National

Fear that hackers could exploit vulnerabilities in our voting systems could undermine voter confidence this November, especially if the vote ends up being close. The good news is that it is also helping fuel an important discussion about how the U.S. should secure its elections. Recent hacks on the Democratic National Committee, for which the White House has officially blamed Russia, along with reports that hackers have targeted online voter registration databases in more than 20 states, have made it clear that adversaries are inclined to disrupt the American political system using cybercrime. The attacks prompted the U.S. Department of Homeland Security to begin assisting state and local election boards on cybersecurity matters. Congress has held multiple hearings to assess the national election system’s technical weaknesses and explore ways to account for them. And there have been countless media reports (including some from MIT Technology Review) cataloguing vulnerabilities like Internet-connected voting registration databases and absentee ballot-return systems, as well as electronic voting machines that don’t produce paper audit trails.

National: Elections at Risk in Cyberspace, Part I: Voting Lists | Signal Magazine

As U.S. elections increasingly are digitized, the same threats faced by other users of cyberspace loom as potential vulnerabilities to voting and ballot tallies. Candidates and interest groups have expressed concern about the validity of the upcoming election based on real and perceived cyber threats. Voting systems connected to the Internet as well as those that are isolated are susceptible to intrusions that could shake up an election. The threat to an election can take two forms. One is an attack that actually changes the outcome by altering the vote count to favor one candidate over another. The other threat is tampering that may not clearly change the outcome but sows doubt among the electorate and reduces public trust about the validity of an election and the sanctity of the democratic system. The Office of the Director of National Intelligence (ODNI) and the Department of Homeland Security (DHS) issued a joint statement on October 7 expressing confidence that the Russian government “directed the recent compromises of emails from U.S. persons and institutions, including from U.S. political organizations. … These thefts and disclosures are intended to interfere with the U.S. election process.”

National: Elections at Risk in Cyberspace, Part III: Vote Database Security Ultimately Could Determine an Election Result | SIGNAL Magazine

Any attempts to sabotage an election through cyber attacks ultimately would be geared to affecting the vote count, either to change the outcome of the race or to sow doubt on the validity of the election itself. Just as banks strive to secure their depositors’ assets, governments also work to ensure the fidelity of their election returns. But, as bank accounts are vulnerable to cyber attacks, so are vote totals—to varying degrees. While most tabulation databases are safe from everyday hacker threats, nation-states with highly advanced cyber operations theoretically might be able to mount an effective cyber attack on a U.S. national election by bringing their best offensive cyber capabilities to bear. State governments, which are responsible for the voting process, pay close attention to tabulation security. Ron Bandes is a network security analyst in the CERT division of the Software Engineering Institute of Carnegie Mellon University. He also is president of VoteAllegheny, a nonpartisan election integrity organization. Bandes points out that in many states, two tallies occur. One is done at the local level, usually by the county. The other is a statewide count comprising all the county totals. These counts are cross-validated. “The outputs from the voting machines have to match the inputs to the tally system,” Bandes points out.

National: Intelligence Analyst: Russian Cyberattacks Could Roil US Elections | VoA News

Malcolm Nance is extremely worried about what might happen as U.S. votes are tallied on Nov. 8, election night. A career U.S. counterterrorism and intelligence official with 33 years of experience, Nance said he had overwhelming evidence that Russia is seeking to interfere in U.S. elections to put “not just a finger, but their whole hand” on the scale to help Republican nominee Donald Trump and hurt Democratic nominee Hillary Clinton. Nance said a number of private companies had traced cyberattacks exposing potentially damaging Democratic Party emails and voicemails back to cyber “fingerprints” clearly identified in the past as those of Russian state hackers. He said the same fingerprints were found in what turned out to be Russian hacking of power plants in Ukraine and of the German parliament. … U.S. federal investigators believe Russian hackers are also behind cyberattacks on a contractor for Florida’s election system that may have exposed the personal data of Florida voters.

National: Two State Elections Databases Have Been Hacked. The Russians Aren’t the Only Suspects. | Mother Jones

Arizona Secretary of State Michele Reagan was in the backyard of her home last June when she got a call from her chief of staff. “The first words out of his mouth were, ‘Can you sit down?'” Reagan told Mother Jones. He then said that her office had been “contacted by the FBI, and it looks like there’s a computer password and username that belongs to our database for sale on the dark web.” Reagan is the chief elections officer for the state of Arizona, and the credential that was for sale on the “dark web”—a collection of websites that hide their IP addresses to obscure where they’re hosted and who runs them—would potentially give the buyer access to a database containing personal information for nearly 4 million voters. With help from the FBI, the Arizona Department of Homeland Security, and the Arizona Department of Administration, Reagan and her staff determined that an employee in Gila County, Arizona, had opened a Microsoft Word document attached to an email. That document likely contained software that may have tracked the employee’s key strokes, which eventually led to the attacker getting a username and password to one of the state’s election-related databases.

National: 7 Ways Electronic Voting Systems Can Be Attacked | Dark Reading

Concerns about the fragility of US electronic voting systems to cyberattacks go back to 2002 when the Help America Vote Act was passed mandating the replacement of lever-based machines and punchcards with more modern voting equipment. Those concerns have been greatly amplified this election season with reports of attacks on voter registration systems in some 20 states and intrusions into the Democratic National Committee’s computers by hackers believed to be out of Russia. The attacks have stirred considerable fears about foreign adversaries and nation-state actors somehow disrupting the elections and even manipulating the outcome of the voting to favor one of the two major party candidates. … In all states but five, a vast majority of the electronic voting equipment that voters use will have paper backups. Some voters will use what are known as Direct-Recording Electronic (DRE) voting systems to cast their votes electronically. Others will mark their choices on a paper ballot and feed it into an optical scanner that will do the ballot counting. In both cases, voters and election officials will have a so-called Voter Verifiable Paper Audit trail that will provide a reliable backup even if the machines fail or are somehow compromised.

National: Donald Trump, Slipping in Polls, Warns of ‘Stolen Election’ | The New York Times

Donald J. Trump has lashed out at fellow Republicans, calling them “disloyal” and “far more difficult” than Hillary Clinton. He has griped openly about a “rigged” political system, saying Wednesday he has “no respect” for the nonpartisan Commission on Presidential Debates and complaining about a “defective” microphone in the first debate. And on Monday, at a rally in Wilkes-Barre, Pa., he worried the election could be “stolen” from him and singled out Philadelphia, a city with a large African-American population, warning, “We have to make sure we’re protected.” Mr. Trump’s ominous claims of a “stolen election” — which he often links to black, urban neighborhoods — are not entirely new. But in recent days, he has been pressing the theme with a fresh intensity, citing everything from the potential for Election Day fraud to media bias favoring Mrs. Clinton to rigged debates.

National: Trump Supporters Monitoring Polls Alarms Voting-Rights Groups | Bloomberg

For the first time in a half-century, Americans will go to the polls in November without the full protection of the Voting Rights Act. Following a 2013 U.S. Supreme Court ruling invalidating a key section of the 1965 law, the U.S. Department of Justice has had to curtail its federal observer program, under which trained monitors oversee access to ballot boxes in areas historically prone to discrimination. The shift comes just as Republican nominee Donald Trump has been exhorting his supporters to be vigilant about the supposed threat of voter fraud, which has been shown to be almost nonexistent in the U.S. “They’re letting people pour into the country so they can go and vote,” he said in an Oct. 7 meeting with the union representing U.S. Border Patrol agents. At a Pennsylvania rally on Oct. 10, he told the crowd, “So important that you watch other communities, because we don’t want this election stolen from us.” An online movement called Operation Red is encouraging Trump supporters to wear red to the polls so people “will have no choice but to acknowledge the visible truth in a sea of red,” according to the group’s website.

National: Elections at Risk in Cyberspace, Part II: Variety is the Spice of Hacking for Voting Machines | Signal Magazine

Election-day activities center on polling places and their voting machines, and this is where the public interest in vote security is most acute. Each state is in charge of acquiring and managing voting machines, and many states have different types of machines within their borders. The wide variety of voting machines used across the United States, rather than deterring hackers, actually helps empower them if they want to change the outcome of people’s votes, say many cybersecurity experts. Many voting machines are so old that modern security has not yet caught up to them. The differences among voting machines also mean that no single tactic could be employed to cause them to give misleading vote totals. Any coordinated effort to use the machines to affect voting outcomes would have to be tailored to each type of machine and would require an extensive network of operatives to be effective on a large scale. Some electronic voting machines still in use in the United States date back to the last millennium, according to a report by the Brennan Center for Justice, a liberal nonpartisan policy and law institute connected with New York University School of Law. The oldest machines have all the security of an ATM—which is to say, very little. Newer machines still are vulnerable because they provide access points for cybermarauders to inject malware that could change votes outright.
Direct-reporting voting machines that offer no paper backup are the most vulnerable, states Chuck Brooks, vice president of government relations and marketing for Sutherland Government Solutions. Also, the diversity of electronic voting machines precludes any easy security fix. Few have had software updates, he says.

National: What it takes to secure the elections | TechCrunch

While virtually every industry and domain is flourishing and being revolutionized by technological advances, more than three-quarters of U.S. citizens will vote for their next president on paper ballots this November. The main reason for this is concern over cybersecurity threats against the electoral system and process. In the wake of major breaches, such as the hacking of the Democratic National Convention and attacks against voter registration databases in at least two states, it is now feared more than ever that the presidential elections might be influenced or compromised by nation-states such as Russia. And that’s why any form of technology being used in elections is generally frowned upon and regarded as a potential attack vector for malicious actors. But is this a pattern that has to repeat itself every four years? Are we doomed to choose our leaders in settings that one expert described to me as reminiscent of the dark ages for fear of major hacks, or is it possible to see future elections leverage the full power of the newest tech without fearing cyber threats?

National: Election cyber threats: More states request DHS help | CNN

More states and local election boards have asked the Department of Homeland Security to help with cybersecurity, the department announced Monday night. The total, which has been steadily rising in recent weeks, has reached 33 state and 11 county or local election agencies, DHS said. More than two dozen states were known to have requested help before the updated tally. DHS has been urging states to take advantage of its resources, which include scanning systems for vulnerabilities and recommendations for improving cybersecurity on election and voter registration systems. The update from Secretary Jeh Johnson warned those on the fence to make a decision.

National: Hurricane Matthew and Its Effect on Voting Rights | The Atlantic

Hurricane Matthew brought utter devastation to Haiti and other islands in the Caribbean after it swept through the region early last week. In Haiti, the storm killed at least a thousand people; damaged infrastructure advancements the nation had made in its push to modernize; and delayed a presidential election originally scheduled for early October. While the problems it’s caused on the eastern United States have been less dire, the storm has nevertheless had serious consequences in many communities. And, as in Haiti, its aftereffects may have repercussions on the country’s upcoming presidential election as well. Efforts to calculate the political costs of a disaster—which are already ongoing in the case of Matthew—often generate callous, clinical results that don’t capture the length and breadth of those effects; they may focus on how displacement might benefit one candidate or the other, but can’t capture the human stories behind those missed votes. The most difficult exercise in a catastrophe’s aftermath is accounting for the things and people lost: the resulting health crises, the activities made difficult, the memories erased, and the strain of rebuilding. Worrying about political consequences can seem crass when people’s day-to-day lives are in ruins. Sometimes, though, the things victims have to lose are political in nature, making a discussion about politics unavoidable—and even necessary.

National: Unable to Vote, Ex-Convicts Reach Out, Try to Have Impact on US Election | VoA News

Kenneth Inniss, 56, has not voted in a U.S. election since 1984, when he first went to prison for a felony conviction. He is now out but will have to wait one more year until he is off parole to vote. “It’s a right that we take for granted until it’s taken from us,” he said. “And that’s when it really hit home for me. I don’t have a say in how those laws are keeping me incarcerated.” Inniss recently packed into a glossy black van with eight other formerly incarcerated New Yorkers and embarked on a road trip to Cleveland, Ohio. The group had a simple mission: Inform Ohio ex-prisoners of their right to vote.

National: Senator wants nationwide, all-mail voting to counter election hacks | Ars Technica

“It’s not a question of if you’re going to get hacked—it’s when you’re going to get hacked.” Those were the words of Verizon CEO Lowell McAdam as he sought to assure investors last week that the company is still interested in purchasing Yahoo despite the massive data breach of Yahoo consumer accounts. Whether McAdam’s words ring true for the hodgepodge of election systems across the US is anybody’s guess. But in the wake of the Obama administration’s announcement that the Russian government directed hacks on the Democratic National Committee and other institutions to influence US elections, a senator from Oregon says the nation should conduct its elections like his home state does: all-mail voting.

National: Facebook Helped Drive a Voter Registration Surge, Election Officials Say | The New York Times

A 17-word Facebook reminder contributed to substantial increases in online voter registration across the country, according to top election officials. At least nine secretaries of state have credited the social network’s voter registration reminder, displayed for four days in September, with boosting sign-ups, in some cases by considerable amounts. Data from nine other states show that registrations rose drastically on the first day of the campaign compared with the day before. “Facebook clearly moved the needle in a significant way,” Alex Padilla, California’s secretary of state, said in an interview on Tuesday.

National: Democracy Live launches voting app to view election ballots on smartphones | Puget Sound Business Journal

Democracy Live launched its LiveBallot app and website Thursday to provide American voters with online access to their ballot ahead of Election Day. The LiveBallot social-balloting technology can offer every registered U.S. voter a digital replica of the ballot they’ll see at the polls, plus candidate bios, contact information and links to recent news articles about them. The information can be shared on social media. “LiveBallot is the only app that delivers a customized ballot to each of the 200 million voters in the U.S.,” Democracy Live President and CEO Bryan Finney said in an interview. “For the first time in election history, voters will have a virtual replica of their ballots on their personal devices, computers and in their hands ahead of Election Day.”

National: Obama Considers ‘Proportional’ Response to Russian Hacking in U.S. Election | The New York Times

President Obama is weighing a “proportional” response to Russia’s efforts to interfere with this fall’s election campaign through hacking, the White House announced Tuesday. “The president has talked before about the significant capabilities that the U.S. government has to both defend our systems in the United States but also carry out offensive operations in other countries,” Josh Earnest, the White House press secretary, told reporters traveling with Mr. Obama on Air Force One to Greensboro, where he was holding a town hall-style meeting with students and campaigning for Hillary Clinton. “There are a range of responses that are available to the president, and he will consider a response that is proportional,” Mr. Earnest said. Whatever the president opts to do would probably not be announced in advance and may never be acknowledged or disclosed if it is carried out, Mr. Earnest said. On Friday, the Obama administration publicly acknowledged for the first time that it believed that the Russian government was responsible for stealing and disclosing emails from the Democratic National Committee and a range of other institutions and prominent individuals, most recently Hillary Clinton’s campaign chairman, John D. Podesta. The emails were posted on the well-known WikiLeaks site and two newer sites, DCLeaks.com and Guccifer 2.0.

National: Which Voter Registration Sites Can Sell Your Information? | Vocativ

Most of the internet’s most popular voter registration sites make no promise to not turn and sell your information to advertisers, a Vocativ analysis has found. The findings shouldn’t be reason for anyone to avoid registering to vote in the 2016 election, though it may steer you to register through the government’s own standard, unadorned portal: vote.gov. Of the nine major voter registration sites surveyed, only vote.gov, maintained by the U.S. General Services Administration, explicitly promises to neither share hopeful voters’ raw personal information with third parties nor to use it for commercial purposes. Combined, the other sites, including Turbovote, RegisterToVote.org, and HeadCount.org, have reported that they’ve registered millions of voters in this and previous elections. Some work with other companies in order to increase exposure and increase registrations. Rock The Vote, an organization that has existed for 26 years, currently has 820 active partners, said Jen Tolentino, its Director of Civic Technology and Policy, and they include massively popular web services like Twitter and Tinder. None of this is to say that each of these sites actively mine their users’ information to sell to the highest bidder. Instead, it’s that they haven’t promised not to. “The thing about privacy policies is they’re written by lawyers to sound like they’re understandable to regular people, but intentionally so that they’re not,” Nate Cardozo, a senior staff attorney at the Electronic Frontier Foundation, told Vocativ. “I don’t know under what circumstances Rock The Vote will share my personal information.”

National: John Podesta Says Russian Spies Hacked His Emails to Sway Election | The New York Times

In his first remarks since WikiLeaks began releasing thousands of his hacked emails, John D. Podesta, Hillary Clinton’s campaign chairman, said Tuesday that Russian intelligence officials intent on swaying the election to Donald J. Trump had been responsible for the illegal breach into his account. “I’ve been involved in politics for nearly five decades,” Mr. Podesta told reporters aboard the Clinton campaign plane. “This definitely is the first campaign that I’ve been involved with in which I’ve had to tangle with Russian intelligence agencies,” he added, “who seem to be doing everything that they can on behalf of our opponent.” Without verifying the authenticity of the emails, Mr. Podesta said that he had spoken with the F.B.I. “as a victim” of hacking. The Obama administration, like Mr. Podesta, believes the Russian government has been trying to help Mr. Trump with its hacking, including the theft of emails of the Democratic National Committee this year. Mr. Podesta said Mr. Trump had “essentially adopted lock, stock and barrel” a foreign policy that would favor the interests of President Vladimir V. Putin.

National: Department of Homeland Security helps 33 states with election cybersecurity | The Hill

Thirty-three states and 11 county and local election agencies have sought help from the Department of Homeland Security (DHS) to shore up their voting infrastructure against cyberattacks, according to the agency. The department urged other states to take advantage of its services — such as scanning internet-facing systems to identify vulnerabilities — noting that less than 30 days remain until Election Day. “Time is a factor,” the agency wrote in a notice sent late Monday. “It can take up to two weeks from the time we receive authorization to run the scans and identify vulnerabilities. It can then take at least an additional week for state and local election officials to mitigate any vulnerabilities on systems that we may find.” The alert comes amidst heightened fears that the Russian government is attempting to interfere in the U.S. election.

National: Why US fears Russia is hacking its presidential election | The Nation

Amidst all the heat of the presidential debate on Sunday night, hackers surfaced for a brief moment. The two candidates clashed over a claim that hackers tied to the Russian state were trying to influence the election. Two days earlier, on Friday, the US director of national intelligence had pointed the finger at the highest levels of the Russian state for intrusions.
Critics of Russia have argued that any role would be part of a growing trend of not just stealing information but also weaponising it. The story begins in May, when the Democratic National Committee (DNC) became concerned about suspicious behaviour on its computer network. It called in the security firm CrowdStrike to take a look. Two hacker groups were found on the system, one that had just entered and another that had been there for nearly a year.

National: Republicans tell Trump to quit claiming rigged election | Politico

It’s not just the Democrats who are frustrated by Donald Trump’s “rigged election” talk. Republicans have started warning their increasingly ostracized nominee to stop stoking his supporters with claims that the 2016 election will be stolen, daring him to show proof or put a lid on it. “Somebody claiming in the election, ‘I was defrauded,’ that isn’t going to cut it,” said former Sen. Kit Bond, a Missouri Republican who earlier in the campaign endorsed Jeb Bush and then Marco Rubio. “They’re going to have to say how, where, why, when. I don’t think leading candidates for the presidency should undercut the process unless you have a really good reason,” Sen. Lindsey Graham, a South Carolina Republican who gained little support for his own 2016 White House run, told POLITICO. Trump and his running mate, Mike Pence, have been flogging for months the notion that Hillary Clinton supporters could tamper with voting to the point that they win the White House. Their campaign website is recruiting poll watchers, and longtime Trump adviser Roger Stone has been raising unlimited funds from corporations and individuals in a bid to “fight a rigged system” that purportedly benefits the Democrats.

National: Election officials say they’re ready if disaster hits | USA Today

Election officials say they’re ready with backup plans in case a natural disaster — like the recent flooding in Louisiana or another storm like Hurricane Matthew — threatens to keep voters away from the polls on Election Day. “We all may have different kinds of disasters, but you still have to hold elections,’’ said Meg Casper, spokeswoman for the Louisiana secretary of state’s office. “What we have done and what we tell folks is, as long as you’ve got a power source, even if it’s a generator, and a tent, you can hold an election. All of these things are mostly lessons learned from (Hurricane) Katrina.’’ Federal and state election officials said Superstorm Sandy, which struck the Northeast in late October 2012, also schooled them in holding elections following torrential rain, flooding and power outages. One lesson: Have paper ballots ready just in case. “We all have contingency plans,’’ Mississippi Secretary of State Delbert Hosemann said. “We just hope the good Lord doesn’t make us use them.’’ Most election officials also have prepared for potential cyber attacks, said Thomas Hicks, chairman of the federal Election Assistance Commission, which held a public meeting last month on Election Day contingency plans.

National: Hurricane victims face another challenge: exercising their right to vote | The Washington Post

In the wake of Hurricane Matthew, residents still struggling to return to their homes and assess the damage are facing another challenge: registering to vote before it’s too late. Nowhere is the issue more acute than in Florida, where a fight to extend that deadline has turned bitterly partisan and litigious. Some 1.5 million Floridians were placed under evacuation last week as the Category 4 hurricane bore down on the state’s coast, closing down county and state government services. After Gov. Rick Scott (R) refused to extend Tuesday’s deadline to register, a federal judge ruled against him, extending it at least until Wednesday and rebuking Scott’s decision as “irrational,” “nonsensical” and “poppycock.” “These voters have already had their lives (and, quite possibly, their homes) turned up-side down by Hurricane Matthew,” U.S. District Judge Mark E. Walker wrote. “They deserve a break, especially one that is mandated by the United States Constitution.”

National: 3 ways big storms like Hurricane Matthew can impact an election | The Washington Post

Hurricane Matthew is significantly earlier in the election than Sandy was — early October vs. late October — and we still don’t know precisely how much it will affect Florida, Georgia and South Carolina. So it’s very early to talk about political implications. But given Florida’s status as a hugely important swing state (and even Georgia’s status as a surprising battleground), there will be plenty of debate about the political impact the storm could have come Nov. 8. And the political fight over it has already begun, with Florida Gov. Rick Scott (R) on Thursday declining the request of Democrats to extend voter registration in that state. Here are three ways in which storms like this can affect elections — along with whether there’s evidence they actually do.

National: Could the U.S. election be hacked? | USA Today

The impact of Russian hacking on the upcoming presidential election was a topic in Sunday night’s debate, raising the question: Is the U.S. election hackable? Experts say at the national level, no. But there could be individual incidents that undermine faith in the system. There’s almost no danger the U.S. presidential election could be affected by hackers. It’s simply too decentralized and for the most part too offline to be threatened, according to the head of the FBI and several security experts. “National elections are conducted at the local level by local officials on equipment that they obtained locally,” so there’s no single point of vulnerability to tampering here, said Pamela Smith, president of Verified Voting, a non-partisan, non-profit organization that advocates for elections accuracy. … The biggest question in the mind of voting security expert Joseph Kiniry is whether the 2016 election will be Y2K or Pearl Harbor.

National: Seven Reasons the New Russian Hack Announcement Is a Big Deal | Politico

It’s been buried under news of Donald Trump bragging about his ability to grab women by their genitals, but Friday afternoon’s news dump included a stunning declaration by the Department of Homeland Security: the first direct accusation from the Obama administration that Russia is trying to interfere with our elections. “The U.S. Intelligence Community is confident that the Russian Government directed the recent compromises of e-mails from US persons and institutions, including from US political organizations,” the statement said, concluding that “these thefts and disclosures are intended to interfere with the US election process.” After the Democratic National Committee hack and the scattered hacks of voting machines, and months of talk in the press and on Capitol Hill, the Obama administration has openly called out the Kremlin for meddling in the election. This was immediately followed by a new dump of documents from WikiLeaks, this time of Clinton campaign chair John Podesta’s emails, and news that the Russian ambassador to the United Nations lodged a formal complaint with the organization when another official criticized Trump. And all of this comes against the backdrop of Trump’s constant and effusive praise for Vladimir Putin, as well as a steady stream of revelations about his campaign’s shady ties to Russia.

National: Is there any practical way for Republicans to replace Trump at this point? Not really | Los Angeles Times