National

Over the past two days, all major US news outlets breathlessly reported that hackers in Las Vegas needed little time to expose the security flaws of several types of voting machines this weekend. While it is certainly nice to see the mainstream media cover election integrity issues more than once every four years, anybody following the topic, as WhoWhatWhy routinely does, was hardly surprised that the hackers were so successful. How do we know? Because, in anticipation of what happened at the DEF CON hacking conference, WhoWhatWhy spoke to many of the leading election integrity experts to get their thoughts on the event. Most of them expressed hope that the hackers would raise much-needed awareness of the vulnerabilities of US voting machines. Some of the experts we spoke to ahead of the event expressed concerns that, should the hackers fail to breach the machines, it would give people a false sense of security. It turns out that they did not have to worry about that — at all.

National: Congressmen at DefCon: Please help us, hackers! | The Parallax

For the first time in the 25 years of the world’s largest hacker convention, DefCon, two sitting U.S. Congressmen trekked here from Washington, D.C., to discuss their cybersecurity expertise on stage. Rep. Will Hurd, a Texas Republican, and Rep. Jim Langevin, a Rhode Island Democrat, visited hacking villages investigating vulnerabilities in cars, medical devices, and voting machines; learned about how security researchers plan to defend quantum computers from hacks; and met children learning how to hack for good. … Hurd said security researchers could play an important role in addressing increasingly alarming vulnerabilities in the nation’s voting apparatus. DefCon’s first voting machine-hacking village this weekend hosted a voting machine from Shelby County, Tenn., that unexpectedly contained personal information related to more than 600,000 voters. Village visitors managed to hack the machine, along with 29 others.

National: Kobach appeals order to answer questions under oath | The Kansas City Star

Kansas Secretary of State Kris Kobach is seeking to avoid answering questions under oath about two documents containing plans for changes to U.S. election law. Kobach, who also is vice chairman of President Donald Trump’s commission on election integrity, filed a notice late Monday saying he is appealing to the 10th U.S. Circuit Court of Appeals an order to submit to a deposition by the American Civil Liberties Union in a voting rights case. The closed deposition is scheduled for Thursday. The ACLU said Tuesday that Kobach’s appeal of the deposition order to the 10th Circuit is “bizarre.”Kansas Secretary of State Kris Kobach is seeking to avoid answering questions under oath about two documents containing plans for changes to U.S. election law. Kobach, who also is vice chairman of President Donald Trump’s commission on election integrity, filed a notice late Monday saying he is appealing to the 10th U.S. Circuit Court of Appeals an order to submit to a deposition by the American Civil Liberties Union in a voting rights case. The closed deposition is scheduled for Thursday. The ACLU said Tuesday that Kobach’s appeal of the deposition order to the 10th Circuit is “bizarre.”

National: Hackers at a cybersecurity conference breached dozens of voting machines | Business Insider

Professional hackers were invited to break into dozens of voting machines and election software at this year’s annual DEFCON cybersecurity conference. And they successfully hacked every single one of the 30 machines acquired by the conference. The challenge was held at DEF CON’s “Voting Village,” where hackers took turns breaching ten sample voting machines and voter registration systems, Politico reported. … “Follow the money,” Harri Hursti, the cofounder of Nordic Innovation Labs, which helped organize DEF CON, told The Hill. “On the other end of the ballot, that’s where the money is — banks and roads.” Hodge said that if officials take care to “store machines, set them up, [and] always have someone keeping an eye on machines,” that could go a long way in ensuring the safety of the electoral process.

National: To make our voting tech more secure, policymakers may need to work with the people who can break in them | KPCC

After acquiring a decommissioned voting machine, Anne-Marie “Punky” Chun and her colleagues at Synack set out to hack it. It took them only a matter of hours. “Just looking at the security hygiene, it wasn’t very strong,” Chun told Take Two host A Martinez in an interview. “The encryption password, for example, was hard-coded as ‘ABCD.’ And it was used on the whole machine.” Chun and her team test cyber security in, arguably, the most effective way: by breaking in themselves. So when they though about the best way to check the security of election data, they knew they had to find a voting machine, and preferably an older one.

National: Federal judge set to hear new challenge to Trump fraud commission Tuesday | The Washington Post

A federal judge will hear arguments Tuesday over whether a Watergate-era law prohibiting the government from collecting data on how Americans exercise their First Amendment rights bars President Trump’s Election Integrity Commission from American’s voting records. U.S. District Judge Royce C. Lamberth of the District set the hearing Monday after Common Cause, a nonprofit government watchdog group, alleged that the Trump administration was violating the Privacy Act of 1974 by seeking the “quintessentially First Amendment-protected political party affiliation and voter history data” of every American. The court could rule on the request for a temporary restraining order as early as Tuesday.

National: DHS is refusing to investigate possible breach of voting machines | Business Insider

Pressure to examine voting machines used in the 2016 election grows daily as evidence builds that Russian hacking attacks were broader and deeper than previously known. And the Department of Homeland Security has a simple response: No. DHS officials from former secretary Jeh Johnson to acting Director of Cyber Division Samuel Liles may be adamant that machines were not affected, but the agency has not in fact opened up a single voting machine since November to check. Asked about the decision, a DHS official told TPM: “In a September 2016 Intelligence Assessment, DHS and our partners determined that there was no indication that adversaries were planning cyber activity that would change the outcome of the coming US election.” According to the most recent reports, 39 states were targeted by Russian hackers, and DHS has cited–without providing details–domestic attacks in its own reports as well. “Although we continue to judge all newly available information, DHS has not fundamentally altered our prior assessments,” the department told TPM.

National: Every Voting Machine at This Hacking Conference Got Totally Pwned | Gizmodo

A noisy cheer went up from the crowd of hackers clustered around the voting machine tucked into the back corner of a casino conference room—they’d just managed to load Rick Astley’s “Never Gonna Give You Up” onto the WinVote, effectively rickrolling democracy. The hack was easy to execute. Two of the hackers working on the touchscreen voting machine, who identified only by their first names, Nick and Josh, had managed to install Windows Media Player on the machine and use it to play Astley’s classic-turned-trolling-track. … The security industry encourages regular software updates to patch bugs and keep machines as impenetrable as possible. But updating the machines used in voting systems isn’t as easy as installing a patch because the machines are subject to strict certification rules.

National: Hackers Demonstrate How Vulnerable Voting Machines Are | US News & World Report

We shouldn’t need another reminder, but the DefCon hacking conference in Las Vegas provided one over the weekend anyway: Voting machines are highly susceptible to electronic attacks. You might remember the topic of hacking elections from such recent presidential campaigns as: last year’s. And while – this is important – there’s no evidence that hackers manipulated actual vote tallies in 2016, there’s every reason to believe that cyber-malefactors will try to do just that in future. And the DefCon gang proved how easy that would be. The convention set up a Voting Machine Hacking Village where attendees could see what they could do against more than 30 voting machines (procured, no kidding, via eBay and government auctions). It took less than 90 minutes before a hacker was able to crack the poorly-secured Wi-Fi on one voting machine (which is, thankfully, outdated and was apparently last used in 2015); another programmed a machine to play Rick Astley’s ghastly song, “Never Gonna Give You Up.” Imagine casting your vote on Election Day and getting rickrolled for your trouble.

National: Hackers at DefCon conference exploit vulnerabilities in voting machines | USA Today

It took less than a day for attendees at the DefCon hacking conference to find and exploit vulnerabilities in five different voting machine types. “The first ones were discovered within an hour and 30 minutes. And none of these vulnerabilities has ever been found before, they’ll all new,” said Harri Hursti, co- coordinator of the event. One group even managed to rick-roll a touch screen voting machine, getting it to run Rick Astley’s song “Never Gonna Give You Up,” from 1987. … The groups weren’t able change votes, noted Hursti, a partner at Nordic Innovation Labs and an expert on election security issues. “That’s not what we’re trying to do here today. We want to look at the fundamental compromises that might be possible,” he said.

National: Hackers descend on Las Vegas to expose voting machine flaws | Politico

Election officials and voting machine manufacturers insist that the rites of American democracy are safe from hackers. But people like Carten Schurman need just a few minutes to raise doubts about that claim. Schurman, a professor of computer science at the University of Copenhagen in Denmark, used a laptop’s Wi-Fi connection Friday to gain access to the type of voting machine that Fairfax County, Virginia, used until just two years ago. Nearby, other would-be hackers took turns trying to poke into a simulated election computer network resembling the one used by Cook County, Illinois. … Before the 2016 election, former FBI Director James Comey assuaged fears by telling Congress that the system was so “clunky” — comprised of a mishmash of different kinds of machines and networks, with each state’s results managed by a consortium of state and county officials — that its overall integrity was fairly safe. Election security advocates aren’t as confident. Barbara Simons, Board Chair of Verified Voting, a nonprofit that since 2003 has studied U.S. elections equipment, said that the vulnerabilities on display in Las Vegas only served to reiterate a need for the country to adopt a nationwide system of verifiable paper ballots and mandatory, statistically significant audits. While numerous states have starting moving in this direction, Simons worries it’s not enough.

National: These Hackers Reveal How Easy It Is To Hack US Voting Machines | Forbes

In a muggy little room in the far corner of Caesar’s Palace, wide-eyed and almost audibly buzzing is Carsten Schurmann. The German-born hacker has just broken into a U.S. voting machine with his Apple Mac in a matter of minutes. He can turn it on and off, he can read all the information stored within and if he felt like it, he could probably change some votes if the system was in use. “This is insane,” he says. But today, that machine is not in use, it’s being opened up for anyone to try what Schurmann did. A host of technically-minded folk have gathered at DEF CON’s Voting Machine Village, where they’re tinkering with more than 25 commonly used systems used across American elections. They might just save the next election from Russian hackers. Those machines are, co-organizer Matt Blaze says, horribly insecure. Blaze’s hope is the public will be made aware of their many, many flaws, and demand elections be protected from outside, illegal interference, following the much-documented attempts by Russia to install Donald Trump as president.

National: Hackers Scour Voting Machines for Election Bugs | VoA News

Hackers attending this weekend’s Def Con hacking convention in Las Vegas were invited to break into voting machines and voter databases in a bid to uncover vulnerabilities that could be exploited to sway election results. The 25-year-old conference’s first “hacker voting village” opened on Friday as part of an effort to raise awareness about the threat of election results being altered through hacking. Hackers crammed into a crowded conference room for the rare opportunity to examine and attempt to hack some 30 pieces of election equipment, much of it purchased over eBay, including some voting machines and digital voter registries that are currently in use.

National: Hackers breach each of dozens voting machines brought to conference | The Hill

One of the nation’s largest cybersecurity conferences is inviting attendees to get hands-on experience hacking a slew of voting machines, demonstrating to researchers how easy the process can be. “It took me only a few minutes to see how to hack it,” said security consultant Thomas Richards, glancing at a Premier Election Solutions machine currently in use in Georgia. The DEF CON cybersecurity conference is held annually in Las Vegas. This year, for the first time, the conference is hosting a “Voting Machine Village” where attendees can try to hack a number of systems and help catch vulnerabilities. The conference acquired 30 machines for hackers to toy with. Every voting machine in the village was hacked.

National: Defcon hackers break voting machines easily with old exploits | CNET

When the password for a voting machine is “abcde” and can’t be changed, the integrity of our democracy might be in trouble. The Advanced Voting Solutions WinVote machine, dubbed “America’s worst voting machine,” came equipped with this simple password even as it was used in some of the country’s most important elections. AVS went out of business in 2007, but Virginia used its insecure machines until 2015 before dropping them for scrap metal. That means this vulnerable hunk of technology was used in three presidential elections, starting with George W. Bush’s re-election in 2004 to Barack Obama’s in 2012. In addition to Virginia, Pennsylvania and Mississippi used the WinVote without knowing all the ways it could be hacked. Unlike other technology — your phone, your laptop, connected cars — security wasn’t really a focus.

National: Leader Of Voter Fraud Probe Really Doesn’t Want To Release Trump Meeting Documents | HuffPost

Kansas Secretary of State Kris Kobach (R) continued to fight releasing documents from a meeting with President Donald Trump in November, saying that the public did not need to see them and that disclosing them would impede his ability to serve on Trump’s commission to investigate voter fraud. Kobach, who has lent support to Trump’s claims of widespread voter fraud and exaggerated instances of it in the past, made the argument with his lawyer in a Friday court filing as part of an ongoing lawsuit brought by the American Civil Liberties Union over a Kansas law requiring people to prove their citizenship to vote. As part of the lawsuit, the ACLU is requesting a Kansas federal judge unseal documents that Kobach was photographed holding when he met with Trump in November 2016, as well as a draft amendment to federal voting law, which circulated in his office. The documents contain potential amendments to the National Voter Registration Act, a 1993 law requiring motor vehicle and some other state agencies to provide opportunities to register to vote.

National: It took DEF CON hackers minutes to pwn these US voting machines | The Register

After the debacle of the 2000 presidential election count, the US invested heavily in electronic voting systems – but not, it seems, the security to protect them. This year at the DEF CON hacking conference in Las Vegas, 30 computer-powered ballot boxes used in American elections were set up in a simulated national White House race – and hackers got to work physically breaking the gear open to find out what was hidden inside. In less than 90 minutes, the first cracks in the systems’ defenses started appearing, revealing an embarrassing low level of security. Then one was hacked wirelessly. “Without question, our voting systems are weak and susceptible. Thanks to the contributions of the hacker community today, we’ve uncovered even more about exactly how,” said Jake Braun, who sold DEF CON founder Jeff Moss on the idea earlier this year. “The scary thing is we also know that our foreign adversaries – including Russia, North Korea, Iran – possess the capabilities to hack them too, in the process undermining principles of democracy and threatening our national security.”

National: U.S. elections are an easier target for Russian hackers than once thought | Los Angeles Times

When Chris Grayson pointed his Web browser in the direction of Georgia’s elections system earlier this year, what he found there shocked him. The Santa Monica cybersecurity researcher effortlessly downloaded the confidential voter file of every registered Georgian. He hit upon unprotected folders with passwords, apparently for accessing voting machines. He found the off-the-shelf software patches used to keep the system secure, several of which Grayson said could be easily infected by a savvy 15-year-old hacker. “It was like, holy smokes, this is all on the Internet with no authentication?” Grayson said in an interview. “There were so many things wrong with this.” … Among the most alarmed have been pedigreed computer security scholars, who warn that a well-timed hack of a vendor that serves multiple states could be enough to cause chaos even in systems that were thought to be walled off from one another. And they say security lapses like those in Georgia reveal the ease with which hackers can slip in.

National: Voter Registration Data from 9 States Available for Sale on Dark Web | Dark Reading

Threat intelligence company LookingGlass Cyber Solutions says it has discovered over 40 million voter records from nine different states being traded in an underground forum for stolen credit card data and login credentials. The voter records being offered for sale include the voter’s full first, last and middle name, voter ID, birthdate, voter status, party affiliation, residential address and other details. The data belongs to voters in Arkansas, Colorado, Connecticut, Delaware, Florida, Michigan, Ohio, Oklahoma and Washington State. Over the last two days, voter databases from at least two of the states—Arkansas and Ohio—were sold for a mere $2 each, or a total of $4 for almost 10 million voter records. That suggests financial gain is not the primary reason for the activity, according to LookingGlass. ‘Logan,’ the individual who has advertised the data and is selling it on a site called RaidForums, has hinted at possessing voter records for an additional 20 to 25 states, says Jonathan Tomek, director of threat research at LookingGlass Cyber Solutions.

National: Kris Kobach says Trump’s fraud panel will keep voter data secure. Some states aren’t buying it | Los Angeles Times

After weeks of legal battles and bipartisan pushback from top election officials nationwide, President Trump’s voter fraud commission has renewed a message for the states: It’s safe to pass along your data about voters. “Individuals’ voter registration records will be kept confidential and secure throughout the duration of the commission’s existence,” Kris Kobach, vice chairman of the commission, wrote in a letter sent late Wednesday to all 50 secretaries of state. Even so, by Thursday, much of the criticism that greeted an earlier request from the commission was repeated by election officials and activists, who have expressed concerns about privacy and have called the panel both a sham created by an insecure president and a tool to suppress votes. … The letter from Kobach is the second in less than a month requesting that secretaries of state submit voter data to the so-called Presidential Advisory Commission on Election Integrity.

National: Senate panel moves bill to deter foreign meddling in US | Associated Press

The Senate is moving forward with legislation to combat cyberattacks and deter foreign interference amid an investigation into Russian meddling in the 2016 election. The bill approved by the Senate intelligence committee 14-1 Thursday will now move to the Senate floor. According to the panel, the legislation would ensure the intelligence community is well-positioned to detect cyberattacks, strengthen information-sharing with states to protect voting systems and “send a message to Moscow that we will not accept their aggressive actions.”

National: Voter fraud commission will almost certainly ‘find’ thousands of duplicate registrations that aren’t duplicates. Here’s why. | The Washington Post

Did Vice President Pence commit voter fraud? You might think so, if you looked at voter registration data that includes only each voter’s name and birth year. Mike Pence registered to vote eight times and cast seven ballots across six states in the November 2016 election. But you would be wrong. Each of these registration records belongs to a different person. Their only crime is that they share their name and were born in the same year as the vice president. The Presidential Advisory Commission on Election Integrity, led by the vice president, has gotten considerable attention for requesting voter registration information (including names, birthdays and Social Security numbers) from each state. Presumably, the commission will use the names and birthdays in these lists to identify potential duplicate registration records between states.

National: With New Sanctions, Senate Forces Trump’s Hand on Russia | The New York Times