Vote equipment that can reach the internet
Some vote-counting machines can quietly talk to the internet. Anything connected to the internet can be reached by a stranger far away — so the machines that count votes should be unplugged from every network.
Explainer video coming soon
A 60-second, plain-language walkthrough of this gap.
What actually happened
In a 2020 investigation, security researcher Kevin Skoglund's team found roughly three dozen U.S. election systems reachable over the internet, and the three largest vendors acknowledged that some of their tabulators and scanners contained cellular modems. Princeton's Andrew Appel warned that once an attacker reaches a machine through such a modem, they can alter not just the quick unofficial results but the machine's software itself.
If it has a door, someone can knock
Think of a vote-counting machine like a vault. A vault with no doors to the outside is very hard to rob. But the moment you drill even a tiny tube to the outside world, someone far away can try to reach in.
A network connection — even a hidden cellular modem meant only to send quick "unofficial" results — is that tube. Vendors add it for convenience: results get to the public faster. But the same opening that lets results out can let an attacker in.
Why it matters
A machine an attacker has to physically touch is hard to reach — they'd need to be in the room. A machine on a network can be reached from another country. As one Princeton expert put it: once someone is talking to the machine over a modem, they may be able to change its software and make it cheat in future elections, not just this one.
The safest rule is the simplest one: the machine that counts votes should not be able to reach any network at all.
How TrustVoting closes it
Our equipment has no path to the internet — it is physically air-gapped. Results are exported on signed media that anyone can verify, so there's no live connection for an attacker to ride in on.
How TrustVoting closes it
TrustVoting equipment is air-gapped by design — it has no networking hardware that can join the internet. Results move on signed, verifiable media, never over a live network.