National: Critical U.S. Election Systems Have Been Left Exposed Online Despite Official Denials | Kim Zetter/Motherboard

For years, U.S. election officials and voting machine vendors have insisted that critical election systems are never connected to the internet and therefore can’t be hacked. But a group of election security experts have found what they believe to be nearly three dozen backend election systems in 10 states connected to the internet over the last year, including some in critical swing states. These include systems in nine Wisconsin counties, in four Michigan counties, and in seven Florida counties—all states that are perennial battlegrounds in presidential elections. Some of the systems have been online for a year and possibly longer. Some of them disappeared from the internet after the researchers notified an information-sharing group for election officials last year. But at least 19 of the systems, including one in Florida’s Miami-Dade County, were still connected to the internet this week, the researchers told Motherboard. The researchers and Motherboard have been able to verify that at least some of the systems in Wisconsin, Rhode Island, and Florida are in fact election systems. The rest are still unconfirmed, but the fact that some of them appeared to quickly drop offline after the researchers reported them suggests their findings are on the mark.

National: You can easily secure America’s e-voting systems tomorrow. Use paper – Bruce Schneier | The Register

While various high-tech solutions to secure electronic voting systems are being touted this week to election officials across the United States, according to infosec guru Bruce Schneier there is only one tried-and-tested approach that should be considered: pen and paper. It’s the only way to be sure hackers and spies haven’t delved in from across the web to screw with your vote. “Paper ballots are almost 100 per cent reliable and provide a voter-verifiable paper trail,” he told your humble Reg vulture and other hacks at Black Hat in Las Vegas on Thursday. “This isn’t hard or controversial. We use then all the time in Minnesota, and you make your vote and it’s easily tabulated.” The integrity of the election process depends on three key areas: the security of the voter databases that list who can vote; the electronic ballot boxes themselves, which Schneier opined were the hardest things to hack successfully; and the computers that tabulate votes and distribute this information.

National: Here’s how the Justice Department wants to befriend ethical hackers – The Washington Post

The Justice Department’s relationship with the cybersecurity research community has historically been tempestuous, but Leonard Bailey is on a mission to improve it. That’s what brings him here, to the BSides cybersecurity conference. The head of the cybersecurity unit of DOJ’s computer crimes division is extending an open invitation today to ethical hackers to air some grievances and offer policy advice, in a talk called: “Let’s Hear from the Hackers: What Should DOJ do Next?” Bailey wants to ensure hackers are willing to work with government on improving cybersecurity — instead of staying away because they’re suspicious of government. “It’s about figuring out how to make sure that their ability to help us improve [the nation’s] cybersecurity is not taken off the playing field,” Bailey tells me. “They have a valuable resource and they can be helping everyone.” This marks a drastic change — in terms of both outreach and attitude — from previous years. Tensions have soared as ethical hackers accused DOJ of being too quick to prosecute them for benign research aimed at improving cybersecurity — and of not being transparent enough about the rules for what constitutes a digital crime.

Editorials: Scientific evidence and securing the vote: Verdict is in, now we need the funds | Michael D. Fernandez/The Hill

The Senate Intelligence Committee recently released its much-anticipated report on election security and Russian interference in the 2016 presidential election. Alongside the alarming insights regarding Russian interference, there are critical recommendations based on scientific evidence regarding the security of our voting process, including the replacement of “outdated and vulnerable voting systems.” In too many counties across the country, ballots are being cast on insecure electronic systems. These direct recording electronic systems record a voter’s selection directly to the machine’s memory and automatically tabulate votes. Many leave no physical record of the vote cast. Within the scientific community, there has been consistent alarm regarding the security vulnerabilities of these direct recording electronic systems. Just last year, the National Academies of Science, Engineering, and Medicine issued a report finding that paperless direct recording electronic machines are not secure and should be removed from service as soon as possible. The committee of computer science and cybersecurity experts, legal and election scholars, social scientists, and election officials concluded that local, state, and federal elections should be conducted using human-readable paper ballots, either marked by hand or machine. Every effort should be taken to ensure that direct recording electronic machines are removed from service prior to the 2020 election. Regardless of the vendor or configuration, direct recording electronic systems are fundamentally unverifiable. While hacking is the most discussed concern, these systems are also vulnerable to everyday coding mistakes or errors that could lead to the same inaccurate results as malicious hacking. To effectively safeguard public confidence in our elections and democracy, we must  ensure that every vote is counted accurately.

Florida: Counties’ elections systems were connected to the internet, report says | Steven Lemongello/Orlando Sentinel

Seven Florida counties have elections systems that have been connected to the internet for months, if not years, according to a report by Vice Motherboard – and one was still connected as of this week. The counties – Bradford, Charlotte, Flagler, Wakulla, Miami-Dade, Pasco and one other county researchers were unable to identify – were among 35 in 10 states in which elections systems were potentially exposed to risk of hacking, Motherboard reported. At least 19 of the systems, including one in Miami-Dade, were still connected to the internet as of August. Elections supervisors in Central Florida said although they use the equipment being cited, none of them believed their systems were exposed. The systems are made by Election Systems & Software, one of the country’s top voting machine companies. Orange County Supervisor of Elections Bill Cowles said 49 of the state’s 67 counties, including Orange, use ES&S equipment. The systems are used to transmit unofficial vote totals via a wireless modem from ES&S voting machines on election night, Motherboard reported. The server that receives these votes is connected to the internet behind a Cisco firewall, both of which are only supposed to be connected to the internet for only a few seconds.

Georgia: State faces tight timeline for replacing voting system | Kate Brumback/Associated Press

Georgia elections officials have no time to spare as they hustle to replace thousands of outdated voting machines statewide while fending off lawsuits in the wake of a much criticized gubernatorial election. Even if the state manages to implement the $106 million purchase of new voting machines on schedule, some county officials worry the tight timeline could lead to another round of confusion as presidential politics drives high voter turnout. “There is concern from my board and myself that we won’t have enough time to get our training in for ourselves, our poll workers and the voters,” Elections Supervisor Jennifer Doran of Morgan County said in an interview Wednesday. Without proper training time, voters could face “confusion, anxiety” and longer waits as people learn to navigate the new system, Doran said. The voting system overhaul comes after Republican Gov. Brian Kemp — previously Georgia’s top election official — beat Democrat Stacey Abrams for the governor’s mansion.

Mississippi: Recovered thumb drive puts Newman ahead after DeLano claimed victory in District 50 race | Alyssa Newton/Biloxi Sun Herald

The District 50 Senate race was one of the closest on the Mississippi Coast, but it’s taken another turn with the Wednesday recovery of a thumb drive full of votes. With all precincts in Tuesday night, incumbent Rep. Scott DeLano held a 33-vote lead over Biloxi City Councilwoman Dixie Newman. That lead was without the affidavit votes, but DeLano declared the victory late Tuesday evening. “We look at these elections and see how many affidavits that are out there. It’s very unusual to make a really big difference in the outcome,” told the Sun Herald Tuesday night. “Even though it’s razor-thin, we expect it to fall in line with what the vote came out of those individual precincts.” It wasn’t the affidavits, but a thumb drive that changed the race Wednesday afternoon. “There was a drive that was left out from the D’Iberville Civic Center,” Newman’s campaign manager Holly Gibbes said. “Those numbers were never counted. (Harrison County Circuit Clerk) Connie Ladner‘s office produced that thumb drive today and added it in. “The thumb drive and all the affidavits, absentees and what could be counted is what put Dixie up by one vote.”

Montana: Stapleton nixes upgrade to voter registration system | The Fulcrum

The modernization of Montana’s voter registration system won’t happen in time for next year’s elections, because the state’s top election administrator has concluded the new software cannot be installed and its security assured in time. The decision was made by Secretary of State Corey Stapleton, who has something of a vested interest in his decision. He’s a leading GOP candidate for the state’s singular and reliably Republican seat in the House of Representatives in 2020. But Stapleton was pressed to make the decision by the association of the state’s county clerks, who said the system in place for 15 years was good enough for one more election. “It would seem more reasonable to begin this immense change-over outside of a presidential cycle, which could be one of the biggest in our lifetimes,” they told the secretary of state. “The current project development timeline is simply too aggressive and stands to put the election process in Montana at risk.”

North Carolina: Proposal offers new absentee ballot security, tweaks early voting hours | Travis Fain/WRAL

House leadership rolled out a wide-ranging election bill Thursday to tinker with early voting hours, let counties that use touchscreen voting machines keep doing so and tighten absentee ballot rules in response to last year’s 9th Congressional District scandal. Among other things, Senate Bill 683 would start a pilot project to cover postage on absentee ballots so that voters wouldn’t have to buy stamps. There are other measures meant to keep campaigns from trying to collect absentee ballots en masse, including a rule requiring prohibiting outside groups from returning ballot request forms. Those forms would also change every election so groups couldn’t simply photocopy old ones and submit fraudulent requests. The 12-page bill has been under construction for some time, and it has a ways to go to become law. Rep. David Lewis, R-Harnett, a House leader on election issues, said in a statement that he looks forward to working with the Senate to get the bill passed “in a timely manner.”

Rhode Island: Report prompts elections officials to examine security of voting systems | Patrick Anderson/Providence Journal

The Providence Journal delivers accurate, timely news about the moments that matter most. To receive stories like this one in your inbox, sign up here. Election hacking fears rekindled by the federal Russia probe have prompted Rhode Island elections officials to take a closer look into whether the state’s voting systems are vulnerable to attack. The new concerns relate to the state’s decision to buy voting machines before the 2016 election equipped with their own Verizon modems that transmit preliminary election results to the state Board of Elections after the polls close. The modems have helped shorten the time it takes the state to declare winners on election night. But because any internet connection exposes a system to potential cyber attack, the federal government never certified the modem-equipped machines for states to use and this summer the U.S. Senate committee investigating Russian efforts to breach the 2016 elections urged states to tighten their election security, use only federally-approved voting machines and “remove (or render inert) any wireless networking capability,” such as a modem.

Washington: Primary election tests new voter system, but ‘everything went according to plan’ | Joseph O’Sullivan/The Seattle Times

Washington’s same-day voter-registration law and new elections system faced a major stress test Tuesday as voters around the state returned ballots for the primary election. The new statewide voter management system, VoteWA, had a rocky rollout this spring, but county auditors Tuesday said it was running smoothly as the 8 p.m. election deadline came and went. “Everything went according to plan and worked out really well,” said King County Elections Director Julie Wise after Tuesday night’s election results posted. She previously had expressed concerns about the system being ready for the primary. Turnout in King County was projected to hit 36%, and possibly be a few points higher than that in Seattle, where seven City Council seats are up for grabs. VoteWA, which is rooted in a centralized voter-registration database, is expected to cut the risk of fraud, strengthen the security of the state’s elections and give many counties new elections capabilities.

India: Electronic Voting Machines Controversy: Election Commission’s Use Of Contract Engineers Puts Indian Elections At Risk | Ravi Nair/HuffPost India

The Election Commission of India has deployed teams of private contract workers, with a minimum work experience of just one year, to Maharashtra and Haryana, where they are conducting “first-level checks” on Electronic Voting Machines (EVMs) for state assembly elections scheduled for later this year, HuffPost India has learnt. These engineers told HuffPost India they had previously been tasked with critical aspects of the voting process — including setting EVMs and loading symbols into vote verification machines called VVPATS — in the 2019 general elections. Opposition leaders in these states told HuffPost India they were unaware that first-level checks on EVMs had begun, and that these checks were being performed by engineers who were not full-time employees of Bharat Electronics Limited (BEL) and Electronics Corporation of India Limited (ECIL), two state-owned companies that manufacture and maintain EVMs for the Election Commission. The Election Commission has never admitted to the use of contract workers, and the commission’s own guidelines require that representatives from all political parties be present when first level checks on EVMs are conducted. This HuffPost India report suggests that the nature of electronic voting makes it impossible for the Election Commission of India to maintain full control over all aspects of the voting process, despite its protestations to the contrary. The Commission’s submissions in Supreme Court indicate, at best, a fundamental ignorance about the nature of cybersecurity threats.