he first Americans to line up to vote on Nov. 6, 2018, will be the East Coast’s earliest risers. As early as 5 a.m. EST, rubbing the sleep from their eyes and clutching travel thermoses of coffee, they will start the procession of perhaps 90 million Americans to vote that day. The last to cast ballots will be Hawaiians, who will do so until 11 p.m. East Coast time. When all is said and done, the federal election will unfold something like an 18-hour-long ballet of democracy: 50 states, dozens of different kinds of voting machines and an expectation that everything should be counted up in time for TV networks to broadcast the results before Americans head to bed. Election Day 2018 is expected to unfold no differently than it has in years past.
Except it might.
While Americans are well-acquainted with Russian online trolls’ 2016 disinformation campaign, there’s a more insidious threat of Russian interference in the coming midterms. The Russians could hack our very election infrastructure, disenfranchising Americans and even altering the vote outcome in key states or districts. Election security experts have warned of it, but state election officials have largely played it down for fear of spooking the public. We still might not know the extent to which state election infrastructure was compromised in 2016, nor how compromised it will be in 2018.
Most of us can’t really picture what it would look like to tamper with an election, but security experts can. Even as you read this, voting systems, so dry and complicated and completely taken for granted, could well be in the midst of fending off attacks from foreign adversaries. Things could get bad — really bad. Bad like this:
The following is a rendering of what a worst-case Election Day scenario could look like, based on FiveThirtyEight’s interviews with voting and cybersecurity experts and state election officials, along with news reports and documents in the public record.
DATE Nov. 6, 2018 TIME 6 a.m. EST LOCATION Moscow
It’s midafternoon in Moscow when voting starts. Igor Valentinovich Korobov, head of Russia’s military intelligence directorate, GRU, is settling in for a long day. From GRU headquarters — a steely gray, sleekly foreboding building — he’s monitoring his hacking units. Western cybersecurity firms call them “advanced persistent threat” (APT) groups, a nod to their sustained, targeted efforts in wreaking mayhem. You may have heard the name of one of them: Fancy Bear. Ever since the summer, when President Vladimir Putin handed down the general directive to pursue further cyberattacks on the U.S. elections, Korobov and his team have been in brisk competition with the spooks over at the FSB — Cozy Bear, etc. — to see who can sow the most mischief.
Ivan and Alexei are two hackers with Korobov’s APT groups, or “science squadrons,” which the Russian military started building out in recent years. Ivan, moon-faced with a mop of blonde hair, was a talented computer programmer in university and came to the unit after a professor suggested he talk to the government about a job. Alexei was recruited as well, but from one of the big crime syndicates. A lanky quiet guy, he spends his breaks outside, smoking. The only time Ivan has heard Alexei talk much was at a bar, a few drinks deep, when he went on about the part he played in the big Target hack a few years back. Alexei was friendlier when he was drunk, giving Ivan advice like, “Don’t go on vacation with your girl to any country with a U.S. extradition treaty.” A couple of buddies learned that lesson the hard way. And Prague just isn’t worth the trouble.
At 8 a.m. EST on the big day, Ivan is locked into his chair, ready to watch his work from the past few months unfold: If all goes according to plan, he’s about to wreak havoc on a few hundred polling places around the country. Most U.S. states have online voter registration systems, and they’re decently vulnerable — the science squadrons broke into the Illinois system back in 2016. Since then, the American government has gotten more alarmed about security. In January 2017, one of the last acts of Jeh Johnson, President Obama’s head of the Department of Homeland Security, was to designate election infrastructure as “critical,” making way for swifter cyber help from DHS for states in need.
But in February 2018, Adm. Mike Rogers, the head of the National Security Agency and Cyber Command, told the Senate Armed Services Committee that he had not been instructed by President Trump or Defense Secretary James Mattis to go after Russian hackers at their point of origin. “Everything, both as the director of the NSA and what I see on the Cyber Command side, leads me to believe that if we don’t change the dynamic here, this is going to continue, and 2016 won’t be viewed as something isolated,” Rogers said.
A few months ago, once Ivan got inside a few of the state systems, he was able to change information on certain voter files, so when the American voters show up in person today, their information won’t match their IDs. He mostly focused on screwing with the records of places with a lot of Democratic voters, places dominated by black and Latino people. (He Googled a lot about Florida while hacking its system and decided that if he ever visits the U.S., he’ll definitely be hitting Miami first.) Putin isn’t keen on Democrats taking back control of Congress. In fact, the whole military intelligence crew has focused on certain races where they think they can swing the balance toward Republican candidates. Back in 2016, the hacking groups probed 21 states’ election systems, poking around with phishing scams directed at local officials and attacks like the successful breach in Illinois. The 2016 work had given the team the grist it needed for its 2018 work.
Ivan is eyeing Ohio, North Dakota, Arizona and Florida, where Senate elections are predicted to be relatively close — plus they’ve all been targeted already by the science squadrons. Then there are the 24 House seats deemed toss-ups, 17 in states whose election systems have already been targeted. One Republican who’s in a California toss-up race was even seen as a potential recruit at one point in time. The intelligence guys down the hall are getting better at following American politics chatter on Twitter, keeping tabs on the candidate ups and downs. (They think the new 280-character capacity makes for duller scrolling.) Ivan just takes their directives about where to target, plugging and chugging, dreaming of a post-November trip to somewhere warm and extradition treaty-free.
DATE Nov. 6, 2018 TIME 10 a.m. EST LOCATION Broward County, Florida
Eight time zones away, Brooke Mitchell is sipping a midmorning skinny vanilla latte, her winter drink — though it’s Florida, so the whole Nov. 1 switch from iced macchiatos is purely symbolic. It’s been her first quiet moment of the day; Broward County election workers are used to Election Day mania ever since the 2000 nightmare. And then there was all that Russian nonsense in 2016.