A long-awaited Update to Federal Voting Technology Standards could Ban Voting Machines from Connecting to the Internet or using any Wireless Technology such as Wi-Fi or Bluetooth.
A New Draft of Version 2.0 of the Voluntary Voting System Guidelines (VVSG) says that Voting Machines and Ballot Scanners “must not be capable of establishing wireless connections”, “establishing a connection to an external network”, or “connecting to any device that is capable of establishing a connection to an external network.”
If they survive a Review Process, the New Rules would Represent a Landmark Development in Voting Technology Oversight, Eliminating One of Cybersecurity Experts’ Top concerns about voting Machines by Plugging Holes that Skilled Hackers could Exploit to Tamper with the Democratic Process.
The Wireless and Internet Bans are included in the latest Draft of the “system integrity” Section of the VVSG Update. A Working Group focused on the VVSG’s Cybersecurity Elements Reviewed the Document during an Oct. 29th Teleconference.
As its name suggests, the VVSG, produced by the Election Assistance Commission (FEC) and the National Institute of Standards and Technology Agency (NIST), is Not a Set of Mandatory Federal Rules. However, most States require Voting Equipment to Pass VVSG-based Testing before they Buy it.
Security Experts have frequently Criticized the VVSG for Lacking Robust Protections against Hacking. It has Not been significantly Updated since the EAC Adopted the First Version in 2005.
Wireless Connectivity has been a Particular Concern. Some Vendors offer Machines with Cellular Modems that allow Poll Workers to Rapidly Transmit Unofficial Results to Central Offices on Election Night.
Some Election Officials appreciate the Modems’ Convenience, but Experts say they Create Serious Vulnerabilities by Connecting Machines to the Internet.
In May, Advocacy Groups said that they had Driven more than 50,000 Public Comments to the EAC urging the Commission to Ban Wireless and Internet Connectivity. Dan Savickas, Federal Affairs Manager at the Conservative Organization FreedomWorks, called it “a commonsense measure to ensure the integrity of our voting machines.”
The NIST Employees Drafting VVSG 2.0 ultimately Agreed. “Exposure to the internet could allow nation-state attackers to gain remote access to the voting system,” they wrote in the Discussion Section of the New Wireless Ban.
Even Local Wireless Connections such as Bluetooth “can expand the attack surface of the voting system,” they wrote in explaining the Separate Wireless Ban. Bluetooth is one way for Hearing-Impaired Voters to Connect Accessories they need to use in Polling Places.
Under the New Rules, which were Developed in Collaboration with the VVSG Accessibility Working Group, those Voters will still be able to use Assistive Devices by Plugging in Adapters.
During the Oct. 29th Cyber Working Group Meeting, NIST Staffer Gema Howell Confirmed that, if this Rule were Approved, Election Officials would have to Transmit Results using Non-Voting Technology. “The process for transmitting the results would be handled completely separate[ly],” Howell told the Working Group, which includes Government Employees, Security Experts, Vendor Representatives, and Activists.
The Proposed Bans “should be an absolute no-brainer,” said Susan Greenhalgh, the Vice President of Policy and Programs at the National Election Defense Coalition (NEDC), which helped Drive the Public Comment Campaign. “It’s troubling that it took so long to get here.”
Internet Connections in Voting Systems have been the Source of recent Controversy at the EAC. In May, the Agency’s Republican Chairwoman, Christy McCormick, Falsely told the Senate Rules Committee that the Current VVSG Bans Internet Connectivity. Sen. Amy Klobuchar (D-MN) the Committee’s Top Democrat, asked McCormick to Correct the Record, which she did in June.
The New Rules, along with the Rest of VVSG 2.0, must Survive Approval by Three EAC Advisory Groups. The 15-Member Technical Guidelines Development Committee will Meet on Friday to Review the Draft. If they approve it, the EAC will then Submit it to the Agency’s Board of Advisors, as well as its Standards Board. It remains Unclear, however, whether the EAC’s Four Politically Appointed Commissioners will have to Vote to Approve the rules after that.
The EAC also has Not yet Developed a Plan for Phasing Out the Old VVSG. There will likely be a Transition Period during which States can ask Vendors to Meet either the Old or the New Standards.
NYC Wins When Everyone Can Vote! Michael H. Drucker
