National

At a recent DefCon security conference, organizers wanted to test how voting machines could be hacked. The result? It took just 90 minutes for the hackers to get into the machines. Joseph Lorenzo Hall, chief technologist at the Center for Democracy and Technology, in Washington, DC, says the hack took that long only because the individual had to leave the facility to go buy a USB keyboard. “When he came back, there were two open USB ports on the back of this machine, which was a decertified AVS WINVote,” Hall explains. “He did the ‘three-fingered salute’— the Windows control-alt-delete — and it dropped to Task Manager. Then he could load whatever he wanted. They installed Winamp and played the now-famous Rick Astley song, ‘Never Gonna Give You Up.’” Some of the machines the hackers “attacked” are still in use, but for the most part, they were purchased on eBay or GovDeals (the government version of eBay), Hall says. Most were two or three years old and not running the most current software. Nevertheless, the experiment exposed serious flaws in virtually every type of machine.

National: U.S. state election officials still in the dark on Russian hacking | Reuters

The federal government has not notified U.S. state election officials if their voting systems were targeted by suspected Russian hackers during the 2016 presidential campaign, and the information will likely never be made public, a top state election chief told Reuters. “You’re absolutely never going to learn it, because we don’t even know it,” Judd Choate, state election director for Colorado and president of the National Association of State Election Directors, said in an interview on Thursday during the group’s summer conference. Nearly 10 months after Republican Donald Trump’s upset presidential victory over Democrat Hillary Clinton, Choate said he had not spoken to a single state election director who had been told by the U.S. Department of Homeland Security if their state was among those attacked. The lack of information-sharing on the election breaches reflects the difficulty state and federal officials have had in working together to protect U.S. voting from cyber threats. All U.S. elections are run by state and local governments, which have varying degrees of technical competence.

National: My Conversation With a Leading Election Technology Researcher Should Terrify You | Patriot NOT Partisan

Def Con is a 25 year old hacking convention where the worlds best hackers come together often highlighting security vulnerabilities in technology. This year, Def Con made news by raising awareness of our voting machine insecurities by challenging hackers to hack into the voting machines commonly used in this country for elections. These Def Con hacks took place in the “Voting Village”. I spoke with Voting Village organizer and leading election technology researcher, Harri Hursti, about the results of the experiment and the challenges we face in securing our elections in the future.

AM: Tell me about Def Con and the “Voting Village” and the role you played in the experiment.

HH: I was the co-organizer of the Village along with professor Matt Blaze.

AM: What was the main purpose of this exhibition?

HH: Education. We wanted to let the security community learn more about the machines and the designs. So far, only a very small group of people have been allowed to study and research these machines. As a result there was a lot of misinformation, rumors and false claims, and finding proven facts was difficult. The broader community which has 1st hand experience can help the public and the policy makers to get the facts known and drive better policies and practices to secure the elections.

National: Vote Fraud Crusader J. Christian Adams Sparks Outrage | NBC

J. Christian Adams claims there’s an “alien invasion” at the voting booth. Adams, a member of President Donald Trump’s election integrity commission, is dedicating his life to cleaning up registration rolls around the country and trying to prevent non-citizens from casting ballots. To do so, he’s spent years suing counties to force them to purge their rolls and he’s published personal information online about thousands of registered voters he believes could have committed fraud. Adams has turned allegations of sweeping, illegal voting into a career marked by frequent litigation and a bombastic media presence — calling critics who say that there’s no widespread proof of voter fraud “flat-earthers.”

National: Kander says courts can’t be counted on to save voting rights in Trump era | The Kansas City Star

Former Missouri Secretary of State Jason Kander told a crowd of people at a progressive event in Parkville Saturday that they can’t just rely on the courts to protect voting rights under President Donald Trump and U.S. Attorney General Jeff Sessions. Kander, a Democrat, said that with Trump appointing judges and Sessions running the U.S. Department of Justice, voting rights cases will become tougher to win. Legal challenges have to be paired with political activism. “I believe there should be political consequences for politicians who commit voter suppression,” Kander said. “I believe that if you make it harder to vote, then we should make it harder for you to get reelected.” Kander, who started a political action committee this year called Let America Vote, spoke at a “voting rights festival” hosted at English Landing Park by Northland Progress. The festival is part of the group’s “In for 10” campaign, in which volunteers pledge to help at least 10 Missouri citizens register to vote.

National: Florida judge dismisses fraud lawsuit against DNC | The Washington Post

A year-long legal battle over the Democratic National Committee’s handling of the 2016 presidential primary came to an end Friday, with a federal judge in Florida dismissing a class-action suit brought by supporters of Sen. Bernie Sanders (I-Vt.). “To the extent Plaintiffs wish to air their general grievances with the DNC or its candidate selection process, their redress is through the ballot box, the DNC’s internal workings, or their right of free speech — not through the judiciary,” Judge William Zloch, a Reagan appointee, wrote in his dismissal. “To the extent Plaintiffs have asserted specific causes of action grounded in specific factual allegations, it is this Court’s emphatic duty to measure Plaintiffs’ pleadings against existing legal standards. Having done so . . . the Court finds that the named Plaintiffs have not presented a case that is cognizable in federal court.”

National: Many County Election Officials Still Lack Cybersecurity Training | NBC

August 25, 2017

Despite Russia’s attempt to hack the 2016 U.S. election and the voter registration systems of 21 states, an NBC News investigation reveals that election officials in the most heavily populated counties of three crucial swing states still haven’t received formal training on how to detect and fight attacks. Election officials in three of Pennsylvania’s four biggest counties — Philadelphia, Allegheny and Bucks, which together account for nearly a third of the state’s voters — told NBC News they never received cybersecurity training, which experts say is crucial for officials to identify risks. NBC reached out to election officials in every county in Arizona, Pennsylvania and Michigan and got responses from 60 percent of the counties. Officials from all 15 Arizona counties responded, but only five said their officials had received cybersecurity training. In Pennsylvania, where 42 of 67 counties responded, eight counties said their workers had training. In Michigan, 40 of the state’s 83 counties responded, and only 12 indicated receiving formal training.

National: Proposed legislation discourages Russia-U.S. cyber pact, while prioritizing election security | SC Magazine

August 25, 2017

A U.S. intelligence bill that recently passed committee in the Senate contains key provisions designed to defend the electoral process from Russian meddling and other foreign interference, as well as curtail any possible White House effort to form a joint cybersecurity unit with the Kremlin. Passed in the Senate Intelligence Committee by a 14-1 margin this past July and made public just days ago, the Intelligence Authorization Act for Fiscal year 2018 explicitly forbids the U.S. government from using federal resources to form a cyber partnership with Russia, unless the U.S. Director of National Intelligence (DNI) first submits a report that congressional intelligence committee members can review 30 days in advance of such an agreement. This key clause is a blatant rebuke of President Donald Trump, who fleetingly announced a U.S.-Russian cyber unit in July before backing off the idea amidst backlash.

National: The Trump administration isn’t ready for the 2020 Census | The Washington Post

August 25, 2017

The census, one of the most important activities our government undertakes, is under threat by uncertain funding and a leadership vacuum at a crucial moment. As former directors of the U.S. Census Bureau, serving in both Republican and Democratic administrations, we urge President Trump to act swiftly and the Senate to cooperate in naming a new director as the 2020 Census nears. The immediate task is to nominate someone who can provide stability through the final years of the decade, explain the importance of the agency’s mission compellingly, address Congress’s fiscal concerns and be ready for full immersion in the important tasks at hand.

National: Could Offering Spy Secrets To State Officials Help Safeguard Future Elections? | NPR

August 24, 2017

Congress could authorize top-secret security clearances for each state’s chief election official to help protect voting systems from cyberattacks and other potential meddling. That provision, which was part of the Senate Intelligence Committee’s 2018 policy bill for U.S. spy agencies, is one of the first concrete steps that lawmakers have taken to try to defend future elections from the sort of foreign interference that plagued the 2016 presidential race. The Senate panel is one of two congressional committees investigating what the American intelligence community says was a Russian government campaign to undermine the U.S. democratic system, discredit Hillary Clinton and help Donald Trump win. The Senate Intelligence panel included language that would require Director of National Intelligence Dan Coats to set up the clearances for state leaders in its annual bill setting policy for the intelligence community.

National: Top Trump aide’s email draws new scrutiny in Russia inquiry | CNN

August 24, 2017

Congressional investigators have unearthed an email from a top Trump aide that referenced a previously unreported effort to arrange a meeting last year between Trump campaign officials and Russian President Vladimir Putin, according to sources with direct knowledge of the matter. The aide, Rick Dearborn, who is now President Donald Trump’s deputy chief of staff, sent a brief email to campaign officials last year relaying information about an individual who was seeking to connect top Trump officials with Putin, the sources said. The person was only identified in the email as being from “WV,” which one source said was a reference to West Virginia. It’s unclear who the individual is, what he or she was seeking, or whether Dearborn even acted on the request. One source said that the individual was believed to have had political connections in West Virginia, but details about the request and who initiated it remain vague. The same source said Dearborn in the email appeared skeptical of the requested meeting.

National: Senate bill bans joint cyber initiative with Russia | FCW

An authorization bill introduced Aug. 18 by Sen. Richard Burr (R-N.C.) pushes back against a proposal floated by the Trump administration to set up a joint cyber initiative with Russia. The bill also establishes a strategy to protect U.S. election systems and pushes for increased pay rates for federal cyber professionals. It is not the first bill to call for a prohibition on potential U.S.-Russia cyber cooperation. Following President Donald Trump’s tweet on July 9 stating that he and Russian President Vladimir Putin had “discussed forming an impenetrable Cyber Security unit” in the future to guard against election hacking, a bipartisan group of legislators expressed alarm at the idea. Although Trump later backtracked, Senate Democrats introduced a standalone bill three days later to deny funding for any such plan.

National: Lawsuit: Trump’s Election Commission Is Hiding Public Information | Rewire

President Donald Trump’s election commission led by voter suppression advocates won’t be able to operate in the dark if a new lawsuit is successful. Trump in May signed an executive order creating the “Presidential Advisory Commission on Election Integrity,” led by Vice President Mike Pence and Kris Kobach, who as Kansas’ secretary of state was routinely accused of advancing voter suppression efforts. The commission’s stated purpose is to investigate allegations of voter fraud in the 2016 election. The Brennan Center for Justice at NYU Law School and the Protect Democracy Project filed a lawsuit Monday in federal court in New York to compel the U.S. Department of Justice, the U.S. Department of Homeland Security, and the Office of Management and Budget to answer requests and disclose public information related to the commission.

National: Servicemembers turned out in smaller numbers for 2016 presidential vote | Stars & Stripes

The 2016 U.S. presidential election failed to interest many military voters, a recently released federal study has found. Voting rates dropped from 58 percent in 2012 to just 46 percent in 2016 among servicemembers, says the Federal Voting Assistance Program report, released earlier this month. “A striking finding from our analyses is the reported drop in participation rate among military personnel in the 2016 election as compared to the general population,” FVAP program director David Beirne said in a report to Congress. “The data shows that more military members cited motivation-related reasons for not voting and were less interested in the election in 2016 than in 2012,” he added.

National: Trump-Russia dossier owner faces senators, Donald Jr still a no-show | The Guardian

The co-founder of a Washington opposition research firm that produced a dossier of salacious allegations involving President Donald Trump has met for hours with congressional investigators in a closed-door appearance that stretched into the evening. Glenn Simpson’s lawyer, Josh Levy, emerged from the day-long private appearance with the Senate judiciary committee and said his client had “told Congress the truth and cleared the record on many matters of interest”. “Following up on comments from certain Senate judiciary committee members who have noted Mr Simpson’s cooperation with this investigation,” Levy said, “I would like to add that he is the first and only witness to participate in an interview with the committee as it probes Russian interference in the 2016 election.”

National: Brennan Center and Protect Democracy File Suit to Make “Voter Fraud” Commission Records Public | eNews Park Forest

August 22, 2017

The Brennan Center for Justice at NYU School of Law and Protect Democracy filed a lawsuit today in federal court in New York to compel the Department of Justice, the Department of Homeland Security, and the Office of Management and Budget to disclose information to which the public is entitled pertaining to the president’s “Election Integrity” Commission. The organizations filed suit after their requests to the agencies for information under the Freedom of Information Act went unanswered. The Commission has had its motives and work questioned since it was launched in May, after the president made unfounded claims that voter fraud and noncitizen voting were rampant in the 2016 election. It is co-chaired by Vice President Mike Pence and Kansas Secretary of State Kris Kobach, who has a long history of supporting — and implementing — anti-voter policies.

National: States Need to Modernize the Polling Place, but Funding Is Scarce | Wall Street Journal

August 21, 2017

Federal money set aside to help states upgrade their voting equipment is running out, at a time when many states are seeking to replace aging machines and further fortify against cyberattacks. While federal funding has gradually diminished, the 2016 fiscal year marked a new low. As of September 2016, states had collectively spent more than the approximately $3.2 billion, distributed over several years, that Congress provided under the 2002 Help America Vote Act, according to a report from the independent Election Assistance Commission released Wednesday. Several states now rely mostly on any interest accrued from federal grants or on other sources for election-related efforts, such as replacing equipment that is in some cases a decade old.

National: US Commission on Civil Rights: Trump’s reversal on voter case could lead to ‘disenfranchisement’ | Washington Examiner

August 21, 2017

The U.S. Commission on Civil Rights argued Friday that the Trump administration’s decision to support the way Ohio removes people from its voter rolls could lead to the disenfranchisement of more voters. Last year, the Obama administration filed an amicus brief in favor of civil rights groups who were challenging the way Ohio purges its voter rolls. But under the Trump administration, the Justice Department switched sides, and in August it filed a friend-of-the-court brief in support of the state of Ohio.

National: Trump Election Commissioners Are Resisting Efforts to Protect Elections From Hacking | Mother Jones

August 21, 2017

The intelligence community fears that Russia’s meddling in US elections did not end in November 2016, and that when the Kremlin tries to intervene again, state and local voting systems will be a prime target. “They will be back,” former FBI Director James Comey warned in June. Many election systems would prove an easy target. Last month, hackers at the annual DEF Con conference demonstrated this vulnerability when they easily breached multiple voting machines. A 16-year-old hacked a machine in 45 minutes. In response to this threat, the Department of Homeland Security has taken a major step to protect elections by prioritizing the cybersecurity of state and local voting systems. Yet several members of President Donald Trump’s controversial election commission oppose DHS’s move, and two of them have dismissed the threat entirely as a ploy for the federal government to intrude on states’ rights. Their opposition is a signal that the commission, tasked with finding vulnerabilities in the country’s election system, is not likely to take cybersecurity seriously. On January 6, the same day that the intelligence community released a declassified report alleging Russian meddling in the election, DHS announced that it would make additional cybersecurity assistance available to states that request it. This was done by classifying election infrastructure as “critical infrastructure,” a designation that already brings heightened security measures to critical infrastructure such as dams and the electrical grid. The move means that DHS will provide risk assessments, system scanning, and other cybersecurity services to states that request them. But several election officials and experts who sit on the Presidential Advisory Commission on Election Integrity quickly condemned the designation.

National: For decade-old flaws in voting machines, no quick fix | The Parallax

Hackers rocked the voting machines this summer. On July 28, at the first DefCon “village” dedicated to exposing weaknesses in electronic voting machines—and the first coordinated, research-based assault on EVMs in the United States since 2007—it took visitors just 80 minutes to hack the first machine. The hackers proceeded to find and penetrate multiple security vulnerabilities in each of the village’s 20 machines, representing five voting machine models, calling into question how secure machine-assisted elections are. Rep. Will Hurd (R-Texas) and Rep. Jim Langevin (D-R.I.), two of Congress’ senior cybersecurity experts, visited the village and later told hackers that they were “surprised” by how easy it was to hack voting machines. Langevin promised during the first on-stage appearance of sitting Congressmen at DefCon that when they return to Washington, D.C., “this is going to be a primary topic of conversation.”

National: Election officials: ‘We are going to need more assistance’ | FCW

The Department of Homeland Security continues to work with state and local governments to protect election systems as critical infrastructure. At an Aug. 16 public meeting of the federal Election Assistance Commission, however, officials made clear that risks still remain. EAC Vice-Chairman Thomas Hicks pointed to a recent planning exercise in Albany, N.Y., as an example. That exercise, conducted in July, resulted in some surprising results that remain classified. “I found the meeting very informative, enlightening and frightening,” Hicks said. “I would encourage every state to hold a similar meeting with election officials, emergency management folks and IT officials.”

National: In Ukraine, a Malware Expert Who Could Blow the Whistle on Russian Hacking | The New York Times

The hacker, known only by his online alias “Profexer,” kept a low profile. He wrote computer code alone in an apartment and quietly sold his handiwork on the anonymous portion of the internet known as the Dark Web. Last winter, he suddenly went dark entirely. Profexer’s posts, already accessible only to a small band of fellow hackers and cybercriminals looking for software tips, blinked out in January — just days after American intelligence agencies publicly identified a program he had written as one tool used in the hacking of the Democratic National Committee. But while Profexer’s online persona vanished, a flesh-and-blood person has emerged: a fearful man who the Ukrainian police said turned himself in early this year, and has now become a witness for the F.B.I. “I don’t know what will happen,” he wrote in one of his last messages posted on a restricted-access website before going to the police. “It won’t be pleasant. But I’m still alive.” It is the first known instance of a living witness emerging from the arid mass of technical detail that has so far shaped the investigation into the D.N.C. hack and the heated debate it has stirred. The Ukrainian police declined to divulge the man’s name or other details, other than that he is living in Ukraine and has not been arrested. There is no evidence that Profexer worked, at least knowingly, for Russia’s intelligence services, but his malware apparently did.

National: Will U.S. Cyberwarriors Be Ready for the Next Big Hack? | RealClearDefense