National

With midterm elections looming and primaries already underway in many states, anxiety has been building over the possibility of cyberattacks that could impact voting. Though officials and election security researchers alike are adamant that voters can trust the United States election system, they also acknowledge shortcomings of the current security setup. Little time remains to meaningfully improve election security before the midterms. But Google parent company Alphabet's experimental incubator Jigsaw announced on Tuesday that it will start offering free protection from distributed denial of service attacks to US political campaigns. DDoS attacks overload a site or service with junk traffic so that legitimate users can't access it. For the last two years, Jigsaw's Project Shield has focused on fighting DDoS where it might be used for censorship around the world, offering free defenses to journalists, small publications, human rights groups, and election board sites. Now, those tremendous resources and that technical expertise will extend to political campaigns.

National: Judge To Decide Fate Of Civil Lawsuit Alleging Trump Campaign Colluded With Russia | NPR

A federal judge is deciding whether to permit a lawsuit to go forward in which Democrats allege that Donald Trump's campaign colluded with Russian government's cyberattacks on the 2016 presidential election. The parties appeared in federal court in Washington, D.C., on Thursday. The three plaintiffs are represented by Protect Democracy, a watchdog group made up primarily of former Obama administration lawyers. Two of the plaintiffs, Eric Schoenberg and Roy Cockrum, had their Social Security numbers dumped online by WikiLeaks; a third plaintiff, former Democratic National Committee staffer Scott Comer, said that his sexual orientation and personal medical details were publicized due to the leak of private emails.

National: Mueller hands judge full memo detailing Russia probe scope | Politico

Special counsel Robert Mueller has provided a federal judge with an unredacted version of the Justice Department memo laying out the scope of his investigation and the potential crimes he's authorized to pursue. However, the memo — long sought after by President Donald Trump's allies on Capitol Hill, who regularly accuse Mueller of overstepping his bounds — remains classified and not public, leaving its details hidden. The document was filed as an "unredacted memorandum" under seal with the U.S. District Court's Eastern District of Virginia, where Mueller is expected to try former Trump campaign chairman Paul Manafort on bank fraud charges.

National: Ryan to delay election security briefing, make it classified | The Hill

Speaker Paul Ryan (R-Wis.) has postponed a briefing for members of Congress on the security of U.S. voting systems so that it can be classified. The move comes after Democrats, including House Minority Leader Nancy Pelosi (D-Calif.), pressed GOP leadership to make the briefing classified so that officials could go into sufficient detail about the scope of the threat and the Trump administration’s efforts to protect digital election systems from hackers. Sources told The Hill that the briefing, originally scheduled for Thursday evening, has been pushed back as a result of logistical issues that prevented it from being classified. GOP leadership is now working to reschedule the briefing.

National: Cambridge Analytica whistleblower says Bannon wanted to suppress voters | The Guardian

Former White House senior strategist Steve Bannon and billionaire Robert Mercer sought Cambridge Analytica’s political ad targeting technology as part of an “arsenal of weapons to fight a culture war”, according to whistleblower Christopher Wylie. “Steve Bannon believes that politics is downstream from culture. They were seeking out companies to build an arsenal of weapons to fight a culture war,” Wylie said, when asked why investors thought that the political consultancy’s efforts would work, targeting people based on psychological profiles and assessment of their personality. The pink-haired 28-year-old was appearing to give evidence on Capitol Hill for the first time since his decision to blow the whistle on the use of Facebook data by Cambridge Analytica set off shock waves that are still reverberating through Westminster, Washington DC and Silicon Valley. During his testimony to the Senate judiciary committee, Wylie also confirmed that he believed one of the goals of Steve Bannon while he was vice-president of Cambridge Analytica was voter suppression. “One of the things that provoked me to leave was discussions about ‘voter disengagement’ and the idea of targeting African Americans,” he said, noting he had seen documents referencing this.

National: Homeland Security unveils new cyber security strategy amid threats | Reuters

The U.S. Department of Homeland Security on Tuesday unveiled a new national strategy for addressing the growing number of cyber security risks as it works to assess them and reduce vulnerabilities. “The cyber threat landscape is shifting in real-time, and we have reached a historic turning point,” DHS chief Kirstjen Nielsen said in a statement. “It is clear that our cyber adversaries can now threaten the very fabric of our republic itself.” The announcement comes amid concerns about the security of the 2018 U.S. midterm congressional elections and numerous high-profile hacking of U.S. companies.

National: Legislation would force Trump to fill vacant cyber post | Federal Times

Reps. Jim Langevin, D-R.I., and Ted Lieu. D-Calif., aim to mandate that the Trump administration fill its cyber coordinator position left vacant in the wake of Rob Joyce’s departurein early May 2018. The two congressmen introduced the Executive Cyberspace Coordination Act May 15, 2018, which would create a National Office for Cyberspace in the Executive Office of the President, cementing a new cyber advisory role within the White House into law. “We have had three excellent cybersecurity coordinators since the late Howard Schmidt originated the position. It is an enormous step backwards to deemphasize the importance of this growing domain within the White House,” Langevin said in a news release on the bill. “We need a designated expert to harmonize cyber policy across the many agencies in government with responsibility in this space. We also need clear communication of administration positions on cybersecurity challenges, whether during major incidents or when establishing norms of responsible state behavior in cyberspace.”

National: Google rolls out free cyberattack shield for elections and campaigns | CNET

For about an hour on the night of a primary election in May, residents in Knox County, Tennessee, couldn't tell who was winning. Hackers had taken down the county's election tracking website, crashing the page at 8 p.m., right as polls were closing. The county's IT director, Dick Moran, said the website had seen "extremely heavy and abnormal network traffic." Its mayor called for an investigation into the cyberattack. The incident showed all the signs of a distributed denial-of-service attack -- when attackers flood a website's servers with traffic until they can't handle the incoming requests and crash. And it was just the kind of thing that Jigsaw, a tech incubator owned by Google's parent company, Alphabet, wants to prevent. The company is already expecting even more DDoS attacks as Election Day in the US, on Nov. 6, draws closer. "We have seen that attacks spike in election cycles in different parts of the world," said George Conard, a product manager for Jigsaw's Project Shield.

National: Homeland Security unveils new cyber security strategy amid threats | Reuters

National: Can Government Protect Our Elections From Cyber-Hacking? | The National Memo

For five days in late March, the computers running most of Atlanta city government were frozen—shut down and held hostage by hackers who used ransomware, a pernicious way of extorting money. The attackers breached networks and hard drives. They locked up and encrypted the data. They changed file names to “I’m sorry” and gave its targets a week to pay with cyber currency. “We are dealing with a hostage situation,” Atlanta Mayor Keisha Lance Bottoms said at the time. That nightmarish scenario is exactly what the officials who run state and local elections are seeking to prevent in spring primaries and especially next fall’s general election: a widespread disruption of voting in key locales and races, where the process is held hostage as the press, candidates, supporters and public impatiently demand results.

National: Ryan schedules US election security briefing for lawmakers | The Hill

Ryan schedules US election security briefing for lawmakers | The Hill #url#

National: Justice Department and F.B.I. Are Investigating Cambridge Analytica | The New York Times

The Justice Department and the F.B.I. are investigating Cambridge Analytica, the now-defunct political data firm, and have sought to question former employees and banks that handled its business, according to an American official and other people familiar with the inquiry. Prosecutors have questioned potential witnesses in recent weeks, telling them that there is an open investigation into Cambridge Analytica — which worked on President Trump’s election and other Republican campaigns in 2016 — and “associated U.S. persons.” But the prosecutors provided few other details, and the inquiry appears to be in its early stages, with investigators seeking an overview of the company and its business practices. The investigation compounds the woes of a firm that has come under intense scrutiny from lawmakers and regulators in the United States and Britain since The New York Times and Observer in London reported in March that it had harvested private data from more than 50 million Facebook profiles, and that it may have violated American election laws. This month, Cambridge Analytica announced that it would shut down and declare bankruptcy, saying that negative press and cascading federal and state investigations had driven away customers and made it impossible for the firm to remain in business.

National: Email No Longer a Secure Method of Communication After Critical Flaw Discovered in PGP | Gizmodo

If you use PGP or S/MIME for email encryption you should immediately disable it in your email client. Researchers have discovered a critical vulnerability they’re calling EFAIL that exposes the encrypted emails in plaintext, even for messages sent in the past. “Email is no longer a secure communication medium,” Sebastian Schinzel, a professor of computer security at Germany’s Münster University of Applied Sciences, told the German news outlet Süddeutschen Zeitun. The vulnerability was first reported by the Electronic Frontier Foundation (EFF) in the early hours of Monday morning, and details were released prematurely just before 6am ET today after Süddeutschen Zeitun broke a news embargo. The group of European researchers are warning people to stop using PGP entirely and say that, “there are currently no reliable fixes for the vulnerability.” You can read more about what the researchers are calling the EFAIL vulnerability at https://efail.de/.

National: Mueller’s Probe Is Even More Expansive Than It Seems | The Atlantic

FBI agents working for special counsel Robert Mueller allegedly detained a lawyer with ties to Russia who is closely associated with Joseph Mifsud, the shadowy professor who claimed during the election that Russia had “dirt” on Hillary Clinton. The revelation was made in a book co-written by that lawyer, Stephan Roh, and set to be published next month. “The Faking of RUSSIA-GATE: The Papadopoulos Case” is the latest in a stream of books aiming to capitalize on the chaos of this political moment. But it sheds new light on the expansive nature of Mueller’s investigation into Russia’s election interference and possible ties between President Donald Trump’s campaign team and Moscow. It also highlights Mueller’s interest in answering one of the probe’s biggest outstanding questions: whether the campaign knew in advance that Russia planned to interfere in the election.

National: Russian company charged in Mueller probe seeks grand jury materials | Reuters

A Russian company accused by Special Counsel Robert Mueller of funding a propaganda operation to interfere in the 2016 U.S. presidential election is asking a federal judge for access to secret information reviewed by a grand jury before it indicted the firm. In a court filing on Monday, lawyers for Concord Management and Consulting LLC said Mueller had wrongfully accused the company of a “make-believe crime,” in a political effort by the special counsel to “justify his own existence” by indicting “a Russian-any Russian.” They asked the judge for approval to review the instructions provided to the grand jury, saying they believed the case was deficient because Mueller lacked requisite evidence to show the company knowingly and “willfully” violated American laws.

National: Justice Department Official To Testify On Census Citizenship Question Request | NPR

The acting head of the Justice Department's civil rights division, John Gore, has agreed to testify about why the department requested a controversial, new citizenship question to be added to 2020 census forms, according to a DOJ official and Amanda Gonzalez, a spokesperson for the chairman of the House Oversight and Government Reform Committee. Lawmakers were planning to issue a subpoena for Gore, who was a no-show after receiving an invitation to appear at the committee's May 8 hearing about the upcoming national headcount. Gore has now "agreed to appear voluntarily" at a follow-up hearing on May 18, and was not served a subpoena, Gonzalez says.

National: The Facebook ad dump shows the true sophistication of Russia’s influence operation | The Washington Post

May 14, 2018

The massive trove of Facebook ads House Intelligence Committee Democrats released Tuesday provides a stunning look into the true sophistication of the Russian government’s digital operations during the presidential election. We’ve already heard a lot from the U.S. intelligence community about the hacking operation Russian intelligence services carried out against Democratic party computer networks to influence the election in favor of then-candidate Donald Trump. But this is the first time we have a swath of empirical and visual evidence of Russia’s disinformation campaign, in the form of more than 3,000 incredibly specific and inflammatory ads purchased by an Internet troll farm sponsored by the Kremlin.

National: Senate report on Russian hacking highlights threats to election tech vendors | CyberScoop

Lawmakers are concerned about a major blind spot in the government’s ongoing effort to protect U.S. elections from hackers. Agencies like the Homeland Security Department have little insight into the cybersecurity practices of election technology vendors. This lack of visibility opens the door to supply chain attacks, according to the Senate Intelligence Committee, which could be otherwise potentially detected or stopped by government cybersecurity experts. The Senate committee’s first installment of a larger report on Russian targeting of the 2016 presidential election was released late Tuesday night. It focuses on assessing the federal government’s response to security threats and provides recommendations for future elections.

National: U.S. Voting System Still Vulnerable To Cyberattacks 6 Months Before Election Day | NPR

As America heads toward the 2018 midterms, there is an 800-pound gorilla in the voting booth. Despite improvements since Russia's attack on the 2016 presidential race, the U.S. elections infrastructure is vulnerable — and will remain so in November. Cybersecurity expert Bruce Schneier laid out the problem to an overflowing room full of election directors and secretaries of state — people charged with running and securing elections — at a conference at Harvard University this spring. "Computers are basically insecure," said Schneier. "Voting systems are not magical in any way. They are computers." Even though most states have moved away from voting equipment that does not produce a paper trail, when experts talk about "voting systems," that phrase encompasses the entire process of voting: how citizens register, how they find their polling places, how they check in, how they cast their ballots and, ultimately, how they find out who won. Much of that process is digital.

National: States Await Election Security Reviews as Primaries Heat Up | Associated Press

With the midterm congressional primaries about to go into full swing, the Department of Homeland Security has completed security reviews of election systems in only about half the states that have requested them so far. The government's slow pace in conducting the reviews has raised concerns that the nation's voting systems could be vulnerable to hacking, especially after U.S. intelligence agencies warned that Russia plans to continue meddling in the country's elections. Among those still waiting for Homeland Security to conduct a risk assessment is Indiana, one of four states with primaries on Tuesday. Its ballot includes several hotly contested races, including a Republican primary for U.S. Senate. Indiana Secretary of State Connie Lawson said she is confident state officials have done what they can to safeguard Tuesday's voting, but acknowledged: "I'll probably be chewing my fingernails during the entire day on Election Day."

National: Six States Hit Harder By Cyberattacks Than Previously Known, New Report Reveals | NPR

Two years after Russia's wave of cyberattacks against American democracy, a Senate committee investigating election interference says those hackers hit more states harder than previously thought. The committee also added that it still doesn't know with complete certainty exactly how much of U.S. voting infrastructure was compromised. The report summary released this week by the Senate intelligence committee gives an overview of initial findings focused specifically on how Russian government operatives affected U.S. elections systems. The full report is undergoing a review to check for classified information.

National: Bolton pushing to eliminate White House cybersecurity job | Politico

President Donald Trump’s national security team is weighing the elimination of the top White House cybersecurity job, multiple sources told POLITICO — a move that would come as the nation faces growing digital threats from adversaries such as Russia and Iran. John Bolton, Trump’s hawkish new national security adviser, is leading the push to abolish the role of special assistant to the president and cybersecurity coordinator, currently held by the departing Rob Joyce, according to one current and two former U.S. officials with direct knowledge of the discussions. The sources spoke on condition of anonymity because of the sensitive nature of deliberations about internal White House operations.

National: Documents Reveal How Russian Official Courted Conservatives In U.S. Since 2009 | NPR

Kremlin-linked Russian politician Alexander Torshin traveled frequently between Moscow and various destinations in the United States to build relationships with figures on the American right starting as early as 2009, beyond his previously known contacts with the National Rifle Association. Documents newly obtained by NPR show how he traveled throughout the United States to cultivate ties in ways well beyond his formal role as a member of the Russian legislature and later as a top official at the Russian central bank. These are steps a former top CIA official believes Torshin took in order to advance Moscow's long-term objectives in the United States, in part by establishing common political interests with American conservatives. "Putin and probably the Russian intelligence services saw [Torshin's connections] as something that they could leverage in the United States," said Steve Hall, a retired CIA chief of Russian operations. "They reach to reach out to guy like Torshin and say, 'Hey, can you make contact with the NRA and some other conservatives... so that we can have connectivity from Moscow into those conservative parts of American politics should we need them?' And that's basically just wiring the United States for sound, if you will, in preparation for whatever they might need down the road."

National: What data on more than 3,500 Russian Facebook ads reveals about the interference effort | The Washington Post

On Thursday morning, Democratic members of the House Intelligence Committee released 8 gigabytes of archives containing more than 3,500 documents detailing advertisements run on Facebook from 2015 to 2017 and paid for by Russians attempting to interfere in American politics. We analyzed those files to get a better sense of how the Russian interference effort operated — and how well it worked. Overall, the files provide information on thousands of ads, including data on when ad campaigns began, when they ended, how effective they were and how much they cost. The two months in which the most campaigns began were May 2016 and April 2017 — shortly before the Russian effort was curtailed. (No data for June 2017 were released.)

National: A Voting Rights Push: Allowing Felons to Cast Ballots | Wall Street Journal

As the midterm elections draw closer, Dameon Stackhouse is eager to cast a ballot, but he can’t under New Jersey law because he remains on parole after more than a decade behind bars for second-degree robbery. “We have no say,” said Mr. Stackhouse, a 41-year-old construction worker and student at Rutgers University-New Brunswick. “This is one of the worst things you can do to a citizen.” New Jersey is weighing a measure that would immediately restore voting rights to Mr. Stackhouse and more than 94,000 other state residents with convictions. If passed by the state’s Democratic-controlled Senate and General Assembly, it would be the third U.S. state, along with Maine and Vermont, to allow people to vote even while incarcerated.

National: Fiercest Fight of the Midterms May Be the One for Maps | Roll Call