Thread by @jennycohn1

"To underline the lack of security at the ballot-programming level, ... Halderman displayed a screenshot of the “Who We Are” section of the webpage for Governmental Business Systems (GBS), an Illinois-based company that programs ballots 4 ... Michigan." 1/archive.thinkprogress.org/how-easy-would…

2/ "(They noted that GBS’s website didn’t even have basic Transport Layer Security encryption enabled.) This website offered names of all of GBS’s employees, along with their email addresses. From this, they pointed to the administrative assistant as a possible target."

3/ "But with the email addresses for every person in the company on display, it would be easy enough to find one person likely to be convinced enough by a professional-looking email purporting to come from Gmail, Facebook, LinkedIn, or Twitter to click on a link or attachment."

4/ "From there, a sophisticated hacker could introduce malware into the central programming of the ballots. Each vote would run through malware, ensuring a preferred candidate always wins."

5/ Thanks to #RealityWinner (and NOT the FBI & DHS, which want to conceal everything from the public), we already know that Russia sent spear phishing emails to VR Systems, a supplier of electronic poll books.

6/ "In September 2017, The New York Times reported that current and former intelligence officials said at least two other providers of elections services, in addition to VR Systems, had been breached by hackers in 2016.” fivethirtyeight.com/features/what-…

7/ How much do you want to bet one or both of those other two vendors are involved in programming the ballot files for voting machines? I'd say the odds are pretty good. But to be clear, I am speculating. It is unclear that our own govt is keeping what happened classified.

8/ "One potential stand-in for the EAC is the [DHS], which offers an array of cybersecurity information, tools, and services. Last summer, when news broke that Arizona and Illinois voter-registration data had been breached by Russian hackers, ...

9/ ... the DHS underlined the array of services (such as vulnerability scanning) it offered at no cost to states."

10/ “At first there was a trickle of interest, maybe three states. Then it was eleven, then twenty, then by election day almost all the states had interacted with the DHS in some way or other,” Smith said. ("One way or another?" That isn't all that reassuring frankly.)

11/ Plus vote tallying is usually done at the local level, not the state level. The National Committee for State Legislatures says there are 10k local election jurisdictions in the US...