State And Local Officials On High Alert For Breaches In Vermont's Election System

Jun 27, 2017

Secretary of State Jim Condos says his office is actively taking steps to protect the state's election system from being manipulated by foreign or domestic computer hackers, but says there's no evidence so far to indicate that Vermont's voting system was breached.

Following reports of Russian efforts to affect the outcome of the 2016 presidential election, the Department of Homeland Security has reached out to individual states to help strengthen the security of their voting systems.

Condos says this issue has become an ongoing and critically important concern for his office.

"We take the security of our elections process very seriously," says Condos. "We want to maintain the utmost integrity in our system."

Condos says his staff is constantly on the lookout for suspicious activities. He says the Department of Homeland Security periodically runs tests on Vermont's system to look for weaknesses because DHS believes many state systems are being targeted by hackers.

"'Breached' is when someone actually gets into your system, 'targeted' means they try to scan your system to see what vulnerabilities you had. We have no evidence that anybody got into our system,” said Condos. “We were doing it before, but we're doing it even more so now — that we're constantly on the alert."

"We have no evidence that anybody got into our system." — Secretary of State Jim Condos

Condos says it would be very difficult for someone to use their computer to actually alter the election results in Vermont towns. That's because all towns in the state tally their votes by using either paper ballots or ballots that are fed into an optical scan machine.

Condos says Vermont's vote counting system is decentralized and that the optical scan machines are stand-alone tabulators that aren't linked to any outside system. This makes it virtually impossible to hack them.

"It would be very difficult: First of all, state law says they cannot be connected to the internet by hardwire or Wi-Fi or in any way," said Condos.

Montpelier is one of the several dozen communities that use an optical scan machine.  City Clerk John Odum is confident about the security of the system as long as the tabulator is not connected to any on line programs.

"As long as we don't network them it's functionally impenetrable, it's the highest level of computer security essentially." — Montpelier City Clerk John Odum

"There's really no way to get in there and the technology is solid,” said Odum. “It's just straight forward scanning technology, 20 years old, it's reliable, it's tested, as long as we don't network them it's functionally impenetrable, it's the highest level of computer security essentially."  

The programing cards for the optical scan machines are locked in a vault in Montpelier.

Would it be possible for a hacker to manipulate the card to alter voting results in the city?

Odum says it's very unlikely because access to the card is extremely limited and his office also tests the performance of each card several times before election day.

"We test them every which way,” said Odum. “We screw up ballots, we give them good ballots and we feed them every way imaginable and then we compare them with the results."

Odum says the state's voter registration system is on-line and is potentially subject to a breach. But he says a new state law allowing for same day voter registration would ensure that all eligible voters had an opportunity to cast their ballot in the event of a computer attack.

"That actually procedurally is a huge help to covering that hole if somebody gets in there and they find they've been removed maliciously we can just register them again under the law," said Odum.

Odum says it's critical for state and local officials to remember that safeguarding the election system will require an ongoing commitment to upgrade security measures.

"It's important to remember that [information technology] security is always a moving target you can't just create a bench mark , create a date we're going to upgrade everything we're going to get it to this point and then we are secure," said Odum.  

As part of that ongoing commitment, Odum says he'd like to see the appointment of an IT specialist at the state level whose primary responsibility would be to protect all state and local election systems.