National: Analysts question whether FBI election cybersecurity changes are robust enough | Jonathan Greig/TechRepublic
The FBI released new guidelines on how it will approach cyberattacks on elections after facing years of criticism from lawmakers across the country for their response to Russian intrusion attempts during the 2016 election. State officials, particularly those in Florida, were incensed when the Mueller Report revealed that two county voting databases were breached by Russian hackers ahead of the 2016 election. The FBI never told state-level officials and only coordinated with people in the counties that had been hit, waiting nearly two years until meeting and explaining the situation to Florida Gov. Ron DeSantis. The new guidelines, explained on a media call last Thursday and in a press release last Friday, say the FBI will notify a state's chief election official and other local election workers in the event of any cyberattack. "Understanding that mitigation of such incidents often hinges on timely notification, the FBI has established a new internal policy outlining how the FBI will notify state and local officials responsible for administering election infrastructure of cyber activity targeting their infrastructure," the FBI statement said.National: Weakening Encryption Could Impact Election Security, Coalition Says | Frank Konkel/Nextgov
A coalition for secure elections sent a letter to Attorney General William Barr Wednesday, criticizing the AG for recent comments he made calling on companies to create a “backdoor” through encryption. The letter, published by the Project on Government Oversight, warns such backdoors—even if expressly for use by law enforcement—would weaken the security of encrypted services and devices, “opening the door” for hackers to harm users. “While encryption does not guarantee safety from all forms of malicious hacking, it is a vital safeguard to minimize risk. The Department of Justice has previously asked companies to create a ‘backdoor’ through encryption that would be accessible to law enforcement—but it is simply not possible to create a ‘backdoor’ that could not also be accessed by malicious hackers,” the letter states.National: Tech Companies Volunteer to Beef Up Presidential Campaigns’ Cybersecurity | Alexa Corse/Wall Street Journal
Nearly a dozen technology companies said they will provide free or reduced-cost cybersecurity services to presidential campaigns, which experts and intelligence officials have warned are ripe targets for intrusion and disinformation. They join a growing number of firms offering protection on a nonpartisan basis, a trend that has gained steam in the past 18 months or so, since federal regulators eased rules to make such offers permissible under campaign-finance laws. The Federal Election Commission made policy changes after urging from nonprofits and technology companies, including Microsoft Corp. Campaigns have struggled to make their information more secure in part because of budget pressures and the fast-moving nature of a campaign. “Any dollar that a campaign spends on extra levels of cybersecurity is a dollar they’re not spending on voter contact and getting their candidate elected,” noted Matt Rhoades, campaign manager for Republican Mitt Romney in 2012.California: Lawsuit claims new Los Angeles County voting machines could favor some candidates | Jason Ruiz/Long Beach Post News
A lawsuit filed Thursday by the City of Beverly Hills alleges that the machines to tabulate votes that are being deployed by Los Angeles County for the upcoming March 3 elections could give some candidates an unfair advantage. In a statement the city said that the issue is that only four candidates can be displayed at one time on the screens and that the confusion between the “More” and “Next” buttons could lead to those not listed on the first page being overlooked by voters. Potential for the city’s suit was first reported by LAist, which earlier this month reported the Beverly Hills City Council was considering the action after it received a preview of the machines and noticed the potential for confusion. One of its incumbent members is listed fifth on the ballot, which means he would appear on the second screen and potentially be skipped over by voters. The county is using VSAP (Voting Solutions for All People) machines for the first time during the March elections, but have rolled them out for demonstrations in the past few months including at November’s California Democratic Party Endorsing Convention hosted in Long Beach. Voters can use the machines to electronically mark selections, with the machine printing out a paper version of their votes to be turned into county officials. The machines have yet to be certified by state election officials.Verified Voting Blog: Verified Voting Comment on Los Angeles County VSAP 2.0 Certification
The following is a comment on the certification process for Los Angeles County’s VSAP 2.0 system. To view a pdf, click here.
Los Angeles County Voting Systems for All People (VSAP) 2.0 Certification
Comment of Pamela Smith, Senior Advisor, Verified Voting
January 20, 2020 Verified Voting commends Los Angeles County for the decade-long process of reimagining a voting system that must effectively serve the nation’s most populous and most diverse voting jurisdiction, as that system approaches certification and use in California’s upcoming elections. We have appreciated the opportunity to participate on the County’s Technical Advisory Committee since it was established and provide vigorous comment through the development process. We also appreciate the changes brought about by California’s lawmakers and Secretary of State Padilla to establish a more rigorous set of requirements for testing and examination of voting systems prior to approval for use. We believe, however, that there is a gap in the certification process that must be addressed for it to be fully transparent and to enable the public to more fully understand voting system compliance with California’s requirements.
The California Voting System Standards (CVSS)[1. https://www.sos.ca.gov/administration/regulations/currentregulations/elections/voting-system-certification-regulations/] framework is supported by a set of regulations1 which govern a sequence of events for certification of a system, from application and provision of documentation and system/s for test, to a series of tests by qualified testing entities on security, software, functionality and more, to a set of reports to be published prior to a public hearing and comment period, and to eventual approval or denial of certification.
The required publications include test reports from the involved testing authorities, and a staff report from the Office of Voting Systems Technology Assessment (OVSTA). Reviewing these reports show test results that are characterized as failing or not complying with requirements in some instances, while the subsequent Staff report indicates that the system is in compliance, which seems contradictory at best, and it is not clear to the public how to reconcile those reports.
