National

US president Donald Trump may seem to believe nobody gets hacked, and that to get hacked you need “someone with 197 IQ” and “about 15% of your password”, but his official campaign app is right now vulnerable to an easy-to-exploit Android vulnerability that could be used to spread misinformation – and his rival Joe Biden fares no better. Trump’s latest false pronouncements, which attracted derision across the industry, prompted researchers at Norwegian mobile security outfit Promon to investigate the US election campaign apps, and during its analysis, it found both Trump’s app and Biden’s are vulnerable to StrandHogg. StrandHogg – an old Norse word for a Viking raiding tactic – was first identified at Promon last year. The vulnerability allows malware to pose as a legitimate application and if successfully exploited on a victim device enables cyber criminals to access SMS messages, photos, account credentials, location data, to make and record phone calls, and to activate on-board cameras and the device’s microphone. StrandHogg 2.0, a more dangerous version, was identified in May 2020.

National: Shouting matches, partisan rallies, guns at polling places: Tensions high at early-voting sites | Joshua Partlow/The Washington Post

During a pro-Trump rally earlier this month in Nevada City, Calif., enthusiastic supporters in cars and trucks crowded into the parking lot of the county government center.As many as 300 people played music, cheered and called out through a megaphone, according to Natalie Adona, a county election official who could see the gathering from her second-floor office at the Eric Rood Administration Center.But unlike usual Trump rallies, this one was happening at the site of one of the most popular drive-up ballot boxes in the county. And early voting was already underway.That afternoon, voters were forced to navigate through the pro-Trump crowd, and some felt the electioneering amounted to voter intimidation. In an election year clouded with anxieties about voter intimidation and the possibility of election-related violence, the first days of early voting have unfolded with dozens of accusations of inappropriate campaigning and possible voter intimidation in at least 14 states. The reports, though anecdotal, illustrate the tensions unfolding as more than 33 million Americans have already cast ballots two weeks before Election Day.

National: Trump’s former homeland security adviser says Russia remains major election hacking threat | Joseph Marks/The Washington Post

President Trump’s former homeland security adviser remains seriously concerned that Russia or another U.S. adversary will exploit weaknesses in U.S. election infrastructure to sow chaos or raise doubts about the outcome of the 2020 contest. Tom Bossert, who left the White House in 2018 when John Bolton became national security adviser, worries adversaries could try to change actual vote tallies or corrupt voter registration data and create confusion at polling places.Adversaries might also interfere with state and county systems that report vote tallies to sow mistrust in official results, said Bossert, who is now president of Trinity Cyber.Bossert's concerns stand in sharp contrast to Trump, who has largely ignored or downplayed the threat of Russian interference in the election, claiming without evidence that a greater threat is posed by domestic fraud from mail ballots. But foreign interference would pay dividends for adversaries including Russian President Vladimir Putin, Bossert said — even if it doesn’t result in corrupting the entire election process or delivering a reelection victory to Tump, which U.S. intelligence agencies say Putin prefers.

National: FBI says Russia and Iran have interfered with the US presidential election | Jeremy Herb, Zachary Cohen, Evan Perez and Paul P. Murphy/CNN

Director of National Intelligence John Ratcliffe said Wednesday both Iran and Russia have obtained US voter registration information in an effort to interfere in the election, including Iran posing as the far-right group Proud Boys to send intimidating emails to voters. Ratcliffe, appearing alongside FBI Director Chris Wray, said at a hastily arranged news conference Wednesday evening that Iran was responsible for the email campaign, made to look like it came from the Proud Boys, as well as spreading disinformation about voter fraud through a video linked in some of the emails."This data can be used by foreign actors to attempt to communicate false information to registered voters that they hope will cause confusion, sow chaos and undermine your confidence in American democracy," Ratcliffe said. "We have already seen Iran sending spoof emails designed to intimidate voters, incite social unrest and damage President (Donald) Trump," Ratcliffe added. "You may have seen some reporting on this in the last 24 hours, or you may have even been one of the recipients of those emails." Ratcliffe did not explain what he meant by his statement that the emails -- which were sent to registered voters from "info@officialproudboys.com" and warned recipients to "Vote for Trump or else!" -- were intended to damage the President.

National: U.S. government concludes Iran was behind threatening emails sent to Democrats | Ellen Nakashima, Amy Gardner, Isaac Stanley-Becker and Craig Timberg/The Washington Post

The U.S. government has concluded that Iran is behind a series of threatening emails arriving this week in the inboxes of Democratic voters, according to two U.S. officials.Department of Homeland Security officials told state and local election administrators on a call Wednesday that a foreign government was responsible for the online barrage, according to the U.S. officials and state and local authorities who participated in the call, who all spoke on the condition of anonymity because of the matter’s sensitivity. A DHS official also said authorities had detected holes in state and local election websites and instructed those participating to patch their online services.The emails claimed to be from the Proud Boys, a far-right group supportive of President Trump, but appeared instead to be a deceptive campaign making use of a vulnerability in the organization’s online network.

National: Hacking federal voting system now a federal crime | Maggie Miller/The Hill

President Trump has signed legislation making it a federal crime to attempt to hack federal voting systems.The Defending the Integrity of Voting Systems Act was unanimously approved by the House last month, over a year after the Senate also unanimously passed the legislation. Trump signed the legislation on Tuesday, just two weeks before the election.The new law empowers the Department of Justice (DOJ) to pursue charges against anyone who attempts to hack a voting system under the Computer Fraud and Abuse Act, commonly used by the agency to pursue charges against malicious hackers. The bill’s original introduction was the result of a 2018 report compiled by the DOJ's Cyber Digital Task Force, which evaluated ways the federal government could improve its response to cyber threats. The bipartisan bill was introduced by Sens. Richard Blumenthal (D-Conn.), Sheldon Whitehouse (D-R.I.) and Lindsey Graham (R-S.C.) last year.

National: Cybersecurity company finds hacker selling info on 186 million U.S. voters | Ken Dilanian/NBC

A cybersecurity company says it has found a hacker selling personally identifying information of more than 200 million Americans, including the voter registration data of 186 million. The revelation underscored how vulnerable Americans are to email targeting by criminals and foreign adversaries, even as U.S. officials announced that Iran and Russia had obtained voter registration data and email addresses with an eye toward interfering in the 2020 election. Much of the data identified by Trustwave, a global cybersecurity company, is publicly available, and almost all of it is the kind that is regularly bought and sold by legitimate businesses. But the fact that so many names, email addresses, phone numbers and voter registration records were found for sale in bulk on the so-called dark web underscores how easily criminals and foreign adversaries can deploy it as the FBI said Iran has done recently, by sending emails designed to intimidate voters.

National: US Cyber Command Teams With Microsoft To Limit TrickBot Botnet Ahead of Expected Election Interference | Scott Ikeda/CPO Magazine

Malware-as-a-Service (MaaS) giant TrickBot, a botnet estimated to be about one to three million computers strong, is the world’s largest of its kind and the biggest distributor of ransomware. Already wreaking havoc on the United States for several years, the US Cyber Command is also expecting it to be involved in election interference attempts ahead of the 2020 vote. Both Cyber Command and Microsoft are actively running persistent operations against the Trickbot botnet in an effort to reduce its capability, and there have been some significant successes. Cyber Command is the Pentagon’s offensive force in cyberspace, engaging in active measures against threat actors. The agency has been tracking TrickBot for some time; it came onto the US government’s radar after the Department of Homeland Security (DHS) issued reports indicating that it was a substantial ransomware threat to state and local IT networks. TrickBot not only poses a threat to the 2020 election, but also is an ongoing potential risk to disrupt critical infrastructure such as patient care facilities, financial institutions and utilities.

National: Cybercriminals Step Up Their Game Ahead of U.S. Elections | Lindsey O’Donnell/Threatpost

With the U.S. presidential elections a mere few weeks away, the security industry is hyper-aware of security vulnerabilities in election infrastructure, cyberattacks against campaign staffers and ongoing disinformation campaigns. Past direct hacking efforts, such as the attack on the Democratic National Committee in 2016, have left many nervous that this time around, the actual election results could be compromised in some way. This year, worries about the integrity of voting machines have popped up too, coupled with the expected expansion of mail-in voting due to COVID-19. Perhaps most concerning, according to Matt Olney, director of Talos’ Threat Intelligence and Interdiction at Cisco, is cybercriminals “going after the minds of the American people and their trust in the democratic institutions that we use to select our leaders. ”The good news, Olney, said in a recent video interview with Threatpost, is that awareness of election-security threats has increased since the 2016 elections. That’s been both on the part of the federal government, as well as by U.S. citizens themselves, who have gotten better at calling out content that may be associated with disinformation campaigns.

National: Mid-October numbers indicate increased turnout of military absentee voters | Karen Jowers/Military Times

Some early statistics indicate this year’s absentee voting turnout among military and overseas citizen voters may far surpass the turnout for the 2016 general election.One indicator of the increased military vote is the 51-percent increase in the overseas absentee ballots returning to the U.S. by the Label 11-DoD express mail tracking system, compared to the same time period in the 2016 general election, from the beginning of September through Oct. 14. The U.S. Postal Service has tracked 36,377 of these ballots entering the U.S. mail stream since the tracking began in September, said USPS spokesman David Coleman. That compares to 24,034 through Oct. 14, 2016.The Label 11-DoD is a free express mail tracking system that is used at military post offices overseas, and is available only to service members and family members. It has been used in federal elections since 2010, and is available starting the beginning of September before the election. About three out of four active duty members in the U.S. and overseas are eligible to vote by absentee ballot because they’re stationed away from their voting residence, according to the Federal Voting Assistance Program.

National: As Election Nears, Government and Tech Firms Push Back on Russia (and Trump) | David E. Sanger and Nicole Perlroth/The New York Times

Over the past two weeks, United States Cyber Command and a group of companies led by Microsoft have engaged in an aggressive campaign against a suspected Russian network that they feared could hold election systems hostage come November.Then, on Monday, the Justice Department indicted members of the same elite Russian military unit that hacked the 2016 election for hacking the French elections, cutting power to Ukraine and sabotaging the opening ceremony at the 2018 Olympics. And in Silicon Valley, tech giants including Facebook, Twitter and Google have been sending out statements every few days advertising how many foreign influence operations they have blocked, all while banning forms of disinformation in ways they never imagined even a year ago.It is all intended to send a clear message that whatever Russia is up to in the last weeks before Election Day, it is no hoax. The goal, both federal officials and corporate executives say, is to disrupt Russia’s well-honed information-warfare systems, whether they are poised to hack election systems, amplify America’s political fissures or get inside the minds of voters.But behind the scenes is a careful dance by members of the Trump administration to counter the president’s own disinformation campaign, one that says the outcome on Nov. 3 will be “rigged” unless he wins.

National: States Have Improved Election Cybersecurity, but Still Can Do More | Phil Goldstein/StateTech Magazine

After more than a year of preparations and security enhancements, state and local governments are entering the final weeks of the 2020 election season. With millions of votes already cast, two things are clear: Government agencies have markedly improved their cybersecurity controls in the wake of the 2016 election, and yet they could still be doing more and cannot let their guards down. Outside experts say that state governments, especially those in battleground states, have improved their cybersecurity protections for election infrastructure and voter data. However, there are still cybersecurity measures they should be taking ahead of Election Day on Nov. 3. Meanwhile, the U.S. Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency is continuing to coordinate with state and local agencies on election security threats, especially from nation-state actors and cybercriminals. CISA is confident in election security protections that have been put in place but remains on high alert.

National: How US security officials are watching for threats ahead of Election Day | Sean Lyngaas/CyberScoop

FBI Director Christopher Wray once called the 2018 midterm elections a “dress rehearsal for the big show” of protecting the 2020 presidential election from foreign interference. The big show is finally here, and American officials say they are pulling out all the stops to keep it secure.U.S. intelligence, law enforcement and national security agencies have for weeks been in an “enhanced operational posture” to share any election-related threats with state and local officials, said Chris Krebs, director of the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. The week before Election Day, which is Nov. 3, those security efforts will kick into overdrive.Officials from the Department of Defense, FBI, the Election Assistance Commission, political campaigns and the private sector are scheduled to gather at CISA’s operations center outside of Washington, D.C. The U.S. Postal Service, which is playing an expanded role in this year’s election with the increase in mail-in ballots, will also have a representative on hand.“It gives us an opportunity to share that information in near-real-time to understand what’s happening…detecting issues at the soonest, smallest opportunity, and then making sure that it doesn’t spiral into a bigger issue,” Krebs said during an interview during CyberTalks, the annual summit produced by CyberScoop.

National: Here’s Why Concerns About Absentee Ballot Fraud Are Overhyped | Whose Vote Counts | Pat Beall, Catharina Felke, Sarah Gelbard, Jackie Hajdenberg, Elizabeth Mulvey and Aseem Shukla/Frontline

Leila and Gary Blake didn’t want to miss elk hunting season. It was 2000, and the election conflicted with their plans, so the Wyoming couple requested absentee ballots.But the Blakes had moved from 372 Curtis Street five miles down the road to 1372 Curtis Street, crossing a town line. When they mailed their votes using the old address, they were criminally charged. The misdemeanor case was settled with $700 in fines and a few months’ probation, but two decades later, the Blakes are still listed as absentee ballot fraudsters in the Heritage Foundation’s Election Fraud Database. Far from being proof of organized, large-scale vote-by-mail fraud, the Heritage database presents misleading and incomplete information that overstates the number of alleged fraud instances and includes cases where no crime was committed, an investigation by USA TODAY, Columbia Journalism Investigations and the PBS series FRONTLINE found. Although the list has been used to warn against a major threat of fraud, a deep look at the cases in the list shows that the vast majority put just a few votes at stake.

National: Activists brace for voter intimidation efforts on election day | Chris Megerian and Arit John/Los Angeles Times

As a young lawyer for the New Jersey Democratic Party, Angelo Genova quickly realized something was amiss on election day in 1981.“Our team was getting calls left and right,” he said. “A lot of it was a blur.”In urban Black communities across New Jersey, large signs had appeared warning that polling places were “patrolled by the National Ballot Security Task Force.” Off-duty cops, some armed, wore armbands and demanded voters’ identification before they could cast ballots.The task force was a Republican invention. Though no one could prove how many people were too intimidated to vote, the party viewed it as a success when its candidate, Thomas Kean, won by a 1,797 votes in a recount of more than 2.3 million ballots cast.The Republican National Committee planned to run the same playbook in states around the country, but Democrats obtained a federal court order preventing them. The consent decree has limited the committee’s activities in every election since then — until now.

National: Voter registration deadlines could see more online glitches | Nolan D. McCaskill/Politico

A cut cable, an equipment failure at a data center, an online traffic overload that crashed a website — online voter registration systems have already had their share of snafus this election season, amid record-breaking registration totals in battleground states. With registration deadlines approaching in more than a dozen states, voting rights groups and party officials warn there could be more glitches on the horizon, resulting in the disenfranchisement of would-be voters. Registration deadlines were extended last week in Virginia and two weeks ago in Florida after web outages prevented residents from registering online for hours, prompting lawsuits from voting rights groups and even allegations of voter suppression. Jeanette Senecal, senior director of mission impact at the League of Women Voters, said other states should be taking the outages seriously because online systems in states across the country sometimes fail even on regular days. “It can also forecast problems with the state system to support their polling place finder or their ballot lookup or their voter verification system,” she warned. “All of these systems to tend to be connected to one another.”

National: Why the US absentee ballot is so poorly designed | Anne Quito/Quartz

Complaining about the US ballot is centuries-old American tradition. Every election cycle, critics lament how unwieldy, ugly, or downright confusing the voting form is. With the spike in voting by mail this year amid the Covid-19 pandemic, many more are noticing how puzzling the piece of paper truly is as they fill out their ballots at home. Turns out, the ballot’s confusing design is less a weakness of America’s participatory democracy than a sign of its robustness. Americans can cast a vote several ways. They can go to a polling station on Election Day or do it in advance via a mail-in absentee ballot; many states allow early in-person voting as well.Voting online isn’t widely available for federal elections. This year, 32 states and the District of Columbia are accepting ballots submitted via a mobile app, fax, e-mail, or an online portal, but this method is mostly reserved for military personnel serving overseas or civilians living abroad. While countries like Australia, Brazil, Canada, Estonia, Norway, and Switzerland have have embraced some form of remote voting via the internet, experts caution that it’s not useful to compare them with the American context. That’s because the US operates on a much larger and complicated scale.And so, old-fashioned paper is still the most common and secure voting medium in the US. An estimated 95% of voters will manually fill out and send forms by postal mail, deposit in a drop box, or feed their paper ballots to a machine that produces an auditable paper record at a voting center.

National: Far-Right Trump Supporters Are Infiltrating Polling Stations | David Gilbert/VICE

As threats to disrupt Election Day grow, some members of a far-right Trump superfan group are boasting about securing positions as polling station managers and supervisors while dozens of them are advocating violence on November 3.“Consider this polling station...ON LOCK DOWN” That’s what a member of the far-right message board TheDonald.win posted this week, alongside a picture of a South Carolina poll manager’s handbook. The poster, utahbeachballs1944 responded to other users’ comments, saying “my polling place is gonna be like trying to enter North Korea. Fucking LOCKED DOWN” and added: “I will be honoring the BLM movement by working in Blackface.” Utahbeachballs1944 is among at least four users of TheDonald who have posted pictures showing polling station manuals as evidence that they will be overseeing voting on Election Day next month, according to an investigation by VICE News. VICE News has been unable to independently verify that these people are actually poll workers, but the photos they posted of official materials did not show up on a reverse image search, suggesting that they are photos taken by the posters themselves. The posts on the message board also match a pattern of activity we've seen before and come in response to specific suggestions from Trump that his supporters "watch" the vote.

National: Why elections aren’t happening on our smartphones | Kevin Collier/NBC

Andrew Yang asked a question in July, months after he ended his presidential bid, that has dogged election officials: “Why is it again that I can pay a parking ticket online, apply for a passport and conduct personal financial transactions but I can’t vote the same way?”It’s an understandable wish. With technology now powering just about every daily activity — even more so during the pandemic — looming concerns about the election next month make technology a tempting place to look for answers. Technologists and voting experts understand the frustration. But they are also clear about their findings, and generally always have been: Voting is a uniquely difficult problem for software to solve because you only get one chance to do it right. And that makes it fundamentally different from other sensitive functions like banking, said Matt Blaze, a law professor and computer scientist at Georgetown University who’s led some of the research teams that have found the most glaring vulnerabilities in voting machines.“ The entire banking industry is based on the premise that if fraud occurs, it can be reversed,” Blaze said. “That’s not true with an election. If the wrong person wins an election and takes office, there is essentially nothing you can do about it if you discover six months down the line the wrong person was sworn in.”

Source: Why elections aren’t happening on our smartphones

National: How Will the U.S. Combat Election Day Cyberwarfare? With Paper | Kassie Bracken and Alexandra Eaton/The New York Times

The 2016 U.S. election was a game changer for voting technology. Widespread Russian interference in our voting systems spurred new federal scrutiny of the country’s vast and fragmented election infrastructure. Four years later, “The psychological import of what the Russians did may be greater than anything that they actually hacked into, because they have managed to shake the confidence of American voters that their votes will be counted as they cast them,” said David Sanger, national security correspondent for The New York Times. And this lack of trust has led to a renewed examination of the nation’s voting equipment. That, in part, is why some election experts believe that when it comes to the security of election machines, voters should feel more confident than ever in 2020.

National: How officials are protecting the election from ransomware hackers | Patrick Howell O’Neill/MIT Technology Review

Hackers played a significant role in the 2016 election, when the Russian government hacked into the Democratic campaign and ran an information operation that dominated national headlines. American law enforcement, intelligence services, and even Republican lawmakers have concluded, repeatedly, that Moscow sought to interfere with the election in favor of Donald Trump. Meanwhile, in the last four years, ransomware has exploded into a multibillion-dollar business. It’s a type of malware that hackers use to restrict access to data or machines until they’re paid ransoms that can run into the tens of millions of dollars. There’s now a global extortion industry built on the fact that the critical infrastructure and digital systems we rely on are deeply vulnerable. Put those two things together, and you get the nightmare scenario many election security officials are focused on: that ransomware could infect and disrupt election systems in some way, perhaps by targeting voter registration databases on the eve of Election Day. Steps to prevent such attacks are well under way.

National: A ruling against expanding online voting is a win for cybersecurity advocates | Joseph Marks/The Washington Post

A federal judge yesterd ay dismissed a lawsuit that sought to dramatically expand online voting by military service members and other citizens living overseas, halting an effort that critics say could have made the election far more vulnerable to hacking.The overseas voters who brought the suit hail from seven states and said they fear restrictions and slowdowns between the U.S. Postal Service and the postal services where they live raise dangers their ballots won’t arrive in time to be counted. They wanted an option of submitting the ballots as PDF attachments to emails or using a secure fax system managed by the Defense Department. Similar voting methods are available to overseas voters from 30 other states. The ruling underscores how efforts to make voting easier during the pandemic can sometimes clash with efforts to protect the election against foreign interference.

National: Group warns of gaps in election infrastructure | Mark Rockwell/FCW

The Department of Homeland Security's (DHS) cybersecurity agency has worked since 2016 to help states protect their election infrastructure from electronic attack, but it only takes one small breach to dent confidence in the systems, according to a digital rights and technology expert." There has been a ton of effort from [the Cybersecurity and Infrastructure Security Agency] and others," said William Adler, senior technologist for elections and democracy at the Center for Democracy and Technology (CDT)." But cybersecurity is an active process. Threats are constantly changing and evolving, so we need to keep making the case that election officials need to prioritize cybersecurity and not be complacent," he said during a conference call with reporters on Oct. 16. On the call, officials at the technology and digital rights advocacy group explained the variety of threats facing the upcoming elections, from voter suppression, to misinformation about mail-in ballots and cybersecurity.

National: Eight-Hour Waits. Machine Glitches. Why Early Voting in Some States Has Had a Rough Start. | Reid J. Epstein, Stephanie Saul and Manny Fernandez/The New York Times

Virginia’s online voter registration portal crashed on the final day it was available when roadside utility workers cut the wrong cable. Texans waited in long lines on the first day of early voting in their state’s biggest cities, and in one county in the Houston suburbs, a programming error took down all of the voting machines for much of the morning. On Georgia’s second day of early voting, long lines again built up at polling places in the Atlanta suburbs. The hurdles to early voting on Tuesday resulted from a combination of intense voter interest that stressed the capacity of overwhelmed local elections officials and the sort of messiness that has long been common in American elections and which is now under a microscope as concerns over voter suppression and the unprecedented dynamics of voting during a pandemic collide.The long lines in Georgia and Texas illustrate how eager voters are to cast ballots in the 2020 election — particularly, but not only, in Democratic-trending urban and suburban areas. By 2 p.m. on Tuesday, Harris County, Texas, which includes Houston, had smashed its first-day early-voting turnout record. In Gwinnett County, Ga., north of Atlanta, even with the long lines there was a 450 percent increase in first-day early voting compared with 2016, according to Ryan Anderson, who tracks Georgia voting data on the Georgia Votes website.

National: Critical swing states push for ‘simple change’ to make counting mail-in ballots easier | Allan Smith/NBC