The Pitfalls and Vulnerabilities of Electronic Voting

Almost all registered U.S. voters will cast their ballots on one of three types of electronic voting machines: Direct Recording Electronic, DRE with Voter-Verified Paper Trail, and Precinct Counter Optical Scan machines. Each has its vulnerabilities, according to the Brennan Center Task Force on Voting System Security.

Click here to read about electronic voting machine failures in the 2008 Democratic and Republican primaries.

The following is a look at some of the most serious vulnerabilities faced by the current stock of electronic voting machines, and the countermeasures available:

SOFTWARE ATTACKS

Vulnerability: According to the Brennan Center, the insertion of software attacks is the least difficult way to corrupt the voting system, and all types of electronic voting machines are vulnerable to such attacks.

Countermeasure: For paperless DREs, in particular, parallel testing will help jurisdictions detect software-based attacks as well as subtle software bugs that may not have been discovered during inspection and other testing. The Task Force does not recommend parallel testing as a substitute for the use of voter-verified paper records with an Automatic Routine Audit. 

WIRELESS ATTACKS

Vulnerability: The Task Force found that voting machines with wireless components are significantly more vulnerable to a wide array of attacks. Currently, only two states—New York and Minnesota—ban wireless components in all voting machines.

Countermeasure: Ban all voting machines with wireless elements.

PAPERLESS DREs

Vulnerability: DREs without VVPTs do not have available to them a powerful countermeasure against software attacks: post-election automatic routine audits that compare paper records with electronic records.

Countermeasure: Require a paper trail for every vote cast.

PAPER TRAILS

Vulnerability: The voter-verified paper record, by itself, is of questionable security value.

Countermeasure: The paper record has significant value only if an automatic routine audit is performed (and a well-designed chain of custody and physical security procedures is followed). Of the 26 states that mandate voter-verified paper records, only 12 require regular audits.