Could the U.S. Presidential election be hacked? It’s a scary thought. And given how unprecedented 2020 has been, a cyber attack disrupting the vote might seem more plausible than it would have just a few years ago.

The good news is that the integrity of the vote tallying and reporting itself is likely to be maintained overall. The bad news is that the threat actors seeking to disrupt our elections have so far made the rational decision to attack our election’s integrity by focusing on softer targets beyond the vote itself.

It has long been known that voting machines, particularly “advanced” ones with touch screens running commodity operating systems, contain vulnerabilities that could be exploited to alter vote tallies. Another weak point is the transmission of results from precincts to local election boards, and then onto states. Fortunately, these systems have been examined closely, and security experts have recommended a number of sensible best practices to mitigate the risks, from generating back-up paper ballots to using segmented private networks for sending results. Adoption of these measures is by no means uniform or perfect, but election officials across the country have worked very hard to improve the operational security of these systems.

In the U.S., the responsibility for administering elections is decentralized and distributed among thousands of local jurisdictions. On the one hand, such fragmentation makes it extremely difficult to completely secure all such voting systems against a determined attack by a nation-state-level adversary. On the other hand, the scope for damage arising from a single intrusion is naturally limited. To fundamentally alter the results of voting in the election would require simultaneous successful attacks going undetected during the intrusion and afterwards. While possible, it remains comparatively expensive and unlikely to succeed. 

Moreover, by increasing security around the vote tally itself, would-be attackers have been encouraged to focus their efforts on other aspects of the election where attacks are easier to launch and the potential impact is greater. In other words, they are behaving like rational economic actors.

Nation-state adversaries may seek to undermine confidence in the democratic process, as well as steer the electorate to its preferred candidates. With those goals in mind, launching disinformation campaigns through social media and releasing incendiary stolen documents, as Russia did in 2016 and appears to be doing in 2020, is an attractive approach. Such attacks can be launched remotely and target the entire electorate, so they are relatively inexpensive to perpetrate while also offering high impact. By contrast, attacks on the vote tallying process may very well require physical access and only affect a small number of votes. 

In other words, disinformation campaigns targeting social media or leaking sensitive documents have comparatively low risk and high rewards, whereas attacks on the vote itself have high risks and low rewards. Not to mention they are harder to pull off.

So, what are the most likely cyber threats we might experience on Election Day?

We have already seen ransomware cripple the IT systems of local governments. It is conceivable that attackers might try to wreak havoc by launching similar attacks on the infrastructure reporting vote tallies, for example. This would inevitably create delays in tallying the votes. Ransomware on the voting systems themselves — which would bring voting at the polls to a standstill — seems unlikely, given that such systems should be disconnected from the Internet. 

Nonetheless, there is reason to be skeptical that we’ll see attackers adopt such a tactic. Why seek a ransom on Election Day? Election boards are underfunded and may not have the means to pay, and in any event the benefit of doing so would be limited since it usually takes days or weeks to recover systems from the crippling effects of a ransomware attack. It is possible that a nation state adversary unmotivated by actually recovering the ransom might masquerade as a cybercriminal, simply to wreak havoc. But again, such disruptions should not affect the resulting vote count.

Finally, it is not outside the realm of possibility that we could see an isolated incident or two of attacks targeting the vote tally itself. Were that to occur, it would almost certainly be isolated, given the decentralized nature of election administration described above. Instead, such an attack’s goal might be to undermine broader confidence in the election, perhaps providing a pretext to politicians claiming the overall election results are fraudulent, as the President has already alleged without evidence. 

What is most likely, instead, is that we will continue to see attempts to interfere with voter intent up to and including on Election Day. Already, Iran and Russia have been alleged to harvest public voter information and send out messages designed to deter voting. As a society, we should recognize such foreign meddling for what it is — an attempt to discredit the democratic process. 

And how do we know about such meddling? The NSA and Cyber Command have taken on the job of countering foreign election interference. Their willingness to call out attempts to interfere have highlighted both the gravity of the threat and the confidence we should have as a nation in facing down the would-be attackers. More broadly, we should have faith in our institutions to carry out a free and fair vote, and recognize that we have robust processes in place to deter and detect voter fraud, initiate recounts and ensure accurate tallies do in fact occur.