Election cybersecurity or election security refers to the protection of elections^[1] and voting infrastructure from cyberattack or cyber threat^[2] – including the tampering with or infiltration of voting machines and equipment, election office networks and practices, and voter registration databases.^[3]

This article has multiple issues. Please help improve it or discuss these issues on the talk page. (Learn how and when to remove these template messages) The examples and perspective in this article deal primarily with the United States and do not represent a worldwide view of the subject. (June 2018) A major contributor to this article appears to have a close connection with its subject. (August 2020)

Cyber threats or attacks to elections or voting infrastructure could be carried out by insiders within a voting jurisdiction, or by a variety of other actors ranging from nefarious nation-states, to organized cyber criminals to lone-wolf hackers. Motives may range from a desire to influence the election outcome, to discrediting democratic processes, to creating public distrust or even political upheaval.

A variety of experts and interest groups have emerged to address voting infrastructure vulnerabilities and to support democracies in their security efforts.^[4] From these efforts have come a general set of policy ideas for election security, including:

• Transition from black-box proprietary voting systems to transparent open-source voting systems^[5][6][7]
• Implement universal use of paper ballots, marked by hand and read by optical scanner, ensuring a voter-verified paper audit trail (VVPAT).^[8][9][7]
• Pass voter machine certification requirements^[10] that, for example, phase out touch-screen voting machines – especially the most vulnerable direct-recording electronic (DRE) devices^[11] and follow recommendations like those by the US Election Assistance Commission.
• Verify voting results by requiring election officials to conduct risk-limiting audits, a statistical post-election audit before certification of final results.^[11][7][12]
• Ballot accounting and reconciliation to ensure all ballots are accounted for^[10]
• Give voters an opportunity to fix any mistakes that would otherwise get their ballots thrown out
• Ban electronic voting^[10]
• Secure all voting infrastructure from databases to equipment using cyber hygiene tools such as the CIS "20 Critical Security Controls" or NIST's Cybersecurity Framework.^[10][12][13]
• Provide resources, training and information-sharing to election leaders for cyber maintenance and on-going monitoring.^[14][15]
• Designate elections as critical infrastructure^[14] and provide appropriate funding to implement infrastructure upgrades, audits, and cyber hygiene measures.
• Pre-election logic and accuracy testing to check for equipment malfunctions^[10]
• Institute a pre-election threat assessment plan to bolster technical support capacity for election officials requesting assistance.^[14]
  • Call upon outside experts to conduct cyber assessments – government specialists, white-hat hackers, cybersecurity vendors and security researchers – where needed.^[15]

The "white hat" hacker community has also been involved in the public debate. From July 27–30, 2017, DEFCON – the world's largest, longest running and best-known hacker conference – hosted a "Voting Machine Hacking Village" at its annual conference in Las Vegas, Nevada to highlight election security vulnerabilities.^[16] The event featured 25 different pieces of voting equipment used in federal, state and local U.S. elections and made them available to white-hat hackers and IT researchers for the purpose of education, experimentation, and to demonstrate the cyber vulnerabilities of such equipment. During the 3-day event, thousands of hackers, media and elected officials witnessed the hacking of every piece of equipment, with the first machine to be compromised in under 90 minutes.^[17] One voting machine was hacked remotely and was configured to play Rick Astley's song "Never Gonna Give You Up."^{[18][irrelevant citation]} Additional findings of the Voting Village were published in a report issued by DEFCON in October 2017.^[19]

The "Voting Village" was brought back for a second year at DEF CON, which was held in Las Vegas, August 9–12, 2018. The 2018 event dramatically expanded its inquiries to include more of the election environment, from voter registration records to election night reporting and many more of the humans and machines in the middle. DEF CON 2018 also featured a greater variety of voting machines, election officials, equipment, election system processes, and election night reporting. Voting Village participants consisted of hackers, IT and security professionals, journalists, lawyers, academics, and local, state and federal government leaders. A full report was issued on the 2018 Village Findings at a press conference in Washington, DC, held on September 27, 2018.

Russia's 2016 attempts to interfere in U.S. elections fits a pattern of similar incidents across Europe for at least a decade. Cyberattacks in Ukraine, Bulgaria, Estonia, Germany, France and Austria that investigators attributed to suspected Kremlin-backed hackers appeared aimed at influencing election results, sowing discord and undermining trust in public institutions that include government agencies, the media and elected officials.^[20]

The United States is characterized by a highly decentralized election administration system. Elections are a constitutional responsibility of state and local election entities such as secretaries of state, election directors, county clerks or other local level officials encompassing more than 6,000+ local subdivisions nationwide.^[21]

However, election security has been characterized as a national security concern increasingly drawing the involvement of federal government entities such as the U.S. Department of Homeland Security. In early 2016, Jeh Johnson, Secretary of Homeland Security designated elections as "critical infrastructure" making the subsector eligible to receive prioritized cybersecurity assistance and other federal protections from the Department of Homeland Security. The designation applies to storage facilities, polling places, and centralized vote tabulations locations used to support the election process, and information and communications technology to include voter registration databases, voting machines, and other systems to manage the election process and report and display results on behalf of state and local governments.^[22] In particular, hackers falsifying official instructions before an election could affect voter turnout or hackers falsifying online results after an election could sow discord.^[23]

• Open-source voting systems
• Verified Voting Foundation
• Voluntary Voting System Guidelines