IN THE run-up to the attacks of September 11th 2001, said George Tenet, the former director of the CIA, America’s intelligence system was “blinking red”. On July 13th Dan Coats, the current director of national intelligence, invoked Mr Tenet’s language to convey the magnitude of the threat posed by foreign hackers. “The digital infrastructure that serves this country is literally under attack,” he said. “The warning lights are blinking red again.” Although Mr Coats expressed concern about infiltration from numerous countries, he called Russia “the most aggressive foreign actor”. Meanwhile, the president seems indifferent when it comes to the risk of Russian meddling with the mid-terms in November. How vulnerable are American elections?

If Vladimir Putin’s hackers did seek to intervene in the congressional elections in November, they would have two avenues. One, familiar after 2016, is to use social media and pretend news sites to spread disinformation or propaganda. It seems likely that Russian intelligence agencies will continue trying to bolster the Kremlin’s preferred candidates and hinder their rivals in the court of online public opinion. In May a Russian news agency with close ties to Mr Putin’s government launched a “news” website called USA Really, which publishes a regular stream of articles favourable to Mr Trump. The impact of such campaigns is hard to measure: recent research on their effect in 2016 found that most people reading such stuff already supported Mr Trump (see Lexington). But the races for control of both chambers of Congress now look close enough that propaganda could prove decisive, even if it only sways a tiny sliver of the electorate.

The second, more insidious, method is to complement that tactic with a more direct cyber-attack on voting records or machines. Fortunately, the spectre of hackers in Moscow doctoring actual election results appears remote. Just before leaving the White House, Barack Obama designated election systems as critical infrastructure. That decision granted election officials access to federal cyber-security experts and to an information-sharing network. The federal government has since provided billions of dollars for securing the administration of elections.

All voting machines are supposed to be “air-gapped” (not connected to the internet), making them much harder to infiltrate from afar. Attackers could try to alter voting results by loading malware onto USB sticks that get plugged into the machines, or embedding it in the code run on them (the government’s own hackers used this technique to sabotage Iran’s air-gapped nuclear centrifuges). But even if Russia did manage to sneak a virus onto some of these machines, it would need to remain hidden during routine logic and accuracy tests, conducted before the election, which ensure that the devices’ tabulated totals equal the sum of the individual votes entered on them. Rigorous reviews of software and vote tabulations have revealed no evidence of any electronic ballot-stuffing, deleting or switching in 2016.

Voter lists are not so well protected. Even without foul play, simple clerical errors in state and city databases of voters’ names and addresses caused long delays at polling places in California in 2018 and North Carolina in 2016, for example. In Palm Beach County, Florida, similar mistakes caused 2,000 properly registered voters to be turned away in the presidential primaries of 2016. And, unlike the machines that tally up votes, the computers that house this information are connected to the internet and often lack robust defences against intrusion. In 2016 Russian hackers gained access to the state elections server in Illinois, proving they could penetrate even a fairly well-secured system.

If hackers were able to alter the recorded addresses of a few thousand voters with African-American family names, for example, they could disenfranchise these voters, whose identification documents would no longer match their listed addresses. Congressmen should spend a bit less time bloviating about Russians on Facebook and more time preventing that.