National

States are in need of further funding from the federal government to fully secure elections, a report published Thursday found, citing six states as examples. The report was compiled by the Brennan Center for Justice, the R Street Institute, the University of Pittsburgh’s Institute for Cyber Law, Policy, and Security, and the Alliance for Securing Democracy. It spotlights Alabama, Arizona, Illinois, Louisiana, Oklahoma, and Pennsylvania. “Elections are the pillar of American democracy, and, as we saw in 2016 and 2018, foreign governments will continue to target them,” the authors wrote in the report. “States cannot counter these adversaries alone, nor should they have to. But at a time when free and fair elections are increasingly under attack, they can, with additional federal funding, safeguard them.” Four of the states reported that future federal funds are needed to replace “legacy” or older voting equipment that have cyber vulnerabilities, while several other states cited the need for funding to train election officials in cybersecurity.

National: Senate passes bill making hacking voting systems a federal crime | Jordain Carney/The Hill

The Senate passed legislation on Wednesday night that would make it a federal crime to hack into any voting systems used in a federal election. The bill, known as the Defending the Integrity of Voting Systems Act, passed the chamber on Wednesday night by unanimous consent, which requires the sign off of every senator. It would allow the Justice Department to pursue federal charges against anyone who hacks voting systems used in federal elections under the Computer Fraud and Abuse Act. Sen. Sheldon Whitehouse (D-R.I.), Richard Blumenthal (D-Conn.) and Lindsey Graham (R-S.C.) introduced the legislation earlier this year and it cleared the Judiciary Committee in May. “Our legislation to protect voting machines will better equip the Department of Justice to fight back against hackers that intend to interfere with our election,” Blumenthal said when the bill was introduced.

National: Top Democrat demands answers on election equipment vulnerabilities | Maggie Miller/TheHill

Sen. Ron Wyden (D-Ore.) is demanding answers from the Election Assistance Commission (EAC) as to how the federal agency plans to secure election equipment amid reports that most machines depend on software that will soon be out-of-date and vulnerable to cyber attacks. In a letter dated July 12 that was released on Monday, Wyden asked EAC Chairwoman Christy McCormick how the agency plans to address this “looming cybersecurity crisis.” “Intelligence officials have made it clear that Russian hackers targeted our elections in 2016, and that they expect similar threats in 2020,” Wyden wrote. “The continued use of out-of-date software on voting machines and the computers used to administer elections lays out the red carpet for foreign hackers. This is unacceptable.” The Associated Press recently reported that the majority of U.S. counties use election management systems that run on Windows 7, an outdated operating system that Microsoft will stop updating in January. The systems are responsible for programming voting machines and tallying votes. Wyden focused his questions on whether products created by Election Systems and Software (ES&S), one of the major U.S. voting equipment manufacturers, would be decertified by the EAC prior to the 2020 elections. According to EAC documentation, the equipment uses Windows 7. Wyden gave McCormick a July 26 deadline to respond to his questions.

National: Microsoft will give away software to guard U.S. voting machines | Ken Dilanian/NBC

Microsoft on Wednesday announced that it would give away software designed to improve the security of American voting machines, even as the tech giant said it had tracked 781 cyberattacks by foreign adversaries targeting political organizations so far this election cycle. The company said it was rolling out the free, open-source software product called ElectionGuard, which it said uses encryption to “enable a new era of secure, verifiable voting.” The company is working with election machine vendors and local governments to deploy the system in a pilot program for the 2020 election. The system uses an encrypted tracking code to allow a voter to verify that his or her vote has been recorded and has not been tampered with, Microsoft said in a blog post. Its announcement was timed to coincide with the Aspen Security Forum, an annual conference of current and former intelligence, defense and homeland security officials that kicks off Wednesday in Aspen, Colorado — co-sponsored by Microsoft and others. NBC News is a media partner of the forum. Edward Perez, an election security expert with the independent Open Source Election Technology Institute, said Microsoft’s move signals that voting systems, long a technology backwater, are finally receiving attention from the county’s leading technical minds.

National: How Julian Assange turned an embassy into a command post for election meddling | Marshall Cohen, Kay Guerrero and Arturo Torres/CNN

New documents obtained exclusively by CNN reveal that WikiLeaks founder Julian Assange received in-person deliveries, potentially of hacked materials related to the 2016 US election, during a series of suspicious meetings at the Ecuadorian Embassy in London. The documents build on the possibility, raised by special counsel Robert Mueller in his report on Russian meddling, that couriers brought hacked files to Assange at the embassy. The surveillance reports also describe how Assange turned the embassy into a command center and orchestrated a series of damaging disclosures that rocked the 2016 presidential campaign in the United States. Despite being confined to the embassy while seeking safe passage to Ecuador, Assange met with Russians and world-class hackers at critical moments, frequently for hours at a time. He also acquired powerful new computing and network hardware to facilitate data transfers just weeks before WikiLeaks received hacked materials from Russian operatives. These stunning details come from hundreds of surveillance reports compiled for the Ecuadorian government by UC Global, a private Spanish security company, and obtained by CNN. They chronicle Assange’s movements and provide an unprecedented window into his life at the embassy. They also add a new dimension to the Mueller report, which cataloged how WikiLeaks helped the Russians undermine the US election. An Ecuadorian intelligence official told CNN that the surveillance reports are authentic.

National: Multiple Bills Seek To Secure Elections: Will They Do It? | Taylor Armerding/Forbes

If the security of voting systems in the next election will be a function of the amount of legislation on the topic now pending in Congress, we’ve got nothing to worry about in November 2020. There is a growing pile of bills in both the House and Senate, most featuring several to dozens of cosponsors—sometimes even from both parties—accompanied by press releases with made-to-order endorsements from congressional leaders, advocacy groups and cybersecurity experts. They all call for securing U.S. elections and “protecting our democracy.” But, of course, the number of bills doesn’t matter. It’s about quality, not quantity. The things that do matter are what gets enacted into law and whether its mandates get done or get watered down. And that, as the predictable cliché goes, remains to be seen.

National: Alarm sounds over census cybersecurity concerns | Maggie Miller/The Hill

Lawmakers are raising concerns that the upcoming 2020 census, which people are expected to fill out primarily online for the first time, is opening the door to potential cyber vulnerabilities. These vulnerabilities were in the spotlight on Capitol Hill on Tuesday as the Senate Homeland Security and Governmental Affairs Committee held a hearing to examine the security of the census, which residents will be able to complete online, over the phone or on paper. The hearing featured testimony from top officials from the Government Accountability Office (GAO), which has added the Census Bureau to its list of “high risk programs” due to cybersecurity and information technology shortfalls. “Although the Bureau has taken initial steps to address risk, additional actions are needed as these risks could adversely impact the cost, quality, schedule, and security of the enumeration,” Nick Marinos, the director of Information Technology and Cybersecurity at GAO, and Robert Goldenkoff, the director of Strategic Issues at GAO, said in their written testimony. Concerns center around the security of personal data involved in the census, and around securing systems against threats from foreign nations. The anxiety echoes some of the worry surrounding security against cyberattacks from foreign actors during the upcoming presidential election.

National: Secretaries of state plead for more money for election security | Mark Albert/KOCO

The nation’s chief elections officials are pleading for more money from the federal government to shore up the security of crucial voting systems before the presidential contest in 2020, even as such aid appears dead on arrival in the U.S. Senate. Interviews with 10 secretaries of state, conducted by the Hearst Television National Investigative Unit at the annual summer conference of the National Association of Secretaries of State held this year in Santa Fe, New Mexico, found unanimity across party lines. When asked whether their states needed more money for election security, one secretary after another answered in the affirmative. “Absolutely,” responded Pennsylvania Acting Secretary of State Kathy Boockvar, a Democrat. “Absolutely,” seconded Laurel Lee, Florida’s Secretary of State, a member of the Republican party. “Look, we absolutely need more money,” Democrat Alex Padilla, California’s secretary of state, said. “We can always use more money for election security,” said Mac Warner, a Republican who serves as secretary of state in Virginia. But despite the landslide of bipartisan requests, $600 million in additional funding is stuck in the Senate after passing the House last month on a nearly party-line vote.

National: Here’s an overlooked election cybersecurity danger: outdated software | Joseph Marks/The Washington Post

There’s a big hacking danger facing the 2020 election that’s so far been overlooked: software so old that companies aren’t updating it anymore. The “vast majority” of the nation’s 10,000 election jurisdictions rely on Microsoft’s Windows 7 operating system, which was introduced in 2009 and will reach the end of its technological life span in January, according to a report this weekend from the Associated Press’s Tami Abdollah. And some of those jurisdictions are relying on software that’s even older. That means those systems — which are running in numerous swing states’ election systems — won’t get automatically updated to protect against newfound computer bugs, leaving the systems far more vulnerable to hackers who exploit those bugs, Abdollah reports. The report highlights yet another way in which elections remain vulnerable to hacking despite calls for vastly improved election cybersecurity after the 2016 contest was upended by Russian hacking and disinformation operations — and amid warnings from Intelligence officials that Russia and other U.S. adversaries want to similarly compromise the 2020 contest. The vulnerable software is deployed on systems to create ballots, program voting machines, tally votes and report counts, per the AP. It also demonstrates how many election cybersecurity challenges evade easy fixes.

National: New election systems use vulnerable software | Tami Abdollah/Associated Press

New election systems use vulnerable software | Tami Abdollah/Associated Press

National: Who’s behind voting-machine makers? Money of unclear origins | Emery P. Dalesio/Associated Press

The voting-machine makers that aim to sell their systems in North Carolina are largely owned by private equity firms that don’t disclose their investors. The companies didn’t want the public to know even that much. North Carolina’s statewide elections board demanded the machine-makers’ ownership information last month after special counsel Robert Mueller’s April report into Russian efforts to sway the 2016 presidential election. Their concerns about potential foreign interference have grown since Maryland officials learned last year that a company maintaining that state’s election infrastructure did not disclose its financing by a venture fund whose largest investor is a Russian oligarch. The private-equity backers of the three voting systems vendors seeking approval to sell to county elections boards in North Carolina told The Associated Press they’re controlled by U.S. citizens. They claimed they have no ties to foreign oligarchs or other nefarious persons facing financial sanctions by Washington. But they didn’t provide information about the sources of the money they invest. And they asked the board not to share what they did disclose with the public. The elections board released the companies’ responses — as required by law — under a public records request from The AP. Election security watchdogs remain frustrated.

National: Thousands of election systems running software that will soon be outdated: report | Tal Axelrod/The Hill

The vast majority of the nation’s 10,000 election jurisdictions are using an operating system that will soon be outdated, according to an Associated Press analysis. Those jurisdictions using Windows 7 or an older operating system to create ballots, program voting machines, tally votes and report counts will reach its “end of life” on Jan. 14 — meaning Microsoft will no longer provide technical support or produce “patches” to deal with vulnerabilities that hackers could possibly exploit. Microsoft told the AP in a statement Friday that it would offer continued Windows 7 security updates for a fee through 2023. The company did not immediately respond to a request for comment from The Hill. Critics told the AP that the obsolescence was an example of what happens when private companies determine the security level of election systems without federal guidelines. Vendors defended themselves, saying they’ve been making consistent improvements on security, but state officials said they were wary of federal involvement in state and local races.

National: Who Will Clean Up America’s Voter Rolls? | Mark Hemingway/RealClearPolitics

Los Angeles County has too many voters. An estimated 1.6 million, according to the latest calculations – which is roughly the population of Philadelphia. That’s the difference between the number of people on the county’s voter rolls and the actual number of voting age residents. This means that L.A. is in violation of federal law, which seeks to limit fraud by requiring basic voter list maintenance to make sure that people who have died, moved, or are otherwise ineligible to vote aren’t still on the rolls. Los Angeles County has made only minimal efforts to clean up its voter rolls for decades. It began sending notices to those 1.6 million people last month to settle a lawsuit brought by the conservative watchdog group Judicial Watch. Los Angeles County may be California’s worst offender, but 10 of the state’s 58 counties also have registration rates exceeding 100% of the voting age population. In fact, the voter registration rate for the entire state of California is 101%. And the Golden State isn’t alone. Eight states, as well as the District of Columbia, have total voter registration tallies exceeding 100%, and in total, 38 states have counties where voter registration rates exceed 100%. Another state that stands out is Kentucky, where the voter registration rate in 48 of its 120 counties exceeded 100% last year. About 15% of America’s counties where there is reliable voter data – that is, over 400 counties out of 2,800 – have voter registration rates over 100%.

National: Election security briefings failed to satisfy congressional critics | Tim Starks/Politico

House members and senators emerged from two election security briefings by top Trump administration officials Wednesday with plenty of questions. “There is real interest on the part of members of Congress to know who is in charge or what are the operating procedures for the process to move forward,” said Rep. Bennie Thompson (D-Miss.), chairman of the House Homeland Security Committee. “And the answers were not as clear as they need to be.” Some reportedly didn’t get answers about whether President Donald Trump himself has received a comprehensive briefing. Sen. Angus King (I-Maine) told MC that while he was impressed with the 2020 preparation thus far, more needs to be done. “One of the open questions is, what is the responsibility of the intelligence community to notify a campaign if they’re being victimized by a foreign adversary?” he said. As for the administration: “Today we shared with Congress how we continue to bring the full strength, capabilities, and expertise of our departments and agencies to identity and defend against threats to the United States,” agency officials involved in the briefing said in a joint statement. “Just like our successful, whole-of-government approach to securing the 2018 elections, we will work together with our Federal, state, local and private sector partners as well as our foreign allies to protect the 2020 elections and maintain transparency with the American public about our efforts.”

National: As Feds struggle, states create their own anti-election propaganda programs | Kevin Collier/CNN

As the 2020 presidential campaign heats up, individual states are ramping up education efforts to counter the threat posed by foreign disinformation campaigns to US elections. A lack of action at the federal level has prompted many states to craft their own programs designed to counter foreign efforts to undermine American democracy and educate the next generation of voters in schools. “It harms our democratic process when disinformation is at any point fed to voters in our democratic process,” Michigan Secretary of State Jocelyn Benson told CNN. “So I do think as secretaries of state, we have a responsibility to it take to the people.” Declassified intelligence reports on Russian meddling, by design, refuse to analyze the effectiveness of American opinion. And though most of Russia’s known propaganda efforts in the 2016 election were unsophisticated — armies of trolls with often strongly partisan opinions on polarizing subjects — they were effective enough to be widely quoted in the media and cited by a number of political figures, including Texas Republican Sen. John Cornyn, Donald Trump’s then-campaign manager Kellyanne Conway, and Michael Flynn, who went on to briefly serve as Trump’s national security adviser and was later charged and pleaded guilty to lying to the FBI about conversations with Russia’s ambassador.

National: Voting Machine Makers Claim The Names Of The Entities That Own Them Are Trade Secrets | Tim Cushing/Techdirt

Recently, the North Carolina State Board of Elections asked suppliers of electronic voting machines a simple question: who owns you? (h/t Annemarie Bridy) On June 14, 2019, the State Board of Elections requested that your companies disclose any owners or shareholders with a 5% or greater interest or share in each of the vendor’s company, any subsidiary company, of the vendor, and the vendor’s parent company. This seems like very basic information — information the Board should know and should be able to pass on to the general public. After all, these are the makers of devices used by the public while electing their representatives. They should know who’s running these companies and who their majority stakeholders are. If something goes wrong (and something always does), they should know who’s ultimately responsible for the latest debacle. It’s not like the state was asking the manufacturers to cough up code and machine schematics. All it wanted to know is the people behind the company nameplates. But the responses the board received indicate voting system manufacturers believe releasing any info about their companies’ compositions will somehow compromise their market advantage. Hart Intercivic said letting the public know that the company is owned by H.I.G. Hart, LLC and Gregg L. Burt is a fact that would devalue the company if it were made public. Hart InterCivic, a corporation that derives independent actual value from this information not being generally known or readily ascertainable and makes reasonable efforts to maintain the secrecy of this information, requests that it be designated as a trade secret pursuant to G.S. § 132-1.2(1)d. and G.S. § 66-152(3).

National: Disabled voters left behind in push to amp up 2020 security, advocates say | Jordan Wilkie/The Guardian

Russian attacks on American democracy in 2016, carried out over the internet, have triggered a national debate over the use of technology in the United States’ upcoming 2020 elections. But some of the best ways to beef up the security of the voting process and fight off future cyber-attacks could have an unintended consequence: limiting access to the vote for people with disabilities. Voting on hand-marked paper ballots – which by definition can’t be hacked – combined with robust audits of how the elections were carried out and how the votes were counted is widely seen as the most secure way to run an election. Cybersecurity experts want hand-marked paper ballot systems, but disability rights advocates want voting machines to be used for all voters, as they are best for disabled access. The two groups have been butting heads over this since the Help America Vote Act (Hava) of 2002, which gave states $3.9bn to buy new voting technology and required every polling place have at least one accessible voting machine. Rather than operate parallel systems – and since it was on the federal dime – many county and state governments decided to purchase voting machines to be used by all voters – something now seen as a security weakness.

National: FEC allow scampaigns to accept discounted cybersecurity services | Maggie Miller/The Hill

The Federal Election Commission (FEC) on Thursday approved a request from a private company to provide discounted cybersecurity services to political campaigns, saying it did not violate campaign finance rules. The decision came in response to a request from Area 1 Security, a California-based company, to offer cybersecurity services to federal political candidates and political committees at discounted rates. The FEC, which has jurisdiction over campaign finance for presidential and congressional elections, decided the arrangement did not violate campaign contribution rules because the company offers similar discounted services to nonpolitical clients as well. The decision allows the company to sell anti-phishing services to federal candidates and political committees for as little as $1,337 per year, according to the FEC. The agency wrote that “doing so would be in the ordinary course of Area 1’s business and on terms and conditions that apply to similarly situated non-political clients.”

National: Oh, lovely, a bipartisan election hack alert law bill for Mitch McConnell to feed into the shredder | Shaun Nichols/The Register

Two US lawmakers are pushing a bipartisan bill that would force the Department of Homeland Security (DHS) to alert the public of hacking attempts on election computer systems. House reps Mike Waltz (R-FL) and Stephanie Murphy (D-FL) agreed to reach across the aisle to sponsor HR 3259, the Achieving Lasting Electoral Reforms on Transparency and Security (ALERTS Act). The bill, right now resting in the hands of the House Administration Committee, would require Homeland Security officials issue a notification to Congress, state governments, and local officials whenever they, or any other federal agency, “have credible evidence of an unauthorized intrusion into an election system and a basis to believe that such intrusion could have resulted in voter information being altered or otherwise affected.” It seems incredible that this wouldn’t already happen, but then we remembered we’re living in America in 2019. In addition to state and local authorities, the bill would require individual members of the public be notified when any of their personal information – such as information on voter rolls – is thought to have been pilfered by hackers.

National: Top intelligence, homeland and cyber officials brief Congress on election security | Karoun Demirjian/The Washington Post

The full House and Senate were briefed about election security Wednesday by the Trump administration’s top intelligence, homeland security and cybersecurity officials as the parties continue to battle over how to protect the 2020 elections against foreign threats. Director of National Intelligence Daniel Coats; FBI Director Christopher A. Wray; the director of the National Security Agency and commander of U.S. Cyber Command, Gen. Paul M. Nakasone; and acting homeland security secretary Kevin McAleenan were among the senior officials who spoke to the full complement of House members and senators in back-to-back briefings. They told the lawmakers about the state of election security, including the new tools the government has equipped itself with to identify and avert future organized attempts to interfere with federal elections. Democrats and Republicans left the sessions expressing confidence in the officials’ efforts, even while the parties remain bitterly divided as to whether President Trump is taking election security seriously enough. That division has played out in Congress as a standoff between each party’s leaders, who spent Wednesday accusing each other of attempting to politicize election security to achieve partisan objectives.

National: Democrats clash with Republicans over election security | Marianne Levine, Sarah Ferris and Heather Caygle/Politico

House Democrats and Senate Republicans may have attended similar classified briefings on election security Wednesday, but they left with opposite conclusions. House Democrats expressed deep concerns about the White House’s ability to protect voting systems in 2020, drawing fresh scrutiny to the administration’s efforts to prevent foreign meddling in another election. But Senate Republicans said they had faith in the administration’s handling of the issue and saw no need for further legislation on election security. The divergent reactions suggests that while both parties acknowledge the role of Russian interference in the 2016 election, detailed in former special counsel Robert Mueller’s report this spring, Congress is unlikely to take any further legislative action. Leaving the hour-long House briefing, several senior Democrats said they still had key questions about the Trump administration’s work ahead of next November’s election, including which agency is leading the effort to combat foreign interference. “There is real interest on the part of members of Congress to know who is in charge or what are the operating procedures for the process to move forward,” said Rep. Bennie Thompson (D-Miss.), chairman of the House Homeland Security Committee. “And the answers were not as clear as they need to be.”

National: Republicans say they’re satisfied with 2020 election security after classified briefings | Jordain Carney/The Hill

Congressional Republicans are expressing confidence that the 2020 elections will be secure, despite strong protests from Democrats that more needs to be done. House and Senate members received separate classified briefings from senior administration officials on Wednesday, during which the plans for securing the 2020 elections were outlined in the wake of Russia’s extensive interference ahead of the 2016 vote. House Minority Whip Steve Scalise (R-La.) told reporters that while the U.S. must be “very vigilant” against election threats from foreign governments, “the agencies have the tools they need, and I am confident they are addressing the threats.”Sen. Lindsey Graham (R-S.C.), a close ally of President Trump who has previously supported additional election security legislation, said that he was “very impressed” by the administration’s efforts ahead of 2020. “They all said the president is giving them every authority they’ve asked for. No interference from the White House,” Graham said. While none of the administration officials involved spoke with the press, several lawmakers confirmed that they said during the closed-door meetings they didn’t need additional legislation or extra funding from Congress.

National: Trump officials warn of ‘active threats’ to US elections | Matthew Daly/Associated Press

The Trump administration warned of unspecified “active threats” to U.S. elections as top security officials briefed Congress Wednesday on steps the government has taken to improve election security in the wake of Russian interference in 2016. Director of National Intelligence Dan Coats, FBI Director Christopher Wray and other officials “made it clear there are active threats and they’re doing everything they can” to stop them, said Rep. Debbie Dingell, D-Mich. Dingell called the closed-door presentation “very impressive” and said the issue was “one we all need to take seriously.” Coats, Wray and other officials, including acting Homeland Security Secretary Kevin McAleenan, met separately with the House and Senate in classified briefings at the Capitol. Democrats requested the sessions as they press legislation to keep Russia and other foreign adversaries from interfering with the U.S. political system. House Minority Whip Steve Scalise, R-La., called the briefing helpful and said it reinforced the importance of remaining vigilant against outside threats to U.S. elections. Federal agencies “continue to learn from the mistakes of the 2016 election, when the (Obama) administration was flat-footed in their response” to Russian interference, Scalise said. “We need to stay vigilant.”

National: No new legislative momentum after election security briefings | Niels Lesniewski/Roll Call

Sen. Marco Rubio emerged from a closed briefing on the Trump administration’s efforts to secure elections and made a renewed push for his own bipartisan deterrence legislation, even as he acknowledged there has not been momentum. “In my view, they’re doing everything you can do,” Rubio said of the administration efforts. “Election interference is a broadly used term, and understand this is psychological warfare. It’s designed to weaken America from the inside out, to drive divisions internally so we fight with each other, to undermine our confidence in the elections and in our democracy and particularly to undermine individual candidates either because they don’t like that candidate or because they know someone else.” Rubio, a Florida Republican, then plugged the DETER Act, a bipartisan bill he introduced with Maryland Democratic Sen. Chris Van Hollen, that is designed to provide for new sanctions to be imposed against Russia or other adversaries in the event of future interference.

National: Feds Don’t Regulate Election Equipment, So States Are On Their Own | Matt Vasilogambros/Stateline

Behind nearly every voter registration database, voting machine and county website that posts results on Election Day, there’s an election technology company that has developed those systems and equipment. By targeting one of those private vendors, Russia, China or some other U.S. adversary could tamper with voter registration rolls, the ballot count or the publicly released results, potentially casting doubt on the legitimacy of the final tally. Nevertheless, there are no federal rules requiring vendors to meet security standards, test equipment for vulnerabilities or publicly disclose hacking attempts. With the 2020 presidential election approaching, security experts, lawmakers and even election vendors themselves are calling for more rigorous testing of election equipment and stricter security standards for the private companies that provide election-related services. “The lack of vendor regulation in the election technology space is a big gap that needs to be addressed,” said Edgardo Cortés, an election security expert at the Brennan Center for Justice at New York University Law School.

National: Portland cybersecurity company aims to design, protect the future | Pat Dooris/KGW