Still, it's unclear how any changes made will effectively halt polarizing messaging by nefarious actors. The use of social media by Russian bots and trolls never stopped. It is incredibly cheap and clearly effective.

"Whenever a solution is implemented, the workarounds begin," Napoli said. "I just don't know how you maintain the scale at which these platforms operate and not be a porous platform where significant amounts of misinformation can still slip through."

After initial denials, Facebook has begun to accept that its platform wields an incredible amount of power. Less than a decade ago, social media was being hailed for helping fuel a civil resistance in Tunisia. Now it's under fire for eroding democracy.

"And that's not an uncommon pattern that we see with new communications technologies — from Utopian to apocalyptic in a fairly short turnaround time," Napoli said.

Just as in 2006, no one had heard of Twitter, by 2020, and 2024, there will be completely new social tools and companies that people will be using to share information.

When it comes to hacking voting infrastructure, one danger is more subtle than literally changing peoples ballots after they're cast.

"Maybe the threat model is not only that somebody wants to win or that somebody wants to boost their favorite candidate to win, it might just be to cause havoc and undermine trust in the system," says Hursti.

In short, an attacker might disrupt an election by disrupting everything else associated with an election.

"All of a sudden, an attack where you would go to voter registration systems and randomize a party affiliation, making primaries a complete disaster is what the attacker might want to do," he said.

The Help America Vote Act of 2002 required each state to implement a "centralized, interactive computerized statewide voter registration list," which would contain the name and registration information for every legally registered voter in each state.

While the rule may have made voting more efficient, it also introduced a wealth of new vulnerabilities. The new requirement, combined with a lack of adequate funding for increased security, "created the possibility of coordinated attacks where this possibility never existed before," wrote Emily Shaw, for the nonpartisan Sunlight Foundation.

Many jurisdictions have begun also digitizing how registered voters are checked in at their polling places. Electronic poll books, in most cases laptops or tablets, have begun replacing the three-ring binders that local elections workers use in each district or precinct. As of March 2017, 32 states had jurisdictions that used e-poll books, according to data from the National Conference of State Legislatures.

In many cases, the e-poll books can scan a person's driver's license to allow them to vote, a process that avoids data entry errors — but Hursti says it's an example of another technology that introduces an entry point where a malicious actor could introduce a cyber-threat.

"The driver's license was never intended to be used in this type of environment, the bar code can be used to inject an attack," Hursti said. "I actually think this is a place where technology can do a lot of good for democracy, and can make a lot of the process easier, it just has to be brought in a very responsible way otherwise it will be a low hanging fruit for an attacker to cause havoc."

Whereas the security of voter rolls and ballot boxes is regulated by the government, if not always strictly enforced or well-funded, cybersecurity in the campaign world goes just about completely unregulated.

In 2016, the reams of emails that became public from the Democratic National Committee as well as Hillary Clinton's campaign staff dominated whole weeks of news cycles and public conversation.

The types of phishing attacks that garner data like that are cheap, effective, hard to track and perfect for the American electoral system, says Nicholas Weaver, a researcher at the International Computer Science Institute.

"Phishing is unreliable — you might send out 500 phishing emails and only get a couple of responses," said Weaver. "But when you have [435] House races, each with dozens of potential staffers as targets, you're going to see a lot of these low-level attacks that are remarkably effective when you just use the law of large numbers."

It's mostly up to each individual campaign to police and enforce its own cybersecurity, and force staffers to do things like two-factor authentication.

"Campaigns need to think like they are a target," Weaver said. "Because they are."

The thing that ties all these strategies together is messaging.

Even without actually changing any ballots, the attacks of 2016 exposed the possibility that voting systems could be hacked in a way that could go undetected.

So a long-term risk for the United States is that the voting public loses faith in the concept of a fair democratic system if it can't be sure the system wasn't manipulated — especially if elected officials, without evidence, complain about illegal votes.

"That's, unfortunately, the situation we're in, where experts like me cannot reassure people that the system is foolproof, because it's not," said Halderman.

"With every year that goes by without significant new investment in voting technology, the system becomes weaker, and our basis for confidence in election results unfortunately deteriorates," he also explained.

All that is to say, in 2018 or 2020, Russia or another hostile party could toss support behind the Democrats in an effort to create a divided and gridlocked government, or just mix up voter registrations to sow confusion and frustration in a public that is clearly prone to further polarization already.

"It may have been Russia in 2016 but in the future it could be China, it could be North Korea, it could be any number of other countries that are developing sophisticated cyber-offensive capabilities," said Halderman. "The fact is, interfering in elections through cyber-means is cheap and it can be very effective. "

Copyright NPR 2021.