Teens did not “just hack a state election,” no matter how many headlines are published to make it look like they did. So, please don’t believe the hyped-up story in which a self-described “not even a very good hacker” brags about how he could “theoretically bring an election to a screeching halt.”
If you are familiar with this story, it begins with a conference that allowed fifty kids — some as young as eight — to participate in trying to hack a replica website that was designed to be easily hacked by them.
Recommended Stories
Yes, that’s right — a website, not an election like he repeatedly states. All a “successful hack” would be doing is confusing the public for a few moments while “hackers” change the results numbers on a web page.
In reality, election results are kept in offline servers, completely nullifying basic attempts like the ones that happened at this conference. Voting machines are also heavily tested prior to elections, with trained officials and the Department of Homeland Security standing guard.
In a quick aside, the author actually reveals a key reason as to why these children were successful: Not only were they first taught how to use their chosen method of attack in its entirety — a simple SQL injection — but they were also then hand-held through the “hacking” process itself “with the assistance of volunteers.” In short, they were specifically led toward a purposely-created vulnerabilities in order to accomplish what they did from inside their unguarded network. To be surprised by the result is akin to being shocked that you were robbed after you personally led a criminal into your house and unlocked every single safe and cabinet in front of him.
To de-techify that aforementioned hack for everyone, an SQL injection is arguably the simplest kind of hack someone can do on any website that has a search bar. It is easy enough to defend against, although the results can be rather embarrassing when it succeeds. Still, there is little to worry about — the kids in this competition were spoon-fed him the information they needed to hack the website in question minutes prior to doing so.
Headlines that point to this incident as a sign of serious vulnerabilities only serve to delegitimize actual election vulnerabilities when they are discovered. It is a modern case of “Boy-Who-Cried-Wolf.” People need to be made aware of actual threats that may exist, not just subjected to clickbait by opportunistic editors.
Matthew Pinna is a student at the University of Chicago.
