Researchers warn US voting systems remain vulnerable to attack

The SecurityWeek piece surveys the integrity of US elections through a cybersecurity lens, arguing that, in strict terms, current voting processes remain vulnerable even as they incorporate familiar safeguards. It notes that many jurisdictions rely on ballot-marking devices for in-person voting, with paper ballots printed and a human-readable element alongside a barcode or QR code that is later scanned for counting.

Certification by the Election Assistance Commission and air-gapping are described as intended security features, yet researchers warn the combination of fixed certification cycles and patching timelines can leave an attack surface that is not patched in the lead-up to elections. The article cites concerns from industry voices that certification alone is not a guarantee of security across a four-year cycle, and that a single machine could be reused with unpatched software across multiple stages of the process.

On the threat landscape, the piece divides issues into machine security and influence operations. It quotes Shai Bargil of Sequent criticising the certification regime as potentially meaningless unless software is openly examined, and he proposes open-source voting software paired with encrypted voting records that travel directly to the counting system.

Christiaan Beek of Rapid7 cautions against treating machines as the ultimate truth, urging a broader view of the system that includes supply chains and administrator access. The article also highlights influence campaigns, noting historical claims of foreign interference and current AI-enabled risks such as targeted robocalls and deepfakes intended to depress turnout or erode trust.

It references the 2016–2024 timeline of attributed operations and concludes that while complete security is unattainable, verifiability and layered safeguards remain central to election integrity.