Working to find actionable solutions to the nation's key challenges.

BPC Experts: Reports Unfairly Imply Hacker Found Way to Change Election Results

Tuesday, August 21, 2018

Washington, D.C.– The following statement is from John Fortier, director of BPC’s Democracy Project, and Matthew Weil, associate director, on DEF CON election hacking reports:

“Election officials across the country have made key improvements to secure election databases and fortify the integrity of voting systems. We applaud these ongoing efforts to upgrade the security of our election systems.

“But recent reporting around DEF CON 26 election hacking sessions in Las Vegas unfairly implied that a teen hacker had found a way to change official election results. This is deceiving. At worst, what the exercise showed was that the websites displaying unofficial results have vulnerabilities. In no way does this hacking exercise point to the ability to change votes or final election tallies.

“Vote counting occurs at the local level, usually by county-based election officials. Those local results are then relayed to state officials. Sometimes these results are phoned into state headquarters, in other cases these local results are entered into databases or software that relay the results to the state. State election websites take these unofficial results and display them for the public to see.

“After election night, state election officials complete a canvas and certification that can take as long as 28 days following the election. It is during this time when vote counts are checked and confirmed, and some late arriving absentee and provisional ballots are counted. Only after this period is an election certified and the outcome is official.

“The recent reports about relatively inexperienced hackers being able to change public facing results are a concern, not because of any impact on an election vote tally, but because of potential damage to public confidence that their vote will be counted.

“Officials should do all they can to keep the public facing reports websites secure and accurate. But the vote tallying is not done on public facing websites. Hackers’ ability to change numbers on those sites does not equate to making votes appear or disappear.

“There is much work to do to make the election system more secure. Sensationalized reporting about areas that do not represent the greatest risks undermines confidence in the system and potentially discourages voters going to the polls—an outcome that would hurt our democratic process.”

KEYWORDS: JOHN FORTIER, MATTHEW WEIL