National

Reports this week of Russian intrusions into U.S. election systems have startled many voters, but computer experts are not surprised. They have long warned that Americans vote in a way that’s so insecure that hackers could change the outcome of races at the local, state and even national level. Multibillion-dollar investments in better election technology after the troubled 2000 presidential election count prompted widespread abandonment of flawed paper-based systems, such as punch ballots. But the rush to embrace electronic voting technology – and leave old-fashioned paper tallies behind – created new sets of vulnerabilities that have taken years to fix. “There are computers used in all points of the election process, and they can all be hacked,” said Princeton computer scientist Andrew Appel, an expert in voting technologies. “So we should work at all points in that system to see how we make them trustworthy even if they do get hacked.”

National: Democrats ask FBI: Did Donald Trump aides’ Russia connections lead to cyberattacks? | CBS

Top House Democrats are asking the FBI to investigate whether connections between Donald Trump’s campaign aides and Russian interests led to the cyberattacks at the Democratic National Committee and Democratic Congressional Campaign Committee. “We are writing to request that the FBI assess whether connections between Trump campaign officials and Russian interests may have contributed to these attacks in order to interfere with the U.S. presidential election,” the lawmakers wrote in a letter sent to FBI Director James Comey on Tuesday. The letter was signed by Rep. Elijah Cummings, D-Maryland, ranking member on the House Oversight and Government Reform Committee; Rep. John Conyers, D-Michigan, ranking member on the House Judiciary Committee; Rep. Eliot Engel, D-New York, ranking member on the House Foreign Affairs Committee; and Rep. Bennie Thompson, D-Mississippi, ranking member on the Homeland Security Committee.

National: Russia-Backed DNC Hackers Strike Washington Think Tanks | Defense One

Last week, one of the Russia-backed hacker groups that attacked Democratic computer networks also attacked several Russia-focused think tanks in Washington, D.C., Defense One has learned. The perpetrator is the group called COZY BEAR, or APT29, one of the two groups that cybersecurity company CrowdStrike blamed for the DNC hack, according to founder Dmitri Alperovitch. CrowdStrike discovered the attack on the DNC and provides security for the think tanks. Alperovitch said fewer than five organizations and 10 staffers researching Russia were hit by the “highly targeted operation.” He declined to detail which think tanks and researchers were hit, out of concern for his clients’ interests and to avoid revealing tools and techniques or other data to hackers. CrowdStrike alerted the organizations immediately after the company detected the breaches and intruders were unable to exfiltrate any information, Alperovitch said.

National: Comey: FBI takes election tampering ‘very seriously’ | Politico

One day after reports the FBI had warned states of potential hacks on their election systems, Director James Comey declined to address the bureau’s investigation, simply insisting he takes the matter “very seriously.” The FBI alert — sent Aug. 18 and revealed publicly on Monday — sparked fears that recent cyberattacks on voter databases in Illinois and Arizona were harbingers of a nationwide hacking assault on state voting systems, possibly linked to Russia. “It won’t surprise you that I’m not going to give an answer that touches on any particular matter we’re looking at,” Comey said Tuesday at a conference hosted by digital security firm Symantec.

National: Hack Brief: As FBI Warns Election Sites Got Hacked, All Eyes Are on Russia | WIRED

In any other year, hackers breaking into a couple of state government websites through common web vulnerabilities would hardly raise a blip on the cybersecurity community’s radar. But in this strange and digitally fraught election season, the breach of two state board of election websites not only merits an FBI warning—it might just rise to the level of an international incident. On Monday, an FBI alert surfaced warning state boards of election to take precautions against hackers after two election board websites were breached in recent months. According to Yahoo News, those breaches likely targeted Arizona and Illinois board of election sites, both of which admitted earlier this summer that they’d been hacked. Cybersecurity researchers are already speculating that the attacks link to Russia, pointing to the string of recent, likely Russian attacks that have hit the Democratic National Committee and the Clinton campaign. “Someone is trying to hack these databases, and they succeeded in exfiltrating data, which is significant in itself,” says Thomas Rid, a cybersecurity-focused professor in the War Studies department at King’s College of London and author of Rise of the Machines. “In the context of all the other attempts to interfere with this election, it’s a big deal.”

National: FBI says foreign hackers penetrated state election systems | Yahoo

The FBI has uncovered evidence that foreign hackers penetrated two state election databases in recent weeks, prompting the bureau to warn election officials across the country to take new steps to enhance the security of their computer systems, according to federal and state law enforcement officials. The FBI warning, contained in a “flash” alert from the FBI’s Cyber Division, a copy of which was obtained by Yahoo News, comes amid heightened concerns among U.S. intelligence officials about the possibility of cyberintrusions, potentially by Russian state-sponsored hackers, aimed at disrupting the November elections. Those concerns prompted Homeland Security Secretary Jeh Johnson to convene a conference call with state election officials on Aug. 15, in which he offered his department’s help to make state voting systems more secure, including providing federal cyber security experts to scan for vulnerabilities, according to a “readout” of the call released by the department.

National: Harry Reid Cites Evidence of Russian Tampering in U.S. Vote, and Seeks F.B.I. Inquiry | The New York Times

The Senate minority leader, Harry Reid of Nevada, asked the F.B.I. on Monday to investigate evidence suggesting that Russia may try to manipulate voting results in November. In a letter to the F.B.I. director, James B. Comey Jr., Mr. Reid wrote that the threat of Russian interference “is more extensive than is widely known and may include the intent to falsify official election results.” Recent classified briefings from senior intelligence officials, Mr. Reid said in an interview, have left him fearful that President Vladimir V. Putin’s “goal is tampering with this election.” News reports on Monday said the F.B.I. warned state election officials several weeks ago that foreign hackers had exported voter registration data from computer systems in at least one state, and had pierced the systems of a second one. The bureau did not name the states, but Yahoo News, which first reported the confidential F.B.I. warning, said they were Arizona and Illinois. Matt Roberts, a spokesman for Arizona’s secretary of state, said the F.B.I. had told state officials that Russians were behind the Arizona attack.

National: Stealing Voter Files Was Shockingly Easy for These Hackers | The Daily Beast

The FBI says that computer hackers accessed, and in one case stole, voter registration files in two states, potentially compromising personal information and putting crucial election data at risk just three months before voters head to the polls. And if that weren’t unsettling enough, the techniques that the hackers used were neither sophisticated nor particularly hard to employ, proving that it’s not just high-end hackers from foreign governments, like the ones believed to be targeting U.S. political organizations, that elections officials need to worry about in the runup to November. “I don’t think anyone can assume that these vulnerabilities would be unique to these states,” Pamela Smith, the president of Verified Voting, a nonprofit group that advocates transparency and security in U.S. elections, told The Daily Beast. “This is a time when assuming is not the best thing to do.”

National: How Electronic Voting Could Undermine the Election | The Atlantic

It’s 2016: What possible reason is there to vote on paper? When we use touchscreens to communicate, work, and shop, why can’t we use similar technology to vote? A handful of states, and many precincts in other states, have already made the switch to voting systems that are fully digital, leaving no paper trail at all. But this is despite the fact that computer-security experts think electronic voting is a very, very bad idea. For years, security researchers and academics have urged election officials to hold off on adopting electronic voting systems, worrying that they’re not nearly secure enough to reliably carry out their vital role in American democracy. Their claims have been backed up by repeated demonstrations of the systems’ fragility: When the District of Columbia tested an electronic voting system in 2010, a professor from the University of Michigan and his graduate students took it over from more than 500 miles away to show its weaknesses; with actual physical access to a voting machine, the same professor—Alex Halderman—swapped out its internals, turning it into a Pac Man console. Halderman showed that a hacker who has access to a machine before election day could modify its programming—and he did so without even leaving a mark on the machine’s tamper-evident seals. But it wouldn’t even take a full-fledged cyberattack on an electronic voting system to throw a wrench in a national election. Even the specter of the possibility that the American electoral system is anything but trustworthy provides ammunition to skeptics to call foul if an election doesn’t go their way.

National: Two swing states decline DHS security for voting machines | The Hill

Two swing states, Pennsylvania and Georgia, are declining an offer from the Department of Homeland Security (DHS) to scan their voting systems ahead of the 2016 elections. In August, DHS offered to help states thwart potential hacking amid cybersecurity concerns about just how easily a U.S. election could be manipulated. Georgia and Pennsylvania, however, have opted out. Instead, the two states will rely on their own systems to monitor potential election hacking, reports NextGov. Georgia Secretary of State Brian Kemp cited state sovereignty concerns. “The question remains whether the federal government will subvert the Constitution to achieve the goal of federalizing elections under the guise of security,” he told Nextgov in an email. “Designating voting systems or any other election system as critical infrastructure would be a vast federal overreach, the cost of which would not equally improve the security of elections in the United States.”

National: Elections security: Federal help or power grab? | Politico

The federal government wants to help states keep hackers from manipulating the November election, amid growing fears that the U.S. political system is vulnerable. But Georgia’s top election official is balking at the offers of assistance — and accusing the Obama administration of using exaggerated warnings of cyberthreats to intrude on states’ authority. Georgia Secretary of State Brian Kemp’s objections add to a bumpy start for the Department of Homeland Security’s attempt to shore up safeguards for the election, during a summer when cyberattacks on the Democratic National Committee have called attention to weaknesses across the electoral system. Cybersecurity experts call tougher protections long overdue for parties, political advocacy groups and voting machinery, but DHS’ efforts risk becoming caught in the same partisan arguments about state sovereignty that have hung up programs such as President Barack Obama’s Medicaid expansion. “It seems like now it’s just the D.C. media and the bureaucrats, because of the DNC getting hacked — they now think our whole system is on the verge of disaster because some Russian’s going to tap into the voting system,” Kemp, a Republican, told POLITICO in an interview. “And that’s just not — I mean, anything is possible, but it is not probable at all, the way our systems are set up.”

National: Voting Hurdles Often Keep College Students Away From the Ballot Box | News21

Students at Rollins College in Florida are designing custom “I voted” stickers for absentee voters. Across the country, the University of Southern California has partnered with county officials to host voter registration events with prizes, games and free food. And at the University of Wisconsin-Madison, the student government plans campuswide voter registration drives as well. Across the country, groups and organizations promoting civic engagement among college students have spent hundreds — if not thousands — of hours trying to galvanize this large, yet often elusive group of potential voters. The Campus Vote Project, one of the most prominent college voter outreach groups, has launched an initiative to establish “voter-friendly” campuses. So far, more than 90 institutions, including Rollins College, have agreed to commit to things such as hosting voter registration drives, inviting candidates to speak or offering rides to the polls to increase voter education, registration and mobilization. Why go to the trouble of recruiting college voters? College students have the potential to influence elections. There were 17.3 million undergraduate students enrolled in degree-granting postsecondary institutions in 2014, according to the National Center for Education Statistics. Experts predict that population will increase to 19.8 million by 2025.

National: Selfies in voting booths: Depending on where you live, they may be illegal | Ars Technica

“Dude, check out who I voted for!” We soon could be seeing a lot more selfies with that caption. That’s because legislation legalizing ballot selfies in voting booths landed on California Gov. Jerry Brown’s desk on Friday. Assembly Bill 1494 amends California law that, for now, says “a voter shall not show” a ballot “to any person in such a way as to reveal its contents.” The new law awaiting the governor’s signature says “a voter may voluntarily disclose how he or she voted if that voluntary act does not violate any other law.” The measure passed the state Senate earlier this year and the state Assembly last week on a 63-15 vote. “I see this as a First Amendment issue,” Assemblyman James Gallagher, a Republican representing Yuba City and one of the bill’s sponsors, told colleagues during a floor vote. “All this does is to say that those who want to share how they voted have the right to do so.” Across the US, the law in the 50 states on voting booth selfies is mixed. No federal law addresses the issue, and there’s a smattering of court challenges across the country. Consult these guides from the Huffington Post and the Digital Media Law Project on whether it’s OK to snap a picture of yourself showing your votes on the November 8 presidential ballot.

National: Swing States Reject Feds’ Offer to Cybersecure Voting Machines | Defense One

Some key swing states have declined an offer from the Homeland Security Department to scan voting systems for hackers ahead of the presidential elections. As suspected Russian-sponsored attackers compromise Democratic Party and other U.S. political data allegedly to sway voter opinion, some security experts say it wouldn’t even take the resources of a foreign nation to manipulate actual votes using this country’s antiquated tallying systems. Against this backdrop, Homeland Security Secretary Jeh Johnson during an Aug. 15 call with state election officials, offered states DHS services that can inspect voting systems for bugs and other hacker entryways. Earlier in the month, he also suggested the federal government label election systems as official U.S. critical infrastructure, like the power grid. But some battleground states, including Georgia and Pennsylvania, say they will rely on in-house security crews to maintain the integrity of voter data.

National: Data Shows Trump’s Election-Rigging Claim is Unlikely | Government Technology

… At a campaign rally in Altoona, Pa., on Aug. 12 [Trump] alleged that a poor showing could only mean one thing: “The only way we can lose, in my opinion — I really mean this, Pennsylvania — is if cheating goes on. I really believe it.” Trump said, alluding to political subterfuge from the Clinton campaign. Since that rally, Trump has held to these assertions of foul play while his critics have cast them as highly dangerous for the democratic process. However, for those close to the matter — voting officials and voters’ rights groups — the conspiracy theory is a bit bewildering. Pamela Smith, the president of VerifiedVoting.org, is among these. Her organization — a nonpartisan voting advocacy, accountability and research group — has gained notoriety since it was founded in 2003 for its work tracking election tech, legislation and voting procedures. In this time, Smith said incidents of voter fraud and rigged elections have been nearly nonexistent. “It’s frustrating because I think a lot of people may get the mistaken impression that there are some major areas of vulnerability,“ Smith said. “But they may not be aware of things election officials do already, or the true scope of the issue.” A look at current and historical data, said Smith, indicates that the potential for cheating is uniquely limited. Voter ID fraud is nearly nonexistent; purchasing votes is too tricky to cover up, at least at a national or county level; and hacking voting machines and software is ineffectual since usage of the systems is low and controlled. “Because our elections are really decentralized, it’s also not like there’s a single point of vulnerability out of 9,000 jurisdictions we have in the U.S.,” Smith said.

National: Hack the vote: How attackers could meddle in November’s elections | Network World

Political action committees aren’t the only entities attempting to influence the upcoming U.S. presidential election. Supposedly, Russia wants a say in who should lead the country. At least that’s the opinion you could form after reading the many news stories that allege Russia is behind the recent hacks targeting the Democratic National Committee and the Democratic Congressional Campaign Committee. Attack attribution aside (I shared my thoughts on that topic in last month’s blog), these data breaches raise the question of whether attackers could actually impact an election’s outcome. Not to scare you, but hacking the vote is pretty easy. Some possible ways of carrying this out, like hacking electronic voting machines, have been discussed extensively, while others, such as targeting organizations that poll voters, probably haven’t been considered. I’m not trying to frighten people by bringing up these scenarios. As far as I know, none of the methods I’m going to discuss have been used to sway an election. To me, this is an opportunity to present these possible situations to the security community and, by freely talking about them, ensure that voting goes as smoothly as possible on November 8.

National: Efforts to restore felons’ voting rights cause deep divide | News21

Republican and Democratic politicians across the country are deeply divided over restoring the right to vote to felons, a political fracture that affects millions of convicted criminals. In Iowa and Kentucky, Democratic governors issued executive orders to restore voting rights to many felons, only to have them rescinded by Republican governors who succeeded them. Democratic legislators in 29 states proposed more than 270 bills over the last six years that would have made it easier for some felons to vote, but very few passed, especially in legislatures controlled by Republicans, News21 found in an analysis of state legislative measures nationwide.

National: Why some military personnel ballots may not be counted | News21

Military and overseas voting can be a complicated process. Service members can file a Federal Post Card Application, which allows them to both register to vote and request an absentee ballot from their home state or county. If the service member doesn’t receive their ballot in time, they can use a Federal Write-in Absentee Ballot as a backup. EAC Commissioner Thomas Hicks told News21 that some of the inconsistencies between ballots sent and ballots returned are likely the result of military voters printing out the Federal Write-in Absentee Ballot and sending it back home. Since the ballots are not sent by local jurisdictions, they might be counted as ballots returned but not mailed out. The commissioner stressed that ensuring the accuracy of that data is up to states and not the EAC. “I’m confident in that it is the data coming from the states and I think that we put that data out and it’s accurate,” said Hicks.

National: Clock running out on challenges to voting rights cases in key states | CNN

August 25, 2016

Battles over voting rights are heating up in states that could play a critical role in the November election. The pressure is on to resolve key issues in a timely manner as courts are often reluctant to make legal changes too close to Election Day. “It’s very important not to disrupt the machinery and the administration of the voting process,” says Edward Foley of the Moritz College of Law at the Ohio State University. “Judicial rulings too soon to the election can be disruptive, and in the past the Supreme Court has made it very clear that it doesn’t want that disruption.” … In the coming days, Supreme Court justices will rule on an emergency petition filed by North Carolina asking the court to allow provisions of the state’s omnibus 2013 election law to remain in effect. The law boosts voter ID requirements, restricts early voting days and eliminates same-day registration.

National: Native Americans still fighting for voting equality | News21

August 25, 2016

Terry Whitehat remembers gathering at the community hall in Navajo Mountain each election day, where Navajo Nation members in this remote Utah community would cast their ballots. The tribal members would catch up with friends and family and eat food under the cottonwood trees in the parking lot. So when Whitehat, a social worker who has lived most of his life on the reservation, received a ballot in the mail for the 2014 elections, he said it caught him off guard. The county began conducting elections by mail in 2014. Members of the Navajo Nation who live in the area could no longer physically vote in the village. If they wanted to vote in person, they would have to drive to the only remaining polling place at the county seat in Monticello, a 400-mile round trip from Navajo Mountain. Whitehat and a half-dozen other Navajo community members, along with the Navajo Nation Human Rights Commission, sued the county. They claimed the move to a mail-only election disenfranchised Native Americans, especially those who don’t read or speak English and had limited access to mail. They said it also violated the Voting Rights Act and the 14th Amendment.

National: This Election Could Be Hacked, And We Need To Plan For It | Forbes

August 24, 2016

With the Democratic National Committee cyberattack far more widespread than originally thought, fears of foreign power using cyber-espionage to influence this November’s election are growing, and real. It’s also prompted concern that hackers may shift focus to an even more vulnerable target: your vote. Voters in 43 states will cast their ballot for the next president using aging electronic voting machines, many now ten years old with dated software lacking proper security. Despite machine manufacturers’ repeated claims of their integrity, high-profile studies have shown hackers can alter vote tallies on these notoriously-penetrable machines within minutes. Tactics available to hackers are numerous and growing: A distributed denial-of-service (DDoS) attack would disable voting machines or the back-end servers, preventing voters from participating in the election. Deleted voting records ahead of Election Day would expunge names from the registered voter rolls. And malware could be used to “steal” an election by tampering with voting machine hardware or software.

National: New Voting Technologies Create Need for Improved Infrastructure | StateTech Magazine

August 24, 2016

The days of hanging chads might be over, but new Election Day challenges have arisen to fill the void. Electronic voting machines, online voter registration portals and optical scanning devices place significant strain on data center operations. States, counties and cities must now ensure they have the infrastructure necessary to support these increasingly popular technologies — especially with the 2016 presidential election just over the horizon. But even though all states face the same Nov. 8 deadline for Election Day improvements, the varied adoption of voting innovations means no two states have the same infrastructure-upgrade needs.

National: There’s work to be done to make US elections secure — and it has nothing to do with voter ID | Public Radio International

Recently, Homeland Security Secretary Jeh Johnson said the government was considering classifying voting systems part of the nation’s “critical infrastructure,” a designation currently held by systems such as the electric grid and banking networks. The announcement comes on the heels of reports of a vast infiltration of Democratic Party servers. “Everything we know about voting machines — electronic ones, computerized ones, is they’re not very secure,” says tech security expert Bruce Schneier. “They are not tested, they are not designed rigorously and in many cases there’s no way to detect or recover from fraud. So there really is a disaster waiting to happen.” Aviel Rubin, a professor of computer science at the Johns Hopkins University, agrees. “Unfortunately, I think the thing that’s improved the most in the last 10 years is the sophistication of the hackers and the number of incidents that we see that are occurring daily. If you look at the news you see that ransomware is becoming pretty common,” Rubin says. “The big change that I’ve seen has been just how sophisticated the hackers are today. And they’re sponsored by countries like Russia and China, which is a much more formidable adversary than we had in the past.”

National: In-person voting fraud is rare, doesn’t affect elections | PBS NewsHour

Donald Trump’s newest campaign ad begins with a warning: “In Hillary Clinton’s America, the system stays rigged against Americans.” The commercial, which aired Friday as part of his $5 million swing state ad buy, harkens back to a claim Trump has been hammering for weeks — that the general election is rigged against him. The questionable claim looks to mobilize Republicans, with the all-important start of early voting in some states just weeks away. The presidential nominee has voiced strong support for North Carolina’s stringent voter ID law — struck down as discriminatory, but to be appealed — saying without it, voters will cast ballots “15 times” for Democrat Hillary Clinton. He also launched a new effort on his website last week seeking volunteers to root out fraud at the polls. That ID law Trump referred to had involved a broader package of restrictions — among them, reducing early in-person voting, which is popular among blacks in particular. At the same time, it exempted tough photo ID requirements for early mail-in voters, who were more likely to be white and Republican.

National: After DNC Hack, Cybersecurity Experts Worry About Old Machines, Vote Tampering | NPR

Security experts say that Russian hackers have broken into the computers of not only the Democratic National Committee but other targets as well. This has raised a new wave of concerns that on Election Day, the votes themselves could be compromised by hackers, potentially tipping the results. Most states have returned to paper-backed voting systems in recent years, but that still leaves vulnerable a number of states that rely solely on machines. Zeynep Tufekci, a professor at the University of North Carolina’s School of Information and Library Science, tells NPR’s Scott Simon that without these paper-backed systems, up to 15 states could be putting their election results at risk. That’s a possible reach of 60 million voters — “enough to swing an election,” Tufekci says. In my old workplace — at Princeton University at the Center for Information Technology Policy — we had this lounging area with comfy couches, and researchers had decorated the place with a voting machine that had been hacked to play Pac-Man instead of counting votes. … And when they hacked this, the machine had been in use in jurisdictions around the country with more than 9 million voters.

National: Report: Online Voting Carries Security Risks | The Daily Dot

In 2016, people are increasingly doing everything online. Dating has moved to Tinder, your bank is now a smartphone app, and schoolyard bullies are basically giving virtual wedgies. In that respect, it may seem odd online voting hasn’t become ubiquitous; however, a new report shows that electronic voting is fraught with problems. According to the report, released this week by a trio of nonprofit organizations—the Verified Voting Foundation, the Electronic Privacy Information Center, and Common Cause—online voting systems necessarily create a link between a voter and his or ballot. That link runs counter to the system of secret ballots the United States has almost universally employed for well over a century. Entitled Secret Ballot At Risk: Recommendations for Protecting Democracy, the report notes that 32 states, along with the District of Columbia, employ some form of online voting. Only Alaska allows all of its citizens to vote online; most other states restrict the privilege to active U.S. service members stationed overseas.

National: America scrubs millions from the voter rolls. Is it fair? | News21

The cleansing of America’s voter registration rolls occurs every two years and has become a legal battleground between politicians who say the purges are fair and necessary, and voting rights advocates who contend that they discriminate. Voting rights groups repeatedly have challenged states’ registration purges, including those in Ohio, Georgia, Kansas and Iowa, contending that black, Latino, poor, young and homeless voters have been disproportionately purged. In Florida, Kansas, Iowa and Harris County, Texas, courts have ordered elections officials to restore thousands of voters to the registration rolls or to halt purges they found discriminatory. The 1993 National Voter Registration Act mandates that state and local elections officers keep voter registration lists accurate by removing the names of people who die, move or fail in successive elections to vote. Voters who’ve been convicted of a felony, ruled mentally incompetent or found to be noncitizens also can be removed. The U.S. Election Assistance Commission reported that 15 million names were scrubbed from the lists nationally in 2014.

National: OSCE rights group requests 500 international observers to monitor US presidential vote | Reuters