Election Security in Vermont – A Race Without a Finish Line

August 22 2019

I want to assure every single Vermont voter that election security is my #1 top priority. It’s something that I, and every one of my staff members, takes incredibly seriously, and something that we work on every single day.

Fair and free elections are the cornerstone of our democracy, and rest on the foundation of ‘one person; one vote.’

Technological advances increase the transparency and accessibility of our elections, but, as we all know, every piece of technology is not without its risks.

First, let me make it clear that Vermont has one of the most secure, if not the most secure, elections systems in the whole country, including the gold standard protection of voter marked paper ballots. Simply put, it’s impossible to hack paper.

Since the Russian attacks on state election systems in 2016, the issue of election security has been thrown into the spotlight, and I think that’s a good thing. As Secretaries of State and our federal intelligence partners around the country work to defend our systems, private sector partners and ‘white-hat’ ethical hackers are working to challenge assumptions and independently test the security of our equipment. We welcome this work.

Recent misleading headlines characterized Vermont’s tabulators as ‘vulnerable’ based on this work. That’s simply not the case, and I’m going to tell you why.

At a recent national event, ethical hackers were able to perform a limited range of disruptive activities on election equipment including the tabulators currently used in Vermont. The feedback we’ve heard from members of this community is that of all the tabulators tested, the tabulator we use in Vermont is the preferred model with the least concerns, and further, is the model these hackers would most want used in their state.

After being given unfettered physical access and unlimited time, they were able to break open physical security protections to then be able to perform a limited range of programming measures, primarily zeroing out the memory card, printing a false report, or triggering the final report prematurely.

Well, let me tell you, if you give someone the keys to the front door, show them where the lock is, turn off your security alarm, and tell them you’re going out of town for the weekend, they’ll probably be able to get into the house.

The truth is, at the polls, the tabulators are kept under close watch by an election official supervising their use. Being able to pull up next to a supervised tabulator, break the locked cover, remove the machine, and plug a bunch of wires in just isn’t going to happen. Since our tabulators are never connected to the internet by Wi-Fi, hardwire, or remote access, hacking a tabulator, not to mention multiple tabulators, is virtually impossible.

Sure, when you’re sitting in a conference room and someone gives you a key and the ‘go-ahead,’ you might be able to gain access, but these simulated environments do not reflect reality.

Election security is as much about physical security as it is cyber security, and in Vermont we have the necessary procedures and protections in place, on top of strict chain of custody protocols from start to finish.

Even in the incredibly unlikely event someone is able to perform one of these measures, red flags will call attention to the issue for election workers due to the fail-safes we have in place. For instance, zeroing out the vote count will create a discrepancy with the physical checklist from checking voters in, and if a tabulator starts spitting out an end of the night report at 5pm, the Town Clerk is going to know something’s fishy.

In that event, we have the paper ballot backup for every single vote cast. It may not be a shiny, fancy piece of technology, but this fact alone is the strongest election security measure we have in place. I have the authority to issue an order to cease use of the tabulators and revert to hand counting at any time, if anything suspect arises.

By law, every ballot is sealed and saved for 22 months. After every General Election we conduct a post-election audit, and these audits have never turned up a major discrepancy since we started performing them in 2006.

I’ll be the first to make clear: no computer is 100% ‘un-hackable.’ Anyone who tells you so is either naive or lying. That’s why it’s critical to put the necessary safeguards in place to prepare for and prevent unauthorized activity, and mitigate the damage that could be done.

I’m confident in the safeguards we have in place for Vermont elections, and proud of the work we do every day to protect the integrity of every single vote cast. I know that there is always more we can do.

Cybersecurity is like a race without a finish line. I promise you that we’re doing the hard work every day and staying vigilant, so that we can stay one step ahead of this constantly evolving menace.

I’m committed to transparency and providing you with all the information you need about the security of our elections process. You can reach out my office anytime with questions. Keep an eye out for future events, like the Defending Our Democracy summit we did in 2018, as we approach 2020.

I want to make sure that every Vermonter has confidence in the integrity and security of their ballot when they vote on Election Day. Your vote is your voice, so get out there and vote!

James C. Condos, Secretary of State