UNSECURITY Episode 101: Election Security in 2020

### Overview In Episode 101 of the UNSECURITY podcast, hosts Evan Francen and Brad Nigh analyze the security landscape surrounding the upcoming November 3, 2020, United States presidential election. Moving past media hysteria and political polarization, the hosts examine the operational security of absentee and mail-in voting, the genuine risks posed by foreign disinformation campaigns versus technical ballot manipulation, and the persistent resource constraints confronting local election jurisdictions. The episode concludes with a review of prominent cybersecurity news, including encryption backdoor proposals and compliance shortfalls.

### Key Topics - **Mail-in Ballot Architecture & Validation:** Analysis of absentee voting workflows, focusing on multi-envelope designs, unique barcode tracking, and automated deduplication systems (drawing directly from Minnesota's implementation). - **Disinformation vs. Technical Ballot Tampering:** Why nation-state threat actors predominantly rely on social engineering, public confusion, and social media echo chambers over mass compromise of decentralized voting hardware. - **Local Election Agency Capacity:** Real-world findings from security assessments with Minnesota county election administrators, emphasizing severe budget and staffing constraints despite high security awareness. - **Industry News Roundup:** Discussions covering government calls for encryption backdoors, John McAfee's arrest, global PCI DSS compliance rates, and COVID-19/election-themed phishing lures.

### Technical Details - **Absentee Ballot Verification:** Mail-in workflows utilize a multi-tiered privacy structure requiring an inner privacy envelope and an outer signature envelope stamped with an individualized barcode. Once registered by election officials, the unique barcode prevents subsequent duplicate submissions from being counted. Many jurisdictions also offer tracking portals to verify receipt, processing, and acceptance status. - **Decentralization as a Security Control:** Mass machine hacking across jurisdictions is structurally impeded by extreme technical and logistical fragmentation. Voting machines operate independently across thousands of counties, are segmented onto separate networks, and do not communicate on central public networks during voting. - **Security Resources:** The hosts highlight government-provided election security aids, including CISA's Election Disinformation Toolkit (released October 2020) and CISA's recurring, no-cost automated external vulnerability scanning offered to municipal and county government entities. - **Cybersecurity News Items:** - *Five Eyes Encryption Backdoor Demands:* Security alliance nations (the US, UK, Canada, Australia, New Zealand), along with Japan and India, pressured technology vendors to engineer backdoors into end-to-end encryption—a practice the hosts caution inevitably results in systemic abuse. - *PCI DSS Compliance Deficits:* A report from Verizon indicated that only 25% of global businesses fully comply with the Payment Card Industry Data Security Standard (PCI DSS), compounded by inconsistent auditing and post-breach revocation practices. - *Opportunistic Phishing:* Malicious campaigns weaponized topical news, specifically disguising malware lures within updates regarding Donald Trump's COVID-19 diagnosis.

### Takeaways While direct electronic tampering of election outcomes remains logistically impractical due to decentralized architectures and manual tracking controls, social engineering and disinformation remain the predominant attack vectors against democratic processes. County and municipal election offices possess dedicated staff and high risk awareness, but critically require continuous funding, tooling, and low-barrier federal assistance (such as CISA vulnerability assessments) to bridge operational resource gaps. Finally, security professionals must avoid relying on compliance checklists alone and resist architectural backdoors that inherently undermine cryptographic security.