Nation's largest voting machine maker embraces paper amid security concerns
'We are repelling thousands of attempts by bad actors,' security chief at Election Systems and Software says
'We are repelling thousands of attempts by bad actors,' security chief at Election Systems and Software says
'We are repelling thousands of attempts by bad actors,' security chief at Election Systems and Software says
About a third of all Americans will cast their ballots in the midterm elections on platforms designed by the nation's largest vendor of voting machines and software.
Election Systems and Software provides voting capabilities to nearly 3,000 of the nation's roughly 10,000 voting jurisdictions. As cybersecurity and hacking concerns grew after the 2016 presidential election, the company had to respond to public pressure.
"Our customer base tells us what to produce," explained Christopher Wlaschin, vice president of security at ES&S. "State and local election officials and the voting public are demanding a paper record be available."
All of the company's new voting products now contain that paper record, even if voters make their selections on touch screen technology. The ES&S ExpressVote system prints out a receipt of the voter's selections to feed into the company's ballot reader.
"You can almost think of this as an electronic pen," said Craig Seibert, an ES&S regional sales manager.
The ExpressVote System is in about 900 jurisdictions for these midterm elections, according to company representatives. The ballot reader -- which can operate without the ExpressVote touchscreen -- is in about 1,400 jurisdictions.
The math means some voters in the 2018 midterm elections will use ES&S machines that don't have a paper trail. Technology upgrades in 2006 created what the industry calls direct-recording electronic machines -- where voters make selections on a screen and there is no paper ballot.
Wlaschin explains the technology was well-intentioned.
"The technology actually prevents voters from making mistakes and over-voting or under-voting or casting a ballot that is troubled," he said, admitting cyber security wasn't top of mind when the machines were developed.
ES&S says none of its machines are connected to the internet and election officials store them in secure areas to protect against tampering.
But the company itself, which develops the firmware that runs the machines, is under constant attack.
"On a daily basis, we are repelling thousands of attempts by bad actors to get into our systems," Wlaschin revealed.
In August, amateur hackers at the Las Vegas convention DEFCON in a simulation called the Vote Hacking Village. The results drew the attention of Democrats and Republicans in the U.S. Senate who wrote to the company's CEO, Tom Burt.
"We are disheartened that ES&S chose to dismiss these demonstrations as unrealistic and that your company is not supportive of independent testing," the lawmakers wrote.
Wlaschin pushed back on the accusation and noted ES&S has addressed and fixed security concerns raised by third-party testers. He told KETV the company is engaged with third-party testing even on the eve of the midterm election.
"What we will not support is random, ad hoc, anonymous testing by people whose agendas and origins we are not familiar with," he explained, noting the company's distrust of the Vote Hacking Village method.
Millions of people will cast their ballots through ES&S platforms as the cloud of foreign tampering with American election systems remains. It comes as special counsel Robert Mueller pursues indictments against Russian nationals for not just waging an influence campaign on U.S. voters but actively hacking targets.
It's a dark backdrop that officials say requires constant vigilance.
"This election will be more secure than any one previous," Wlaschin predicted.
On Tuesday, he will join Department of Homeland Security officials in Washington, D.C., at a newly-created nerve center to respond to election security issues that arise. ES&S has 600 workers deployed across the nation to help state and local election officials and operates its own response center out of its Omaha headquarters.