Trust Is a Bug: Why Cybersecurity People Side-Eye Mail-In Voting

Hello, I’m Grumpy Tech Bro, and welcome to my candid discussion of an election vulnerability in the US.

You should know that by reading this article you are committing a felony, specifically 18 U.S.C. § 371 (conspiracy to commit an offense against the United States or to defraud the United States) and your own state and local equivalents.

However, you should tell your defense lawyer that nothing you will learn here is in any way “new” to cybersecurity folks, the Intelligence Community, Russia, China, or anyone who bothered to look after the White House released the July 2026 election-integrity materials.

But the way things are going, that may not help you. Lawfare didn’t used to be a thing. The people who win elections are politicians. They write the rules, and they don’t want elections questioned. Cybersecurity guys don’t have that luxury. We don’t even bring our personal phones to Black Hat.

So you should really stop reading this now. Right now, some "our elections are perfect" politician is trying to figure out how to get Elon to tell him if you read this article.

Still here? Okay, let me tell you why you should listen to me.

I’ve kicked around. I’ve worked on video games, cybersecurity, intellectual property protection, user interfaces, seven different startups, and a large multinational tech company. I’ve seen things. I know things. My specialty is taking complicated tech problems and making them simple enough that someone with an MBA can understand them.

My wife, when we lived in Arizona, volunteered as a poll worker. That meant she went through the classes that covered how elections had been stolen in the past. My favorite detail: Arizona used to let people vote in bars. Also, Smokey and the Bandit exists because it was the sheriffs who collected the ballots. The corrupt sheriff trope is just people paying attention. No matter who we vote for, Roscoe Coltrane keeps being Sheriff...

Inspired by that, I volunteered to help with the 2020 election. In Santa Clara County, California, that meant unpacking mail-in ballots for scanning. I pulled the ballot out of the already-opened envelope, unfolded it, and put it in a stack. I saw a whole bunch of BS. Some of that is probably still there, but I live in Oregon now. I have no way of knowing if it’s better. Neither do you. It's not knowable. We’ll get to that.

This article is going to explain what the White House materials (https://www.whitehouse.gov/election-integrity/ you want the 4th drop) are actually trying to warn everyone about. I’m writing it because those documents made me an Angry Tech Bro. I don't like being angry. It's bad for my health.

Why you shouldn’t listen to me

I’m not going to come at this from a partisan angle. I’m going to come at it from a cybersecurity and human-factors angle. That’s less popular on 𝕏, where everyone wants me to pick a side, but a plague on both your houses; you're annoying.

I grew up in SoCal, worked in Silicon Valley, moved to the Central Coast in California, lived in Arizona, moved back to Silicon Valley, then to Oregon. No one has a monopoly on truth, or really seems interested in it.

If you’re looking for partisan shitbaggery, go elsewhere. Here’s some reasons to get upset before I start slaying sacred cows and really piss off the "everything is fine" folks:

Things that will piss off the Red Team / MAGA

I am not going to re-litigate the 2020 election. I’m a Constitutionalist, and the Constitution is pretty clear: once the election is certified, it’s over. I’m not going to re-litigate 2024 either. I want our elections to be good going forward. Unless you have a time machine in your back pocket, I’m not interested.

Things that will piss off the Blue Team

Our elections are not secure. Mail-in ballots are a crock. Anyone who tells you otherwise is lying to you, and you should think about that.

So to be clear: I am not going to write this article from a 🔴 or a 🔵. Take your partisan shit elsewhere. The fact that election integrity has become a partisan issue worries me. Enough with the BS, folks. Let's fix it.

The Word “Attack”

When cybersecurity people say “attack,” we do not mean a criminal plot. We mean a systematic way of looking for places where a system trusts something it should not. An “attack” is just the question: “If I were trying to break this, where would I start?” It is a diagnostic method, not a to-do list. Same thing in chess and Go: you look at the board and ask where you are weak and where your opponent is weak.

To start, let us slay some sacred cows to get everyone good and pissed off.

Sacred Cow #1: U.S. elections are the most secure they’ve ever been.

No. There are 50 states + DC and about 3,140 counties and county-equivalents. The Founding Fathers had a luxury: Most of them weren’t lawyers, so they could actually get things done, and there were only 13 states to deal with. Even they threw up their hands and left it to the states.

Whether our elections are secure when 3,140 different jurisdictions interpret 51 different sets of election laws with their own personnel, procurement, and training is unknowable. Anyone who tells you they are secure is immediately lying to you. Did they talk to the election officials in 3,140 counties? I bet not.

Too much of our elections are built on trust. To a cybersecurity person trust is a bug. It should be a bug for you too; you shouldn't have to worry about how secure our elections are. The fact that you're getting this reassurance is a huge red flag.

At 59, I've noticed that when a corporation has a "mission statement", they're doing the exact opposite of that statement. "Our elections are the most secure they've ever been" means exactly the opposite. Our elections are the most gaslit and contentious they've ever been.

Sacred Cow #2: “Widespread.”

Picture a seesaw with a 200-pound person on each side. How much weight does it take to tip 400 pounds? One pound.

Fraud does not need to be widespread when the country is evenly split. Anyone who leans on the word “widespread” as the standard is lying to you.

Our standard is 50%+1. That means 1 vote matters.

Sacred Cow #3: The computers are secured / securable.

When I worked at the cybersecurity company, we built secure computers. You know what they didn’t have? Ports.

It is a basic rule among cybersecurity people: if you can get physical access to the machine, you can compromise the machine. Our secure systems didn’t even have the chips to support ports. The hardware guys soldered the chips only onto the special debugging units. There were only 2, and they were kept locked away.

Every computer involved in voting has ports. They are not secure.

Sacred Cow #4: Public Key Infrastructure protects you.

Crypto is built on the public-key / private-key model. Industry designs against commercial-level attackers, not state-level attackers. When all the security lives inside the code, people start trusting the computer to do the right thing. Stuxnet showed what a state-level actor can do to “secure” systems.

At the cybersecurity company we generated our own keys by hand and kept them in special hardware. Not even the crypto engineers had access. Even then, we never claimed our systems were proof against the NSA.

When I worked for the intellectual property protection company my CEO was waxing rhapsodic about how wonderful PKI was, and I stopped him and said "I know how PKI works, but have you actually implemented a certificate revocation endpoint?" No, they hadn't and it bit them in the butt when an IT employee walked off with a certificate and started minting software licenses.

Black boxes do not protect. Human attention protects.

How to think like a cybersecurity geek

I think it’s best illustrated by a joke one of my Jewish friends told me in high school:

Q: How do you say “I’m going to sodomize you without Vaseline” in Yiddish?

A: It sounds exactly like the English for “Trust me.”

In cybersecurity, trust is a bug. The holy grail is something called Zero Trust systems. We worked hard to make it so that no one had to trust anything. But here’s the problem:

Humans suck.

Bruce Schneier wrote the bible on crypto, Applied Cryptography. He followed it up with Secrets and Lies. In the second book he had a point that has always stuck with me: people will click OK on a dialog box that effectively says “If you click OK, your entire company’s IT infrastructure will be compromised, but you personally will get your work done.” Humans are always the weak link.

That startup selling the super-secure hardware? No one wanted it until after they had been hit by NotPetya. Then they wanted as many as we could make. There is no money in security. When you go to the gas station, look closely at the pump, it might have a card skimmer on it.

You know that email one of your co-workers sent you that said "click here to see the dancing bunny, it's hilarious"? You clicked on it didn't you? Was the bunny funny? Did you know you just got a computer virus that turned your computer into a zombie? Oops. Or did you figure it out after 10 of your coworkers said you sent the email to them?

Computers suck.

Computers will blindly do whatever you tell them to do. Banks use crypto to certify your $8 coffee at Starbucks. But if you want $8 billion, there’s a human involved.

Because when there’s $8 billion on the line, you want the computers to do their thing and the humans to do theirs. Money talks, bullshit walks.

Yes, that means every time you saw a movie where the bad guys sit down at a computer, push some buttons, and $100 million magically appears in someone’s account? Hollywood lied to you.

Cybersecurity in 2 sentences: Trust is a bug, people lie.

How real financial systems actually work

For small everyday transactions (your $8 coffee), the system is mostly automated. Card networks, banks, and processors run risk checks in seconds and either approve or decline. The computer does almost everything.

For large amounts (hundreds of thousands, millions, or billions), the system deliberately puts humans back in the loop. Banks and financial institutions use something called dual control (or the “four-eyes” principle). One person can initiate a transfer. A second, independent person has to review and approve it on a separate system or with separate credentials. In many cases a third person or a call-back verification is required above certain dollar thresholds.

The actual movement of the money does not happen by someone typing an account number and hitting “send.” Large domestic transfers usually go through systems like Fedwire or CHIPS. International ones go through SWIFT messaging, which is only a messaging system: the actual funds still have to settle through correspondent banks. Those settlement processes have built-in delays, cut-off times, and reconciliation steps. People on both ends check that the numbers match before the money is considered final.

In short: the bigger the number, the more the system forces humans to look at it, approve it, and leave an audit trail. Hollywood’s version (one person at a keyboard instantly moving $100 million) is pure fiction. Real systems are designed so that no single person, and no single compromised computer, can move serious money by themselves.

We take money seriously. Voting? Not so much. Voting is designed by lawyers, not cybersecurity engineers. Secure systems blend humans (short attention span, corruptible, lazy) with computers (tireless, do what they're told).

Going on the attack

So a cybersecurity person looking for an “attack” could dive into the details of network protocols and stuff like that, but it is hard/boring. So instead they start by asking: where is there trust?

There is a lot of trust in the mail-in ballot process:

The voter has to trust they are properly registered.

The voter has to trust the ballot will arrive on time.

The county has to trust the ballot was filled out without coercion and wasn’t sold or handed off.

The voter has to trust the ballot will actually be delivered to the elections office.

The voter has to trust the elections office will count it.

The elections office has to trust its machines are counting correctly.

That’s a lot of trust. Trust is a bug. There are problems with all of these, but I'm going to start with one in particular so I don't have to think about husbands who vote for their wives or vice versa, too close to home.

The July 2026 White House election-integrity materials specifically call out centralized election-related data repositories as among the most vulnerable points in the entire system. Every county elections office maintains a database of registered voters. That database is the single source of truth for who gets a ballot in the mail. (Think of a database as a big list of all the voters with their mailing address etc.)

If a name is missing from it, or if the address or status information is wrong or incomplete, the ballot simply never shows up. No envelope. No notice. Nothing. The voter may never realize anything went wrong until it is too late to fix.

It’s easy to notice when something happens. It’s much harder to notice when something doesn’t happen.

The White House documents highlight exactly this class of risk around voter registration systems. That is the point worth paying attention to. What happens if a voter is no longer in the master list of voters? They don’t get their ballots.

We supposedly fixed this after Bush v. Gore with the Help America Vote Act by requiring provisional ballots. In theory, if your name wasn’t on the list you could still show up and cast a provisional ballot. In practice, the massive shift to mail-in voting in 2020 largely threw that safety net away. If the ballot never arrives and you don’t notice in time, the old provisional process doesn’t help you much.

Brief CA personal experience digression

When I was processing mail-in ballots in Santa Clara County in 2020, do you really think California thought, “Gee, we should ask Oregon how they do mail-in ballots — they’ve been doing it for a while”? I grew up in California. The idea that the Oregon hippies might know something is not something a Californian would ever admit. Much less all 58 county election officials in 2020.

Every bilingual ballot came in a bilingual envelope. Humans are tribal; we tend to vote in groups. Every Vietnamese ballot I processed voted for Trump in 2020. Santa Clara County is about 8% Vietnamese. You could skew results 8% while never looking inside the envelope.

OR Voting Experience Digression

Lane County Elections sent me a bingo card. It tells me that they'll mail me a ballot 14 to 20 days before the election, and it lists their phone numbers and office hours M-F 9-12 (lunch) 1-4. The next election in OR is the 4th Tuesday in August, so they're going to mail the ballots the 1st or 2nd Tuesday, which means I have to wait until the 3rd Tuesday in August to see if I get one. I have not put an item in my calendar "make sure I get a ballot". I have other things to do. Have you?

Attack vectors for the voter database

A cybersecurity person looking at any system asks: where is the trust?

I love my IT folks, but pretty much everyone I’ve ever met has been vulnerable to the “sultry redhead attack.” Or what cybersecurity nerds call “social engineering” when the suits are around.

IT staff working for a county election department are generally patriots, but they are not highly paid, not deeply trained in cybersecurity, and do not have unlimited resources (unlike state actors, who only need to figure out one compromise and can then repeat it across roughly 3,140 counties).

There are ports on the computers.

At its peak, 80–90% of email traffic was spam, most of it sent by “zombie” computers under remote control.

The practical assumption many security people start with is simple: treat the systems as already compromised and design around that reality. That way you don’t have to get involved with the dating habits of the employees. The White House materials flag centralized voter registration databases as high-value, high-exposure targets for exactly this class of risk.

How do we fix it?

I dunno. What if we met at some public place on Election Day with volunteers from both parties and an Indy, and there was a list of registered voters? We check people off when they show up. If they aren’t on the list, they can still fill out a ballot. We just put those in a separate pile to deal with later.

If people are sick or lazy, they can send in a special request and get a special ballot they can mail in. But it would be the exception. They’d know their ballot wasn’t fully secret, might not get there, etc., but that would be their choice.

You know, like everyone else in the world who isn’t batshit crazy votes.

And get rid of the computers.

Secure elections shouldn’t be a partisan thing. The fact that they are is one of the reasons I’m grumpy. I only came up with one attack on mail-in ballots in this article, and I only described it very vaguely. There are plenty more. OR keeps trying to get me to register my wife to vote, even though she's in memory care, and I'd have to fill out her ballot for her.