Two years after many voter-registration networks were penetrated by hackers, voting infrastructure in US remains largely unchanged, despite officials' warnings
As the midterms approach, America's electronic voting systems are more vulnerable than ever. Why isn't anyone trying to fix them? Tweets: @kimzetter , @kimzetter , @justinhendrix , @ilvestoomas , @kimzetter , and @jakesilverstein Tweets: Kim Zetter / @kimzetter : “Sixteen years ago, lawmakers led Americans to believe that they had solved the problems of Florida in 2000. But the 2016 election made it clear that the problems simply shifted from one technology to another.” Kim Zetter / @kimzetter : “The Dept. of Homeland Security, the intelligence community and election officials have all insisted that there is no evidence that Russian hackers altered votes in 2016. But the truth is that no one has really looked for evidence.” Justin Hendrix / @justinhendrix : “The ballot box is the foundation of any democracy. It's not too grand to say that if there's a failure in the ballot box, then democracy fails.” Toomas Hendrik Ilves / @ilvestoomas : Headed for a major mess, if not a disaster. So why is this not on everyone's radar screen? https://nyti.ms/2N3hoAh Kim Zetter / @kimzetter : What's the state of election security going into 2018 and 2020 elections? Mostly unchanged since 2016. We don't really know if anyone altered votes in 2016 and there's a good chance we won't know if someone does it in next election. My piece for @NYTmag https://nyti.ms/2ORNFfq Jake Silverstein / @jakesilverstein : In a frightening new @NYTmag cover story, @KimZetter explores the big question: heading into the mid-terms and 2020, how vulnerable is our election infrastructure to hacking? The answer will alarm you. https://www.nytimes.com/...
Context & Ripple Effects
This piece lands two years after hackers penetrated voter-registration networks in 2016, and its core finding is inertia: despite warnings from DHS, the intelligence community and election officials themselves, the machines and registration systems heading into the midterms are largely the same ones that were attacked. Officials maintain there is no evidence Russian hackers altered votes, but as Kim Zetter notes, no comprehensive investigation has ever searched for one — the 'solved after Florida 2000' narrative simply shifted problems from punch cards to electronic systems.
The follow-on coverage shows why the warning went unheeded: security experts say the companies dominating the US election tech market have failed to acknowledge or fix known vulnerabilities, and ES&S's claim that its systems are never internet-connected was contradicted by researchers finding dozens of its systems online. The story arc runs from penetration, through vendor denial, into a 2020 cycle where responses to Russian interference remain inadequate even as tactics evolve.
First-order effects
- Election officials enter the midterms running infrastructure they already know is vulnerable, with DHS and the intelligence community able to offer only reassurance — no evidence of altered votes — rather than remediated systems.
- Vendors like ES&S face direct credibility exposure: their air-gap assurances are testable claims, and researchers have already caught systems online.
Second-order effects
- With vote-alteration evidence absent and hard to produce, attackers and observers shift toward perception hacks — small, exaggerated incidents aimed at undermining confidence rather than changing tallies — which officials must now monitor alongside physical security.
- Vendor stonewalling pushes scrutiny toward procurement and oversight: states buying from a concentrated market dominated by a few firms have little leverage to demand fixes, making certification and federal pressure the remaining levers.
Third-order effects
- If the pattern holds, US election integrity becomes a trust problem more than a technical one — repeated warnings without remediation erode the credibility of both the systems and the officials defending them, regardless of whether any given attack succeeds.
- The vacuum invites a larger federal role for Homeland Security in what has been a state-and-vendor-run system, since neither the market nor local officials have closed the gaps on their own.
The trend: US election security is settling into a warning-without-remediation loop in which attacks migrate from altering infrastructure to attacking confidence in it.