Yet another mainstream tech reporter has decided to draft up an alarmist piece about the hacking of the US election based on a flawed understanding of both how our elections are conducted and the reporting of other related news. CNet’s Edward Moyer threw out this misleading story over the weekend:

“Don’t blame me, I voted for the other candidate (but hackers stole my ballot).”

You might chuckle, but apparently that’s a bumper sticker we could soon encounter for real — if election officials aren’t careful.

The US Department of Homeland Security issued a statement Saturday saying hackers have been casing state voting systems, and it offered its cybersecurity assistance to any states that request it. (emphasis mine)

That link in the last line is the critical piece. It leads to a DHS bulletin in reference to the agency’s offer of help to states looking to secure systems in it, they note:

In a few cases, we have determined that malicious actors gained access to state voting-related systems. However, we are not aware at this time of any manipulation of data. (emphasis mine)

You will notice the difference between the two passages in bold above. It may seem overly pedantic or a minor semantic distinction, but it really isn’t. A “voting system” would refer to the system by which America votes. A “voting-related system” would be a supplementary system that aids in that process, but is not actually part of the voting system. In other words, as I have commented previously, the actual conduct of elections and the storage of voter information are not one and the same. Your voter registration is not tied to the machine on which you vote. The city/county/state registration databases exist separate and apart from the machines you will use to actually cast your ballot.

This is critically important for reporters covering the concern over election manipulation to get right, and yet they rarely do. Instead, like Moyer, they write these sensationalist pieces that mislead the public into conflating the illegal access of voter data with the manipulation of their sacred vote. It’s unfortunate that writers like Moyer don’t bother to actually talk to people who have spent a lifetime in elections to get the story right.

It’s a good thing someone in our government is actually informed about elections. A report out yesterday afternoon noted the head of the NSA, during an Armed Services Committee weighed in on the possibility of US elections being hacked (and here).

During a Senate Armed Services Committee, Sen. John McCain, R-Ariz., asked about the possibility that Russia “could somehow harm the electoral process” in his state and “disrupt the voting results in the upcoming election.”

Admiral Mike Rogers, head of the NSA and U.S. Cyber Command, spoke about the disparate structure with some states voting manually and others electronically.

“But is it a concern?” McCain asked.

“Oh, yes sir,” Rogers responded.

Fortunately, elsewhere in government, another top official knows how things actually work.

 “The beauty of the American voting system is that it is dispersed among the 50 states, and it is clunky as heck,’’ said [FBI Director] Comey. “A lot of people have found that challenging over the years, but the beauty of that is it’s not exactly a swift part of the internet of things, and so it is hard for an actor to reach our voting process.’’

Rogers clearly doesn’t understand how elections work. As I pointed out the other day, there is almost ZERO chance that the election could be “hacked” in any meaningful way. The FBI Director (who I rarely agree with on matters of security, privacy and surveillance) is spot on. Our election process is a giant, decentralized mess. It is largely impervious to hacking largely because it is not standardized, not centralized, and not connected. Comey gets this. That’s ultimately good because it would probably be up to the FBI/DOJ to enforce security over elections. If the NSA was in charge, we would be screwed.

Recent news reports that the election databases in Arizona and Illinois have a whole lot of people up in arms, and have caused numerous publications that have precious little understanding of election systems to proclaim that the US election in November could be hacked. For instance, there is this from the Daily Signal:

“If it’s an organized effort, and someone hacks into a system and falsely registers bogus voters, you could hire a crew of people to vote multiple times under different names,” von Spakovsky told The Daily Signal. “That’s a problem for states with no voter ID laws. There is no way to prevent that.”

Guess what, there is nothing that prevents that currently. You can fill in a ton of false registrations in a state and hire a crew of people to vote multiple times. Yet it doesn’t happen. Just about every major study of voter fraud has found that when it does occur, it is a) generally on a very small scale and b) frequently caught. Why? Several reasons:

• The sudden appearance of a large number of extra voter registrations would be noticed. Most states publish the number of registered voters publicly and there are people who look at the numbers, literally, on a daily or weekly basis to see how they have changed, and how the change tracks against changes over time. A sudden shift in the number would stand out.
• The size of the “crew” required to throw an election is significant. Few states decide Presidential or Congressional elections by a few votes and rigging them is VERY difficult. The Florida results in 2000 are the rare exception, not the rule in Presidential elections. To swing a state like Ohio in 2004, you would have needed 60,000 votes. The size of the crew that could pull that off is so large it is unlikely that somebody wouldn’t brag about it to a friend. Occasionally you have a down ballot race for something like dog catcher that is decided by a handful of votes. Those are frequently fixed and very frequently caught.
• The decentralization of American election systems would make a large scale hack almost impossible. Typically each county in a state is responsible for providing their own election systems. You vote, the aggregate vote from your precinct/ward/division is sent to the county election official, who then sends it along to the state. To “hack” an election in a single state, you may have to compromise dozens or even hundreds of individual polling systems in a state, and quite frequently a mix of different systems is in use. So you may have to compromise dozens of different types of machines. You could possibly hack the secretary of state’s central computer, but all the counties have to reconcile their votes, then meet with the state election officials to certify that what the state shows is correct. So the hack at the state would eventually be revealed.

The biggest threat to our election systems is not the hacking of an election, but the workaday hacking of our personal information. That, however, is something that threatens every major database – be it commercial, private or government. In just the last few years, an alphabet soup of government agencies has been hacked. The IRS, NSA, and OPM, to name just a few, compromised the personal information of millions of citizens. Corporate hacks on everything from Target to porn sites have resulted in even more.

Election agencies maintain huge databases of information about voters. In many states the use of a voter ID number is prohibited, so they often use your Social Security Number to identify you. When the database gets hacked, the attackers will often get your name, address, date of birth, driver’s license number and SSN. That’s all the ingredients needed for identity theft. What’s worse, is the leak of that information happens all to frequently.

A lawsuit filed this week revealed what Kemp said his office learned on Friday — that Social Security numbers, dates of birth and driver’s license numbers for 6.1 million registered voters was included in a voter file provided last month to 12 organizations.

That’s among the largest breaches affecting states, if not the largest, according to a timeline kept since 2005 by the Privacy Rights Clearinghouse. South Carolina in 2012 discovered that unencrypted data from tax returns was hacked from its Department of Revenue, affecting 3.8 million adults, 1.9 million dependents and 700,000 businesses.

Despite that danger not only existing, but coming to fruition, Georgia’s elections director refused help in securing their systems, claiming a fear that the federal government was using it to get their nose under the tent to take over elections.

The reality is there is precious little chance that elections can be hacked, unless and until we centralize and standardize our election systems. While some have called for that as a way to provide better oversight and protection, it is actually quite likely that would create worse problems. Instead, the real election reform we need as voters is the creation of a national voter ID number that could keep track of voters without compromising their social security and drivers license information. Many on both the left and the right oppose a voter ID number though for different reasons. The left is generally opposed to voter IDs because they feel they suppress minority and low-income voters. The right fears them as a way for government to track individuals’. Both are likely justified in those complaints.

However, we already have ID numbers that are frequently surrendered on registering to vote, but those IDs are tied to everything else we do in life, and our system, currently, is ill-equipped to protect them.

So sleep well tonight knowing that our election systems will likely keep our democracy safe, but not your personal information.

Over the last week there has been a lot of fretting about a decision by the US Court of Appeals for the Ninth Circuit regarding a case in which a former employee gained access to his former employer’s proprietary database using a current employee’s password. A veritable who’s who of tech blogs have been spun up claiming that the decision makes it illegal to share your Netflix password.

In his dissenting opinion, Judge Stephen Reinhardt pointed out the trouble of ambiguous phrases like “unauthorized access” is that it could be interpreted to criminalize the actions of millions of Americans who might share their Netflix passwords.

The majority does not provide, nor do I see, a workable line which separates the consensual password sharing in this case from the consensual password sharing of millions of legitimate account holders, which may also be contrary to the policies of system owners. There simply is no limiting principle in the majority’s world of lawful and unlawful password sharing.

To be clear, nobody was charged with sharing a password. Nosal was charged with illegally accessing a proprietary database to steal something of value from a system he was not authorized to access. The facts of the case are not in dispute. The Computer Fraud and Abuse Act, under which Nosal was tried, was meant to handle exactly this sort of incident – an individual circumventing prohibitions on system access to steal something of great value.

The comparison to sharing a Netflix password, specifically, is completely ridiculous given that Netflix actively encourages you to share your account by allowing you to specify multiple account users. Nothing in this decision makes that illegal.

If the tech community wanted to make a sensationalist claim, a more apt comparison might be the sharing of an Amazon password to get a Prime discount tomorrow. Even that, however, is not an apt comparison as you are still paying for the goods, albeit at a savings. You are still paying the full price that any Prime member would pay. The CFAA does, however, give Amazon the legal authority to prosecute that if they would like to do so.

Despite the wishes of the “everything should be free” crowd, their is still a concept of ownership. The CFAA decision reinforces that concept and holds individuals (in this case Nosal) responsible for theft of goods owned by someone else. Despite the public outcry, this decision was rightly decided and is, in fact, a feature of the law, not a bug.