Computer Science Professor Says Ballots In Key States Have to Be Examined to Rule Out Cyberattack

Halderman, a professor of computer science at University of Michigan, writes that he’s going public to correct some errors in the Sherman report and to explain why it’s necessary to manually re-check ballots. He studies computer security and privacy, and points out that the FBI has already formally accused Russia of hacking the emails of the Democratic National Committee. Hackers also stole voter data in Arizona and Illinois and attempted to do so in 20 other states, which FBI director James Comey also suggested was the work of Russian hackers. (When he wasn’t busy loudly reopening a pointless investigation into Clinton’s email servers at a crucial moment in the waning days of her campaign.)

Halderman writes that the surprising and very close results in Wisconsin, Michigan, and Pennsylvania were probably not the result of a hack. But nobody’s going to know for sure unless there’s an actual petition for a recount (bold emphasis is Halderman’s):

Were this year’s deviations from pre-election polls the results of a cyberattack? Probably not. I believe the most likely explanation is that the polls were systematically wrong, rather than that the election was hacked. But I don’t believe that either one of these seemingly unlikely explanations is overwhelmingly more likely than the other. The only way to know whether a cyberattack changed the result is to closely examine the available physical evidence — paper ballots and voting equipment in critical states like Wisconsin, Michigan, and Pennsylvania. Unfortunately, nobody is ever going to examine that evidence unless candidates in those states act now, in the next several days, to petition for recounts.

Halderman adds that voting machines in many states have known cybersecurity issues, and haven’t been replaced for the most predictable of reasons: money. He writes: “But many states continue to use machines that are known to be insecure — sometimes with software that is a decade or more out of date — because they simply don’t have the money to replace those machines.” He says the most secure system is voting with a paper ballot that’s scanned into a machine for voting (New York state, for example, uses that system).

But even in computer-based voting, a paper record is created: the computer counts the vote and prints the record. Halderman argues that those paper records have to be checked against the computer records, but that it’s not going to happen:

There’s just one problem, and it might come as a surprise even to many security experts: no state is planning to actually check the paper in a way that would reliably detect that the computer-based outcome was wrong. About half the states have no laws that require a manual examination of paper ballots, and most other states perform only superficial spot checks. If nobody looks at the paper, it might as well not be there. A clever attacker would exploit this.

Halderman closes by saying, again, that the only person who can put this in motion is a candidate calling for a recount, and soon:

Examining the physical evidence in these states — even if it finds nothing amiss — will help allay doubt and give voters justified confidence that the results are accurate. It will also set a precedent for routinely examining paper ballots, which will provide an important deterrent against cyberattacks on future elections. Recounting the ballots now can only lead to strengthened electoral integrity, but the window for candidates to act is closing fast.

Republican North Carolina Governor Pat McCrory is formally asking for a recount on the basis of much, much less. But it seems increasingly unlikely that Hillary Clinton or her campaign chairman John Podesta will ask for a recount, given that that Clinton expressed horror when Trump said during the debates that he believed the election would be “rigged” and implied he might not accept the results. Instead, we’ll all just take the high road right into the toilet.