Voting-machine vendors have some serious questions to answer, senators say

Senators, including Amy Klobuchar, say every machine made by election technology companies should reliably produce paper records.

While the security of the 2020 election remains a prominent topic in Washington, a group of Democratic senators is raising alarms about longer-term issues that will resonate after voters are done choosing a president about 20 months from now.

The three companies that make most of the voting technology used in the U.S. must be more transparent about their plans to improve their products to meet current expectations about security and performance, says a letter Wednesday by Sen. Amy Klobuchar of Minnesota and three other top Democrats. In particular, the senators say every machine should reliably produce paper records, and the companies should do far more to upgrade their products.

“The integrity of our elections is directly tied to the machines we vote on — the products that you make,” says the letter from Klobuchar, Mark Warner of Virginia, Jack Reed of Rhode Island and Gary Peters of Michigan. “Despite shouldering such a massive responsibility, there has been a lack of meaningful innovation in the election vendor industry and our democracy is paying the price.”

The senators ask the top executives of Hart InterCivic, Election Systems & Software and Dominion Voting Systems 16 detailed questions about their commitment to innovation, their ability to produce machines that allow voters to easily check their selections and their adherence to guidelines established by the federal Elections Assistance Commission for certification and testing of machines.

The EAC recently proposed an update to its Voluntary Voting System Guidelines, the first since 2005, and the new document — labeled version 2.0 — is not expected to be fully revised and approved in time to affect technology used in the 2020 election. The senators are clear about their expectations for the companies to generally embrace those guidelines now, however.

“[T]he fact that VVSG 2.0 remains a work in progress is not an excuse for the fact that our voting equipment has not kept pace both with technological innovation and mounting cyber threats,” the letter says. “There is a consensus among cybersecurity experts regarding the fact that voter-verifiable paper ballots and the ability to conduct a reliable audit are basic necessities for a reliable voting system. Despite this, each of your companies continues to produce some machines without paper ballots. The fact that you continue to manufacture and sell outdated products is a sign that the marketplace for election equipment is broken.”

Hart, ES&S and Dominion are three largest election-equipment vendors in the U.S. and “provide the voting machines and software used by ninety-two percent of the eligible voting population,” the senators say. The companies have received unprecedented levels of scrutiny since the 2016 elections, which heightened Americans’ awareness of the potential for meddling by foreign and domestic sources.

The cybersecurity community has not only called attention to weaknesses in the machines, but also reported tensions within the ranks of the companies themselves.  In their limited public comments on such issues, executives from the companies have defended their products and their development processes. Voting technology — even the most advanced kind — is under close watch far beyond the U.S. Recent reports highlighted flaws in an encrypted system used in Switzerland.

Klobuchar, who is running for president, is ranking member of the Senate Rules Committee, which has oversight of election systems. The letter’s other three signers are influential on national security issues: Warner is vice chairman of the Intelligence Committee, Reed is ranking member of the Armed Services Committee, and Peters is ranking member of the Homeland Security and Governmental Affairs Committee.

The senators, who asked for responses by April 9, also noted that the Department of Defense’s Defense Advanced Research Projects Agency (DARPA) “is reportedly working to develop an open source voting machine” — a sign that the industry currently isn’t meeting the market’s needs. Motherboard reported that DARPA is working with Oregon-based Galois on that project.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure