Yet Another Report About Voter Fears & Voting System Integrity
Gregory Miller
Today, we learned of yet another blog post and a White Paper about voter “concerns” and sentiments regarding the trustworthiness of our existing election infrastructure. This was led by a bit of a sensational headline:
.
“Democracy at Risk: More Than 15 Million Voters May Stay Home on Election Day Over Cyber-Security Doubts”
.
The sum and substance of their article is that the State of PA is the most vulnerable for an election hack. Or as one respected Media outlet asked of us today, “Would you agree that Pennsylvania — given any number of aspects, in
cluding non-paper ballots — is among the most vulnerable states to cyber-focused attacks?“
cluding non-paper ballots — is among the most vulnerable states to cyber-focused attacks?“ .
No. Not so much. Not even close, actually.
.
FACT: “PA is no more vulnerable to cyber-focused attacks than any other state relying heavily if not completely on digital voting machinery, namely DREs,” says John Sebes, CTO at the OSET Institute. “Notwithstanding reports such as the CarbonBlack white paper, PA’s voting machines share the same technical security vulnerabilities as in other states, no more and no less.”
.
Let’s put a fine point on this: If one believes there are State actors seeking to alter an election result by exploiting voting machine vulnerabilities — despite the fact there are lower-cost higher-impact attack opportunities on U.S. elections in general, including some already underway — then PA might be a more attractive target. In other words, PA is not more vulnerable but potentially more attractive insofar as attempts on voting machines. While we’re at it, a few more points worth making:
.
- Its really not just about PA. Actually, FL, and VA, are also among potential swing states that have paperless voting machine vulnerabilities, and have potential Federal election margins that might be narrow enough for an undetected exploit to have a chance of being effective.
- Although elections are at some risk from State sponsored adversaries, concern over possible “voting machine hacks” should not be the major concern of voters, and certainly not a reason to not vote.
- The best way to make sure your ballot isn’t counted correctly, is to not cast one in the first place.
- Voters with concerns over paperless DREs should consider their alternatives for voting on paper ballots in absentee, by-mail, early, and election-day voting.
.
Honestly, we’re not impressed with the nearly sensational approach Ben Johnson’s blog post presents. And while the paper makes some interesting observations (and is a slick presentation to be sure), we don’t believe CarbonBlack is a subject matter expert in elections technology and infrastructure. But if they are, then they’re not being particularly intellectually honest in their assessment by singling out PA for convenience of making their point.
.
We take Ben’s point about the potential for people to stay at home; we’ve seen some similar numbers from equally unscientific polls regarding voter sentiment we’ve been involved with, but chose not to publish. We’re working with some folks deeply experienced at polling, who believe more thorough polling would be required to vet this potential. However, we agree that there does seem to be a rising sentiment.
.
This is one of the reasons election integrity professionals are walking a fine line publicly discussing it.
.
All that observed, the most important value in CarbonBlack’s blog post or any discussion about voter fears should be a wake-up call that more messaging is required to inform voters of the importance to get out and vote (and disregard the hype about rigging, legitimacy, or hacking concerns.) That is, lest we experience a BREXIT of our own.
.
We note Mr. Johnson obtained his Masters in CS from Johns Hopkins in 2006, and he has some impressive credentials with some good experience (e.g., computer scientist for certain 3-letter Agencies). We’d welcome a professional like Ben into the election integrity community. For starters, our CTO has a professional colleague who is a Professor at Johns Hopkins, and truly one of the top election technology integrity experts in the nation if not globally. Actually, we’d be surprised if Ben doesn’t know this Professor already. Maybe we should (re)connect them. Then perhaps, once embedded in the election integrity community, Ben’s writing will be a bit more conditioned on some internal realities. For sure, we’d welcome CarbonBlack acquiring the domain expertise to contribute to the integrity and security mandates of this critical democracy infrastructure. We’re just not sure this blog post or the accompanying White Paper serves the best interest of election integrity goals, where intellectual honesty, a lack of hyperbole, and straight talk are essential.
.
But then, if media coverage is the goal and publishing bait too delicious for the Media to pass on, then there is one more note of clarity deserving here. CarbonBlack has just quietly filed for an IPO (Initial Public Offering), so brand awareness raising activity like this White Paper is normal.
.
Think about it from their PoV: “Let’s leverage all the “FUD” about this year’s election integrity and tie it together with our need for lots of media coverage to support our impending IPO road show.” Sorry, a bit self-serving IOHO. Apologies if this reads strongly, but add grains of salt accordingly.
.
BTW: we offered to chat with CarbonBlack about their paper. Had that happened, we might have been able to help boost their credibility without this work looking so self-serving. There response to us on Twitter? “Sure, send eMail to media@carbonblack.com.” Really? Directing us to your Media Relations team? That flagged us to look into CarbonBlack a bit more, and that’s when we discovered the IPO filing news breaking today.
.
Look, even we are feeling trepidation about recent interviews and demos we’ve put together with NBC Nightly News, due to air soon. Its such a fine line between scaring off the vote, and yet having a vital conversation about how election integrity can be increased, while costs are decreased, and usability is improved. To wit, we recently launched this video to start that delicate conversation, striking the right chord.
.
And no, we don’t single out any jurisdiction, let alone PA, a State doing the best it can (and a good job at that) to be as ready as possible.
.
Back to work here.