Investigation Finds Major Flaws in Rhode Island’s Election Technology, RI Officials Caught Unaware

Investigation Finds Major Flaws in Rhode Island’s Election Technology, RI Officials Caught Unaware

A major investigation by Vice’s Motherboard has found major gaps in Rhode Island’s election technology security.

Rhode Island officials seem confused about the state of the technology and its vulnerability.

“For years, U.S. election officials and voting machine vendors have insisted that critical election systems are never connected to the internet and therefore can’t be hacked,” according to the investigation.

GET THE LATEST BREAKING NEWS HERE -- SIGN UP FOR GOLOCAL FREE DAILY EBLAST

The Vice investigation found that Rhode Island’s election system is one of the most vulnerable in the United States. 

“But a group of election security experts have found what they believe to be nearly three dozen backend election systems in 10 states connected to the internet over the last year," wrote Vice.

Last week, Secretary of State Nellie Gorbea told GoLocal’s News Editor Kate Nagle on GoLocal LIVE that the state’s system was secure.

“We did invest and we bought machines that are based on a paper ballot which are the gold standard across the country -- even the Senate Intelligence Committee report just recently released says that that should be the case and so we have paper ballots, we have state-of-the-art voting systems and I think that we're well-positioned to handle the demand next election cycle,” said Gorbea.

Rhode Island uses Election Systems & Software (ES&S).

But Gorbea seems unaware of the basic functionality of the RI system. According to Vice, “Although only one system was found online in Rhode Island, this one was particularly problematic, the researchers note. Rhode Island, unlike other states, conducts its elections from a centralized office at the state Board of Elections, instead of farming out election administration to each county or jurisdiction. The election reporting system the researchers found online, therefore, was the reporting system for the entire state.”

In a New York Times story of February of 2018, Rhode Island officials admitted to the Times that RI did connect to the Internet.

“ES&S advises election officials to configure the external firewall that protects the DMZ to only accept connections from IP addresses assigned to the voting machines. And election officials in Rhode Island, which uses ES&S’s DS200 machines with modems, told me that the modems only transmit for about a minute, which wouldn’t be sufficient to hack into voting machines or results servers.”

Lack of Security Sparks Outrage

One of the leading critics of Rhode Island’s Board of Election jumped on the issue.

“A huge black eye for RI Secretary of State Gorbea and the RI Board of Elections. After assuring everyone that Rhode Island's new elections gear was not connected to the internet, independent researchers prove that in fact RI's systems ARE on the internet, and therefore exposed to being hacked. Elections are now high tech endeavors, but our elections officials are technological dinosaurs,” said Ken Block, former candidate for Governor.

“This is a recipe for disaster. Even worse is that the vendor of this system states that the system is "air-gapped", which means it is not connected to the internet in any way - but quite clearly, the system does not get connected to the internet. An air-gapped system is never connected to the internet, nor is it ever connected to a network that IS connected to the internet,” said Block.

Gorbea’s office was scrambling on Thursday after the release of the investigation.

“[Gorbea] also noted in her statements that cyber threats are constantly evolving. Given the new revelations in the Vice article, the Secretary has urged the Board of Elections, which maintains the voting equipment and oversees Election Day operations, to thoroughly review the security of modem transmissions for unofficial Election Day results. It is not enough to rely on ES&S’ statements regarding the cybersecurity of its equipment,” said Gorbea’s spokesman Nick Domings in an email to GoLocal.

Block continued his assault on Gorbea, “This is technological ineptness at the highest level - and our elections officials were not up to the task of discovering this - let alone, apparently, understanding it. The [Vice] story...is a long one, but worth the read. I have zero confidence that RI election officials are up to the task of securing our elections. Their priorities mystify me - and I fully expect that somehow I will be accused of voter suppression because I want our elections infrastructure secured. We have plenty of competent technologists in RI - our incompetent elections officials should be hiring them to ensure that our elections cannot be hacked.”

In addition to Block, former GOP candidate for Secretary of State Pat Cortellessa told GoLocal in a statement, “The Rhode Island Republican Party should demand a paper ballot recount regarding the 2018 Rhode Island election. Due to the fact that our election system was probably hacked by unscrupulous individuals.”