The security of the US voting system is a source of concern regarding voting machines, ballot counting, and voter influence. According to source analysis, there is no evidence that machine tampering has altered the outcome of a US election, even though the system cannot be considered secure in the strict cybersecurity sense.
Certified machines, but rarely updated
Voting is organized by the states, with procedures that vary by state and county. At polling stations, voters indicate their choice on a machine certified by the Election Assistance Commission (EAC) and isolated from any network, following the so-called “air gap” principle. The machine then prints a paper ballot, containing readable text and a barcode or QR code, which is scanned and then counted.
Shai Bargil, co-founder and CEO of Sequent, questions the scope of this certification. He points out that it is not tied to the four-year election cycle and that a machine can remain unchanged for two years or more. “It’s quite ridiculous. Software needs to be updated and patched constantly,” he says, concluding that this certification is “almost meaningless.”
The machines are also entrusted to the Voting Village, an election security lab organized during the DEF CON conference, where researchers and officials can test them. According to Shai Bargil, every machine delivered to this lab has been successfully hacked as soon as attackers could physically handle it. Christiaan Beek, vice president of cyber intelligence at Rapid7, recommends not considering the machines as “the ultimate source of truth,” but as part of a broader system.
Paths to strengthen trust
Shai Bargil proposes making all the software used open source, which would allow academics and experts to examine it. He also suggests that an encrypted record of each vote be transmitted directly to the counting system, in addition to the paper ballot. Microsoft’s ElectionGuard project proposes homomorphic encryption of votes, but does not advocate opening the code.
Dave Gerry, CEO of Bugcrowd, believes the most difficult vulnerabilities to address are on the periphery of the system, notably voter registration databases, county websites, and campaign team email systems. Casey Erikson, director of penetration testing at NRLabs, insists that the goal is not to eliminate risk, but to contain it: “It’s about controlling access. Verifiable backups are essential.”
Influence and disinformation
Adam Marrè, a former FBI special agent and now CISO at Arctic Wolf, observes that most election-related activities aim less at altering votes than at influencing the perception of the election, through disinformation campaigns or manipulation on social media. Several sources have stated that Russia conducted an influence campaign in favor of Donald Trump before the 2016 election, an analysis reported by US intelligence agencies in 2017. In 2024, US agencies attributed a hacking and leak operation targeting Trump’s campaign to Iran.
In 2024, an automated call using a deepfake-generated voice of Joe Biden, meaning a synthetic imitation, was broadcast in New Hampshire. It urged Democrats to stay home. This attempt failed, according to the source, and its author stated it was not a serious attack, but a way to raise awareness about the possibilities of AI.
