STEVE INSKEEP, HOST:
How much damage could Russia have done when it tried to hack U.S. voting systems? A document leaked to The Intercept details just how Russia tried. Russia, according to this National Security Agency document, likely broke into the computers of a voting systems company and then tried to obtain the passwords of local election officials. It's not clear exactly how far they got.
We've brought in NPR's Pam Fessler who covers voting security issues, has done so for years. Hi, Pam.
PAM FESSLER, BYLINE: Hi, Steve.
INSKEEP: So how big of a deal is this document?
FESSLER: Well, it could be a huge deal. We already know that the Russians tried to hack into the election or influence the election by hacking into Democratic emails and releasing some of them and also that they might have been behind attempts to gain access to voter registration systems in a number of states. But this really takes a big step further.
According to this report posted on The Intercept, Russian intelligence tried last August to gain access to the log-in information from workers at a company that provides voter registration systems to about eight states. The report says it was likely that at least one employee account was compromised and that then the Russians used that information that it collected from the operation to target more than 122 local election officials.
And they did this by apparently trying to trick those officials into thinking they were getting emails from the vendor so that they would click on an attachment or a link and that this would have allowed the Russians to introduce malware into the election systems. But the NSA report says it's unknown whether or not those phishing attacks succeeded.
INSKEEP: OK, so they crack into the company, a legitimate company. Then they pose as the company to election officials to try to crack into the systems of the election officials. We don't know how far they got. But is it known what the Russians were trying to do?
FESSLER: Well, they're probably - it looks like they were trying to, if, you know, this is all accurate, they were trying to do something that election security officials experts have been warning for a long time - that voting machines themselves - the actual voting machines that you cast your ballot on - are not connected to the Internet. But there are a lot of other aspects of elections that are in fact at some point connected to the Internet.
INSKEEP: Like voter registration, apparently.
FESSLER: Like voter registration systems, also something called the election management systems that election offices use to program, you know, those little cards that they sometimes insert into each voting machine that, you know, says what the ballot is and tabulates the votes...
INSKEEP: That might be connected to the Internet at some point?
FESSLER: Well, that is - that central system might be. And that - if that is infected, it could potentially affect the machines and give somebody from the outside the ability to manipulate the vote.
INSKEEP: Yeah, I guess we should stress this is not 100 percent new. We'd heard from the U.S. government stating publicly that Russia tried to go after election officials in some way. But I guess this is more detail than we had before, right?
FESSLER: Right, and it really shows the intent - that the intention is out there to try and get into the voting systems. I mean it's something a lot of people, as I say, have been worried about for a long time. But this is sort of evidence that there is a willingness out there to do something.
INSKEEP: OK, so U.S. government officials have said that Russia's aim or one of Russia's aims has been to diminish the credibility of the election system, to diminish confidence in democracy. Well, here we are. And there's probably a reason for some people to at least be worried. What can people hear that would reassure them?
FESSLER: Well, almost every election official or security expert says that the best thing to do is to have a paper ballot backup or some kind of paper ballot that you can use to actually compare the electronic results with the paper results if there are any issues raised. The problem is, lots of times people don't. They just throw that paper away, ultimately, and nobody does compare them. So this is something that people are trying to get officials to do more of.
INSKEEP: Pam, thanks very much.
FESSLER: Thank you.
INSKEEP: NPR's Pam Fessler. Transcript provided by NPR, Copyright NPR.
