Put Up or Shut Up: A Hack-the-Pentagon Challenge for Mail-In Voting

Maxine Dexter has repeatedly and forcefully defended Oregon’s all-mail system as safe, secure, and effectively unhackable (“you can’t hack paper ballots”). The New York Times has characterized many of President Trump’s election-integrity critiques as baseless. Both positions amount to a high-confidence claim about system resilience. High-confidence claims in security invite rigorous, authorized testing — not just official assurances or low historical prosecution rates.

The U.S. Department of Defense already demonstrated the value of this approach with “Hack the Pentagon” (2016), the first federal bug-bounty program. Roughly 1,400 vetted ethical hackers participated in the six-week pilot. The first valid vulnerability arrived in 13 minutes. Ultimately 138 unique, legitimate vulnerabilities were confirmed and fixed. Defense Secretary Ash Carter noted that a traditional private-sector audit would have cost more than $1 million; the crowdsourced effort was far cheaper and more effective. It became the model for ongoing DoD vulnerability disclosure.

Mail-in voting systems are not identical to public-facing DoD websites, but the principle transfers. Oregon’s system, California’s, Washington’s (and similar long-chain mail systems) relies on an extended physical and procedural custody path: printing → mailing/drop-box → intake → signature verification → tabulation → storage → audit. That chain multiplies points of human access. Security professionals call the residual risk the insider threat — people with legitimate Motive, Opportunity, and Means (MOM). Federal guidance from CISA explicitly treats insider threats to election infrastructure as a real and ongoing concern; authorized testing is one recognized mitigation.

A “Hack the Mail-In System” program modeled on the Pentagon effort would therefore prioritize:
Legal safe harbor and clear rules of engagement so participants who stay inside scope are protected. Unauthorized access remains illegal.

Public-facing technical layer (voter portals, tracking sites, registration systems) — the closest parallel to the original Pentagon challenge.

Authorized insider / custody-chain red-team exercises in non-production or tightly observed environments. Realistic scenarios include temporary workers with signature-verification access, collusion thresholds needed to affect meaningful numbers of ballots, privilege retention after role changes, effectiveness of chain-of-custody logs/cameras/dual-control rules, and whether audits can be delayed or misdirected by someone who understands the process.

Process and privilege audit track examining who holds elevated access, how often privileges are reviewed/revoked, background-check depth for temporary staff, and time-to-detection metrics.
Transparent scoring and remediation ranked by required privilege level, collusion needed, opportunity window, detection probability, and potential impact. Publish redacted findings and fix status so the public can evaluate the work without handing adversaries a complete playbook. Monetary or recognition incentives scaled to severity, as in the Pentagon program.

Oregon already employs paper ballots, signature verification, barcode tracking, risk-limiting audits (or hand counts), bipartisan observation in many steps, and air-gapped tabulation equipment. Official reviews report extremely low prosecution rates for fraud. Those controls matter. They do not eliminate the value of deliberately stress-testing the higher-privilege, higher-trust human and procedural layers under controlled conditions. Systems that claim high resilience improve public trust most effectively when they invite authorized adversarial scrutiny rather than treat skepticism as illegitimate.

The challenge is straightforward: if the system is as robust as claimed, an authorized, time-boxed, scoped program modeled on Hack the Pentagon will demonstrate it. If gaps surface, they can be fixed before a motivated actor exploits them. Either outcome strengthens the system and the public’s ability to evaluate the confidence claims made by officials and major media outlets. That is how mature institutions treat security assertions.

Mail-In Vote Security Challenge
(Modeled on the 2016 Hack the Pentagon bug-bounty program)

 Specific Technical Scope Boundaries

1. Public-Facing Technical / Vulnerability Disclosure Layer
(Closest parallel to the original Hack the Pentagon program)

In scope:

• Publicly reachable voter registration and online voter information portals operated by the state or participating counties (e.g., Oregon’s My Vote / ballot-tracking interfaces, online registration or update forms, and county election websites).
• Ballot-tracking and status-inquiry web applications and associated APIs.
• Publicly accessible election-result reporting or sample-ballot systems.
• Authentication, session management, access-control, and input-validation flaws that could lead to account takeover, unauthorized data modification, or large-scale information disclosure of voter records.
• Only systems explicitly listed by the participating election authority in the program rules and that are internet-reachable without credentials or with publicly available credentials.

Out of scope:

• Any system not explicitly listed by the election authority.
• Internal election-management or tabulation networks.
• Third-party vendor systems (unless the vendor and the authority jointly authorize inclusion).
• Physical security of data centers, office buildings, or drop boxes.
• Denial-of-service, rate-limiting, or volumetric attacks.
• Social-engineering of real voters or election staff outside of pre-approved, supervised exercises.
• Any testing that requires bypassing multi-factor authentication that is not publicly available, or that involves purchasing credentials, phishing, or other illegal means.

2. Authorized Insider / Custody-Chain Red-Team Exercises
(The distinctive mail-in focus)

In scope:

• Time-boxed, supervised access to non-production replica environments or detailed process documentation supplied by the authority.
• Simulated temporary-worker roles with signature-verification, ballot-intake, or storage-custodian privileges.
• Demonstration of realistic collusion thresholds, privilege-escalation or retention after role change, and effectiveness of chain-of-custody logs, dual-control rules, cameras, and audit triggers — all performed on replica ballots or synthetic data.
• Process-walkthrough testing of documented procedures for drop-box collection, signature curing, ballot adjudication, and storage.

Out of scope:

• Any interaction with live ballots, live tabulation systems, or production databases during an active election period.
• Physical insertion, removal, or alteration of real ballots or drop boxes.
• Unauthorized entry into election facilities.
• Testing that would interrupt or delay real election operations.
• Attempts to compromise air-gapped tabulation equipment or voting-system certification boundaries.

3. Process and Privilege Audit Track

• Independent review of documented privilege-assignment, background-check, dual-control, and access-revocation policies.
• Measurement of time-to-detection metrics using only the logs and monitoring tools the authority already operates or is willing to expose under the program rules.
• No requirement to grant researchers live administrative access beyond what is defined in the supervised red-team track.
• Scoring and remediation rules
• Findings ranked by:
• Privilege level required
• Number of colluding individuals needed
• Opportunity window
• Probability of detection by existing controls
• Potential impact on outcome integrity
• Only findings that stay inside the published scope and rules of engagement are eligible for bounty or recognition. Election authorities publish remediation status and timelines for accepted findings.
• These boundaries keep the program tightly focused on the residual risks that distinguish long-chain mail systems — the extended human and procedural attack surface — while protecting live elections and staying within the legal and operational realities that election officials face. The result is a practical, high-signal test rather than an open-ended invitation to chaos.

Agree/Disagree with the author(s)? Let them know in the comments below and be heard by 10’s of thousands of CDN readers each day!