Election Security


From internet voting to election systems, our election infrastructure continues to be vulnerable to cyber-attacks.

U.S. election systems face a wide range of security threats and vulnerabilities, especially when systems are connected to the internet or a wide-area network. Election systems include public election websites, voter registration systems, voting systems that allow voters to cast ballots, vote tabulation systems, election night reporting systems, and auditing systems. 

Security Risks to Election Systems

Different voting systems can be subject to a range of vulnerabilities based on how the votes are cast or tabulated. For example, computerized optical scanners are typically used to tabulate votes made by paper ballot or by ballot-marking devices (BMD). However, BMDs do not tabulate or record votes in the system’s memory. BMDs can be subject to hacking or misconfiguration in the software that could print out an inaccurate ballot. BMDs generally encode votes in bar codes or QR codes alongside the printed text of a voter’s choices but voters cannot verify the accuracy of bar codes or QR codes before the ballot is scanned by tabulation machines. Direct Recording Electronic (DRE) systems, on the other hand, involve a voter casting their ballot in an electronic system and the ballot is counted internally by the system’s computer. Because there is often no paper record, DRE systems are not auditable. Relying on computers like DREs have inherent cybersecurity risks and technological challenges, such as touchscreen miscalibration. There is currently no system that can provide a secure way to vote over the Internet while preserving the secret ballot. Human-readable paper ballots are the most robust method of casting a vote because it is not subject to manipulation by faulty hardware or software and can be audited to verify the results of an election.  

Other election systems can be subject to many different types of cybersecurity threats: denial of service attacks, malware, phishing attacks, or infiltrating data bases and networks.

Denial-of-service (DoS) attacks interrupt or slow access to machine or network, making it inaccessible to users. DoS can be used to disrupt the voting process by preventing access to electronic voting systems, electronic auditing systems, or e-pollbooks.

Malware can be introduced at any point in the voting process and might not be easily detected. From the software allowing voters to cast a vote on an electronic voting machine to the software used to tabulate votes to the auditing software used, the introduction of malware can compromise or disrupt the election process.

Phishing attacks can also be used to attempt to gain access to sensitive information. Attackers in these scenarios would target election officials with administer-level credentials in an effort to gain access to (or alter) voter information or other election databases.

Vote By Mail and Privacy

Voters in numerous states have had access to vote by mail for years, but the practice gained increased attention in 2020 due to the COVID-19 pandemic . Mail-in ballots are tamper-proof and do not face the same vulnerabilities that make secure online voting impossible. States have systems in place to ensure that every vote gets counted and that voter privacy is maintained. These ballot status verification systems are a key part of the U.S. election integrity infrastructure.

EPIC’s Work on Election Security

EPIC has long worked to ensure that elections in the United States are secure and fair for all citizens. Through advocacy, litigation, and policy efforts, EPIC is fighting to protect democratic institutions and highlighting privacy and cybersecurity concerns related to election systems.

In 2016, EPIC published The Secret Ballot at Risk: Recommendations for Protecting Democracy to highlight how internet voting threatens voter privacy. Both federal and state governments have acknowledged that the secure online return of ballots is not feasible. EPIC advocates against internet voting because of the privacy and security risks.

Through the Freedom of Information Act, EPIC has learned more about Russian interference in the 2016 presidential election. EPIC obtained the Federal Bureau of Investigation’s “Victim Notification Procedures,” which showed that the FBI is to notify victims of cyberattacks “even when it may interfere with another investigation or (intelligence) operation.” But, the FBI failed to notify U.S. officials that their email accounts were compromised during the 2016 election and a U.S. House report found that the FBI’s cyberattack victim notification “was largely inadequate.” Learn more about EPIC v. FBI.

EPIC also filed an open government lawsuit against the Department of Homeland Security following the agency’s designation of election infrastructure as critical infrastructure. As a result of the suit, the agency has released hundreds of records to EPIC about the agency’s role in election cybersecurity and its slow response to election cybersecurity threats. Some of these records include: the DHS’s pre-election assessment on threats to U.S. election infrastructure, the DHS’s contacts with election officialsstate reports of election security incidents going back to 2016, meeting minutes from the agency’s Election Task Force in 2017, and a September 2016 Election Infrastructure Cyber Risk Characterization Report. The incident reports, for example, revealed difficulties contacting Republican campaign officials, including the Trump campaign, in the lead up to the 2016 election and the agency’s concern about “unbalanced” outreach to both parties. In the September 2016 Election Infrastructure Cyber Risk Characterization Report, the DHS counseled strongly against untested voting technologies, particularly internet-connected voting systems, finding that the “introduction of new technologies in the voting system will increase vulnerabilities to the election systems in the future.” Learn more about EPIC v. DHS.

EPIC also filed the first lawsuit in the nation for the disclosure of the complete and unredacted Mueller Report. Through litigation, EPIC obtained memos about a suspected agent of a foreign power. One of the released memos was submitted one day after the Justice Department released the redacted version of the Mueller Report. EPIC also learned that there were no records of any outside referrals by Special Counsel Mueller for “administrative remedies, civil sanctions or other governmental action outside the criminal justice system.” EPIC’s case also forced the Justice Department to disclose additional material from the Mueller Report concerning Roger Stone, President Trump’s longtime ally and former adviser. Learn more about EPIC v. DOJ.

Recent Documents on Election Security

Support Our Work

EPIC's work is funded by the support of individuals like you, who help us to continue to protect privacy, open government, and democratic values in the information age.