Colorado: Garfield County election judges stay busy in early November | Chelsea Self /Post Independent
On and leading up to Election Day, anyone who enters Room 101 B in the Garfield County Courthouse must sign in and out with a bright pink or green pen – intentionally different colors than the blue or black ink voters use to fill out their ballots. It’s just one of the many steps taken to ensure all votes are counted – and that the count is done with integrity. “We have all of these checks and balances,” Lois Wilmoth said. Wilmoth, who was born and raised in Glenwood Springs, has served as a mail-in election judge for over a decade. Monday, Wilmoth meticulously verified that the number of envelopes that entered room 101 B matched the amount of ballots that would eventually run through the scanning machines. “Once you have a problem, you stop. Nobody goes ahead anywhere until you find the ballot that is missing,” Wilmoth said.Florida: State and federal officials promise transparency but sidestep specifics on election security | Jeffrey Schweers/Tallahassee Democrat
State, local and federal officials asked the public to trust their ongoing efforts to strengthen Florida's election system against foreign and domestic threats leading up to the 2020 elections, but they refused to give any details. “We are committed to the maximum amount of transparency as possible,” Secretary of State Laurel Lee told more than a dozen reporters Friday at a 30-minute Tallahassee news conference hosted by Larry Keefe, U.S. Attorney for Florida's northern district. She dodged a barrage of questions about why the state won't say which counties were hacked in 2016, what vulnerabilities her office found during a review of the election systems of all 67 counties, and whether the state would disclose any future breaches or potential breaches to the public. A week ago, she sidestepped the same questions during a 30-minute interview with the Tallahassee Democrat citing security issues. Keefe said Friday's news conference was ushering in an "unprecedented" collaboration among state, federal and local officials responsible for election security, vowing his office will investigate and prosecute any election tampering.Georgia: State rushes to install voting machines before 2020 election | Mark Niesse & David Wickert/The Atlanta Journal-Constitution
With a presidential election on the line in 2020, Georgia is switching to a new voting company, Dominion Voting Systems, that state evaluators ranked second-best and that critics said will leave elections vulnerable. Dominion, based in Denver, must rush to install 30,000 voting machines for 7 million Georgia voters before the March 24 presidential primary, the largest rollout of elections equipment in U.S. history. Most voters in Tuesday’s local elections will cast ballots on Georgia’s 17-year-old machines, and voters in six counties are testing Dominion’s machines. The company faces intense scrutiny in Georgia, one of the most competitive states in the nation entering an election year featuring President Donald Trump and two U.S. Senate seats on the ballot. The challenge for Dominion is to seamlessly introduce computer-printed paper ballots in a state criticized last year over allegations of vote flipping, missing voter registrations, precinct closures, long lines and voter purges. The swift transition to new voting equipment has raised eyebrows far from Georgia. “What Georgia is trying to do basically blows my mind,” said Dwight Shellman, an election official at the Colorado secretary of state’s office. His state adopted a Dominion system in 2016. “We had 2 1/2 years to do it, and it was challenging,” Shellman said. “I can’t imagine implementing the number of counties Georgia has in, what, two months? Three months?” Actually, the work will take eight months. But the challenge remains daunting.Illinois: State Elections Board: ‘We’re Under Constant Threat’ from Foreign Interference | Paris Schutz/WTTW
The 2020 election is just under a year away, and both federal and state election authorities say the threat of foreign interference is ramping up. Illinois was one of several states whose election infrastructure was attacked by Russians in 2016, and officials say they’ve made big changes to make sure it doesn’t happen again. But can voters be sure the new measures will work? The Illinois State Board of Elections says it has received $13.2 million in federal aid since 2016 to deal with foreign interference. As outlined in the Mueller report, Russian hackers successfully breached an Illinois voter database that included information such as names, addresses and voter registration status. The breach affected 76,000 Illinois voters, but the board says there is no evidence that hackers manipulated any of that information to try and change voter registration status and, ultimately, impact the outcome of the election. But they say it was a wakeup call.Indiana: State to start seeing voting equipment changes | John Lynch/Ball State Daily
While some Hoosier voters will start seeing changes in electronic voting systems this election, Muncie will have to wait. In late July, the Indiana Election Commission approved the first voter verifiable paper audit trail (VVPAT) for electronic voting systems — a security measure that allows voters to independently verify their vote was correctly recorded, according to a press release from the Office of the Indiana Secretary of State. Almost half of the counties in Indiana use direct record electronic (DRE) machines, the press release stated. These machines have a paper trail in the back of the machines, but not visible to the voter. As a security measure, paper trails that are visible to the voter are being added to VVPAT electronic voting equipment, it stated. “Adding VVPATs to election equipment will help boost voter confidence and allow us to implement risk limiting audits,” said Secretary of State Connie Lawson in the press release. “Together, these practices will show voters at the polls their vote is safe and secure and following up with a post-election audit will confirm their vote was counted. As we prepare for the upcoming presidential election, we will be working to protect 2020 and beyond.”Virginia: We now know that Russia specifically targeted Virginia elections in 2016 | Mike Valerio/WUSA
Russian hackers with the Kremlin’s military intelligence unit targeted Virginia’s election infrastructure in 2016 – a cyber operation now confirmed by current and former state election officials. The Russian effort searched for vulnerabilities within Virginia’s online election infrastructure, authorities familiar with the matter said. The specific Russian actions targeting Virginia have not been previously reported. Analysts within the Department of Homeland Security eventually traced the suspicious activity to the GRU, the Russian military spy agency. The attempts to break into Virginia’s election systems did not change any votes, steal any personal information, or affect any voting during the presidential election, the officials stressed. Yet Richmond first received notice of the Russian reconnaissance only after hackers looked for weaknesses within the state’s election websites. Federal investigators disseminated a critical cyber bulletin known as a FLASH alert only days after malicious actors broke into Illinois’s voter database in the summer of 2016. The alert detailed how the Illinois Board of Elections reported an unusual surge in online traffic – traffic later traced back to Russia.Europe: On the front line in Europe’s war against Russian election interference | Ellie Zolfagharifard/The Telegraph
The hackers who fought against Russia in the first ever nationwide cyber attack are today hailed as heroes. “I’ve been to parties where people would discuss how they fought in the cyber war,” says Pactum’s Kristjan Korjus, with a combination of pride and envy. “They had to try to get to the main server rooms and hack for several days and nights… it was really cool.” It may not sound as dramatic as aiming a gun on a battlefield, but the work of these cyber warriors was crucial in thwarting a Russian assault that could have brought down a nation. Today, as the UK prepares for a General Election, Estonia believes Britain can learn from its efforts in defending against online attacks and misinformation. “This is a country that is on the front line of digital warfare,” says Scott Dodson, Lingvist’s chief growth officer, who moved from Seattle to Tallinn several years ago. “It’s kind of a fact of life that, you know, I don't think people in the UK or the US really appreciate... essentially this region is kind of a firewall [against Russian attacks].” That’s partly thanks to Nato’s Cooperative Cyber Defence Centre of Excellence, codenamed K5, which sits in the shadow of grey Soviet high-rises in the suburbs of Tallinn. Surrounded by barbed wire and armoured trucks, K5 looks like something out of a spy film. "We get people asking if they can tour this as part of their stag party all the time," laughs Aari Lemmik, who heads up the centre's communications team.Namibia: Windhoek protesters call for electronic voting machine removal | The Namibian
More than 100 protesters on Saturday took to the streets of Windhoek to vent their frustrations and anger around the use of electronic voting machines (EVMs) at the upcoming presidential and National Assembly elections. The protestors started their demonstration in the Havana informal settlement on the outskirts of Windhoek, and headed to the head office of the Electoral Commission of Namibia (ECN), where they were expected to hand over their petition to the commission's chief electoral and referenda officer, Theo Mujoro. Mujoro did not show up on the day to receive the petition. “I don't take instructions from the Namibian Police. I read about the intention of people to march on social media. Nobody has written to me as the chief electoral officer or the commission about the planned march. So, I had no obligation to receive anything from anybody,” Mujoro told Nampa on Saturday.United Kingdom: Prime Minister accused of cover-up over report on Russian meddling in UK politics | Dan Sabbagh and Luke Harding/The Guardian
Boris Johnson was on Monday night accused of presiding over a cover-up after it emerged that No 10 refused to clear the publication of a potentially incendiary report examining Russian infiltration in British politics, including the Conservative party. Downing Street indicated on Monday that it would not allow a 50-page dossier from the intelligence and security committee to be published before the election, prompting a string of complaints over its suppression. The committee’s chairman, Dominic Grieve, called the decision “jaw dropping”, saying no reason for the refusal had been given, while Labour and Scottish National party politicians accused No 10 of refusing to recognise the scale of Russian meddling. Fresh evidence has also emerged of attempts by the Kremlin to infiltrate the Conservatives by a senior Russian diplomat suspected of espionage, who spent five years in London cultivating leading Tories including Johnson himself.National: New federal guidelines could ban internet in voting machines | Eric Geller/Politico
A long-awaited update to federal voting technology standards could ban voting machines from connecting to the internet or using any wireless technology such as Wi-Fi or Bluetooth. A new draft of version 2.0 of the Voluntary Voting System Guidelines says that voting machines and ballot scanners “must not be capable of establishing wireless connections,” “establishing a connection to an external network” or “connecting to any device that is capable of establishing a connection to an external network.” If they survive a review process, the new rules would represent a landmark development in voting technology oversight, eliminating one of cybersecurity experts’ top concerns about voting machines by plugging holes that skilled hackers could exploit to tamper with the democratic process. The wireless and internet bans are included in the latest draft of the “system integrity” section of the VVSG update. A working group focused on the VVSG’s cybersecurity elements reviewed the document during an Oct. 29 teleconference.National: Almost 100 former officials, members of Congress urge Senate action on election security | Maggie Miller/The Hill
A group of nearly 100 former members of Congress, Cabinet officials, ambassadors and other officials is urging Congress to take action to secure U.S. elections, citing “severe threats to our national security” if certain steps are not taken. The officials, all of whom are members of nonprofit political action group Issue One’s “ReFormer’s Caucus,” sent a letter to the Senate on Thursday urging members to support various bills designed to bolster election security. “Foreign interference in American elections is a national security emergency,” the group wrote. “We are alarmed at the lack of meaningful Congressional action to secure our elections. The United States cannot afford to sit by as our adversaries exploit our vulnerabilities. Congress — especially the Senate — must enact a robust and bipartisan set of policies now.” Specifically, the officials advocated for the passage of five bipartisan bills, including the Honest Ads Act, a bill meant to increase the transparency surrounding online political ads, and the Defending Elections from Threats by Establishing Redlines (DETER) Act, which would impose sanctions on countries that interfere in U.S. elections. The officials also urged the Senate to pass legislation aimed at increasing the cybersecurity of voting infrastructure and cracking down on foreign donations to U.S. elections.National: Voting machines still easy prey for determined hackers | Derek B. Johnson/FCW
Security researchers showed lawmakers and reporters how easy it is to compromise voting machines in what has become an annual event at the U.S. Capitol. The Washington, D.C., version of the Voting Village event at the DefCon security conference in Las Vegas gives policymakers a hands-on glimpse of the technology that powers U.S. democracy. This year's report is consistent with prior exercises: virtually every machine experts can get their hands on can be easily exploited in a number of different ways. What has changed in recent years, said Voting Village Co-founder Harri Hursti, is that the community of security researchers with first-hand experience working with these machines has grown from less than a dozen to thousands. Even though the annual event has been held for several years, fresh researchers have discovered of new vulnerabilities and attack vectors. "In this area, it's always mind-blowing how these machines keep giving," Hursti told FCW.National: Four ways to address electronic voting security concerns | Earl D. Matthews/StateScoop
Despite the $380 million in federal grants made to states to update the security of their election systems, we are still woefully unprepared to deal with potential attacks on our essential digital voting infrastructure. With the 2020 election cycle fast approaching, there is tremendous urgency to address the underlying issues that jeopardize the sanctity of our elections.
As former director of cyber operations and chief information security officer for the U.S. Air Force, as well as with my more recent experience working in the cybersecurity sector, I have a fairly unique perspective on how our state governments should be addressing election security. In my view, the main cause of our cybersecurity-unpreparedness is that we are not looking at the problem holistically, nor are we fully appreciating the complexity involved. Solutions being posed only address part of the problem and inevitably fall short, thus putting our democracy at serious risk.
States are ultimately responsible for election systems and their security, but cybersecurity solutions vendors can also contribute to this effort. Below are four steps that state governments should take, working with the technology community, to effectively address vulnerabilities in the voting system and better protect our democratic process through cybersecurity practices, people and technology.
1. Mandate transparency from e-voting hardware and software providers about security of their software and require them to identify security vulnerabilities.
What I’m talking about is mandating cybersecurity hygiene, much in the same way that companies require cybersecurity hygiene of the organizations with which they do business or form partnerships. There is a broad range of commercial providers of election system technology, each playing a different role in the overall e-voting system ecosystem — some of which have begun offering free, open-source versions of their software to governments — making it critical for providers to be transparent about potential vulnerabilities in their systems. Similar to how Microsoft releases patches and upgrades when new threats are discovered to offer users greater protections, this needs to happen in our election system as well. As part of this transparency, ongoing monitoring and measurement of the effectiveness of each component also needs to be conducted, which leads to my next point.
2. Instate continuous, automated measurement and monitoring of the effectiveness of security controls.
States need to understand how systems are protecting against new and existing vulnerabilities, and this needs to be automatically monitored on an ongoing basis with cooperation from each software provider. Too often, assumptions are made that security technology and protocols are working as they’re supposed to — but given the complexity of IT environments, the number of software elements that need to work together and the volume of network and access changes made every day, misconfigurations that compromise performance are common. To ensure optimal performance of the overall security environment requires quantifiable measurement and evidence that controls are working as they should.
3. Limit access for government employees to certain portions of the election system based on role and need.
In the business world, insider threats pose greater risks to organizations than external forces, and the same can be true for governments.
