WASHINGTON — When Chris Grayson pointed his Web browser in the direction of Georgia’s elections system earlier this year, what he found there shocked him.
The Santa Monica, Calif., cybersecurity researcher effortlessly downloaded the confidential voter file of every registered Georgian. He hit upon unprotected folders with passwords, apparently for accessing voting machines. He found the off-the-shelf software patches used to keep the system secure, several of which Grayson said could be easily infected by a savvy 15-year-old hacker.
“It was like, holy smokes, this is all on the internet with no authentication?” Grayson said in an interview. “There were so many things wrong with this.”
American elections only recently seemed impenetrable: too many different systems, different jurisdictions and different machines — online and offline — to hack. But confidence in the system’s invulnerability is eroding after national security officials revealed that during the 2016 presidential race Russian hackers attempted to infiltrate elections systems in 21 states. Officials won’t identify which states, but say in some cases culprits got inside networks to look around.
“The cyber threat to elections in 2016 was significantly more severe than in previous years,” said Bob Kolasky, the acting deputy undersecretary for national protection at the Department of Homeland Security, which is trying to help states shore up their systems. “We anticipate going forward it will be a more significant threat than we’ve had in past.”
Such discord and uncertainty is exactly what intelligence officials say operatives from Russia and other hostile nations are seeking as they target U.S. elections systems.
The possible scenarios for interference are unnerving. Worries range from cyber criminals changing vote counts — as they did successfully a few years ago in Ukraine — to a mass corruption of voter registration that could paralyze key precincts on election day.
Red flags are going up around the country, even as secretaries of state try to assure an increasingly concerned electorate that they have things under control. Particular concern is focused right now on voter registration. The databases appear to be the most vulnerable link in elections and erasing tens of thousands of voters from the rolls on election day would be a surefire way to create a chaos scenario.
Hackers are already aggressively probing ways in. Just before the presidential election, hackers showed they could break into VR Systems, a Florida company that election officials in eight states rely on to keep track of who is eligible to cast a ballot on election day.