JA
HI
CHIK
WENDIU/”T
HEW
ASHI
NGTON^
POST”/GETTYIMAGES40 | Rolling Stone | February 2020
windows and doors are no longer wide open,
but the burglars are more sophisticated, and
there are a lot more of them than there were
four years ago. They may try to break into our
voting systems; they may push online propa-
ganda to merely create the impression of an
attack as a way to undermine our faith in the
electoral process. “The target is the minds
of the American people,” says Joshua Gelt-
zer, a former counterterrorism director on
the National Security Council. “In some ways,
we’re less vulnerable than we were in 2016. In
other ways, it’s more.”
Nearly every expert agrees on this: The
worst-case scenario, the one we need to pre-
pare for, is a situation that causes Americans
to question the bedrock of our democracy —
free and fair elections. If such a catastrophe
occurred and the integrity of a national elec-
tion came into doubt, Michael Daniel, the for-
mer cybersecurity coordinator in the Obama
White House who now runs the Cyber Threat
Alliance, isn’t sure the country would ever be
the same. “How do we deal with that?” he asks.
“How do we recover from that?”
E
ACH MORNING, Kammi Foote gets in
her car and begins her 40-minute
commute to the front line of an invis-
ible war. Foote lives and works in Inyo
County, a vast expanse of eastern California
snug along the Nevada border, home to the
lowest point in the continental U.S. and the
highest, with the hottest recorded temperature
in the nation and some of the coldest. There
are as many square miles — 10,000 — as there
are voters.
In a small county like Foote’s, local public of-
ficials tend to wear many hats. As Inyo County’s
clerk-recorder and registrar of voters, Foote is-
sues birth and death certificates, officiates 50
or so weddings a year, and oversees elections.
Voting is like a religion in her family. As soon
as she turned 18, she got her voter registration
card and volunteered as a poll worker. Her par-
ents used to call her every Election Day to make
sure she’d voted; when she got elected in 2010,
her family couldn’t have been prouder. Run-
ning the election was now her job.
She realized that her job was about to change
in a dramatic way when an FBI agent contact-
ed her in the fall of 2016. The agent asked Foote
if she’d seen anything suspicious related to the
upcoming election. Was something about to
happen, she wondered. Were her local elec-
tions under attack? When she asked for more
details, the agent wouldn’t confirm anything.
Even if there were an issue, he said, he couldn’t
share that information because it was classified.
Foote’s first call with the FBI left her more con-
fused than ever.
Inyo County is one of roughly 8,000 juris-
dictions in the country that administer elec-
tions. The distributive and localized design of
the American system has long been seen as
an asset: There is no central database or vot-
ing system to attack, no uniform set of voting
software or polling-place equipment. Some-
one planning a widespread attack on U.S. elec-
tion infrastructure would, in theory, have their
work cut out for them.
The 2016 election flipped that logic on its
head. The possible compromise of a few coun-
ties in a razor-thin race was enough to create
doubt, if not inflict real damage, on voters’ per-
ception of the election — and in the age of so-
cial media and the instantaneous flow of in-
formation, perception was reality. Classified
documents leaked by NSA whistleblower Real-
ity Winner revealed that Russian hackers tried
to do just that, targeting a voting software com-
pany called VR Systems and local government
offices right before the election. Today, thou-
sands of county and state election offices are
prime targets that need protection. “People
will say the way we vote is so distributed and
diverse and that makes it more resilient,” says
Ferrante, the former FBI cybersecurity expert.
“But it also introduces a lot of risk and creates
a much larger attack surface.”
What makes things complicated is that the
federal government traditionally leaves the run-
ning of elections to states and municipalities.
When the Obama administration proposed des-
ignating voting equipment as critical infrastruc-
ture, like power plants, dams, and highways,
in the fall of 2016, a small but vocal group of
state and local election officials saw a feder-
al takeover in the works and resisted. A few
months later, Brian Kemp, a Trump ally who
was then Georgia’s secretary of state and gov-
ernor-elect, accused DHS of trying to hack into
his state’s voter registration database. (This was
false.) Not until January 2017, in the final days of
Obama’s presidency and after the intelligence
community published its conclusion that Rus-
sia interfered in the 2016 election, did state of-
ficials agree to a critical infrastructure desig-
nation. Congress soon passed a bill to create
the Cybersecurity and Infrastructure Security
Agency at DHS to help county clerks and sec-retaries of state protect election infrastructure.
“We went from an environment in 2017 and the
beginning of 2018 where quite literally states
are accusing the Department of Homeland Se-
curity of trying to hack them to having relation-
ships with all 50 states,” says Matt Masterson, a
DHS cyber security adviser.
Experts who study election systems in the
U.S. say many flaws remain. Some counties and
states still use outdated voting equipment and
insecure election software: At the 2018 DEF-
CON hacker conference, an 11-year-old hacked
into a copycat version of Florida’s state election
website and changed vote totals in less than 10
minutes. Only three states conduct mandatory,
scientifically rigorous post-election audits to en-
sure the final vote count is accurate. “We’re still
in a situation going into 2020 where there are
significant gaps left in the security of election
infrastructure,” says J. Alex Halderman, a Uni-
versity of Michigan computer science professor
who studies voting equipment. “Until we en-
sure that all of the doors are locked, there will
be ample opportunity for foreign adversaries to
disrupt or, in the worst-case scenario, change
the outcome of close elections.”
And the federal government is in no hurry
to fill those gaps. As Halderman likes to say,
there are more federal guidelines and require-
ments on whiskey and plastic bottles than vot-
ing equipment. While Congress has funded
nearly $900 million in election security in the
past two years, it let states spend the money
however they pleased. “We would never say
to our power grid companies, ‘We’re not going
to have any rules of the road at all — you just
self-regulate,’ ” Sen. Warner says. “Money with-
out some requisites means states could print
bigger ‘I Voted’ stickers instead of actually im-
proving their systems. That’s a huge error.”
Local election officials like Kammi Foote find
themselves thrust into a global battle withoutDEMOCRACY
IN DANGER
The worst-case
scenario,
according to
experts, is one
that causes
Americans to
question the
bedrock of our
democracy.
“The target is
the minds of
the American
people,” says
a former
counter-
terrorism head
of the NSA.