While initially declining to speak on the record, the professor has gone public with his theory in a post on Medium, demonstrating how he successfully hacked voting machines in a laboratory.
Here's the gist:
First, the attackers would probe election offices well in advance in order to find ways to break into their computers. Closer to the election, when it was clear from polling data which states would have close electoral margins, the attackers might spread malware into voting machines in some of these states, rigging the machines to shift a few percent of the vote to favor their desired candidate. This malware would likely be designed to remain inactive during pre-election tests, do its dirty business during the election, then erase itself when the polls close. A skilled attacker’s work might leave no visible signs — though the country might be surprised when results in several close states were off from pre-election polls.But how could the voting machines be hacked if they don't connect to the Internet? Doesn't matter, Halderman says:
Shortly before each election, poll workers copy the ballot design from a regular desktop computer in a government office, and use removable media (like the memory card from a digital camera) to load the ballot onto each machine. That initial computer is almost certainly not well secured, and if an attacker infects it, vote-stealing malware can hitch a ride to every voting machine in the area.Sound like science fiction? Halderman points out a number of proven cyberattacks this year aimed at the Democratic Party apparently meant to interfere with the election, including the hacking of the DNC's emails. The White House has publicly asserted that it believes the Russian government commissioned those attacks.
While Halderman acknowledges that Clinton's surprise loss in states like Michigan, Wisconsin, and Pennsylvania could have been due to flawed pre-election polls, he is still calling on Clinton to request an investigation.
"I believe the most likely explanation is that the polls were systematically wrong, rather than that the election was hacked," he says. "But I don’t believe that either one of these seemingly unlikely explanations is overwhelmingly more likely than the other. The only way to know whether a cyberattack changed the result is to closely examine the available physical evidence — paper ballots and voting equipment in critical states like Wisconsin, Michigan, and Pennsylvania."
The computer scientist's proposed solution for a safer, more secure voting technology may come as a surprise:
"I know I may sound like a Luddite for saying so, but most election security experts are with me on this: paper ballots are the best available technology for casting votes," he says.
