While the U.S. presidential election is getting a lot of attention, the truth is it’s just one of many consequential elections around the world this year. All told, more than 4 billion people across 76 different countries will head to the polls in 2024 — a new global record.  

With so much at stake, ensuring these elections are free, fair, and secure is critical. However, election infrastructure around the world is becoming increasingly digitized—and while this offers certain advantages, it also carries new risks. While it’s unlikely that an attacker could meaningfully affect the outcome of an election, simply disrupting or derailing voting systems can cause voters to lose faith in the electoral process, which can throw results into doubt and delegitimize democratic institutions.  

Avoiding this outcome starts with understanding what makes election infrastructure vulnerable, how attackers can exploit those vulnerabilities, and what steps officials can put in place to keep them as secure as possible.  

The Strength of America’s Election Security 

Contrary to popular opinion, elections in the U.S. are not particularly modernized — at least, not compared to other countries around the world. U.S. elections generally use electronic voting machines, but many of these machines keep a paper record that serves as an effective backup. Absentee ballots and mail-in ballots are also physical documents — there is no way to vote by phone or over the internet. In some ways, America’s analog election infrastructure is a good thing: it makes it harder to hack. Security concerns have led to increased reliance on paper backups, meaning there is a hard copy of almost every ballot to cross-reference. This dramatically reduces the potential for fraud. 

Another fact that makes America’s election infrastructure difficult to manipulate is that elections are not run by the federal government. Instead, each state and territory is responsible for its election process. While that can lead to some frustrating differences (Why does it take some states so long to tally votes? Why do only some states have same-day registration?), it has the side effect of strengthening election security. Because each state’s election infrastructure is siloed, compromising one state’s election systems would have no bearing on any other state.  

This means that affecting the outcome of a national election is borderline impossible. Even if a threat actor was able to compromise one state’s electoral system to the point that they could alter the outcome, they would have to accomplish the same thing across multiple other states, each with their own unique security architectures. Given that there is no evidence that attackers have ever compromised a state’s election security to any meaningful degree, this scenario is highly unlikely. Does that mean it’s impossible? No. But that’s why it’s essential to establish clear and effective security protocols and avoid complacency. 

The Real Threat to Elections — and How to Address It 

While overturning an election is difficult (bordering on impossible), causing disruption is easy. This is true of any kind of cyberattack. This year’s Verizon Data Breach Investigations Report notes that denial-of-service attacks made up a whopping 55% of incidents they analyzed…but those incidents rarely led to a breach. The reason is those attackers aren’t trying to steal data or break into networks. They’re just trying to cause disruption. Likewise, disrupting voting systems in just a few key counties could undermine voters’ faith in the integrity of the election — and if the past several years have taught us anything, that can have long-lasting effects.  

With that in mind, election officials must be proactive when putting appropriate safeguards in place. From a technical perspective, that means being as transparent as possible. For example, choose voting machine manufacturers that use open-source software that can be publicly verified as safe and secure. Switzerland famously made its code open source and wound up delaying the implementation of its digital voting system after security experts found critical vulnerabilities — so there is evidence that openness leads to finding issues before they materialize.  

It’s also important to obtain a Software Bill of Materials for any devices in use. If a vulnerability is discovered in one software platform, it is critical to be able to identify every device using that software. The best part is that this doesn’t really cost anything—it just means municipalities need to be more careful when choosing which partners they work with. That said, it’s possible this could require replacing voting machines and other devices—but optics matter more than usual here. If an attacker’s goal is to damage trust in the voting system, it’s probably a bad idea to talk about “replacing poorly secured voting machines.” Instead, keep the focus on prevention, framing budgetary requests around upgrading election infrastructure and security.  

Speaking of optics, elections officials should not underestimate the value of physical security. Making sure there is visible physical security around voting machines, ballot boxes, and other critical areas can go a long way toward making voters feel more secure. Election administrators also need to ensure that there are observers in place — and that they are thoroughly vetted. Background checks are relatively inexpensive, and the cost of additional police or security resources for one day is something most municipalities can afford. The more transparent the process, the fewer opportunities there are for threat actors to undermine or otherwise cast aspersions on election integrity. By minimizing opportunities for disruption, election officials can put themselves in the best possible position to succeed.  

Limiting the Potential Impact of an Attack 

Ultimately, protecting election infrastructure isn’t wildly different from the way modern organizations protect their systems and networks: you can’t prevent every incident, but you can significantly limit their impact. The presence of physical documentation and the fact that elections are overseen by individual states already help soften the potential impact of a compromise, but taking simple precautions can reduce that risk even further. By understanding attackers’ true goals, prioritizing transparency, and winning the optics battle, election officials can help keep the process secure and avoid losing the faith of the electorate.