National

States have taken it upon themselves to bolster cyber defenses for the midterm elections instead of waiting for Congress to act. “Cybersecurity is now our focus, it’s what keeps many of us as secretaries of states and local officials up at night,” said Jim Condos, president of the National Association of Secretaries of State and Vermont Secretary of State. Hacks of states’ voter registration systems, voting machines or vote reporting systems could lead to rigged vote counts, confusion at polling booths and public distrust of results, according to interviews with voting advocacy groups, former and current Department of Homeland Security officials, and state election officials. Two dozen states lack several of the strongest measures that could protect them against cyber attacks: mandating voting machines that leave a paper trail and requirements for a post-election audit to check for accuracy of the system.

National: Midterms: how the votes of vulnerable groups are being suppressed | The Guardian

With just over a month before the crucial midterm elections, Americans in some states will return to the polls two years after the election of Donald Trump to face new laws that could make it harder to vote. Since a landmark supreme court ruling in 2013, which repealed key provisions of the 1965 Voting Rights Act, over a dozen states, mostly Republican controlled, have imposed a swathe of laws that critics argue are intended to suppress the franchise among often vulnerable, Democratic leaning, groups. The measures range from complex voter ID laws to restrictive voter registration procedures as well as efforts to cut back on polling places and bids to exclude more former felons from casting a ballot.

National: Twitter Releases Tweets Showing Russian, Iranian Attempts to Influence US Politics | VoA News

On Wednesday, Twitter released a collection of more than 10 million tweets related to thousands of accounts affiliated with Russia’s Internet Research Agency propaganda organization, as well as hundreds more troll accounts, including many based in Iran. The data, analyzed and released in a report by The Atlantic Council’s Digital Forensic Research Lab, are made up of 3,841 accounts affiliated with the Russia-based Internet Research Agency, 770 other accounts potentially based in Iran as well as 10 million tweets and more than 2 million images, videos and other media. Russian trolls targeting U.S. politics took on personas from both the left and the right. Their primary goal appears to have been to sow discord, rather than promote any particular side, presumably with a goal of weakening the United States, the report said.

National: Security Seals Used to Protect Voting Machines Can Be Easily Opened With Shim Crafted from a Soda Can | Motherboard

Voting machine vendors and election officials have long insisted that no one can manipulate voting machines and ballots because tamper-evident seals used to secure them would prevent intruders from doing so without anyone noticing. But a security researcher in Michigan has shown in videos how he can defeat plastic security ties that counties across his state use to protect ballot bags, the cases that store voting machines and the ports that store the memory cards on optical-scan machines—electronic voting machines that record paper ballots scanned into them. He can do so without leaving evidence of tampering. If an intruder obtains physical access to the machines and this port, it’s possible to alter software in the machines using a rogue memory card—something that security researchers at Princeton University demonstrated in the past is possible. Matt Bernhard, a grad student at the University of Michigan and voting machine security expert, posted two videos online last week showing how he can open different types of plastic tamper-evident ties used in Michigan in just seconds, using a shim crafted from an aluminum Dr. Pepper can. By simply curling a small piece of the aluminum around a plastic zip tie and slipping it into the channel that encases the tie, he’s able to open the security device and re-close it, while leaving no marks or damage to indicate it was manipulated. He demonstrated the technique on smooth plastic ties as well as zip ties.

National: Justice Dept. charges Russian woman with interference in midterm elections | The Washington Post

The Justice Department announced Friday it had charged a Russian woman who prosecutors say conspired to interfere with the 2018 U.S. election, marking the first criminal case that accuses a foreign national of interfering in the upcoming midterms. Elena Khusyaynova, 44, was charged with conspiracy to defraud the United States. Prosecutors said she managed the finances of “Project Lakhta,” a foreign influence operation they said was designed “to sow discord in the U.S. political system” by pushing arguments and misinformation online about a host of divisive political issues, including immigration, the Confederate flag, gun control and National Football League protests during the national anthem. The charges against Khusyaynova came just as the Office of the Director of National Intelligence warned that it was concerned about “ongoing campaigns” by Russia, China and Iran to interfere with the upcoming midterm elections and the 2020 race — an ominous message just weeks before voters head to the polls.

National: US voter records from 19 states sold on hacking forum | ZDNet

The voter information for approximately 35 million US citizens is being peddled on a popular hacking forum, two threat intelligence firms have discovered. “To our knowledge this represents the first reference on the criminal underground of actors selling or distributing lists of 2018 voter registration data,” said researchers from Anomali Labs and Intel471, the two companies who spotted the forum ad. The two companies said they’ve reviewed a sample of the database records and determined the data to be valid with a “high degree of confidence.” Researchers say the data contains details such as full name, phone numbers, physical addresses, voting history, and other voting-related information. It is worth noting that some states consider this data public and offer it for download for free, but not all states have this policy.

National: DHS finds increasing attempts to hack U.S. election systems ahead of midterms | NBC

The Department of Homeland Security says it’s working to identify who — or what — is behind an increasing number of attempted cyber attacks on U.S. election databases ahead of next month’s midterms. “We are aware of a growing volume of cyber activity targeting election infrastructure in 2018,” the department’s Cyber Mission Center said in an intelligence assessment issued last week and obtained by NBC News. “Numerous actors are regularly targeting election infrastructure, likely for different purposes, including to cause disruptive effects, steal sensitive data, and undermine confidence in the election.” The assessment said the federal government does not know who is behind the attacks, but it said all potential intrusions were either prevented or mitigated.

National: U.S. Still Hasn’t Finalized Election Security Plans—and the Midterms Are Weeks Away | Daily Beast

The midterms are less than a month away. But working groups inside the intelligence community charged with overseeing election security are still trying to finalize plans for countering foreign interference in the 2018 elections, three senior officials involved with the efforts told The Daily Beast. The issue came up in a meeting this month that included current senior intelligence officials and former officials who were asked to attend and provide advice. The Federal Bureau of Investigation and the National Security Agency were pinpointed as two of the departments that had made the most progress. The Department of Homeland Security, however, is lagging behind, according to officials inside the meeting.

National: How hackable are American voting machines? It depends who you ask | ABC

To hear Alex Halderman tell it, hacking the vote is easy. The University of Michigan professor is on a crusade to demonstrate how vulnerable American voting machines are, and some of his arguments are quite compelling. He has rigged mock elections. He has testified to the machines’ vulnerabilities in Congress and in court. He has even managed to turn a commonly used voting machine into an iteration of the classic arcade game Pac-Man. “They’re just computers at the end of the day,” said Halderman, who told the Senate Intelligence Committee last year that states should move back to paper ballots. “Often with voting machines, when you open it up, it’s not that different from a desktop PC or mobile device. The only difference is that it’s going to be 10 years out of date, or sometimes 20 years.”

National: November Elections and the Art of Voter Suppression | Union of Concerned Scientists

Voting rights violations are emerging across several states with less than a month before the conclusion of midterm elections in the United States. As a result of discriminatory election laws and procedures, representation and policy making power could be distorted in favor of powerful, entrenched interests, against the will of a majority of the electorate. The threat of such democratic dysfunction illustrates the need for meaningful electoral reform and the protection of voting rights for all citizens. Early voting is underway in seventeen states, including at least two states where voting rights have already become a flashpoint in pivotal elections. In North Dakota, Senator Heidi Heitkamp and challenger Kevin Cramer is in a race that Cook Political Report rates as a “toss up.” The election could determine control over the US Senate—but the Supreme Court of the United States just refused to block the state’s discriminatory practice of requiring voter identification from a residential street address.

National: Facebook to ban misinformation on voting in upcoming U.S. elections | Reuters

Facebook Inc will ban false information about voting requirements and fact-check fake reports of violence or long lines at polling stations ahead of next month’s U.S. midterm elections, company executives told Reuters, the latest effort to reduce voter manipulation on its service. The world’s largest online social network, with 1.5 billion daily users, has stopped short of banning all false or misleading posts, something that Facebook has shied away from as it would likely increase its expenses and leave it open to charges of censorship. The latest move addresses a sensitive area for the company, which has come under fire for its lax approach to fake news reports and disinformation campaigns, which many believe affected the outcome of the 2016 presidential election, won by Donald Trump.

National: GOP claims of voter fraud threat fuel worries about ballot access in November | The Washington Post

October 15, 2018

Nine months after President Trump was forced to dissolve a panel charged with investigating voter fraud, GOP officials across the country are cracking down on what they describe as threats to voting integrity — moves that critics see as attempts to keep some Americans from casting ballots in November’s elections. In Georgia, election officials have suspended more than 50,000 applications to register to vote, most of them for black voters, under a rigorous Republican-backed law that requires personal information to exactly match driver’s license or Social Security records. In Texas, the state attorney general has prosecuted nearly three dozen individuals on charges of voter fraud this year, more than the previous five years combined. And in North Carolina, a U.S. attorney and U.S. Immigration and Customs Enforcement (ICE) issued subpoenas last month demanding that virtually all voting records in 44 counties be turned over to immigration authorities within weeks — a move that was delayed after objections from state election officials.

National: More Senate Democrats back alternative to Secure Elections Act | FCW

October 15, 2018

For much of the past year, Sen. Ron Wyden’s (D-Ore.) Protecting American Votes and Elections Act has taken a backseat to the Republican-led, bipartisan-crafted Secure Elections Act in the election security debate on Capitol Hill. Boosters for the bipartisan effort continue to work to get their bill passed during the upcoming lame duck session. However, its stall out amid the perceived watering down of security provisions at the request of states in August combined with increasingly sunny forecasts for Democrats in the upcoming midterm elections may have provided an opening for consideration of alternative legislation. On Oct. 11, Wyden’s bill picked up four more Democratic co-sponsors in the Senate, with Tammy Duckworth (Ill.), Tammy Baldwin (Wis.), Maria Cantwell (Wash.) and Gary Peters (Mich.) all signing on.

National: What stands in the way of Native American voters? | Center for Public Integrity

October 15, 2018

Two years ago, when Chase Iron Eyes decided to run for Congress, he knew he had, as he puts it, “a snowball’s chance in hell” of winning. But Iron Eyes, a member of the Standing Rock Sioux Tribe, still saw the narrowest of paths to victory in the race for North Dakota’s sole congressional seat. If he and the two other Native American candidates running for state offices as Democratic nominees were able to boost Native American voter turnout while simultaneously convincing independent-minded undecided voters to break their way, he explained, he thought he might win. Instead, incumbent Rep. Kevin Cramer, a Republican, coasted to another term by a huge margin.

National: Online voting is a security nightmare, say experts | Fast Company

Online banking, ecommerce, e-filing taxes. Moving print documents and in-person services online–even those full of sensitive information–has been an inexorable trend for decades. And voting has moved in that direction too, in 32 U.S. states and several countries, starting in those simpler times of the 1990s and early 2000s. That was a giant security blunder, according to a new report from tech and election experts that urges a return to good old paper ballots. “This is a position consistently that computer scientists have been saying for a decade, and computer scientists are the ones who you think would be the most favorable to the idea [of online voting] because, we invent the things.” So says Jeremy Epstein, vice chair of the U.S. Technology Policy Council at the ACM, billed as the largest association of computing experts.

National: Election security groups warn of cyber vulnerabilities for emailed ballots | The Hill

Election security groups are sounding the alarm about emailed ballots ahead of the November midterm elections, warning in a new report that PDF and JPEG ballot attachments sent to election officials could be exploited by hackers. The organizations, including watchdog group Common Cause, issued a report Wednesday that found election workers who receive emailed ballots are at risk of clicking on unsafe attachments, sent from unknown sources, that could contain malware. “In jurisdictions that receive ballots by PDF or JPEG attachment, election workers must routinely click on documents from unknown sources to process emailed or faxed ballots, exposing the computer receiving the ballots — and any other devices on the same network — to a host of cyberattacks that could be launched from a false ballot laden with malicious software,” the report says. “An infected false ballot would enter the server like any other ballot, but once opened, it would download malware that could give attackers backdoor access to the elections office’s network.”

National: Can Elections Be Hacked? Online Voting Threatens 32 States, Report Says | Newsweek

Voters cast a minimum of 100,000 ballots using insecure internet methods in the 2016 election, highlighting an overlooked threat to election integrity, according to a report released Wednesday. Thirty-two states permit some voters—primarily overseas military personnel—to return ballots by email, fax or internet, according to “Email and Internet Voting: The Overlooked Threat to Election Security,” a report produced by the Association for Computing Machinery, Common Cause, the National Election Defense Coalition and R Street. “There are two concerns with email voting,” in which ballots and voter identification information are typically attached as a PDF or JPEG. “One—the ballots can be intercepted and undetectably altered or deleted. This hack was performed at DEF CON in August. And it’s something academics have long known,” Susannah Goodman, one of the authors of the report, told Newsweek. “Second—emailed ballots can be easily spoofed in a spear phishing attack designed to put malware on a county election official’s computer.”

National: To Deter Foreign Hackers, Some States May Also Be Deterring Voters | NPR

A number of states are blocking web traffic from foreign countries to their voter registration websites, making the process harder for some U.S. citizens who live overseas to vote, despite the practice providing no real security benefits. On its face, the “geo-targeting” of foreign countries may seem like a solid plan: election officials around the country are concerned about foreign interference after Russia’s efforts leading up to the 2016 election, so blocking traffic to election websites from outside the United States might seem like an obvious defense starting point. But cybersecurity experts and voting rights advocates say it’s an ineffective solution that any hacker could easily sidestep using a virtual private network, or VPN, a commonly-used and easily-available service. Such networks allow for a computer user to use the Internet and appear in a different location than they actually are.

National: Can Paper Ballots Save Our Democracy? | Slate

In August at DEFCON, the annual hackers’ convention in Las Vegas, J. Alex Halderman, a professor of computer science and an expert in cybersecurity, brought along several of his Diebold Accuvote TSX voting machines. The Accuvote is a touch-screen voting device known as a direct-recording electronic voting machine, which, as the name suggests, records votes and stores them on a memory device. Halderman’s machines were set up as part of the Voting Village, an area dedicated to the cybersecurity of voting machines, where visitors were asked to cast votes in a mock presidential election between George Washington and Benedict Arnold. “Because this is DEFCON, of course almost everyone thought they were clever and voted for Benedict Arnold,” said Halderman. At the end of the mock election, with over 100 votes cast, the machine produced the totals and the winner of the two-man race: the Dark Tangent.

National: Why federal courts may become the next front in the battle to secure our elections | The Hill

Last week, a team of security researchers who run the DefCon hacking convention released a report on voting machines in use around the country that contain structural flaws ripe for exploitation by hackers. Among its dismaying findings, DefCon reported a flaw in one widely used voting tabulator that, if hacked, “could enable an attacker to flip the Electoral College and determine the outcome of a presidential election.” Though it’s been nearly two years since the 2016 election, there remains a startling gap between the well understood need to secure our elections against cyberattacks and the reality on the ground. Computer security experts and leading intelligence and law enforcement voices have sounded the alarm on the persistent and serious threats facing election systems. Yet the actors best positioned to take broad action — state governments, Congress, and election system vendors — have moved slowly, and in some cases stalled.

National: Measure seeks to protect election systems from foreign foes | Associated Press