The state of Pennsylvania has taken a big step toward keeping its election systems secure for the upcoming 2020 election. Last April, the state’s top elections official said there was a need to update the state’s systems. The process was done with the help of $14 million in federal funds.
The problem is that election systems are running older software that is vulnerable to hackers. According to the Associated Press, the vast majority of 10,000 election authorities are still using Windows 7 or older operating systems. The bad news in this case is that Windows 7 expires on January 14, which means that it will no longer be provided with technical support and fixes for vulnerabilities from Microsoft. Microsoft, on the other hand, has stated that it can continue to provide the necessary updates until 2023, but with no compensation.
It is worth mentioning that, for now, it is uncertain whether a version running on Windows 10 and featuring more security features can be certified and deployed in time for the upcoming elections. Thus, there is a risk of repeating past mistakes, such as the purchase of voting machines without updated software.
The election technology industry is dominated by three major companies
- Election Systems and Software LLCDenver
- Dominion Voting Systems Inc
- Hart InterCivic Inc
Of the three companies, only Dominion's newer voting systems are not affected by the upcoming software issues. However, it also has others, acquired from companies that no longer exist and potentially running on even older systems.
Microsoft releases monthly updates for operating systems, which hackers know and understandably target older ones.
For most people, the end of Windows 7 simply means it's time for an update. However, for election systems, things aren't so simple. ES&S and Hart don't have federally certified systems on Windows 10, and certification is a long and expensive process.
According to the chairwoman of the US Election Commission , Christy McCormick, electoral systems are supposed to be disconnected from the internet . However, various stages of the electoral process require the transfer of information, which could be a trigger for attacks.
Certification of election systems is voluntary at the federal level and ensures that the software is running properly. But without internet security checks, the process is meaningless, as it doesn't keep up with ever-changing technology.
Finally, it would be good for Congress to provide for legislationthat would give the federal government the authority to enforce basic cybersecurity for election infrastructure.
