National

On Friday, a group of hackers targeted computer infrastructure in Russia and Iran, impacting internet service providers, data centres, and in turn some websites. In addition to disabling the equipment, the hackers left a note on affected machines, according to screenshots and photographs shared on social media: “Don’t mess with our elections,” along with an image of an American flag. Now, the hackers behind the attack have said why they did it. “We were tired of attacks from government-backed hackers on the United States and other countries,” someone in control of an email address left in the note told Motherboard Saturday.

National: When Russian hackers targeted the U.S. election infrastructure | 60 Minutes/CBS News

The U.S. intelligence community has concluded there is no doubt the Russians meddled in the 2016 U.S. presidential election, leaking stolen e-mails and inflaming tensions on social media. While Congress and special counsel Robert Mueller investigate Russian interference, including whether the campaign of Donald Trump colluded with Russia, we have been looking into another vector of the attack on American democracy: a sweeping cyber assault on state voting systems that U.S. intelligence tied to the Russian government. Tonight, you’ll find out what happened from the frontline soldiers of a cyberwar that was fought largely out of public view, on digital battlegrounds in states throughout the country. The threat Russia posed to our democratic process was deemed so great, the Obama Administration took the unprecedented step of using the cyber hotline – the cybersecurity equivalent of the nuclear hotline – to warn the Kremlin to stop its assault on state election systems. Russian operatives had launched a widespread cyberattack against state voting systems around the country.

National: The Challenge of Machines in the 21st Century | Fair Observer

Information technology and the internet are changing the way democracy works. Recent revelations of the use of personal data to manipulate elections tell us that we live in a very different place we thought we did just weeks ago. Marketing companies, like the now infamous Cambridge Analytica, may deploy data profiling to influence human targets on social media. This involves the enveloping of the subjects within an artificial world; Christopher Wylie, the whistleblower at the center of this scandal, referred to these worlds as “cultures.” In each of these artificial cultures, political candidates would appear to each target from a different aspect, but always as a perfect candidate tailored to the psychographic profile of that particular voter. This approach, Cambridge Analytica claims, would increment the candidate’s electoral margins. There is currently no information if the use of personal data had a deciding effect on the US presidential elections. However, the process is revealing of the power online companies hold today to, in principle, manipulate its customers.

National: Facebook to Require Verified Identities for Future Political Ads | The New York Times

For months, Facebook’s critics — ranging from Silicon Valley executives to Washington politicians — have been urging the company to do a better job of identifying who is buying political ads and creating pages about hot-button topics on its social media sites. On Friday, just days before its chief executive, Mark Zuckerberg, is expected to testify before Congress, Facebook said it had started forcing people who want to buy political or “issue” ads to reveal their identities and verify where they are. Mr. Zuckerberg announced the move in a post on Facebook. He said this verification was meant to prevent foreign interference in elections, like the ads and posts from so-called Russian trolls before and after the 2016 presidential election.

National: Politicians follow in Facebook’s footsteps on mass data collection | Politico

The last three weeks have revealed how reliant political campaigns have become on people’s data. Almost 90 million Facebook users from Los Angeles to London may have had their online information illegally collected by Cambridge Analytica as part of its work for Donald Trump’s 2016 presidential campaign. Mark Zuckerberg, the social networking giant’s chief executive, will testify to U.S. lawmakers this week over claims that the tech giant played fast and loose in its protection of people’s online privacy. Both companies deny any wrongdoing. It’s legitimate to point the finger at the world’s largest social network and a data analytics firm with somewhat shady political connections. But there’s one sizeable piece of the puzzle that’s missing from the world’s newfound fixation on digital privacy: voters themselves.

National: 14 states’ voting machines are highly vulnerable. How’d that happen? | McClatchy

Texas counties have doled out millions of dollars in recent months to replace thousands of old touch-screen voting machines that lack a paper record – a weakness security experts warn could allow Russians or other hackers to rig U.S. elections without detection. The problem is, many of the new machines have the same vulnerability. So do similar machines in more than a dozen states across the country. Vicki Shelly, the election administrator in San Jacinto County, Tex., north of Houston, said she received no alert from Washington or state officials before the county spent $383,000 on its new paperless touch-screen voting system made by Hart InterCivic. “Whoever’s doing all the research, it seems like we should have been in on it a little sooner,” said Shelly, one of hundreds of election officials that make up the first line of defense against attempts to tamper with U.S. election results. “Honestly, it’s very disturbing.”

National: States, cities sue U.S. to block 2020 census citizenship question | Reuters

A group of U.S. states and cities sued the Trump administration to stop it from asking people filling out 2020 census forms whether they are citizens. The lawsuit by 17 states, Washington D.C. and six cities challenged what they called last week’s “unconstitutional and arbitrary” decision by the U.S. Department of Commerce, which oversees the Census Bureau, to add the citizenship question. It was also a fresh challenge to what New York Attorney General Eric Schneiderman, at a press conference announcing the lawsuit, called the administration’s “anti-immigrant animus.” All of the states bringing the case have Democratic attorneys general. They were joined by New York City, Chicago, Philadelphia, San Francisco, Seattle and Providence, Rhode Island, which all have Democratic mayors, and the U.S. Conference of Mayors. Another state, California, filed a similar lawsuit last week.

National: How Partisan Gerrymandering Became Supreme Court Issue | Bloomberg

Gerrymandering, the process of drawing district lines to fortify one political party at the expense of another, is as old as the U.S. republic. In the late 1780s, Virginia Governor Patrick Henry, who opposed ratifying the new Constitution, got allies in his state’s legislature to draw a congressional district map unfavorable to James Madison, the father of the founding document. (Madison won anyway.) Good-government groups grouse that gerrymandering lets politicians choose their constituents, rather than the other way around. But as the courts get more involved, others fret about judges interfering in politics.

National: Felony Voting Laws Are Confusing; Activists Would Ditch Them Altogether | Stateline

Her sentencing made headlines across the country this week: A woman, recently released from prison in Texas and still on felony probation, is set to head back to prison for another five years after she unknowingly broke the law by voting in the 2016 election. Texas law prohibits people such as Crystal Mason from voting until they are no longer under supervision by corrections officers. Mason told the court she had no idea she was prohibited from voting. At her polling station, officials let her cast a provisional ballot. The confusion over felons’ voting rights is not limited to Mason’s situation or to Texas. Across the country, state felon voting laws vary widely. Some states bar people from voting only while they are in prison, while others deny voting rights to people who are still under the supervision of a probation or parole officer. And some prohibit convicted felons from voting for the rest of their lives, unless they receive a pardon from the governor.

National: Groups partner to improve local elections | The Hill

The education arm of The Leadership Conference on Civil and Human Rights is teaming up with a voting rights group to increase voter turnout and fix polling problems that keep people from voting. The Leadership Conference Education Fund announced Wednesday that it’s partnering with Access Democracy for three years to provide institutional support in the group’s efforts to fix local election issues such as long lines and broken voting machines.

National: Voting machine vendor firewall config, passwords posted on public support forum | CSO

April 5, 2018

A sysadmin at a leading voting machine vendor posted a firewall configuration file, including passwords, into a public Cisco support forum in 2011, opening the company up to possible attack. The config files expose a wealth of information useful to an attacker, including domain name, hostname, and ASA version number. While there is no evidence that the voting machine vendor was compromised, this accidental leakage of information is “juicy intelligence,” Dan Tentler, founder and CEO of Phobos Group, an attack simulation security company, tells CSO. “If you have a crack team of cat burglar types and they’re all going to break into a building, this firewall configuration file is the equivalent of finding the floor plan of the building they are planning to break into,” Tentler says.

National: Lawyer Alex van der Zwaan jailed for 30 days in Mueller’s first conviction | The Guardian

April 5, 2018

A Dutch attorney was sentenced on Tuesday to 30 days in prison for lying to federal agents, in the first formal conviction obtained by Robert Mueller in his investigation of Russian election interference and alleged collusion between aides to Donald Trump and Moscow. A federal judge in Washington sentenced Alex van der Zwaan, a 33-year-old lawyer who previously worked with Paul Manafort, Trump’s former campaign manager. He was also ordered to pay a $20,000 fine. Van der Zwaan had pleaded guilty to lying to the FBI about his contacts with another former Trump adviser, Rick Gates, and a person the FBI has assessed as being tied to Russian military intelligence.

National: Meet the high-tech solution to Russian election hacking: paper ballots | Vox

April 4, 2018

Russian hackers tried to tamper with voting systems in 21 states during the 2016 US presidential election, and the American intelligence community expects Moscow will try again in November. But states from Virginia to Rhode Island aren’t focused on new cybersecurity software. Instead, they’re looking to one of the oldest technologies in existence: paper. It’s a striking change from 2016, when five states used electronic voting systems that didn’t leave any paper record of votes, and nine used some paperless machines. Now, states are rushing to take advantage of $380 million that Congress approved last month to help protect voting systems. Most states are prioritizing some kind of paper record. “In this year of our lord 2018, we’re talking about paper ballots, but that actually might be one of the smartest systems,” Sen. Kamala Harris (D-CA) told reporters in March.

National: Want to hack a voting machine? Hack the voting machine vendor first | CSO

Thousands of voting machine vendor employees’ work emails and plaintext passwords appear in freely available third-party data breach dumps reviewed by CSO, raising questions about the security of voting machines and the integrity of past election results. While breached sites, like LinkedIn after the 2012 breach, force users to change their passwords, a significant number of people reuse passwords on other platforms, making third-party data breaches a gold mine for criminals and spies. For many years voting machine vendors have claimed that voting machines were air gapped — not connected to the internet — and were thus unhackable. Kim Zetter debunked that idea in The New York Times in February. An attacker who managed to break into a voting machine vendor employee’s work email, because the employee used the same password as on a breached site, could leverage that to gain access to the voting machines themselves. And if voting machine vendors install remote access software on voting machines, factory backdoors that vendor employees use to remotely access the machines for maintenance, troubleshooting or election setup purposes, this turns voting machine vendor employees into targets. Hack the vendor, hack the voting machine.

National: Here’s how much money states will receive for election security upgrades | Cyberscoop

The Trump administration has told states exactly how much of a $380 million fund they will get to make their voting systems more cyber-secure ahead of the 2018 midterm elections. The funding, made available through a $1.3 trillion omnibus package passed last week, is one of Congress’s first major steps to prevent a repeat of Russian hackers’ meddling in U.S. elections. The money can be used to upgrade state computer systems and offer cybersecurity training to election officials, among other things. California, Florida, New York and Texas together will get a quarter of the cash, with California leading the pack with about $35 million. A full breakdown of the funding can be found here. The money is a “breakthrough for election security and the health of our country’s democracy,” said Lawrence Norden of the Brennan Center for Justice at NYU Law.

National: So Your State Has Come Into Some Election Security Money. Now What? | Route Fifty

Most states won’t have risk-limiting audits in place by the November midterms, which makes how they spend the $380 million in federal funding for election security, due out within 39 days, that much more important. Congress included the money in the omnibus spending bill, at the Senate Intelligence Committee’s recommendation, to be disbursed to states under the Help America Vote Act and spent on verifiable paper balloting, post-election audits of votes and cyber defenses. The appropriation is a good first step in shoring up voting systems against Russian-connected hacking, according to election security experts, but it doesn’t come close to replacing vulnerable polling place equipment in most at-risk states. “I wouldn’t say it’s a drop in the bucket—a glass of water in the bucket,” Joe Kiniry, Free & Fair CEO and chief scientist, told Route Fifty by phone. “A big corporation spends this much money on cybersecurity in a year.”

National: Higher cyber security services demand around elections, says McAfee boss | Press Association

The chief executive of McAfee believes cyber security firms will see higher demand for election protection as authorities in countries such as the US and UK try to safeguard “integrity” at the ballot box. Chris Young said there was a growing trend of attacks targeting “major events” like the most recent Winter Olympics, with the next big focus likely to be the highly-anticipated US midterm elections in November. “We’re now at a point where you could almost be certain than any notable event will have a corresponding set of cyber attacks with it,” he told the Press Association, adding that “election protection is going to be … bigger.”

National: Trump administration says a citizenship question on the census will help enforce voting rights. Sure. | Los Angeles Times

He went ahead and did it. Of course he did. Bashing California is way too much fun and easy for President Trump. California Democratic leaders shouldn’t be shocked. Politically, they had it coming, proudly emerging as the president’s chief antagonist while revving up their liberal and Latino bases. Not that Trump didn’t deserve it. He has been feeding his political base by assailing California and immigrants in the country illegally since first running for president. But when a state plays hardball with a president — especially a brawler like Trump — it should expect to get hit hard. A president always has a bigger bat.

National: Everyone Knows How to Secure Elections. So Do It | WIRED

After months of stalled progress in Congress, efforts to promote and fund nationwide election security improvements have finally gained some momentum this week. The Senate Intelligence Committee released its long-awaited election infrastructure defense recommendations. Senate leaders got behind a revised version of the Secure Elections Act. And late Thursday night, the Senate passed the omnibus spending bill, which includes $380 million for securing digital election systems. All the pieces are in place. The solutions are clear. All that’s left is the doing. But, of course, that turns out to be the hardest part. Experts say that while Congress did take meaningful action this week, it likely comes too late to play an extensive role in securing this year’s midterm elections. “This is a great first step, but it’s not going to solve the problem,” says Marian Schneider, president of Verified Voting, a group that promotes election system best practices. “Just the heightened awareness of what is the threat model and what are best practices for dealing with that threat model makes me hopeful and optimistic that those steps will be taken. But I would like to see the vulnerable systems replaced, and the clock is ticking. The farther we get into the year, the less likely it is. That’s just a reality.”

National: Justices cast doubt on partisan redistricting | Politico

The Supreme Court on Wednesday grappled with a case with the potential to reorder the country’s political landscape: How much gerrymandering is too much gerrymandering? Republicans who sued to overturn the congressional district lines that Maryland implemented after the 2010 census map found allies in the court’s four liberal justices, who expressed sympathy for their claims during oral arguments. What’s less clear is whether those four can recruit another justice to their side — the most likely targets would be Chief Justice John Roberts or Justice Anthony Kennedy, typically the high court’s swing vote on election law cases. Both asked tough questions, but neither tipped his hand. At issue was Maryland’s 6th Congressional District, represented for 20 years by a Republican. After the 2010 census, Democrats in the state legislature and the then-Democratic governor redrew the district lines to move large numbers of Democratic voters into the district. Democratic Rep. John Delaney won the seat in 2012 and was reelected twice after.

National: Everyone Agrees That All Voting Machines Should Leave A Paper Trail. Here’s Why It Won’t Happen. | Buzzfeed

Despite Congress’s agreement last week to spend $380 million to help states replace voting machines that don’t produce a paper trail, it’s likely that tens of thousands of voters will cast their ballots in this year’s midterm elections on outdated equipment that the Department of Homeland Security has called a “national security concern.” That’s because the newly approved money will be allocated to all 50 states instead of just those that have the greatest need to replace voting machines. Thirteen states use voting machines that can’t be audited because they don’t produce a paper trail to check against the machine’s electronic tabulations. Of those, only two would receive enough funding under the recent appropriation to replace all their machines; the rest could replace only a fraction of what they need. For example, the funding would cover less than half the cost of what it would take for Pennsylvania — a state whose results were critical to the outcome of the 2016 presidential race — to replace all of its outdated machines.

National: Protecting election registration sites from cyber intrusions | GCN

The Center for Internet Security’s newly established Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) plans to deploy intrusion detection sensors to voter registration websites for all 50 states by the 2018 midterm elections, an official told GCN. The intrusion detection sensors are called Albert sensors, and CIS has been using them on the state and local level since 2010, according to CIS Vice President of Operations Brian Calkin. The open-source Albert sensors provide automated alerts on both traditional and advanced network threats. Albert grew out of a Department of Homeland Security’s Einstein project, which focuses on detecting and blocking cyberattacks within federal agencies. DHS approached CIS about creating similar capability for states and localities, but since the Einstein name was taken, CIS called it Albert instead.

National: Election Assistance Commission announces security funding | GCN

As part of the omnibus spending law passed on March 23, all 50 states, the District of Columbia and four U.S. territories are getting funding to improve their elections infrastructure prior to the 2018 elections. On March 29, the Elections Assistance Commission announced how the $380 million will be distributed. An extension of the 2002 Help America Vote Act that distributed funds to states to improve voting systems and voter access issues identified following the 2000 election, the 2018 HAVA Election Security Fund will give states additional resources to secure and improve their election systems. The funds will be made available by the EAC as grants to make it easier for states to access the funds ahead of the 2018 federal elections. States will receive grant award notification letters in April. With primary elections already underway, however, states will be allowed to incur costs against forthcoming grant awards with EAC approval.

National: Facebook aim to fight election manipulation misses a big problem, critics say | USA Today

After being gamed by Russian operatives during the 2016 presidential election, Facebook says it’s working to tighten election security ahead of the midterm elections. Company executives detailed new initiatives to prevent foreign interference and anticipate new tactics to undermine the integrity of the November elections. Thursday’s remarks were part of a widening public relations campaign to rebuild consumer trust following the Cambridge Analytica data leak, which gave access to the personal information of tens of millions of Facebook users to a political ad targeting firm without their consent. They come as concern mounts that Facebook can be too easily exploited to disrupt elections and democracies around the globe. “We’ve gotten progressively better over the last year and a half,” Samidh Chakrabarti, who leads Facebook’s work on election security and civic engagement, told reporters. “We feel like we’re going to be in a really good place for the 2018 midterms.”

National: Facebook’s Election Safeguards Are Still a Work in Progress | WIRED

Nearly three years after a Russian propaganda group infiltrated Facebook and other tech platforms in hopes of seeding chaos in the 2016 US election, Facebook has more fully detailed its plan to protect elections around the world. In a call with reporters Thursday, Facebook executives elaborated on their use of human moderators, third-party fact checkers, and automation to catch fake accounts, foreign interference, fake news, and to increase transparency in political ads. The company has made some concrete strides, and has promised to double its safety and security team to 20,000 people this year. And yet, as midterm races heat up in states across America, and elections overseas come and go, many of these well-meaning tools remain a work in progress. “None of us can turn back the clock, but we are all responsible for making sure the same kind of attack on our democracy does not happen again,” Guy Rosen, Facebook’s vice president of product management said on the call. “And we are taking our role in that effort very, very seriously.”

National: The Motives Behind the Trump Administration’s New Census Question on Citizenship | The New Yorker