The federal government already has stringent cybersecurity standards for systems of national interest. IMO voting machines/tabulators would apply as a system of national interest. We should apply the standards. The case could easily be made that it would prevent foreign hacking/meddling in our elections.
air-gapped standalone systems
No wifi/bluetooth hardware/software capability
robust non-alterable logging & auditing
mandatory scans & security updates
software/hardware certification
records retention standards
access controls
cybersecurity training and accountability
etc....
Its all industry standard stuff. Just need someone to say that voting systems are essential to the security of the country (which they obviously are) and mandate that it happens.
Interesting things that I would add are:
- election software should be fully open source and freely available for review
-Paper summary of electronic vote displayed to voter and saved in machine. Just like a cash register (my county already has this)
- If no ID, ballot is provisional (pending verification) with signed identity affidavit, thumbprint & pic of voter attached.
- All ballots should have watermark & unique serial number which matches voter roll. Duplicate votes become provisional pending investigation
- Voting machine output only by screen & uniquely serialized cdrom which must have a chain of custody. Encrypted based on specific machine. Lightscribe label the serial numbers, precinct, totals, timestamp, encrypted machineID on disk.
- Historically problemmatic tabulation sites should have internet firewalls closed to all but essential election ports. All router traffic retained and fully audited. There should be Wifi/cellular jammers in place as well.
Non-tamperable live feed cameras mandatory at tabulation sites.
And State Police with arrest authority also funded to evacuate & secure tabulation sites upon closure. Using FEC grant funding. Lol!
Speaking of which.... where has the FEC been throughout this whole mess???
Just silly ponderings.....
I agree with your statements. I conduct both control audits and penetration testing for banks and financial institutions. I have long wondered why these are not being applied to elections and equipment providers. I guess that it has not had the prioritization that it needs.