The voting machines that local officials swore were not connected to the internet have been connected to the internet for years

Election Systems & Software (ES&S) is America's leading voting machine vendor; they tell election officials (who are county-level officials who often have zero cybersecurity advice or expertise) not to connect their systems to the internet, except briefly to transmit unofficial tallies on election night.

This is a stupid idea to begin with. These systems shouldn't have modems, and they shouldn't ever be connected to the internet, at all.

But as it turns out, lots of election officials, including many in heavily contested districts that have determined the outcomes of national elections (cough Florida cough) just leave their machines connected to the internet all the time, while denying that this is the case, possibly because they don't know any better.

A team of ten leading security experts, including some affiliated with NIST's election cybersecurity efforts, have used internet-wide scanning to locate dozens of these systems, live on the internet, and because it's the internet, they're not even sure who all of them belong to, and can't alert the relevant officials. Many of these systems have been online for months; some have likely been online for years.

ES&S has downplayed the risk, using incredibly misleading definitions of "not connected to the internet" (for example, insisting that "behind a firewall" is the same thing as "airgapped"). The company's account of its security best practices, training and maintenance are belied by their own public documents as well as authenticated whistleblower's accounts.

In one case -- Rhode Island -- it appears that every vote cast in the state is tallied on a single system that is often available on the internet. Read the rest