COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
responsibility, all right, give us your Election Day plan." That led to the creation of an Election Day playbook; steps included enhanced watch floor procedures, connectivity between FBI field offices and FBI and DHS, and an "escalation path" if "we needed to get to Lisa [Monaco] or Susan [Rice] in a hurry" on Election Day.[1]
- VII. (U) SECURITY OF VOTING MACHINES
(U) The Committee review of Russian activity in 2016 highlighted potential vulnerabilities in many voting machines, with previous studies by security researchers taking on new urgency and receiving new scrutiny. Although researchers have repeatedly demonstrated it is possible to exploit vulnerabilities in electronic voting machines to alter votes,[2] some election officials dispute whether such attacks would be feasible in the context of an actual election.
- (U) Dr. Alex Halderman, Professor of Computer Science at the University of Michigan, testified before the Committee in June 2017 that "our highly computerized election infrastructure is vulnerable to sabotage and even to cyber attacks that could change votes."[3] Dr. Halderman concluded, "Voting machines are not as distant from the internet as they may seem."[4]
- (U) When State 7 decommissioned its Direct-Recording Electronic (DRE) voting machines in 2017, the IT director led an exercise in attempting to break into a few of the machines using the access a "normal" voter would have in using the machines.[5] The results were alarming: the programmed password on some of the machines was ABC123, and the testers were able to flip the machines to supervisor mode, disable them, and "do enough damage to call the results into question."[6] The IT director shared the results with State 21 and State 24, which were using similiar machines."[7]
- (U) In 2017, DEFCON[8] researchers were able to find and exploit vulnerabilities in five different electronic voting machines.[9] The WinVote machines, those recently decertified by State 7, were most easily manipulated. One attendee said, "It just took us a couple of hours on Google to find passwords that let us unlock the administrative
- ↑ (U) Ibid., p. 82.
- ↑ (U) See also, infra, "Direct-Recording Electronic (DRE) Voting Machine Vulnerabilities."
- ↑ (U) SSCI Transcript of the Open Hearing on Russian Interference in the 2016 U.S. Elections, held on Wednesday, June 21, 2017, p. 117.
- ↑ (U) Ibid., p. 110.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 7], January 25, 2018.
- ↑ (U) Ibid. The machines used were WinVote voting machines.
- ↑ (U) Ibid.
- ↑ DEFCON is an annual hacker conference held in Las Vegas, Nevada. In July 2017, at DEFCON 25, the conference featured a Voting Machine Hacking Village ("Voting Village") which acquired and made available to conference participants over 25 pieces of election equipment, including voting machines and electronic poll books, for generally unrestricted examination for vulnerabilities.
- ↑ Matt Blaze, et. al., DEFCON 25: Voting Machine Hacking Village: Report on Cyber Vulnerabilities in U.S. Election Equipment, Databases, and Infrastructure, September 2017, https://www.defcon.org/images/defcon-25/DEF%20CON%2025%20voting%20report.pdf, pp. 8-13.
40
COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
