The nation’s best hackers found vulnerabilities in voting machines — but no time to fix them

by MAGGIE MILLER

Some of the best hackers in the world gathered in Las Vegas over the weekend to try to break into voting machines that will be used in this year’s election — all with an eye to helping officials identify and fix vulnerabilities.

The problem? Their findings will likely come too late to make any fixes before Nov. 5.

In one sense, it’s the normal course of events: Every August, hackers at the DEF CON conference find security gaps in voting equipment, and every year the long and complex process of fixing them means nothing is implemented until the next electoral cycle.

But Election Day security is under particular scrutiny in 2024. That’s both because of increasing worries that foreign adversaries will figure out how to breach machines, and because President Donald Trump’s unsubstantiated allegations of widespread fraud in 2020 undermined confidence in the vote among his supporters.

As a result, many in the election security community are bemoaning the fact that no system has been developed to roll out fixes faster and worrying that the security gaps that get identified this year will provide fodder for those who may want to question the results.

“As far as time goes, it is hard to make any real, major, systemic changes, but especially 90 days out from the election,” said Catherine Terranova, one of the organizers of the DEF CON “Voting Village” hacking event. She argued that’s particularly troubling during “an election year like this.”

From Friday to Sunday, Voting Village hackers clustered around tables with all shapes and sizes of voting machines and equipment to verify voters’ identities or tabulate ballots, trying to get past firewalls or other security measures. Nearby, secretaries of state and other election officials gave talks on misinformation and disinformation threats facing the upcoming election.

Unlike most of the other events at the conference though, the Voting Village was not on the main show floor. It was a decision organizers said was necessary in order to ensure security following years of hatred flung at the event online by those who see the hackers as undermining democracy. In recent years, individuals associated with election denialism showed up at the Voting Village to harass organizers and speakers.

The findings, at times ignored or resisted by the manufacturers of voting machines, have increasingly been accepted in Washington, and the event is often seen as key for boosting the security of machines.

And just like every year since the Voting Village began almost a decade ago, attendees found problems. Organizers of the Voting Village intend to put out a full report in the coming weeks detailing the vulnerability findings from this cycle, and according to Voting Village co-founder Harri Hursti, these vulnerabilities ran “multiple pages” as of Saturday afternoon. While Hursti would not comment on the exact problems found, the amount was fairly consistent with previous years.

Read more