PROVIDENCE, R.I. (WPRI) – Rhode Island’s election system has been intermittently connected to the internet over the last year, making it potentially vulnerable to hackers, according to a new report.
A group of researchers at Motherboard, a division of Vice Media, published a story Thursday showing at least 35 election management systems in 10 states, including Rhode Island, have been connected to the internet over the last year.
The investigation singled out what it found in Rhode Island — whose system is made by voting machine company Election Systems & Software — as “particularly problematic.”
The reason, wrote Motherboard journalist Kim Zetter: “Rhode Island, unlike other states, conducts its elections from a centralized office at the state Board of Elections, instead of farming out election administration to each county or jurisdiction.”
R.I. Board of Elections Vice Chair Steve Erickson immediately expressed concern about the revelation.
“We were not aware the IP address for our central system was online,” he tweeted. “Obviously we are taking a look at this whole process of data transmission, including the use of modems to transmit data.”
“This is the type of problem some of us have concerns about, causing us to reexamine the use of electronic transmission at any time, even for unofficial results,” Erickson added. “We are reviewing options.”
The issue, however, has come up before.
In April 2018, Common Cause Rhode Island raised concerns during a Help America Vote Act task force meeting about the presence of wireless modems in the state’s tabulators. A month later, the government watchdog organization sent a letter to the Board of Elections reiterating the concern.
“We raise the issue because we believe that the presence of the modems goes against best practices and undermines confidence in the voting system,” wrote executive director John Marion.
Contacted after the Motherboard article published, Marion pointed back to his organization’s longstanding concerns.
“Today’s Motherboard article exposing the Rhode Island voting system has been connected to the internet confirms our well-founded fears,” he told WPRI 12. “We hope the Board of Elections takes this seriously and takes the necessary steps to safeguard our elections.”
The security of elections has been a hot topic since federal investigators determined Russian intelligence officers hacked the Democratic National Committee and the Clinton campaign during the 2016 election. Robert Mueller, who indicted 12 Russian nationals last year, warned Congress last month that the problem persists.
Asked about the findings of the Motherboard story, R.I. Secretary of State Nellie Gorbea said her office regularly assesses its election systems to identify and address new cybersecurity risks.
“I have often said that cybersecurity is not a destination,” Gorbea said in a statement. The new report, she said, “provides valuable new information as we continue to secure our elections system.”
Gorbea also urged the Board of Elections, which is responsible for maintaining the state’s voting equipment and Election Day operations, “to review in detail the allegations in the Motherboard article.”
The story does not suggest any systems were hacked or manipulated, but the research underscored how little election officials seem to understand about the susceptibility of their election management systems, according to Zetter.
The researchers found that some of the election management systems provided by Election Systems & Software were connected to an SFTP server that periodically connects to the internet behind a Cisco firewall.
For counties and states that want to quickly transmit election results, the election systems are designed to quickly connect to the internet and send unofficial results. Motherboard reports the connections are only supposed to last a couple minutes, but sometimes that’s not the case and the data becomes vulnerable.
“Researchers found some of the systems connected to the internet for months at a time, and year-round for others, making them vulnerable to hackers,” according to the story.
Election Systems & Software lists Rhode Island as a client and displays a photo of one of its vice presidents with Robert Rapoza, executive director of the Rhode Island Board of Elections, on its website. The photo is from a January story by Time about Rhode Island headlined, “Russia Wants to Undermine Trust in Elections. Here’s How Rhode Island is Fighting Back.”
Unlike some of the other states found in the report, such as Florida, Michigan and Wisconsin, Rhode Island does not play a major role in the outcome of U.S. presidential elections.
But the findings highlight how many holes there are in the security of election systems everywhere, as researchers said they “stumbled across” the IP address for an Election Systems & Software firewall in Rhode Island in a publicly available document.
Gorbea suggested that the Board of Elections convene public- and private-sector cyber experts to examine the security risks that come along with transmitting election results.