Republican questioning of the outcome of the 2020 presidential race has led to voting system breaches that election security experts say increase the threat to future elections.
Copies of the Dominion Voting Systems software used to manage elections were distributed at a South Dakota event this month organized by Trump ally Mike Lindell, CEO of MyPillow, says The Associated Press.
“It’s a game-changer in that the environment we have talked about existing now is a reality,” says Matt Masterson, a former top election security official in the Trump administration. “We told election officials, essentially, that you should assume this information is already out there. Now we know it is, and we don’t know what they are going to do with it.”
The software copies came from voting equipment in Mesa County, Colo., and Antrim County, Mich., where Trump allies unsuccessfully challenged last fall's results.
The Dominion software is used in about 30 states.
U.S. election technology is dominated by three vendors with 90 percent of the market, so election officials can't easily swap out their existing technology. Release of the software copies essentially provides a blueprint for people trying to interfere with the way elections are run. They could sabotage the system, change ballot design or even try to change results, says election technology expert Kevin Skoglund.
The release gives hackers a “practice environment” to probe for vulnerabilities they could exploit and a road map to avoid defenses, says election security pioneer Harri Hursti. “The door is now wide open,” he says.
All hackers would need is physical access to the systems because they're not supposed to be connected to the internet, says AP.
Security researcher Jack Cable says he assumes U.S. adversaries already had access to the software. He says he's more concerned about the release increasing distrust among the growing number of people not inclined to believe in the security of U.S elections.
“It is a concern that people, in the pursuit of trying to show the system is insecure, are actually making it more insecure,” says Cable, who recently joined a cybersecurity firm run by former U.S. Cybersecurity and Infrastructure Security Agency Director Christopher Krebs and former Facebook security chief Alex Stamos.