Support a ban on Internet connectivity in voting systems
Submit Public Comments to the EAC urging a ban on wireless modems and Internet connectivity in federally certified voting systems.
Sample comments:
We strongly support the draft Voluntary Voting System Guidelines (VVSG) and commend the robust principles and guidelines for software independence, auditability and ballot secrecy.
Given the fact that our election systems are being targeted for interference through cyber attacks, we believe it is imperative the VVSG also include a prohibition on connectivity to the public Internet through wireless modems or other means. Therefore, we urge the Commission to include a guideline under Principle 13: DATA PROTECTION:
"The voting system does not use wireless technology or connect to any public telecommunications infrastructure"
What are Voluntary Voting System Guidelines (VVSG)
The U.S. Election Assistance Commission (EAC) is the federal agency responsible for creating federal guidelines for voting systems and certifying equipment to those standards. A new version of the Voluntary Voting System Guidelines (VVSG) has been drafted and is out for public comments. After the public comment period ends on May 29, 2019, the EAC will consider the comments, adopt any changes and vote on the VVSG.
This high-level set of principles and guidelines provides a strong framework for secure, accessible, auditable voting systems and should be supported.
However, it is missing one critical guideline: the VVSG 2.0 draft does not ban internet connectivity or the use of wireless modems in vote recording or vote tabulating systems.
The EAC has even insisted that “no EAC certified voting system is connected to the Internet,” but that’s only because no vendor has chosen to pursue EAC certification for a voting system configured with wireless modems. The current federal standards would allow wireless modems in federally certified systems and it’s possible if not likely the next version of the federal VVSG will continue this, if citizens don’t speak out.
It’s important to note that the federal guidelines are voluntary; states are free to adopt them or not as they choose and compliance with the VVSG has had no impact on a state’s ability to receive federal funding. But the VVSG help shape the market and a ban on wireless modems and Internet connectivity will send a strong message to states discouraging this practice.
WHY IS INTERNET CONNECTIVITY A PROBLEM?
It’s obvious that connecting voting machines directly to the Internet through wireless modems or other means increases the vulnerability of those systems to hacking. Though we have frequently been told that voting machines are not connected to the Internet[1] this is not always the case. Many states’ voting machines include wireless modems which transmit their unofficial results over the Internet. Some states allow their vote tabulation computers to be connected to the Internet.
These configurations provide increased opportunities for nation-state actors, partisan criminals, hacktivist or other malign attackers to gain access to our voting machines and manipulate and/or disrupt our elections.
Last year, with our allies and over two dozen computer security experts, NEDC sent this letter to the EAC and Department of Homeland Security outlining many of the dangers of using public networks and urging the agencies to encourage states to discontinue the use of wireless modems.
IS INTERNET CONNECTIVITY NECESSARY?
Wireless modems and Internet connectivity are not at all necessary to conduct elections.
Recognizing the significant security threat internet connectivity and wireless modems create, many states have prohibited them in their voting systems, adopting strong and secure methods of transmitting election results without needlessly increasing the exposure of their voting machines to hacks.
Make no mistake, eliminating wireless modems and Internet connectivity will not guarantee our voting machines can’t be manipulated or hacked through corrupted USB sticks, insider attacks or supply chain corruption which is why all votes should be cast on paper ballots and all elections should be audited by manually counting a sample of the paper ballots.
The FBI and Department of Homeland Security have confirmed that our foreign adversaries have targeted election networks in all fifty states for cyber attacks. The EAC must take these warning deadly seriously and pass the VVSG with an added ban on wireless modems and Internet connectivity in voting systems.
We hope you will submit comments to the EAC stressing support for critical security and privacy provisions in the draft VVSG and urging the Commission to add a prohibition on wireless modems and Internet connectivity to the VVSG.
[1] In testimony to the Senate Select Committee on Intelligence, president of the National Association of Secretaries of State, Indiana Secretary of State Connie Lawson testified before the Committee “it is also very important to underscore that voting machines are not connected to the Internet or networked in any way.”