National

A judicial election in Northampton County, Pennsylvania, in November produced a literally unbelievable result. About 55,000 votes were cast on newly purchased electronic voting machines, but only 164 votes were registered for the Democratic candidate. Luckily, the touch-screen machines produced a backup paper trail, which allowed for an accurate recount. Ultimately, the Democrat won by some 5,000 votes. The root cause of this systemic vote switching is still under investigation. Whatever the case, though, the mass malfunction of these machines highlights the reliability and security issues around electronic voting systems that are mostly already primed for use in the 2020 elections. As disturbing as the Northampton County miscount is in its own right, it throws into relief a grave general issue that applies to voting systems across the country. One would hope that whatever glitch or virus, once identified, that caused the massive malfunction will be quickly and easily fixed, patched, or updated so that those machines can be relied upon to work properly going forward. Further, one would also assume that other vulnerable voting systems around the country will be updated prophylactically to prevent similar malfunctions in next year’s elections. However, neither of those things is very likely to happen. Our current regimen for certifying electronic voting systems makes changing or updating election systems in the run-up to an election very difficult—and as Election Day 2020 gets closer, that maintenance becomes virtually impossible.

National: Just How Regulated Are Our Nation’s Elections? | Hadley Hitson/Fortune

The U.S. federal government subjects nearly every industry to a slew of operational rules and regulations. Defense contractors are prohibited from utilizing certain Chinese telecommunications companies like Huawei in order to prevent theft of the nation’s military technology. Power companies must abide by mandatory reliability standards and report any attempted or successful breaches of their systems to a federal commission. National banks implement federally required security procedures to prevent robberies. These sectors are meticulously managed with hundreds of requirements specifically because the Department of Homeland Security considers them so vital that their incapacitation would have a “debilitating effect” on the country as a whole. But when it comes to elections, a cornerstone of American democracy, the vendors whose voting equipment is used throughout the country largely lack the level of federal oversight and direction that protect other critical infrastructure industries from domestic and foreign interference.

National: What Is Election Hacking, and Can It Change Who Wins? | Kartikay Mehrotra & Andrew Martin/Bloomberg

Americans have relied on computers to tally votes since at least 1964, when two Georgia counties used them to count punch-card ballots in a primary election. Over time, high-tech election systems largely supplanted paper ballots and gear-and-lever machinary, a trend hastened by the contested 2000 presidential election between George W. Bush and Al Gore. (Remember hanging chads?) But ever-greater reliance on digital voter registration, electronic voting and computerized tabulation have created the opportunity, at least, for hackers to sabotage elections, and Americans aren’t the only ones who are fearful.

1. What is meant by ‘election hacking’?

It’s sometimes used as a catch-all phrase to encompass all sorts of underhanded efforts to subvert elections, including the type of social media disinformation campaign undertaken by Russia to taint elections in the U.S., Europe and Africa. But in its most literal form, election hacking refers to computer breaches that are intended to manipulate voter data, change a vote tally or otherwise discredit tabulated results.

National: In a bid for better security, elections are going analog | Christian Buckler/Marketplace

ary Scott can tell you a lot about the internet. Or rather, how little of it his machines are connected to. “There’s always some barrier between these machines and any online systems,” said Scott, the general registrar and director of elections for Fairfax County, Virginia. Standing next to one of several DS200 voting machines set up for training purposes in the Office of Elections in Fairfax County, he emphasized that none of the fleet of voting machines he oversees have ever been connected to the internet. Neither have any of the computers used to program them, nor the machines that will receive the final vote count. The most surprising piece of technology involved in Fairfax’s voting approach might well be the oldest one: paper. “We got a lot of resistance from the public because they wanted to know why we were going ‘backwards’ to paper, but it’s a much more secure method of doing it,” Scott said. Fairfax County initiated a move toward paper ballots years before Virginia decertified paperless voting machines across the state, aligning with the latest shifts in thinking about election security—both in the U.S. and abroad. The embrace of paper by districts like Fairfax marks a change in the nationwide trend toward electronic voting infrastructure that can be traced back to the Help America Vote Act of 2002.

National: Ukraine claims threaten Senate consensus on Russian hacking | Joseph Marks/The Washington Post

A tenuous Senate consensus on the dangers of Russian election hacking is being threatened by the GOP’s embrace of President Trump’s debunked argument that Ukraine also interfered in 2016. Numerous Senate Republicans promoted that argument this week, bucking the conclusion of U.S. intelligence officials and ignoring warnings the claims are part of a Kremlin-backed effort to muddy the waters on Russia’s own interference. “There’s no question in my mind Ukraine did try to influence the election,” Sen. John Neely Kennedy (R-La.), one of Trump’s most vocal supporters on the issue, said yesterday. Senate Democrats also struck back. “The only people who are advancing the discredited theory about Ukraine and intervention are part of the continuing Russian disinformation campaign,” Sen. Mark R. Warner (Va.), ranking Democrat on the Senate Intelligence Committee, said. The conflict is a sea change for the Senate, which has generally maintained a bipartisan consensus on the singular damage caused by Russia’s 2016 hacking and disinformation campaign and the danger of a repeat in 2020 — even as House GOP lawmakers have proved far more willing to follow Trump’s lead in questioning Russia’s role in the attacks and embrace conspiracy theories. The shift could prove especially damaging as the legislative clock ticks down to 2020. The Senate is still considering election security measures, including providing more money for states to upgrade their voting systems and to impose new transparency requirements on political advertisements.

National: Email Infrastructure Seen as Lingering Vulnerability for Elections | MeriTalk

New research shows that email is still a weak link in U.S. election infrastructure, with only five percent of the nation’s largest counties protecting election officials from impersonation attempts. The latest research from Valimail finds that an “overwhelming majority of cyberattacks can be traced to impersonation-based phishing emails,” with 90 percent of attacks involving phishing, and 89 percent of phishing involving impersonation. Valimail looked at Sender Privacy Framework (SPF) and Domain-based Message Authentication, Reporting & Conformance (DMARC) status for 187 domains that were used by election officials in each state’s three largest counties. The researchers then sought to determine whether each domain is protected from impersonation attacks by a correctly configured DMARC record with a policy of enforcement.

National: Why we can expect more voting machine headaches in 2020 | Steven Rosenfeld/Salon

December 3, 2019

Still-incomplete explanations of problematic aspects of new voting systems that debuted in November 2019 and will be used in 2020 suggest that voters will likely see random delays in voting and vote counting during next year’s presidential primaries and fall election. The new voting systems were being tested or deployed in advance of 2020. While the machinery did not widely fail across all jurisdictions, there were diverse and serious problems that could undermine public trust if they recur in 2020. However, the official responses, thus far, have not been reassuring. Take Georgia, for example. There, new systems were tested in nine counties on November 5 before statewide use in 2020’s primaries. In four counties, the start of voting was delayed by more than one hour, according to a secretary of state summary that mostly blamed the users, but not the technology. The users would be poll workers and other officials (who underwent training) and private contractors who program the system checking in voters. The opening of the polls is one of the busiest times at polling places, when people come to vote on their way to work. “We had 45 incidents out of 27,482 votes or an incident rate of 0.164 percent,” the secretary of state’s report summary said. “Nearly all issues were caused by human error or interaction which can be mitigated through training or identified through testing.” That statistical assessment is breezy. The report’s fine print describes poll openings delayed by an hour, but does not say how many voters were kept waiting. The apparent reason was that the electronic poll book system had “an additional field within the dataset erroneously.” If that analysis is correct, that is an amateur programming error. The report said that private vendors used Wi-Fi to access and reprogram it. But that wasn’t the only problem.

National: Pennsylvania voting debacle gives ammunition to paper ballot push | Joseph Marks/The Washington Post

December 3, 2019

Massive voting machine failures in a Pennsylvania county in November are giving election security advocates fresh ammunition to call for nationwide paper ballots. The problems, which may have been caused by a software glitch, resulted in some Northampton County residents who tried to vote straight-ticket Democrat initially registering as straight-ticket Republican. It also incorrectly showed a Republican judicial candidate winning by a nearly statistically impossible margin, the New York Times’ Nick Corasaniti reports. In this case, voters got lucky. The county had paper backups for all the votes the machine counted incorrectly. They showed the Democrat judicial candidate Abe Kassis — who the computer tally said got just 164 votes out of 55,000 ballots — actually narrowly won the race. But about 16 million Americans spread across eight states won’t have a paper backup for their votes in 2020. That means a similar software glitch or a malicious hack by Russia or another U.S. adversary could cause mass uncertainty about an election’s outcome or even result in the wrong candidate taking office. Even in Pennsylvania, it could have been different. The machines that malfunctioned in November were just purchased this year in response to a statewide mandate to upgrade to new voting machines with paper records.

National: Election Security Push Ahead Of 2020 Could Be Blunted By Wave Of Retirements | Pam Fessler/NPR

Between possible foreign interference, potentially record-high turnout, new voting equipment in many parts of the country and what could be a razor-close outcome, the 2020 election was already shaping up to be one of the most challenging elections to administer in U.S. history. On top of those challenges, a number of top election officials who oversaw voting in 2016 won’t be around next year. Some are retiring after long careers, but others are feeling the strain of an increasingly demanding and politicized job. Among those who’ve left are former Virginia Election Commissioner, Edgardo Cortes, now an election security adviser with the Brennan Center for Justice. He decided to move on last year when the governor he worked for was heading out of office. Cortes also had a new baby on the way and a three hour commute, and says he needed a break from his 24/7 job. “In Virginia in particular, there are elections going on every year, multiple times a year, so it was definitely a huge time commitment,” says Cortes. Running elections can be difficult work, with long hours, low pay and an electorate that isn’t always appreciative. Most officials say they love the work and believe they’re performing a key democratic function, but several high-profile election officials have recently announced that they’re leaving, in part to give their replacements time to prepare for 2020.

National: As the 2020 US election nears, voter systems still vulnerable | Lydia Emmanouilidou/BBC

With a little less than a year to go before the 2020 US presidential election, security experts and lawmakers say progress has been made to guard against foreign interference. But they warn the country’s election infrastructure could be vulnerable to the types of hacking operations that took place in the lead-up to the 2016 election. One such attack was directed at the Illinois State Board of Elections, an agency that oversees and facilitates parts of election processes in the state, including a statewide voter registration system. “One of our IT people noticed that our [voter registration] system was running extremely slowly,” said Matt Dietrich, a spokesperson for the agency. “It had practically shut down.” The IT member inspected the system, and discovered that an intruder had exploited a vulnerability on the board’s online voter application, broken into the statewide voter registration database and gained access to voter information, including names, addresses and drivers’ license numbers. “It was terrifying. … We took the entire system down,” Mr Dietrich said. In the immediate aftermath of the incident – which took place in July 2016 – Mr Dietrich said the agency didn’t know who was behind the intrusion. But in July 2018, then-Special Counsel Robert Mueller indicted 12 Russian military officers over alleged cyber operations to interfere with the 2016 US presidential election.

National: Ahead of 2020, Democrats wrestle with how to disavow disinformation tactics | Stephen Montemayor/Minneapolis Star Tribune

Democratic Party leaders are engaged in an internal struggle over whether to explicitly disavow the use of disinformation tactics in the 2020 election. State party leaders, led by Minnesota DFL Chairman Ken Martin, have urged the Democratic National Committee to adopt such a pledge, but others are privately worried that it would put the party at a disadvantage against a president who has repeatedly trafficked in doctored videos and retweeted false stories since winning the presidency in 2016. Former Vice President Joe Biden is so far one of the only candidates to publicly sign a pledge not to use manipulated videos, content from fake social media accounts or other increasingly common disinformation tactics. Minnesota U.S. Sen. Amy Klobuchar has not signed a pledge, but she has personally vowed not to traffic in disinformation tactics. But the National Committee has refused to take action. The Republican National Committee also has declined to take a formal stance.

National: Russia’s 2016 Election Meddling Was a ‘Well-Choreographed Military Operation,’ Former FBI Counterintelligence Expert Says | David Brenna/Newsweek

former FBI expert in counterintelligence and cyberwarfare has warned that Russia’s meddling in the 2016 election was not a one-off, and that Moscow’s dedicated network of operatives never stopped their malign activities after President Donald Trump’s victory. Robert Anderson worked for the FBI for 21 years, rising to oversee the bureau’s efforts to identify, track and disrupt foreign intelligence and cyberwarfare efforts—including those originating from Russia. In a 60 Minutes interview broadcast Sunday, Anderson told CBS News’ Bill Whitaker that Russia’s cyberwarfare arm remains a significant threat to the American political system. “The Russians never left,” Anderson said. “I can guarantee you in 2016 after this all hit the news, they never left. They didn’t stop doing what they’re doing.” Asked by Whitaker if 2016 could have been “a one-time thing,” Anderson bluntly replied, “No way. Russia doesn’t do it that way.”

National: Senators advocate for increased election security funding in 2020 budget | Melina Druga/Homeland Preparedness News

A group of 39 Democratic senators recently sent a letter to the leaders of the House and Senate Appropriations Committees urging the panels to better fund election security. The senators requested funding for election security grants and for the Election Assistance Commission (EAC) in the Fiscal Year 2020 Financial Services and General Government Appropriations bill. The EAC is an independent and bipartisan commission established in the Help America Vote Act that ensures elections across the country are secure, accurate, and accessible. It sets voting standards, certifies voting equipment, and conducts the Election Administration and Voting Survey. The senators urged the committees to fund the EAC fully. Currently, the House has appropriated roughly $16.2 million for the commission, and the Senate has appropriated nearly $12 million. The commission has half the staff it did when it was founded in 2010, and EAC’s budget for salaries and administration is $10 million less.

National: Swing states adopt audit tool to safeguard voter ballots ahead of 2020 election | One America News Network

November 25, 2019

A leg of the Department of Homeland Security recently announced its soon to be partnership with election officials and non-profit VotingWorks that would audit votes in 2020. Ballot box officers say the purpose is to prevent possible hacks and watch for faulty voting machines. Battleground states, such as Pennsylvania and Ohio, have already embraced a voter monitoring tool known as Arlo. Four other states have reportedly adopted the tool as well. The VotingWorks sponsored tool is free for state and local election leaders, and would double-check all votes cast. Arlo is a web-based app that uses a security method called “risk-limiting audit.” During this process, a small percentage of the paper ballots are taken at random to check if they match what the machines recorded. Although the method is simple, many places don’t use them reportedly because many states use direct electronic voting machines, which eradicates all paper trails.

National: Report: Election Assistance Commission Grapples With Staffing, Budget Cuts | Alexa Corse/Wall Street Journal

The federal agency responsible for setting election security standards is grappling with key leadership vacancies and inadequate funding, a new report by a government watchdog office has found. The U.S. Election Assistance Commission, which is focused exclusively on the voting process, is struggling to help state and local officials bolster the security of their voting systems, the agency’s inspector general said in a report released Wednesday. The commission has sought to promote cybersecurity best practices and to serve as a central resource for state and local governments, which have the primary responsibility for administering elections. But the inspector general’s report says that the commission’s efforts are faltering amid staffing shortages and years of budget cuts. Two of the agency’s most senior officials—the executive director and general counsel—stepped down last month, and the agency has begun looking for their successors, the report said. The agency’s acting executive director and chief information officer, Mona Harrington, said in a letter to the inspector general dated Monday that the agency “concurs” with the findings about its troubles.

National: CISA and VotingWorks release open source post-election auditing tool | Catalin Cimpanu/ZDNet

The US Cybersecurity and Infrastructure Security Agency (CISA) and VotingWorks, a non-partisan, non-profit organization, have open-sourced today a tool for the post-election auditing process. Developed by VotingWorks and named Arlo, the tool is available on GitHub. It’s a web-based app designed specifically for the US election process where votes are tallied electronically using software or special machines. To safeguard the election process against hacked or faulty voting systems, the US government mandates that all counted votes go through a post-election audit to verify the results, in a process called a Risk-Limiting Audit (RLA). Arlo is designed to automate this auditing process by automatically selecting random voter ballots for the RLA process, providing auditors with the information they need to find those ballots in storage, helping officials compare audited votes to tabulated votes, and providing monitoring & reporting capabilities so that election officials and public observers can follow the audit’s progress and outcome. “The tool supports numerous types of post-election audits across various types of voting systems including all major vendors,” CISA said in a press release today. CISA did not develop Arlo — created by VotingWorks on its own — but the agency has adopted the tool and is currently working on convincing state election officials to deploy it before next year’s presidential election.

National: House Panel Zeroes in on Election Security Ahead of 2020 | MeriTalk

With election security firmly in place as the popular policy de jour on Capitol Hill in the ramp-up to the 2020 election cycle, House members from both sides of the aisle voiced support at a Nov. 19 hearing for more focus on cyberattacks targeting election infrastructure, with a particular focus on ransomware exploits. The hearing of the House Homeland Security Committee subcommittee on Cybersecurity, Infrastructure Protection, and Innovation featured testimony from officials in the Federal government, academia, and the private sector, but mainly targeted efforts the private sector is making to protect U.S. elections infrastructure and political campaigns from malicious actors. Subcommittee Chairman Cedric Richards, D-La., began the hearing by highlighting Russia’s malicious cyber activity in the 2016 elections, saying, “The Russian government’s covert malicious foreign interference campaign attacked every aspect of our elections.” He further pointed to two new countries he said are working towards attacking U.S. elections – Iran and China. Rep. Richards said those countries are “weaponizing new technologies to disrupt our democracy, distort the daily news, and compromise our election security.”

National: On election security, U.S. government leaving much on the table | Derek B. Johnson/FCW

Expert witnesses warned Congress that the U.S. government has largely failed to address known security shortfalls leading up to 2020 and future elections.Much of the election security debate in Washington since 2016 has focused on improving baseline protections for voting machines, but witnesses at a Nov. 19 House Homeland Security Committee hearing noted that similar deficiencies also exist when it comes to protecting political campaigns from compromise by foreign intelligence services and preventing foreign and domestic disinformation. In his opening statement, Georgetown University professor Matthew Blaze noted that the current generation of voting machines used in U.S. elections were never designed to combat attacks or threats from adversarial foreign governments with the resources to penetrate the global supply chain or obtain software source code before it’s even shipped to election officials. “The intelligence services of even small nations can marshal far greater financial, technical and operational resources than would be available to even highly sophisticated criminal conspiracies,” Blaze said.

National: DHS cyber agency invests in election auditing tool to secure 2020 elections | Maggie Miller/The Hill

The Department of Homeland Security’s (DHS) cybersecurity agency announced Thursday it would partner with election officials and private sector groups to develop an election auditing tool that can be used to help ensure the accuracy of votes in 2020. DHS’s Cybersecurity and Infrastructure Security Agency (CISA) is partnering with non-profit group VotingWorks on an open-source software tool known as Arlo, which is provided to state and local election officials for free. According to CISA, Arlo conducts an audit of votes by selecting how many ballots and which ballots to audit and comparing the audited votes to the original count. The tool has already been used to conduct post-election audits across the country, including during the recent 2019 elections. Election officials in Pennsylvania, Michigan, Virginia, Ohio and Georgia have signed on to partner with CISA on Arlo, with more officials expected to join.

National: Senior DHS cyber official Jeanette Manfra to step down | Sean Lyngaas/CyberScoop

Jeanette Manfra, a senior cybersecurity official at the Department of Homeland Security, plans to step down from her position, according to multiple sources familiar with the matter. DHS officials are preparing an internal announcement about Manfra’s departure that could come as soon as this week, two sources told CyberScoop. Manfra has been a key liaison for the agency, speaking about cyberthreats to U.S. supply chains, election infrastructure, and industrial control systems to both the private sector and Congress. She has also represented DHS at top cybersecurity conferences like RSA and DEF CON. Over the course of her tenure, Manfra took on increasingly senior and cybersecurity-focused roles, culminating in her becoming assistant director at DHS’s Cybersecurity and Infrastructure Security Agency (CISA) last year. In a speech last year, she likened supply-chain vulnerabilities to a “digital public health crisis.” It was not immediately clear who would replace her. One source told CyberScoop that officials had a replacement in mind, but declined to say who that was.

National: States and cities make cybersecurity pledge after Trump administration rejects it | Joseph Marks/The Washington Post

U.S. states and cities are breaking with the federal government and signing onto an international pledge aimed at making cyberspace safer. Virginia, Colorado and Washington state have all endorsed the Paris Call, which was first boosted last year by French President Emmanuel Macron and which commits members to combatting major cyberattacks, digital theft of intellectual property and foreign election interference. City governments in Louisville, San Jose and Huntington, W.Va., have also joined. The Trump administration, meanwhile, is still refusing to endorse the pledge — even though it was approved by 74 other nations including our closest allies in Britain, Canada, Australia and New Zealand. The move is another way that cities and states are breaking with the Trump administration. Others have done so on issues ranging from climate change, privacy to immigrant rights. It also underscores how states and localities, which have been pelted with costly ransomware attacks and struggled to protect their elections against highly sophisticated Russian hackers in recent years, are increasingly viewing cybersecurity as an existential threat. “It’s a problem that’s facing us and I really don’t give a flip whether a governor or a president is addressing it,” Huntington, W.Va., Mayor Stephen T. Williams told me. “I’m going to find people on common ground and we’re going to move forward and make our case. If the states and federal government want to come along, that’s fine, but, if not, we’ve got our own voice.”

National: Senate Democrats urge DHS to fund cyber threat information-sharing programs | Maggie Miller/The Hill

A group of three Senate Democrats is urging the Department of Homeland Security’s (DHS) cyber agency to help fund cybersecurity threat information-sharing centers involved in election security efforts. In a letter sent on Monday to Christopher Krebs, the director of DHS’s Cybersecurity and Infrastructure Security Agency, Senate Minority Leader Charles Schumer (D-N.Y.), and Sens. Maggie Hassan (D-N.H.) and Gary Peters (D-Mich.) expressed concerns around the funding level for two information-sharing groups. Specifically, the senators noted that DHS’s proposed fiscal 2020 budget covers only around 70 percent of the estimated $15 million it would take for the Center for Internet Security to run both the Multi-State Information Sharing and Analysis Center (MS-ISAC) and the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC).

National: Ex-U.S. security officials urge ‘aggressive steps’ to protect 2020 election | Mark Hosenball/Reuters

The United States should boost spending and take other “aggressive steps” to protect next year’s presidential election from foreign meddling, a group of former national security officials said on Monday. Citing what they said were signs U.S. rivals want to undermine the November 2020 poll, National Security Action – a group led by former advisers to President Barack Obama – said states and agencies should invest in paper ballot backups for digital voting machines, ensure audits of election results, improve cybersecurity and boost training for poll workers. Election security has become a major concern since U.S. intelligence agencies claimed Russia interfered in the 2016 presidential election to tilt the vote in Donald Trump’s favor. Moscow has denied here any interference. Congress has appropriated some $600 million for election security since 2018 and is working to approve another $250 million, an amount that National Security Action called a “modest start.” Its statement was signed by 70 former security officials from a range of agencies.

National: Russian Hacking 2.0 Could Employ a Whole New Bag of Digital Dirty Tricks | Nick Bilton/Vanity Fair

Last week, a woman, who we’ll call Jane, woke up in her home, as she does every morning, at around 5 a.m. (Her kids didn’t get the memo about daylight saving time.) Jane hobbled downstairs, still half asleep, walked into her kitchen, and started the coffee machine. Then she turned on her iPhone and immediately said, “Holy fuck!” Jane is a former senior staffer at the Democratic Congressional Campaign Committee, or DCCC, and when she turned on her phone that morning, her email inbox had filled with over 4,500 new messages from thousands of authentic businesses across the internet. Because of their authenticity, many of those messages had not been spotted by her Gmail spam filter. As she held her phone in her hand, she watched in disbelief as new messages appeared almost every second. Before she could quell the onslaught, 8,000 had landed in her inbox.

National: U.S. National Guard’s Evolving Mission Includes Assisting Local Governments Experiencing Cyber Attacks | Scott Ikeda/CPO

Cyber attacks on municipalities have been on the rise in the past year, particularly in smaller cities that have inadequate resources to deal with them. In the smallest of towns and cities, local government relies on state and federal resources to deal with remediation in the wake of a breach. For some, those resources now include the National Guard. Established at the national level in 1903, the National Guard is a reserve military force called upon for certain domestic emergencies; primarily, recovery efforts when natural disasters and major terrorist attacks occur. With cyber attacks evolving to target both the digital and physical infrastructure of towns and cities, states are now able to justify deploying the Guard to assist in supporting and protecting these vital services. As little as a few years ago, cyber defense was not even on the radar of most National Guard agencies. In the past two years, cyber brigades have begun to spring up around the country as the need for proactive defense and response to nation-state cyber attacks has become clear. Though each state has its own National Guard agency, many of these cyber brigades are responsible for covering multiple states. For example, the Army Nation Guard’s 91st Cyber Brigade is based in Virginia but is tasked with overseeing cyber response units in 30 states.

National: 3 Cybersecurity Threats Facing Campaigns in 2020 | Sean J. Miller/Campaigns & Elections

Cyber threats are a growing market this cycle. Security vendors, some free or low-cost, are stepping up to provide services for campaigns and groups to help protect themselves from hacking, which could come from a lengthening list of foreign adversaries. Still, awareness and adoption remain uneven, particularly down-ballot. Now, the industry vulnerabilities that exist aren’t just being probed by Russians. Other state actors are trying their hands at election inference, according to Matt Rhoades, co-founder of the non-profit group Defending Digital Campaigns, Inc. “We know that the Chinese play this game. But if you’re a Republican too, you know that the Iranians are now fully invested in this kind of effort, and they’re going to be targeting Republicans, especially, who have been hardcore on things like the Iranian nuclear deal,” Rhoades said last month during a panel at the George Washington University’s GSPM. “You have to look past just Putin.” The tactics that the state actors could use are established, with some new twists. Here are three threats campaigns face.

National: Despite Concerns About Election Security, ‘Vulnerabilities Abound’ | Alan Greenblatt/Governing

Ten days after he lost his re-election bid, Kentucky GOP Gov. Matt Bevin conceded the election. Bevin admitted defeat on Thursday following a recanvass of the vote, which he had requested and didn’t change the outcome. Beginning Nov. 5 — the night of the election — Bevin had complained that his narrow loss to Democrat Andy Beshear was due to irregularities. Bevin’s unsubstantiated complaints showed that there is more than one way to undermine confidence in elections. Although election officials worry about hacking into voting machines and registration rolls, they also worry that claims about potential problems make it harder for the public to accept the outcome of elections — especially if their preferred candidate has lost. “If I wanted to undermine the democratic system, all I really need to do is create doubt in the mind of whatever team loses,” said Michael Miller, a political scientist at Barnard College. “It’s very concerning that we’ve begun to focus on which team do [hackers] hurt, Republican or Democrat. It could be your team today, but it could be the other team tomorrow.”

National: Election vendors should be vetted for security risks, says watchdog group | Joseph Marks/The Washington Post

The federal government should start vetting companies that sell election systems as seriously as it does defense contractors and energy firms, a top election security group argues in a proposal out this morning. Under the proposal from New York University’s Brennan Center for Justice, government auditors would verify election companies and their suppliers are following a raft of cybersecurity best practices. They would also have to run background checks to ensure employees aren’t likely to sabotage machines to help Russia or other U.S. adversaries. The suggestion comes as Congress continues to fight over whether to tighten election security as candidates ramp up for the 2020 election. Senate Republicans, especially, have stalled further security measures, even as observers warn that the next election is ripe for hacking by foreign adversaries such as Russia, which interfered in the 2016 contest. Vendors of voting machines, however, have traditionally been exempt from close review by federal regulators. “These vendors are a critical part of securing our elections, but we haven’t really focused on them at all,” Lawrence Norden, director of Brennan’s election reform program and one of the authors, told me. “We need to understand that they’re critically important but also represent a vulnerability that there needs to be oversight for.”

National: Arming agencies for ransomware attacks in an election year | Stephen Moore/GCN

In the past few months, we have seen just how imperative it is to stop ransomware attacks. Ransomware has the power to rob state and local governments of thousands — or hundreds of thousands — of budget dollars and grind productivity to a halt. Recovery can cost tens of millions, as Atlanta and Baltimore discovered. Just two months ago, a coordinated attack hit 22 local Texas governments simultaneously, forcing many municipalities to rely on backup systems. Fortunately, none of the demanded $2.5 million ransom was paid, but that does not mean the event was without consequence. Cities and their elected officials have learned that failing to protect networks housing taxpayer data risks losing the trust of constituents. While ransomware attacks can happen at any time, an election year is an opportune time for adversaries to conduct attacks — on voter registration systems, for example. In an attempt to prevent a ransomware attack affecting upcoming elections, the Department of Homeland Security recently announced a program to provide state election officials with guidance and support, as well as pen testing and vulnerability scanning of their voting systems. The rollout of this program, and future programs, serves as a major step in helping local governments protect their networks ahead of the 2020 elections and beyond.

National: Bipartisan bill to secure election tech advances to House floor | Maggie Miller/TheHill