Thousands of voting machine vendor employees’ work emails and plaintext passwords appear in freely available third-party data breach dumps reviewed by CSO, raising questions about the security of voting machines and the integrity of past election results. While breached sites, like LinkedIn after the 2012 breach, force users to change their passwords, a significant number of people reuse passwords on other platforms, making third-party data breaches a gold mine for criminals and spies. For many years voting machine vendors have claimed that voting machines were air gapped — not connected to the internet — and were thus unhackable. Kim Zetter debunked that idea in The New York Times in February. An attacker who managed to break into a voting machine vendor employee’s work email, because the employee used the same password as on a breached site, could leverage that to gain access to the voting machines themselves. And if voting machine vendors install remote access software on voting machines, factory backdoors that vendor employees use to remotely access the machines for maintenance, troubleshooting or election setup purposes, this turns voting machine vendor employees into targets. Hack the vendor, hack the voting machine.
The Trump administration has told states exactly how much of a $380 million fund they will get to make their voting systems more cyber-secure ahead of the 2018 midterm elections. The funding, made available through a $1.3 trillion omnibus package passed last week, is one of Congress’s first major steps to prevent a repeat of Russian hackers’ meddling in U.S. elections. The money can be used to upgrade state computer systems and offer cybersecurity training to election officials, among other things. California, Florida, New York and Texas together will get a quarter of the cash, with California leading the pack with about $35 million. A full breakdown of the funding can be found here. The money is a “breakthrough for election security and the health of our country’s democracy,” said Lawrence Norden of the Brennan Center for Justice at NYU Law.
Most states won’t have risk-limiting audits in place by the November midterms, which makes how they spend the $380 million in federal funding for election security, due out within 39 days, that much more important. Congress included the money in the omnibus spending bill, at the Senate Intelligence Committee’s recommendation, to be disbursed to states under the Help America Vote Act and spent on verifiable paper balloting, post-election audits of votes and cyber defenses. The appropriation is a good first step in shoring up voting systems against Russian-connected hacking, according to election security experts, but it doesn’t come close to replacing vulnerable polling place equipment in most at-risk states. “I wouldn’t say it’s a drop in the bucket—a glass of water in the bucket,” Joe Kiniry, Free & Fair CEO and chief scientist, told Route Fifty by phone. “A big corporation spends this much money on cybersecurity in a year.”
National: Higher cyber security services demand around elections, says McAfee boss | Press Association
The chief executive of McAfee believes cyber security firms will see higher demand for election protection as authorities in countries such as the US and UK try to safeguard “integrity” at the ballot box. Chris Young said there was a growing trend of attacks targeting “major events” like the most recent Winter Olympics, with the next big focus likely to be the highly-anticipated US midterm elections in November. “We’re now at a point where you could almost be certain than any notable event will have a corresponding set of cyber attacks with it,” he told the Press Association, adding that “election protection is going to be … bigger.”
National: Trump administration says a citizenship question on the census will help enforce voting rights. Sure. | Los Angeles Times
He went ahead and did it. Of course he did. Bashing California is way too much fun and easy for President Trump. California Democratic leaders shouldn’t be shocked. Politically, they had it coming, proudly emerging as the president’s chief antagonist while revving up their liberal and Latino bases. Not that Trump didn’t deserve it. He has been feeding his political base by assailing California and immigrants in the country illegally since first running for president. But when a state plays hardball with a president — especially a brawler like Trump — it should expect to get hit hard. A president always has a bigger bat.
After months of stalled progress in Congress, efforts to promote and fund nationwide election security improvements have finally gained some momentum this week. The Senate Intelligence Committee released its long-awaited election infrastructure defense recommendations. Senate leaders got behind a revised version of the Secure Elections Act. And late Thursday night, the Senate passed the omnibus spending bill, which includes $380 million for securing digital election systems. All the pieces are in place. The solutions are clear. All that’s left is the doing. But, of course, that turns out to be the hardest part. Experts say that while Congress did take meaningful action this week, it likely comes too late to play an extensive role in securing this year’s midterm elections. “This is a great first step, but it’s not going to solve the problem,” says Marian Schneider, president of Verified Voting, a group that promotes election system best practices. “Just the heightened awareness of what is the threat model and what are best practices for dealing with that threat model makes me hopeful and optimistic that those steps will be taken. But I would like to see the vulnerable systems replaced, and the clock is ticking. The farther we get into the year, the less likely it is. That’s just a reality.”
The Supreme Court on Wednesday grappled with a case with the potential to reorder the country’s political landscape: How much gerrymandering is too much gerrymandering? Republicans who sued to overturn the congressional district lines that Maryland implemented after the 2010 census map found allies in the court’s four liberal justices, who expressed sympathy for their claims during oral arguments. What’s less clear is whether those four can recruit another justice to their side — the most likely targets would be Chief Justice John Roberts or Justice Anthony Kennedy, typically the high court’s swing vote on election law cases. Both asked tough questions, but neither tipped his hand. At issue was Maryland’s 6th Congressional District, represented for 20 years by a Republican. After the 2010 census, Democrats in the state legislature and the then-Democratic governor redrew the district lines to move large numbers of Democratic voters into the district. Democratic Rep. John Delaney won the seat in 2012 and was reelected twice after.
National: Everyone Agrees That All Voting Machines Should Leave A Paper Trail. Here’s Why It Won’t Happen. | Buzzfeed
Despite Congress’s agreement last week to spend $380 million to help states replace voting machines that don’t produce a paper trail, it’s likely that tens of thousands of voters will cast their ballots in this year’s midterm elections on outdated equipment that the Department of Homeland Security has called a “national security concern.” That’s because the newly approved money will be allocated to all 50 states instead of just those that have the greatest need to replace voting machines. Thirteen states use voting machines that can’t be audited because they don’t produce a paper trail to check against the machine’s electronic tabulations. Of those, only two would receive enough funding under the recent appropriation to replace all their machines; the rest could replace only a fraction of what they need. For example, the funding would cover less than half the cost of what it would take for Pennsylvania — a state whose results were critical to the outcome of the 2016 presidential race — to replace all of its outdated machines.
The Center for Internet Security’s newly established Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC) plans to deploy intrusion detection sensors to voter registration websites for all 50 states by the 2018 midterm elections, an official told GCN. The intrusion detection sensors are called Albert sensors, and CIS has been using them on the state and local level since 2010, according to CIS Vice President of Operations Brian Calkin. The open-source Albert sensors provide automated alerts on both traditional and advanced network threats. Albert grew out of a Department of Homeland Security’s Einstein project, which focuses on detecting and blocking cyberattacks within federal agencies. DHS approached CIS about creating similar capability for states and localities, but since the Einstein name was taken, CIS called it Albert instead.
As part of the omnibus spending law passed on March 23, all 50 states, the District of Columbia and four U.S. territories are getting funding to improve their elections infrastructure prior to the 2018 elections. On March 29, the Elections Assistance Commission announced how the $380 million will be distributed. An extension of the 2002 Help America Vote Act that distributed funds to states to improve voting systems and voter access issues identified following the 2000 election, the 2018 HAVA Election Security Fund will give states additional resources to secure and improve their election systems. The funds will be made available by the EAC as grants to make it easier for states to access the funds ahead of the 2018 federal elections. States will receive grant award notification letters in April. With primary elections already underway, however, states will be allowed to incur costs against forthcoming grant awards with EAC approval.
After being gamed by Russian operatives during the 2016 presidential election, Facebook says it’s working to tighten election security ahead of the midterm elections. Company executives detailed new initiatives to prevent foreign interference and anticipate new tactics to undermine the integrity of the November elections. Thursday’s remarks were part of a widening public relations campaign to rebuild consumer trust following the Cambridge Analytica data leak, which gave access to the personal information of tens of millions of Facebook users to a political ad targeting firm without their consent. They come as concern mounts that Facebook can be too easily exploited to disrupt elections and democracies around the globe. “We’ve gotten progressively better over the last year and a half,” Samidh Chakrabarti, who leads Facebook’s work on election security and civic engagement, told reporters. “We feel like we’re going to be in a really good place for the 2018 midterms.”
Nearly three years after a Russian propaganda group infiltrated Facebook and other tech platforms in hopes of seeding chaos in the 2016 US election, Facebook has more fully detailed its plan to protect elections around the world. In a call with reporters Thursday, Facebook executives elaborated on their use of human moderators, third-party fact checkers, and automation to catch fake accounts, foreign interference, fake news, and to increase transparency in political ads. The company has made some concrete strides, and has promised to double its safety and security team to 20,000 people this year. And yet, as midterm races heat up in states across America, and elections overseas come and go, many of these well-meaning tools remain a work in progress. “None of us can turn back the clock, but we are all responsible for making sure the same kind of attack on our democracy does not happen again,” Guy Rosen, Facebook’s vice president of product management said on the call. “And we are taking our role in that effort very, very seriously.”
National: The Motives Behind the Trump Administration’s New Census Question on Citizenship | The New Yorker
Nine years ago, two Republican senators, David Vitter, of Louisiana, and Robert Bennett, of Utah, tried to introduce a measure to change the way that the federal government conducts the census. The Census Bureau tabulates the over-all population, not just that of citizens, and its results have far-reaching consequences, affecting the allocation of federal resources and the apportionment of congressional seats. The senators wanted a law requiring that respondents be asked whether they are American citizens, so that congressional districts could be redrawn. Without such a change, Vitter said, “States that have large populations of illegals would be rewarded.” Other states, like his own, he said, were being “penalized.” The subtext was that the Democrats, who tend to be prominent in areas with high concentrations of immigrants, were gaining an advantage. The measure fell short of the necessary votes, as it did when Vitter proposed it again, in 2014 and in 2016. But his efforts reflected a persistent partisan logic. Now, on the eve of the 2020 census, it has reëmerged.
During the 2016 presidential election, Russian hackers targeted election systems in Pennsylvania and 20 other states, according to U.S. intelligence officials. Those officials fear that, during the 2018 midterms, hackers may target state voter registration databases, county websites and official social media accounts to spread misinformation and sow doubt in the U.S. election system. In February, Pennsylvania Gov. Tom Wolf, a Democrat, directed all counties that are planning to update aging election equipment to buy machines that create a paper trail. However, the directive from Wolf, aimed at machines used by 83 percent of the state’s voters, did not come with funding attached, placing the financial burden on federal or local budgets.
National: Why adding a citizenship question to the census launched a political firestorm | The Washington Post
The Voting Rights Act was passed in 1965 to protect the voting rights of mostly black voters in mostly Southern states. It mandated, among other things, that jurisdictions covered by the law have new voting laws reviewed by the government to assure that they weren’t discriminatory. That provision was tossed by the Supreme Court in 2013. A Texas voter ID law that had been rejected by the Department of Justice prior to the court’s decision was reintroduced immediately afterward — and was quickly found to be discriminatory. During his confirmation hearing last year, Attorney General Jeff Sessions was asked about the Voting Rights Act. “It is intrusive. The Supreme Court on more than one occasion has described it legally as an intrusive act, because you’re only focused on a certain number of states,” the then-Alabama senator said in January 2017.
The Supreme Court justices seemed to grasp the problem of gerrymandering in oral arguments on Wednesday and that it will only get worse, as computer-assisted redistricting gets even more refined. But they appeared frustrated over what to do about it — without becoming the constant police officer on the beat. This case, involving a Democratic-drawn congressional district in Maryland, is essentially Act II of the gerrymandering play at the Supreme Court.
National: After GOP is criticized over election security, key official goes to Homeland Security | The Hill
The official recently replaced atop the U.S. Election Assistance Commission (EAC) is joining the Department of Homeland Security to protect elections from cyber threats, The Hill has learned. Matthew Masterson was replaced as chairman of the EAC in February as a result of a decision made by Republican leadership. The move opened up House Speaker Paul Ryan (R-Wis.) to criticism. Masterson has now signed on to work as a senior cybersecurity adviser at Homeland Security’s main cyber wing and to assist the department’s election security mission. A Homeland Security official confirmed that Masterson will work at the National Protection and Programs Directorate, which spearheads efforts to protect critical infrastructure from cyber and physical threats.
Kirstjen Nielsen, the homeland security secretary, recently warned dozens of foreign diplomats — including the Russian ambassador — that the United States would retaliate if adversaries abroad meddled in its coming elections. “To those who would try to attack our democracy, to affect our elections, to affect the elections of other countries, to undermine national sovereignty, I have a word of warning: Don’t,” Ms. Nielsen told an estimated 80 foreign envoys and other officials during a speech last week, according to a person in attendance. Two other people with knowledge of the event confirmed the comments. All three spoke on the condition of anonymity because the remarks were given at a closed-door meeting.
National: Former Cambridge Analytica workers say firm sent foreigners to advise U.S. campaigns | The Washington Post
Cambridge Analytica assigned dozens of non-U.S. citizens to provide campaign strategy and messaging advice to Republican candidates in 2014, according to three former workers for the data firm, even as an attorney warned executives to abide by U.S. laws limiting foreign involvement in elections. The assignments came amid efforts to present the newly created company as “an American brand” that would appeal to U.S. political clients even though its parent, SCL Group, was based in London, according to former Cambridge Analytica research director Christopher Wylie. Wylie, who emerged this month as a whistleblower, provided The Washington Post with documents that describe a program across several U.S. states to win campaigns for Republicans using psychological profiling to reach voters with individually tailored messages. The documents include previously unreported details about the program, which was called “Project Ripon” for the Wisconsin town where the Republican Party was born in 1854.
The 2020 U.S. Census will include a controversial question about citizenship status, the Commerce Department announced Monday night, a move that sparked outrage from Congressional Democrats, civil rights groups and liberal state attorneys general. A spokeswoman for California Attorney General Xavier Becerra said the state will be suing the administration immediately. Before the announcement, Becerra and California Secretary of State Alex Padilla wrote in an op-ed that including a citizenship question would be “illegal.” “The Trump administration is threatening to derail the integrity of the census by seeking to add a question relating to citizenship to the 2020 census questionnaire,” the pair wrote in an op-ed in the San Francisco Chronicle. “Innocuous at first blush, its effect would be truly insidious. It would discourage noncitizens and their citizen family members from responding to the census, resulting in a less accurate population count.”
Kansas Secretary of State Kris Kobach encouraged President Donald Trump to add a question about citizenship status to the U.S. Census during the early weeks of Trump’s presidency. More than a year later, Trump’s administration has moved to enact that exact policy for the 2020 census. “I won’t go into exact detail, but I raised the issue with the president shortly after he was inaugurated,” Kobach said Tuesday. “I wanted to make sure the president was well aware.” Kobach, a Republican candidate for Kansas governor who is running on a platform focused on immigration, also published a column in January on Breitbart calling for Trump to reinstate the question to the Census.
The National Rifle Association acknowledged that it accepts foreign donations but says it does not use them for election work — even as federal investigators look into the role the NRA might have played in Russia’s attack on the 2016 election. Pressure on the organization has also been increased by a McClatchy report that suggested that the FBI had been investigating whether a top Russian banker with Kremlin ties illegally funneled money to the NRA to aid Donald Trump’s campaign for president. The Federal Election Commission has also opened a preliminary investigation into this question.
Not having a verifiable way to audit election results in some states represents a “national security concern,” the Trump administration’s homeland security chief said on Wednesday, looking ahead to U.S. midterm elections in November. The U.S. Department of Homeland Security (DHS) was prioritizing election cyber security above all other critical infrastructure it protects, such as the financial, energy and communications systems, the agency’s chief, Kirstjen Nielsen, told the Senate Intelligence Committee. The hearing to examine the Trump administration’s efforts to improve election security came following U.S. intelligence officials’ repeated warnings that Russia will attempt to meddle in the 2018 contests after doing so during the 2016 presidential campaign.
The Supreme Court has already heard a major case about political line-drawing that has the potential to reshape American politics. Now, before even deciding that one, the court is taking up another similar case. The arguments justices will hear Wednesday in the second case, a Republican challenge to a Democratic-leaning congressional district in Maryland, could offer fresh clues to what they are thinking about partisan gerrymandering, an increasingly hot topic before courts. Decisions in the Maryland case and the earlier one from Wisconsin are expected by late June.
The blogging platform Tumblr has unmasked 84 accounts that it says were used by a shadowy Russian internet group to spread disinformation during the 2016 US election campaign. Tumblr said it uncovered the scheme in late 2017, helping an investigation that led to the indictment in February of 13 individuals linked to the Russia-based Internet Research Agency (IRA). The announcement adds Tumblr to the list of internet platforms targeted in a social media campaign that US officials said sought to disrupt the 2016 election and help boost Donald Trump’s bid to defeat Hillary Clinton. A Tumblr statement said it discovered the accounts “were being used as part of a disinformation campaign leading up to the 2016 US election”. The company said it notified law enforcement, terminated the accounts, and deleted the posts while working “behind the scenes” with the US Justice Department.
Congress provided $380 million in election security funding as part of its massive spending bill, a move that reflects the growing consensus in Washington that more needs to be done to ensure the integrity of America’s elections. The funding would go to the Election Assistance Commission, which then must distribute the funds to states within 45 days to replace aging voting machines, implement post-election audits, and provide cybersecurity training for state and local officials, among other election security related improvements. “In this challenging political time, this has to be seen as a win and a recognition that [election security] is an important responsibility,” Adam Ambrogi, the director of the Elections Program at the Democracy Fund, told Business Insider. “The federal government needs to aid the states. The states don’t have this money laying around.”
National: ‘Lone DNC Hacker’ Guccifer 2.0 Slipped Up and Revealed He Was a Russian Intelligence Officer | The Daily Beast
Guccifer 2.0, the “lone hacker” who took credit for providing WikiLeaks with stolen emails from the Democratic National Committee, was in fact an officer of Russia’s military intelligence directorate (GRU), The Daily Beast has learned. It’s an attribution that resulted from a fleeting but critical slip-up in GRU tradecraft. That forensic determination has substantial implications for the criminal probe into potential collusion between President Donald Trump and Russia. The Daily Beast has learned that the special counsel in that investigation, Robert Mueller, has taken over the probe into Guccifer and brought the FBI agents who worked to track the persona onto his team.
States will receive at least $3 million each to protect their voting systems against Russian cyber attacks under a provision added to a sweeping government spending deal that Congress has reached. The $1.3 trillion spending deal includes a total of $380 million for election security grants. The House passed the bill Thursday and sent it to the Senate for approval. States have been scrambling to improve their cyber security after Homeland Security officials revealed last year that Russian hackers tried to breach election systems in at least 21 states in 2016. Although no actual votes were changed, hackers broke into Illinois’ voter registration database.
National: New Voting Machines Have Been Declared A National Security Priority. And Congress Looks Likely To Pay For Them. | Buzzfeed
Pressure is mounting for Congress to take dramatic steps to ensure the security of US voting systems with just seven months to go before the crucial 2018 midterm elections. On Wednesday, Homeland Security Secretary Kirstjen Nielsen called the need for new voting machines that produce a paper trail “a national security issue,” and Republican Sen. Richard Burr, the chair of the Senate Intelligence Committee, added his name as a cosponsor to a bill that would provide money to replace voting equipment that can’t be audited. But whether that funding will be appropriated remains uncertain. The Secure Elections Act has been slow to gain cosponsors, but its provisions were folded into the Senate’s must-pass omnibus spending bill to keep the government open as the Senate heads toward a Friday deadline to avoid another government shutdown.
Republicans shut down the House Intelligence Committee’s contentious Russia probe Thursday, despite new revelations that Donald Trump’s 2016 presidential campaign may have benefited from the exploitation of personal information from millions of Facebook users. In a closed-door meeting, the panel voted over Democrats’ objections to approve and release a Republican-written final report, said Michael Conaway, a Texas Republican who led the panel’s investigation. “House Intelligence Committee votes to release final report,” Trump said in a Twitter posting Friday morning in his first comment on the vote. “FINDINGS: (1) No evidence provided of Collusion between Trump Campaign & Russia. (2) The Obama Administrations Post election response was insufficient. (3) Clapper provided inconsistent testimony on media contacts.”