ANALYSIS: Why Russia Would Hack Voter Lists and What We Should Do About It

NEWS ANALYSIS— -- [Richard Clarke served as the national coordinator for counterterrorism on the White House National Security Council during Bill Clinton’s and George W. Bush’s administrations and was in the role before, during and after the Sept. 11, 2001, attacks. He is now an ABC News consultant.]

The FBI has reportedly told state officials in Arizona and Illinois that Russian hackers targeted their voter lists, and Homeland Secretary Jeh Johnson has warned officials in all 50 states that there may be attempts to hack election-related networks. What possible reasons would anyone in Russia have for wanting access to U.S. voter lists?

Any reason is likely to be a source of concern, but the least worrying would be if the hackers were just trying to get names and addresses (what is called "personally identifiable information" or PII) to help them hack into bank and credit card accounts. By putting together data from a number of different sources, hackers can sometimes gain enough information to re-set passwords on bank accounts or file bogus tax returns to hijack refunds.

What concerns U.S. officials, however, is the possibility that these hacks have an even more malicious intent: to somehow interfere with the U.S. election. How could that happen?

The simplest way to cause disruption and to cast doubt on the outcome would be to selectively delete names from the voter lists. Voters who find that they have been deleted from the voter list can file provisional or protest ballots in most states, but if there are many people protesting their deletion, it could lead to chaos at the polls, result in long lines and cause some voters to go home without voting. If that chaos occurs only in areas likely to support one candidate, it could help the other candidate win a close election.

More pernicious would be attempts to hack into voter machines and change the results that they report. In some states, there is no paper backup or audit trail, just electronic digits that record how people voted. Even in states with paper backup, those ballots are usually not tallied unless a candidate insists on a recount. If a cyberattack is done well, there may be no evidence of the attack, no trigger to cause anyone to count the paper ballots.

Many states have recently passed laws to protect against voter fraud, even though there is almost no evidence that people using false identity documents or otherwise attempting to vote when they are ineligible is a significant problem. While worrying about a problem that may not exist, many states have done little to modernize or secure their voting records and polling machines against cyberattack.

So-called "white hat" hackers, the good guys, have repeatedly shown how easy it is to hack into election-related networks and devices. Often the software being used by state governments is so old that the manufacturer no longer supports it or patches the security flaws in it. The kind of network protection systems in place in most large companies are almost never present on election-related machines.

Simply by altering voter records, a hacker can cause the validity of an election to be cast into doubt. Citizens may not trust the results of an election where there has been the implication of cyber voter fraud. Such distrust could undermine the basis of democracy. Some in Russia may simply want to be able to discredit American democracy, especially when the U.S. is frequently casting doubt on the validity of Russian President Vladimir Putin’s electoral system.

In the worst case scenario, in a close election for president or the Senate, changing a few votes each in the right swing districts might not be detected and could alter the outcome in favor of someone the Russians might prefer to have in office.

It is unlikely that even the Putin government would run the risk of being caught tampering with an American election, but unlikely things seem to keep happening. Thus, it is time for the federal government to act to protect the validity of our democracy. The Obama Administration could do four things.

First, the State Department could deliver a firm and public diplomatic demarche to Moscow warning them to keep their government agencies and their criminal cartels and individual “citizen hackers” away from our election system.

Second, the intelligence and law enforcement agencies, most notably the National Security Agency, could give monitoring for cyberattacks on election networks its highest priority.

Third, the president could send federal cybersecurity experts now to work with state election officials to do what can be done on a crash basis in the next 60 days to improve the cybersecurity of the election machines and networks.

Fourth, the president could call on cybersecurity companies to volunteer their services to assist the states to secure their election systems. There may even be federal funds that could be quickly re-programmed to pick up some of the tab.

Beyond this 60-day crash to secure our democracy, when this election is over, Congress and the new president need to establish high security standards for the election of federal officials and come up with the money to meet those standards. No Russian hackers or anyone else should be able to undermine the basis of our democracy by cyber election fraud.