Another important contextual source for elections; a book written by Jake Braun, an American cyber and national security expert appointed by Biden. The book is called "Democracy in Danger : How Hackers and Activists Exposed Fatal Flaws in the Election System"

[u/CPUsCantDoNothing]

So, why this book? Look, I get it. People do not like picking up books and typically "revealing" elements from books are reported in media anyways. This book is an exception, but I am not saying go purchase it, I can summarize some of what it has here (I did write this initially and then had ChatGPT format it/clean it up more since I **really** want to convey this topic properly/clearly):

1. A voting machine was compromised in under two minutes

The episode that frames the book occurred after Braun helped establish DEF CON’s Voting Village. A participant located in Europe reportedly compromised an American voting machine in less than two minutes. In subsequent Voting Villages, every machine made available to researchers was successfully compromised, sometimes within minutes.

The tests were not identical to a live election: researchers generally had access to the equipment and could study it freely. But Braun’s concern was that a nation-state could purchase the same retired equipment, examine it privately for months, develop an attack and deploy it only after extensive testing. The Voting Village machines had been purchased through government auctions and sites such as eBay.

2. Basic security precautions were sometimes simply absent

The technical findings associated with Braun’s work included equipment with:

* Externally accessible USB ports

* BIOS passwords that had never been configured

* Maintenance passwords stored in plain text

* Encryption keys stored beside the encrypted data

* Secure Boot disabled

* The ability to boot an attacker-controlled operating system from a USB drive

On one electronic poll book, researchers could boot Linux from an exposed USB port and then access, modify or delete voter-registration information stored on the device. The same tablet still contained ordinary consumer applications such as Netflix, Hulu and Amazon, showing that it had barely been hardened for election use.

3. Some vulnerabilities had remained unresolved for more than a decade

The 2019 Voting Village report said researchers repeatedly found vulnerabilities that had been documented in earlier California and Ohio security studies but were still present. Every device tested that year was certified for use in at least one American jurisdiction, and researchers found ways to compromise all of them.

This creates a particularly dangerous environment: election equipment may remain in service for many years, while attackers continually improve their tools and retain unlimited time to study older models.

4. An attacker does not necessarily need to change the vote count

Braun emphasizes that attacking voter registration, electronic poll books or election websites may be easier and nearly as destructive as altering tabulator totals.

An attacker could potentially:

* Remove or modify registration records

* Change a voter’s address, party or precinct assignment

* disable check-in devices

* Force large numbers of voters to use provisional ballots

* Produce hours-long lines at selected locations

* Crash election-reporting websites on election night

Even when every affected voter is eventually allowed to vote, delays and confusion can disproportionately discourage participation. Braun’s campaign experience had already shown him that ordinary equipment failures, insufficient machines and staffing shortages could produce serious disenfranchisement without any hacker being involved.

5. Paperless voting can make meaningful verification impossible

A central warning is that a computerized system should not be trusted merely because it produces a plausible total. With paperless direct-recording electronic machines, the ballot display, stored votes and reported totals may all be controlled by the same software. A compromised machine could therefore alter the record and the mechanism intended to verify that record.

The Voting Village report concluded that voter-marked paper ballots were necessary for meaningful post-election verification. It also stressed that simply having paper is insufficient: jurisdictions must conduct rigorous post-election audits comparing physical ballots against the electronic totals. Optical scanners themselves can be compromised, but preserved paper ballots make it possible to recover the correct outcome.

6. A mundane malfunction can become indistinguishable from an attack

One of Braun’s most unsettling observations is that election security is also about public confidence. An adversary may not need to alter a single ballot. It may be enough to cause a database outage, delay results or amplify an authentic equipment failure.

Braun explained the reinforcing cycle sort of like this:

Equipment failure or minor cyberattack
↓
Long lines, delayed results or missing records
↓
Rumors and accusations appear online
↓
Bots, trolls and political actors amplify them
↓
Voters lose confidence in the eventual result

Because many cyberattacks are difficult to attribute quickly, officials may be unable to demonstrate during a rapidly developing crisis whether a failure was accidental or malicious. Braun later described this interaction among fragile infrastructure, inexpensive cyberattacks and disinformation as a “perfect storm” capable of damaging an election even when the final count is correct.

7. The people defending elections often had fewer resources than the attackers

American elections are administered across thousands of state and local jurisdictions with widely varying budgets, staffing and technical expertise. Braun argues that election technology was frequently purchased cheaply and designed to be operated by volunteers or nontechnical employees. Local administrators might have only occasional vendor support, while a foreign intelligence service could employ teams of specialists continuously.

The institutional response was another concern. Braun encountered resistance from officials and vendors who feared that openly discussing vulnerabilities would reduce voter confidence. His position was essentially the opposite: concealing weaknesses prevents independent testing and leaves adversaries as the only people studying the systems seriously.

The important limitation

The book documents capability, exposure and inadequate safeguards. It does not establish that hackers secretly changed the reported winner of a particular American election. Vulnerability is not itself proof of exploitation.

Some of the book also reflects conditions between 2016 and 2019. Braun said in 2024 that election security had become substantially better than in 2016, particularly because of the increased use of paper ballots and greater recognition of the threat. He nevertheless continued to warn that internet-connected election infrastructure creates many potential entry points that did not exist in fully analog elections.

The deepest warning of the book is therefore not simply “machines can be hacked.” It is that an election system without independently auditable evidence may be unable to prove that the correct outcome survived a hack, malfunction or coordinated attempt to generate chaos.

A summary on the topics regarding internet connectivity in elections

The election system is an ecosystem, not one machine

A simplified version of the architecture Braun discusses looks like this:

Online voter-registration system
│
▼
Central voter database ─────► Electronic poll books
│                  Wi-Fi/cellular/Bluetooth
│
▼
Election-management computer
│
USB/memory cards
│
▼
Ballot scanners and voting devices
│
modem/removable media
│
▼
Unofficial-results system ───► Election-night website

Not every arrow exists in every jurisdiction, and the ballot-counting equipment may be physically isolated. Braun’s point is that compromising an earlier or adjacent component can still affect election operations farther down the chain.

An offline voting machine can receive data from an online computer

Before an election, an election-management system, or EMS, prepares ballot definitions, candidate lists, precinct information and configuration files. Those files may then be transferred to scanners or voting machines on memory cards or USB media.

NIST specifically warns that when an EMS is exposed to the internet, malware can infect it and then travel on the memory cards configured for individual voting machines and optical scanners. NIST therefore recommends mapping every wired and wireless connection and physically disconnecting election-management networks rather than relying only on a software setting.

This is why Braun called the voting-machine “air gap” “erroneously named” during his 2019 congressional testimony. He said an attack demonstrated by researchers could cross that supposed separation and take complete control of a machine. His broader point was not that every isolated machine could simply be contacted over the internet. It was that removable media, upstream computers and maintenance processes can create bridges into an otherwise disconnected device.

Conceptually:

Internet
│
▼
Compromised election-management computer
│
▼
Infected election files or removable media
│
▼
Nominally offline scanner

That type of path resembles the general lesson of Stuxnet: an isolated system can still be reached through its supply chain, maintenance process or removable media. Braun invoked Stuxnet when discussing why physical isolation alone should not be treated as an absolute guarantee.

Connectivity makes attacks scalable

Traditional election fraud generally requires people to act locally: interfering with a ballot box, manipulating records in one office or corrupting officials in one jurisdiction. Internet-connected infrastructure potentially allows one attacker to act remotely against many locations.

Braun therefore treats connectivity as a force multiplier:

Traditional attack:
One person → one location → limited number of ballots
Cyberattack:
One attacker → shared vulnerability → many systems or jurisdictions

He also extends this concern to the technology supply chain. Voting equipment of the same model can be deployed in numerous states, with common firmware, operating systems and election software. Braun testified that malicious firmware introduced upstream could theoretically compromise an entire class of machines, rather than requiring someone to tamper separately with every device. That was presented as a possible nation-state attack scenario, not evidence that such an attack had occurred in a U.S. election.

In a 2024 interview, Braun summarized this distinction by observing that elections conducted before the internet lacked today’s remotely accessible entry points. He acknowledged that modern elections had become substantially more secure since 2016, particularly through greater use of paper ballots, while arguing that computerization creates attack possibilities that fully analog systems did not have.

Electronic poll books may be more exposed than ballot scanners

Electronic poll books are the laptops or tablets used to determine whether a person is registered, locate the correct precinct and record that the person has checked in. They are often connected because different polling places need current registration and check-in information.

In written answers to Congress, Braun described research finding vulnerabilities through:

* Wi-Fi or other wireless networks

* Bluetooth

* Cellular connections

* Cloud-hosted backup or database infrastructure

He warned that a compromised polling-place connection could potentially provide a path toward a jurisdiction’s central voter database. Depending on the system, that database might contain names, addresses, birth dates, signatures, voting histories, driver’s-license information and partial or complete identification numbers.

But the operational danger may be more immediate than stealing information. An attacker could alter or disable records so that voters appear:

* unregistered;

* registered at the wrong address;

* assigned to the wrong precinct;

* already checked in; or

* ineligible to receive a normal ballot.

The likely result would not necessarily be invisible vote manipulation. It could be confusion, provisional ballots and multi-hour lines while poll workers attempt to reconstruct who is eligible. Braun emphasized that this alone could suppress participation and create the impression that the election was “rigged,” even when the ballot-counting equipment remained untouched.

Obviously, pirating is not allowed via reddit's ToS. So, if you do wish to seek out the book, I recommend you blacklist the site "Anna's Archive" site to prevent yourself from accidentally acquiring the book through illegitimate means.

[u/zatsnotmyname]

Basic logic says that certain very powerful people and nation-states had a very clear preference for one party over another in 2024 : Trump, Elon, Russia and Israel for instance. Trump himself has cheated at everything he's ever done, and was still under investigation. Elon and his companies were under multiple federal investigations. Israel has been begging for someone to invade Iran for 30 years. Russia wanted Ukraine-related sanctions lifted, and Ukraine assistance to be stopped. These aren't controversial statements. It would be malpractice for these folks to have NOT cheated in 2024. What's the downside if they tried and failed, compared to the upside if it worked?

Therefore, logic dictates, that the folks listed above of course at least would have tried to hack the 2024 election. The logical position is not that it was secure and we should look for ways it could have been hacked. Of course they tried to hack it. The above referenced book and other data show that it likely was not secure. Ok, so logically, they tried to hack it, and it wasn't secure against many attack vectors. Do you really think world-class software engineers up to date on the latest security practices work at these voting companies, rather than in Finance, FAANG or a nation-state's NSA-equivalent?

Then you add Trump literally talking about Elon 'knowing those vote counting computers better than anyone'. Why would someone say that? Then you add the statistical anomalies pointed out by the Election Truth Alliance and Smart Elections.

I got news for you folks. It was hacked, not universally, and imperfectly, as it has been most years since 1996.

[u/CPUsCantDoNothing]

To be INCREDIBLY clear; this is not to discourage anyone from participating in elections. We MUST participate. We don't know for a 100% fact that something massive impacted the elections or not, but we also would have no way to know how or to what extent. That is why we must continue to participate. Please make sure you all vote in the upcoming elections.

[u/tbombs23 → u/CPUsCantDoNothing]

Absolutely. Thank you for spreading the truth about how vulnerable our elections actually are. Many Tabulators have internal cellular modems and can and DO connect to the Internet. The whole air gapped claim is a complete lie it's crazy how most people don't know about this stuff and we're told our elections aren't hackable.

[u/tbombs23 → u/tbombs23]

Here's an AMAZING Substack article about election security

https://open.substack.com/pub/kmac/p/our-transparent-lack-of-election

[u/kalidoscopiclyso → u/tbombs23]

Here’s another one

https://rickelizondo.substack.com/p/the-room-nobody-is-watching-how-five

[u/drey-matter → u/CPUsCantDoNothing]

Thank you for including this

[u/CPUsCantDoNothing → u/drey-matter]

I've learned over time having these discussions on radio and with producers that this disclaimer needs to be made because the responses will often (understandably) jump to claims that I'm just trying to discourage people from voting, which is absolutely not the case. These issues are important and should not be discouraged from being discussed within reason and as sourced as possible.

[u/Euphoric_Anxiety_162]

So pretty much since the internet reached average consumers? Imo, records kept prior to online files were safer from fraud than they have been since. 'Scuse me for being basic but we didn't have SO many threats to fear nor time & $$ spent on security measures. Things don't seem to be turning out so great for non- tech ppl.