discussion about the extent to which voter fraud exists and whether the White House will follow through with an investigation. In the meantime, election officials across the country have been quietly doing their jobs and are wrapping up investigations from the last election while preparing for the next. The reviews to date confirm what most election officials have been publicly stating for some time – that while the amount of actual voter fraud is not zero, it’s very close, with only an infinitesimal number of cases of potential voter fraud nationwide.

Vote Centers Lead to Cost Savings and Other Administrative Efficiencies

2016 saw more states than ever before use vote centers for early or Election Day voting. In addition to providing a convenient option for voters, vote centers can have the additional benefit of saving money for election officials. They often require an up-front investment in e-pollbooks to ensure that all locations have real-time access to the voter registration list and can require larger locations with different technological needs, however they can also require fewer pollworkers and result in a smoother voting experience for voters.

Average Drop-off Rate in 2016 Down From 2012

Prior to the November general election, many wondered how negative feelings towards both presidential candidates would impact other races on the ballot, since voters in a presidential election often go to the polls to cast a ballot for president and then drop-off for other races.  Drop-off measures the difference in turnout between the race at the top of the ticket, in this case the presidential race, and races further down the ballot, such as a United States Senate race.  Drop-off increases the further down the ballot you go, as voter knowledge of and interest in candidates and offices below the state level decreases.  

Resources on Voter Fraud

The last 24 hours have seen voter fraud back in the news more than three months after Election Day.  There are lots of reports and talking heads out there – including our own David Becker on AC360 – so below I’ve compiled a list of some reliable, nonpartisan reports on voter fraud, as well as reliable resources in the field that can help you sort through the noise and find the truth.