The fact that most election machines are not connected to the internet makes hacking unlikely, but the software itself could be vulnerable

It’s been a topic of debate ever since hackers – presumably working for Russia – stole thousands of private emails from the Democratic National Committee and leaked them on the net. Could a nation state or other adversary hack our elections and determine the next president of the United States?

The answer depends on how they try to go about it, says Avi Rubin, computer science professor at Johns Hopkins University and technical director of the university’s Information Security Institute.

Election hacking is highly unlikely, he says. Attackers reaching into the ballot box from thousands of miles away won’t happen, simply because the vast majority of election machines are not connected to the internet.

Some 31 states offer voting via internet, email, or fax, but nearly all only allow it as an option for military families and Americans living overseas – a very small percentage of the electorate. Only Alaska allows any voter to cast a ballot across the net, according to Verified Voting.

But election rigging is a potential threat, says Rubin. That’s where adversaries attack the electronic voting machines themselves, altering the software inside the machines to favor one candidate. “There are a thousand points of vulnerability,” says Rubin. “Anyone with access to the machines at any stage could attack them.”

There are a thousand points of vulnerability. Anyone with access to the machines at any stage could attack them. Avi Rubin, computer science professor

That could include a software engineer who works for a voting machine vendor, a janitor with the keys to the room where the machines are stored, a truck driver who delivers them to polling places or even a poll worker. The machines usually have tamper resistant tape on them but it’s easily circumvented, he says.

Rubin worked as a judge in several elections in his local district in Maryland; at the end of the day, he was asked to remove the memory cards from each machine where the votes were stored. Swapping those cards out for some with a different vote count would have been child’s play, he says.

Rubin says the best defense against election rigging is having the ability to audit the results using a voter verified paper trail. The problem is that 16 states have electronic voting machines but inadequate paper records. Potential swing states that lack voter verified paper trails in at least some counties include Pennsylvania, Virginia, Indiana and Florida, according to Verified Voting.

Attackers determined to alter the US election would likely focus on counties in those swing states where the final result will be likely be close and unverifiable, says Rubin. Still, initiatives to allow internet voting for all US citizens are a bigger problem, he says.

Florida election bias 'exposed in report' Read more

“Internet voting is a terrible idea,” he says. “The best thing you can do is write to Congress and tell them you want verified paper ballots in your precinct, not the internet.”

Overall, Rubin says he is not more concerned about this election being rigged than those in the past, in large part because more states have adopted paper ballots than four or eight years ago. The worst case scenario would be a replay of the Florida election debacle in 2000 – only this time it would be worse because the current supreme court is deadlocked with only eight judges rather than nine, which means a verdict could be inconclusive.

“It really depends on the margin of victory,” he says. “If Hillary wins in a landslide and takes every state, it won’t be a problem. If she wins by just a few electoral votes, and it comes down to a county with no ability to recount paper ballots, we are going to be in big big trouble.

“It will be very hard to audit the election.”