>>189193, >>189194, >>189195, >>189196, >>189197, >>189198, >>189199, >>189200, >>189201, >>189202, >>189203, >>189204, >>189205, >>189206, >>189207, >>189208, >>189209, >>189210, >>189211, >>189212
DNI Pulte @DNIPulte - Redacted Document: NIC NATIONAL INTELLIGENCE COUNCIL
NIC
machines, however, are used far less than other, more secure types of voting machines. • Adversaries who obtained physical access to voting machines could alter how they function, manipulate the data in them, or install malware, according to US state and academic investigations. At the 2019 DefCon cyber security conference, hackers demonstrated the ability to compromise more than 100 voting machines, all of which had been certified for use in at least one US voting jurisdiction.
(U) Pollbook Hacking Example
(U) A pollbook was modified at the 2019 Defcon Voting Machine Hacking Village to run the popular videogame Doom, according to press reporting.
(U)
UNCLASSIFIED
• Thirty-one states and the District of Columbia allow eligible voters to submit absentee ballots via Internet or fax, making these votes susceptible to disruption or manipulation. Four states allow voters to return absentee ballots via a web-based portal, seven allow some voters to return ballots via fax only, and one allows mobile voting secured with blockchain technology. Absentee votes, however, are small in number and typically closely monitored for anomalies. We assess that vote tabulation systems would be difficult to manipulate on a wide enough scale to compromise election results. The systems in each voting location are not connected to the Internet or to
NATIONAL INTELLIGENCE COUNCIL
Ballot and Voting Machine Preparation Vulnerabilities
(U/) Ballot and voting machine preparation is vulnerable to cyber, supply chain, or insider threats. We judge, however, that security and mitigation measures used in these processes, and the distribution of voting machine storage facilities countrywide, would make it difficult for an adversary to coordinate a campaign to manipulate voting results across an entire state or multiple states.
• Ballot Preparation. Creating paper or electronic ballots to upload to voting machines is usually outsourced to third-party vendors. Some use Internet-connected computer systems and lack password and encryption policies, which could allow malicious actors to corrupt ballot files. Logic and accuracy tests to ensure the machines function properly before election day, however, probably would detect such activity.
• Voting Machine Preparation. Voting machines configured at a central location are vulnerable to insider threats. Malware introduced into the voting machines during this phase might affect multiple jurisdictions but also would be detectable during the preelection testing.
each other, and many methods for exploiting them rely on physical proximity. Although an adversary could manipulate voting results across multiple jurisdictions and enough states to influence a presidential election, we judge that conducting such a campaign would be difficult and that postelection audits and paper trails very likely would uncover such an effort.
• (U) A growing number of jurisdictions are using voter-verified paper backups and postelection
[3]