National

Russian hackers targeted 21 U.S. state election systems in the 2016 presidential race and a small number were breached but there was no evidence any votes were manipulated, a Homeland Security Department official told Congress on Wednesday. Jeanette Manfra, the department’s acting deputy undersecretary of cyber security, testified before the Senate Intelligence Committee. U.S. intelligence agencies have concluded the Kremlin orchestrated a wide-ranging influence operation that included email hacking and online propaganda to discredit Democratic presidential candidate Hillary Clinton and help Donald Trump, a Republican, win the White House in November. The Russia issue has cast a shadow over Trump’s first five months in office. The extent of interference by Russian hackers, and whether they or others could interfere in future elections, has been the source of speculation and media reports for months.

National: State and local election systems easy prey for Russians hackers | McClatchy

Local officials consistently play down suspicions about the long lines at polling places on Election Day 2016 that led some discouraged voters in heavily Democratic Durham County, N.C., to leave without casting a ballot. Minor glitches in the way new electronic poll books were put to use had simply gummed things up, according to local elections officials there. Elections Board Chairman William Brian Jr. assured Durham residents that “an extensive investigation” showed there was nothing to worry about with the county’s new registration software. He was wrong. What Brian and other election officials across eight states didn’t know until the leak of a classified intelligence is that Russian operatives hacked into the Florida headquarters of VR Systems, Inc., the vendor that sold them digital products to manage voter registrations. … David Jefferson, a computer scientist at the Lawrence Livermore National Laboratory in California who has acted in his personal capacity in trying to safeguard election integrity, said he believes it is “absolutely possible” that the Russians affected last year’s election. “And we have done almost nothing to seriously examine that,” he said. “The Russians really were engaged in a pattern of attacks against the machinery of the election, and not merely a pattern of propaganda or information warfare and selective leaking,” said Alex Halderman, a University of Michigan computer science professor. “The question is, how far did they get in that pattern of attacks, and were they successful?”

National: GOP Data Firm Accidentally Leaks Personal Details of Nearly 200 Million American Voters | Gizmodo

Political data gathered on more than 198 million US citizens was exposed this month after a marketing firm contracted by the Republican National Committee stored internal documents on a publicly accessible Amazon server. The data leak contains a wealth of personal information on roughly 61 percent of the US population. Along with home addresses, birthdates, and phone numbers, the records include advanced sentiment analyses used by political groups to predict where individual voters fall on hot-button issues such as gun ownership, stem cell research, and the right to abortion, as well as suspected religious affiliation and ethnicity. The data was amassed from a variety of sources—from the banned subreddit r/fatpeoplehate to American Crossroads, the super PAC co-founded by former White House strategist Karl Rove.

National: Can US Elections Be Hacked? Security Experts Call For More Protections Against Election Hacking | International Business Times

More than one hundred security researchers and experts signed on to a letter sent to member of the United States Congress to warn of their belief that not enough has been done to protect against potential threats to state and federal elections. The letter, published Wednesday as a Senate Intelligence Committee hearing on Russian interference during the 2016 U.S. presidential election, argues many states are unprepared to respond to cybersecurity risks that may arise during upcoming election.The signatories laid out three primary suggestions for securing the electoral process and prevent against any potential tampering that may occur. First, the experts called on election officials to establish voter-verified paper ballots as the “official record of voter intent.” Doing so would require phasing out paperless voting machines that offer no way to verify if a vote tallied by the system corresponds to the vote intended to be cast by the voter.

National: Election Hackers Altered Voter Rolls, Stole Private Data, Officials Say | Time

The hacking of state and local election databases in 2016 was more extensive than previously reported, including at least one successful attempt to alter voter information, and the theft of thousands of voter records that contain private information like partial Social Security numbers, current and former officials tell TIME. In one case, investigators found there had been a manipulation of voter data in a county database but the alterations were discovered and rectified, two sources familiar with the matter tell TIME. Investigators have not identified whether the hackers in that case were Russian agents. The fact that private data was stolen from states is separately providing investigators a previously unreported line of inquiry in the probes into Russian attempts to influence the election. In Illinois, more than 90% of the nearly 90,000 records stolen by Russian state actors contained drivers license numbers, and a quarter contained the last four digits of voters’ Social Security numbers, according to Ken Menzel, the General Counsel of the State Board of Elections.

National: Keeping Russia Out of the Voting Booth | The American Prospect

Of all the disturbing questions raised by Russia’s interference in last year’s election, the most alarming may be how a foreign power might hack into the nation’s voting infrastructure. So far there’s no evidence that Russian cyberattacks altered U.S. vote totals in any way. But recent disclosures make clear that Russian intelligence intrusions were much broader and deeper than initially known. And the U.S. election system, while it has strengths, remains vulnerable on several fronts. Aging voting machines, the absence of a paper trail in some states, and spotty audits are all weaknesses that could be exploited in 2018 and 2020. … While most states—36 all told—use machines that produce a paper record, that still leaves 14 states that still operate machines with no voter verifiable paper trail. The absence of paper makes it virtually impossible to cross-check and confirm results after the fact.

National: Computer expert: Some voting machines can be directly hacked | Washington Examiner

A computer science professor told the Senate Intelligence Committee Wednesday that voting machines that create an electronic record of the voters’ decisions are open to fraud and computer hacking, vulnerabilities that are big enough to potentially change the outcome of some elections. J. Alex Halderman, professor of computer science at Michigan University, said he and his team began studying “direct-recording electronic” (DRE) voting machines 10 years ago and found that “we could reprogram the machine to invisibly cause any candidate to win. We also created malicious software — vote-stealing code — that could spread from machine-to-machine like a computer virus, and silently change the election outcome.” … As a computer science professor, Halderman has not only run academic trials on hacking voting machines, he has also run real-time examples.

National: Intelligence Panel Learns How to Hack Air-Gapped Voting Systems | GovInfo Security

Hackers can breach air-gapped voting machines and vote tallying systems – those not connected to internet – in an attempt to alter ballots to sway the outcome of an election, the Senate Select Committee on Intelligence has learned. “Our election infrastructure is not as distant from the internet as it may seem,” Alex Halderman, a University of Michigan computer science professor, testified Wednesday before the Senate Select Committee on Intelligence The Senate panel, as well as its House counterpart, held simultaneous hearings focused on the impact of Russian hacking on America’s election process (see Election Systems’ Hacks Far Greater Than First Realized ). At both sessions, lawmakers heard witnesses agree that Russian hackers did not alter votes in the 2016 presidential election.

National: Obama White House Knew of Russian Election Hacking, but Delayed Telling | The New York Times

The Obama administration feared that acknowledging Russian meddling in the 2016 election would reveal too much about intelligence gathering and be interpreted as “taking sides” in the race, the former secretary of homeland security said Wednesday. “One of the candidates, as you recall, was predicting that the election was going to be ‘rigged’ in some way,” said Jeh Johnson, the former secretary, referring to President Trump’s unsubstantiated accusation before Election Day. “We were concerned that by making the statement we might, in and of itself, be challenging the integrity of the election process itself.” Mr. Johnson’s testimony, before the House Intelligence Committee, provided a fresh insight into how the Obama administration tried to balance politically explosive information with the public’s need to know. That question also vexed federal law enforcement officials investigating Hillary Clinton’s use of a private email server.

National: House Democrats Move to Restore Key Provisions of the Voting Rights Act | US News & World Report

Civil rights icon Rep. John Lewis, D.-Ga., and Alabama Rep. Terri Sewell Thursday introduced a bill that would restore voting rights protections struck down a year ago by the Supreme Court in an effort to block some states’ efforts to impose tough new voter registration laws. Nearly all of the 193 House Democrats have signed on to the legislation; the Congressional Black Caucus, Hispanic Caucus and Asian Pacific American Caucus also endorsed the bill. Sewell said no Republicans were willing to support the measure. The Voting Rights Advancement Act is a response to last year’s Supreme Court ruling in Shelby v. Holder; the court struck down two key provisions of the 1965 Voting Rights Act, which put 13 states under strict rules not to change their voter laws without federal approval and set a formula for determining which states would be subject to the law.

National: Little movement on White House probe into voter fraud | CNN

On Super Bowl Sunday this year, President Donald Trump told Fox News that Vice President Mike Pence would head a commission into voter fraud allegations — ones that he made, claiming that between three to five million people voted illegally in the 2016 election. The commission was formed three months later, but it has yet to meet and there’s no date set to do so. More than one member of the White House’s Election on Voter Integrity told CNN on Thursday that the group would not be doing its job if it did not examine possible interference by a Russian intelligence agency or a military intelligence agency in voting systems. “If you know that there is an outside force that is trying to jimmy the door on the election process somehow, you would want to know about that,” said Matt Dunlap, Maine’s secretary of state and a member of the commission. “That includes the Russians, the Martians, I don’t care. It has to be part of the discussion.” Dunlap said he has not heard from the White House about the commission since the May press release.

National: U.S. Elections Systems Vulnerable, Lawmakers Told In Dueling Hearings | NPR

If two nearly simultaneous hearings Wednesday by the House and Senate Intelligence Committees into Russia’s meddling in last year’s presidential election revealed anything, it’s that U.S. officials saw what was going on but were all but powerless to stop it. In his prepared remarks, former Homeland Security Secretary Jeh Johnson said the Russian government, “at the direction of Vladimir Putin himself, orchestrated cyberattacks on our Nation for the purpose of influencing our election — plain and simple.” But in response to a question from the committee’s ranking member, Rep. Adam Schiff, D-Calif., Johnson said he was concerned he would be criticized “for perhaps taking sides” in an ongoing election if he publicly spoke out about the Russian meddling that he knew was going on.

National: We just learned the government knows Russia will sabotage the next election. Now what? | The Washington Post

The Senate Intelligence Committee held a hearing this morning on Russian efforts to interfere in the 2016 election, and on what the government knows about Russian intentions to meddle in future contests. The Committee heard from three federal officials, two from the Department of Homeland Security, and one from the FBI. Together, those officials made clear that not only did Russians peddle in propaganda and fake news in an effort boost the fortunes of Donald Trump over Hillary Clinton in 2016; they also penetrated election systems via cyber warfare. But they also hinted at another important truth, which a forward looking one. Here it is: The very core of our democracy is at extraordinary risk if we are not prepared to prevent Russian interference in our next election, which is less than 18 months away.

National: Congress urged to increase voting system security | CNN

More than 100 cybersecurity and voting experts are urging the government to make the U.S. voting system more secure. The experts — which come from various industries, from business and academia to technology non-profits — signed a letter addressed to Congress on Wednesday suggesting how three major objectives need to take place to protect the integrity of the system and restore voter confidence. The letter comes as Jeanette Manfra, acting deputy undersecretary for cybersecurity and communications at DHS, told the Senate Intelligence Committee hackers targeted election-related systems in 21 states last year. The letter alleges many jurisdictions are unprepared to handle an increase in cybersecurity risks. To start, the experts believe all jurisdictions should create voter-verified paper ballots and phase out electronic voting machines.

National: Security experts warn lawmakers of election hacking risks | ZDNet

More than a hundred security researchers and computer science experts have warned in a letter to lawmakers that not enough is being done to ensure the integrity of state and federal elections. The letter, published Wednesday, argues many US states are “inadequately prepared” to respond to cybersecurity risks with upcoming elections. The hundred-plus co-signatories, including cryptographer Matthew Blaze, security expert Bruce Schneier, and PGP creator Phil Zimmermann, say the US “needs prompt action to ensure prudent elections security standards.” The experts also outlined several recommendations that would “form the basis of robust, enforceable, sensible federal standards that can restore needed confidence in American elections,” including ensuring that any electronic election machines produce a voter-verified paper ballot to establish the “official record of voter intent.”

National: Congress hears sinister tale of Russia meddling in US election | Associated Press

A sinister portrait of Russia’s cyberattacks on the U.S. emerged Wednesday as current and former U.S. officials told Congress Moscow stockpiled stolen information and selectively disseminated it during the 2016 presidential campaign to undermine the American political process. The Russians ‘‘used fake news and propaganda and they also used online amplifiers to spread the information to as many people as possible,’’ Bill Priestap, the FBI’s top counterintelligence official, told the Senate Intelligence committee.

National: How 2 academics got the Supreme Court to reexamine gerrymandering | Vox

The Supreme Court has officially agreed to hear a case with the potential to put firm limits on partisan gerrymandering — and dramatically change the way states draw legislative boundaries. The case, Gill v. Whitford, challenges the 2011 Wisconsin state assembly map. Those districts were drawn by the Republican state legislature in Wisconsin, and packed Democrats into a smaller number of districts to maximize Republican odds. The lawsuit argues that the map is an unconstitutional effort to help Republicans retain power.

National: Federal officials say they’re stepping up efforts to protect election systems | USA Today

State election chiefs said Wednesday that federal homeland security officials haven’t shared enough intelligence information about Russian attempts to access last year’s election — possibly hampering efforts to better protect their systems. “We need this information to defend state elections,” Indiana Secretary of State Connie Lawson, president-elect of the National Association of Secretaries of State, told members of the Senate Intelligence Committee. The committee held a hearing on Russia’s interference in last year’s elections as part of its ongoing investigation. “We were woefully unprepared to defend and respond (to Russian meddling) and I am hopeful that we will not be caught flat-footed again,” said Sen. Richard Burr, R-N.C., the committee’s chairman. “I am deeply concerned that, if we do not work in lock step with the states to secure our elections, we could be here in two or four years talking about a much worse crisis.”

National: The Microsoft security hole at the heart of Russian election hacking | Computerworld

Russian hacking of the 2016 election went deeper than breaking into the Democratic National Committee and the Clinton campaign — the Russians also hacked their way into getting information about election-related hardware and software shortly before voting began. The Intercept published a top-secret National Security Agency document that shows exactly how the Russians did their dirty work in targeting election hardware and software. At the heart of the hack is a giant Microsoft security hole that has been around since before 2000 and still hasn’t been closed. And likely never will. Before we get to the security hole, here’s a little background about how the Russian scheme worked, spelled out in detail by the secret NSA document. Allegedly, Russia’s military intelligence agency, the GRU, launched a spearphishing campaign against a U.S. company that develops U.S. election systems. (The Intercept notes that the company was likely “VR Systems, a Florida-based vendor of electronic voting services and equipment whose products are used in eight states.”) Fake Google Alert emails were sent from noreplyautomaticservice@gmail.com to seven of the company’s employees. The employees were told they needed to immediately log into a Google website. The site was fake; when at least one employee logged in, his credentials were stolen.

National: DHS Never Ran Audit to See if Votes Were Hacked | Daily Beast

Despite assurances from the U.S. intelligence community that Russian hacking only influenced the 2016 U.S. election—and didn’t change vote tallies—there was never actually a formal federal audit of those systems, the Department of Homeland Security said. And while DHS offered free security scans to any state that wanted them, many states—even ones that took up the DHS offer, like Michigan and Maine—either use audit procedures that are considered inadequate or don’t audit their election results at all. “I think there’s a presumption amongst both the general public and lawmakers that DHS did some sort of investigation,” said Susan Greenhalgh, who serves as Elections Specialist at Verified Voting, a nonprofit devoted to U.S. election integrity. “It didn’t happen. That doesn’t mean that something happened, but it also means it wasn’t investigated.”

National: Despite NSA Claim, Elections Vendor Denies System Was Compromised In Hack Attempt | NPR

The Florida elections vendor that was targeted in Russian cyberattacks last year has denied a recent report based on a leaked National Security Agency document that the company’s computer system was compromised. The hackers tried to break into employee email accounts last August but were unsuccessful, said Ben Martin, the chief operating officer of VR Systems, in an interview with NPR. Martin said the hackers appeared to be trying to steal employee credentials in order to launch a spear-phishing campaign aimed at the company’s customers. VR Systems, based in Tallahassee, Fla., provides voter registration software and hardware to elections offices in eight states. “Some emails came into our email account that we did not open. Even though NSA says it’s likely that we opened them, we did not,” Martin says. “We know for a fact they were never opened. They did not get into our domain.”

National: ‘The mother lode of all leaks’: A massive data breach exposed ‘information that can be used to steal an election | Business Insider

A data analytics firm hired by the Republican National Committee last year to gather political information about US voters accidentally leaked the sensitive personal details of roughly 198 million US citizens earlier this month, as its database was left exposed on the open web for nearly two weeks. Deep Root Analytics, a conservative data firm contracted by the RNC as part of a push to ramp up its voter analytics operation in the wake of Mitt Romney’s defeat in the 2012 presidential election, stored details about approximately 61% of the US population on an Amazon cloud server without password protection for those two weeks.

National: Why the G.O.P. Voter Data Leak Is Scarier than It Seems | Vanity Fair

Facebook and Google aren’t the only companies hoovering up every kilobyte of our digital lives—our late-night shopping habits, social-media posts, travel plans, and celebrity obsessions—and turning that personal data into dollar signs. As the recent leak of nearly 200 million voter profiles shows, political analytics companies are major players in the Big Data space, too—and their methods, if not their security protocols, are getting ever more sophisticated. The terabyte of data that Gizmodo reports Deep Root Analytics left on a cloud server, without password protection, included “home addresses, birth dates, and phone numbers,” along with “advanced-sentiment analyses used by political groups to predict where individual voters fall on hot-button issues such as gun ownership, stem-cell research, and the right to abortion, as well as suspected religious affiliation and ethnicity.” Even more worrying, some of the firm’s voter-registration data was cross-referenced against Reddit users’ profiles, suggesting a wide-ranging, multi-platform effort to build psychological profiles of American citizens. None of this is illegal, nor is it clear whether such information is particularly useful. Gizmodo reports show that the Republican National Committee paid Deep Root $983,000 last year, and that other conservative groups paid millions more. But as The New York Times revealed last year, preference-prediction software peddled by companies like Cambridge Analytica is still an imperfect science.

National: US Election Officials, Cybersecurity Experts to Testify on Russian Hacking | VoA News

Just how extensively Russia penetrated state election systems across America last year and how to prevent a repeat will be the focus of an extensive public hearing by the Senate Intelligence Committee on Wednesday. “We’re trying to focus on all aspects — the aggressive nature of Russia’s attempt to hack all the way down to the state level,” the committee’s chairman, Republican Richard Burr of North Carolina, told VOA. The panel will hear from cybersecurity and counterintelligence officials at the FBI and the Department of Homeland Security, as well as state election officials and a representative of America’s secretaries of state for all 50 states — officials who are tasked with certifying elections.

National: Some States Beat Supreme Court to Punch on Eliminating Gerrymanders | The New York Times