National

The DEF CON hacker conference’s Voting Village event has become a testing ground for our national debate over voting security, referenced by Senate reports, several congressmen and even a presidential candidate (albeit incorrectly, see below). This year’s version, happening next week, comes with some upgrades. The big picture: Now in its third year, the event is traditionally one of the only places where many security researchers get a chance to audit the security of election systems.

Background: Voting Village burst onto the scene in 2017, when it took hackers only a matter of minutes to discover serious problems with machines. That was despite it being the first time many of the hackers had seen the systems.

National: Schumer predicts McConnell will take up election security | Burgess Everett/Politico

Mitch McConnell rarely budges in the face of political pressure. But Chuck Schumer thinks election security is an exception. The Senate minority leader predicted on Thursday that the majority leader will buckle and take up federal election security, a once-bipartisan issue. But though Democrats have continued their push in the House and Senate, McConnell (R-Ky.) has thus far resisted. “I predict that the pressure will continue to mount on Republican senators, especially Leader McConnell, and they will be forced to join us and take meaningful action on election security this fall,” Schumer said. “My prediction is our relentless push is going to produce results.” Though McConnell rarely rethinks opposition to legislation, he did allow criminal justice reform legislation on the Senate floor last year that he initially declined to take up. But that pressure came from President Donald Trump, not the party trying to oust him as majority leader.

National: DARPA to Bring its Smart Ballot Boxes to DEF CON for Hacking | Kelly Jackson Higgins/Dark Reading

US Defense Advanced Research Projects Agency (DARPA) researchers will set up three new smart electronic ballot-box prototypes at DEF CON’s famed Voting Village next week in Las Vegas, but they won’t be challenging hackers at the convention to crack them: They’ll be helping them do so. “We are providing the source code specifications, tests, and actually even providing participants at DEF CON with an easy way of actually putting their own malicious software into [the devices],” explains Daniel Zimmerman, principal researcher with Galois, a DARPA contractor working on the project. “We’re not daring them but actually helping them break this.” DARPA’s smart ballot box is the Defense Department agency’s prototype, featuring a secure, open source hardware platform that could be used not only in voting platforms, but also in military systems. It’s part of a broader DARPA project called System Security Integrated Through Hardware and Firmware (SSITH), which is developing hardware security architectures and tools that are better protected from hardware vulnerabilities exploited in software. DARPA ultimately hopes to build secure chip-level processors that thwart hardware hacks as well as software-borne attacks.

National: Will A Trump Trade Move Create An Election Mess For Overseas U.S. Voters? | Tierney Sneed/TPM

The Trump administration has supported plenty of moves to make it harder to vote. But an under-the-radar action President Trump took last year, as part of his trade war with China, may be a case of him just stumbling into that outcome, election experts fear. Trump is threatening to withdraw from the international body that oversees global mail delivery, putting at risk the stability and reliability of the current system of sending and receiving mail internationally. Any disruption to the international postal service, voter advocates say, could make an already difficult process of casting ballots for Americans abroad even more complicated. Among those who stand to be affected are members of the military overseas, whose ability to vote while serving their country has always been a politically sensitive issue.

National: Senator Feinstein introduces bill limiting use of voter data by political campaigns | Emily Birnbaum/The Hill

Sen. Diane Feinstein (D-Calif.) introduced a bill on Wednesday that would limit the use of voter data by political campaigns. The legislation is being touted as the first bill “directly responding to Cambridge Analytica,” the 2018 scandal that saw a right-wing political consulting firm use data on millions of American to target pro-Trump messaging at swing voters. Feinstein’s Voter Privacy Act seeks to give voters more control over the data collected on them by political campaigns and organizations. Under the legislation, voters would be allowed to access that data, ask political campaigns to delete it and instruct social media platforms like Google and Facebook to stop sharing personal data with those political entities. The legislation would intervene in the large and growing business around voter data, which campaigns increasingly use to direct their messaging.

National: Activists to Congress: Secure Elections or Risk a Repeat of 2016 | Gabriella Novello/WhoWhatWhy

The 2020 election could be vulnerable to another attack by hostile foreign actors if Senate Majority Leader Mitch McConnell (R-KY) continues to block election security legislation. Election integrity activists are urging Congress to take action after a bombshell report by the Senate Intelligence Committee found widespread attacks by the Russian government in the 2016 election. … Marian Schneider, president of Verified Voting, told WhoWhatWhy that the report proves that there can no longer be a dispute as to whether Russia actually interfered in the 2016 election. Schneider said that voting systems, the pieces that tabulate the vote, and voter registration databases need to be made resilient moving forward. “That means you have to be able to monitor the systems, detect that something has gone wrong, and recover,” she said, adding that voter-marked paper ballots are “the only way to do that.” Schneider also called for “uniform federal standards coupled with federal funding,” in light of the 2016 attack on US democracy.

National: A high-level Senate report confirms it: Our elections still aren’t safe | Michael McFaul/The Washington Post

In his congressional testimony last week, former special counsel Robert S. Mueller III once again confirmed the seriousness of Moscow’s attack on our democracy in the 2016 presidential election. Yet that wasn’t even the most important news for those of us who track Russian election interference. The Senate Intelligence Committee has just published the first section of its report on Russian efforts to influence the election. The bipartisan panel’s report has made headlines by showing that the Russians probably targeted elections systems in all 50 states in 2016. That calculated operation was designed not only to help Trump but also to undermine American democracy more generally. You’d think this report would give President Trump and Senate Majority Leader Mitch McConnell (R-Ky.) the perfect reason to support new legislation designed to enhance the security of our elections infrastructure in 2020. As the bipartisan report makes evident, enhancing cybersecurity for our election infrastructure is not a partisan issue — it’s an issue of national security. Department of Homeland Security representatives told the committee “there wasn’t a clear red state-blue state-purple state, more electoral votes, less electoral votes” pattern. So far, though, there is little sign that Trump and McConnell are paying attention.

National: Mitch McConnell just made sure election security will be key Senate campaign issue | Joseph Marks/The Washington Post

Senate Majority Leader Mitch McConnell, R-Ky., smacked back at critics who have accused him of leaving the 2020 election vulnerable to Russian hackers, accusing them of “modern-day McCarthyism.” McConnell offered an impassioned 25-minute defense of his election security record on the Senate floor as Democrats accuse him of consistently blocking their bills from coming up to a vote. “I’m not going to let Democrats and their water carriers in the media use Russia’s attack on our democracy as a Trojan horse for partisan wish list items that would not actually make our elections any safer,” McConnell said. “I’m not going to do that.” His stance ensures that election security will play a major role in Senate campaigns that are ramping up now — and Democrats are already seizing the moment to make McConnell look like the face of obstruction. Within minutes of the speech, Amy McGrath, a Kentucky Democrat and retired Marine lieutenant colonel who’s seeking McConnell’s seat, slammed the majority leader on Twitter. McGrath rattled off a list of election security provisions Democrats have sought to mandate, such as paper ballots and security audits for voting machines before asking: “Tell me again how that is partisan, @senatemajldr? Oh right, you can’t.”

National: Our lax cybersecurity risks our elections and our data. We need solutions | Andrew Grotto/CNN

Our national discussions about cybersecurity and privacy follow a frustrating pattern: a headline-grabbing incident like the recent Capital One breach occurs, Congress wrings its hands and policymakers more or less move on. So it is no surprise cybersecurity hasn’t been much of a focus as the race to the 2020 presidential election heats up. The issue is here to stay, and it should be debated by the candidates. Here are some concrete ideas that would significantly improve the safety and security of the nation — but require presidential leadership if they are to come to fruition. The candidates have been justifiably outraged over Senate Majority Leader Mitch McConnell’s stonewalling on election security legislation that would direct resources and expertise to state and local governments to help modernize election systems and implement paper-based backups for electronic voting, among other improvements. As Special Counsel Robert Mueller warned in Congressional hearings last week, the Russians and other bad actors will undoubtedly attempt to threaten the integrity of the 2020 election. This is no time to stand pat — Congress should pass — and the President should sign — legislation on election security before the 2020 election, not after.

National: Democrats take another stab at preventing foreign election interference | Maggie Miller/The Hill

House Democrats introduced legislation Tuesday that would require campaigns to report any foreign contacts to federal authorities, the latest push for election security following last week’s warnings from former special counsel Robert Mueller. The measure — sponsored by Democratic Reps. Elissa Slotkin (Mich.), Lauren Underwood (Ill.), and Jason Crow (Colo.) — would mandate federal campaigns to inform the FBI and Federal Election Commission about any foreign contacts who attempt to donate funds or assist a candidate. Campaigns would also be required to implement a “compliance system” to monitor communication with those foreign contacts. “Guarding our country against another attack on our political system should not be a partisan issue — it is a national security issue and it’s an American issue,” Slotkin said in a statement. The bill will be referred to the House Administration Committee.

National: Russia Is Going to Up Its Game for the 2020 Elections | Matt Laslo/WIRED

One week after Robert Mueller’s testimony shined a spotlight, once again, on election interference, Senate Majority Leader Mitch McConnell is feeling the heat. The leader turned heads on the Senate floor Monday as he rose to decry critics who have dubbed him “a Russian asset” and “Moscow Mitch” for stonewalling congressional measures to improve election security. And with momentum building in the House to formally start impeachment proceedings against President Trump, the pressure is unlikely to let up anytime soon. Focusing on election interference from 2016 is backwards thinking, though, at least according to Virginia Senator Mark Warner. With 2020 just around the corner, he tells WIRED—in an exclusive interview—that the upcoming election is where both parties need to direct their attention right now. As the top-ranking Democrat on the Senate Intelligence Committee, Warner has long been a vocal proponent of new legislation to strengthen election protections, such as the Honest Ad Act, which would compel Silicon Valley firms to disclose when political ads are paid for by a foreign nation. He’s also behind a bill that would require campaigns to alert federal officials if they’re approached by a foreign operative offering information or other assistance. Both bills have bipartisan support—Senator Susan Collins became the first Republican to cosponsor the Foreign Influence Reporting in Elections Act earlier this week.

National: Why is Mitch McConnell blocking election security bills? Good question. | Amber Phillips/The Washington Post

July 31, 2019

As President Trump’s own FBI director warns that Russians are planning to try to undermine American democracy in the next presidential election, Republican lawmakers led by Senate Majority Leader Mitch McConnell (Ky.) are blocking bills aimed at blocking foreign hackers from states’ voting systems. Why? Republicans have policy objections to the legislation, but it seems clear that politics is at the forefront of McConnell’s decision-making. Specifically, the politics of pleasing Trump. Trump is so sensitive to findings that Russians tried to help him win in 2016 that a Cabinet secretary was warned against briefing him on it. He’s repeatedly sided with Russian President Vladimir Putin over his own intelligence community about whether Russians interfered. He’s said he might accept foreign help in his 2020 reelection. And last month, he made light of it all when he mock-scolded Putin in front of cameras. “Don’t meddle in the election,” he said, waving a finger and wearing a smile. That puts McConnell in a tough spot: Pass legislation, which election security experts say is needed, and risk sparking the president’s ire, or block the legislation — and risk increased Russia election interference and public ridicule.

National: ‘Moscow Mitch’ Tag Enrages McConnell and Squeezes G.O.P. on Election Security | Carl Hulse/The New York Times

July 31, 2019

Senator Mitch McConnell is usually impervious to criticism, even celebrating the nasty nicknames critics bestow on him. But Mr. McConnell, the Senate majority leader, is incensed by the name “Moscow Mitch,” and even more miffed that he has been called a “Russian asset” by critics who accuse him of single-handedly blocking stronger election security measures after Russia’s interference in 2016. Democrats had been making the case for months, but it was supercharged last week by the testimony of Robert S. Mueller III, the former special counsel, who told the House Intelligence Committee that the Russians were back at it “as we sit here.” Mr. McConnell cites several reasons for his opposition — a longstanding resistance to federal control over state elections, newly enacted security improvements that were shown to have worked in the 2018 voting and his suspicion that Democrats are trying to gain partisan advantage with a host of proposals. Republican colleagues say that Mr. McConnell, a longtime foe of tougher campaign finance restrictions and disclosure requirements, is leery of even entering into legislative negotiation that could touch on fund-raising and campaign spending.

National: Election Security Needs Increased Federal Investment | Lucas Ropek/Government Technology

July 31, 2019

Foreign interference is still an ongoing threat to state and local election security and can only be guarded against through increased federal assistance, warns a recently published report. Defending Elections, published by the Brennan Center for Justice, claims that state and local governments are on the “front line” of a “cyberwar” with foreign actors and hackers.…

National: States Rush to Make Voting Systems More Secure as New Threats Emerge | David E. Sanger, Reid J. Epstein and Michael Wines/The New York Times

Amid growing warnings about the security of American voting systems, many states are rushing to address vulnerabilities exposed by the 2016 election, even as intelligence officials worry they are fighting the last battle and are not sufficiently focused on a new generation of threats headed into 2020. Delaware has replaced its voting machines to assure paper backup that would provide a record in case of a breach. South Carolina’s State Election Commission said this month that it would introduce a paper-based voting system in January and planned to “build additional layers of security designed to harden the new system.” Yet Florida, home of the United States’ best-known presidential balloting problems, like hanging chads in 2000 and still mysterious Russian activity in 2016, once again seems far behind. And the fear among American intelligence officials is that the federal government and the 50 states may be making the classic mistake of believing their adversaries will use the same techniques again. “No one expects the Russians will use their old playbook” in the next election, said Suzanne Spaulding, who oversaw election security at the Department of Homeland Security during the Obama administration and is now looking at how Russia is expanding its targets to undermine confidence in the American judicial system.

National: Has Congress already missed its chance to strengthen election security ahead of 2020? | Bryan Lowry/The Kansas City Star

Congress may have already missed its window to shore up state election systems against foreign cyber-attacks ahead of the 2020 election. Former Special Counsel Robert Mueller’s testimony this week on his investigation into Russia’s role in the 2016 election has reignited calls for the passage of a bipartisan election security bill. But Republican Senate leaders have balked at approving any such measure prior to 2020. GOP leadership said Mueller’s testimony did little to persuade them of the need for legislation. Moreover, one of the only GOP lawmakers pushing election security reforms on Capitol Hill said states have effectively run out of time to implement changes ahead of the next presidential election. Sen. James Lankford, R-Oklahoma, told reporters Thursday that Congress should shift its focus to the 2022 mid-term election. “I’ve had folks say we need to hurry and get money out the door so they can buy new systems, that’s not going to happen for 2020. There’s no way to do it for 2020 because you can’t buy the equipment, get it in, test it, evaluate it, train your volunteers on it when the first primary is six months away,” Lankford said. “The discussion now is not about 2020. That’s already resolved. They’re not going to add new stuff unless it’s already currently in the pipeline. It’s really 2022 at this point.”

National: State election offices made for an easy target for Russian hackers | Andrew Eversden/Fifth Domain

In the months before the 2016 presidential election, one U.S. state received a notification from a federally-backed cybersecurity group, warning about suspicious cyber activity directed at its networks. The state IT officials did not share the alert with other state government leaders and as late at January 2018, the same officials reported nothing “irregular, inconsistent, or suspicious” took place before the vote. In fact, GRU, Russia’s military intelligence agency, had scanned one of the state’s “election-related” domains, according to a new Senate report. In another state, leaders did not turn over to the Senate which of its systems had been targeted by Russians. Officials told Senate investigators they hadn’t seen evidence of scanning or attacks on its election infrastructure. Instead, they told the committee that they had seen a “probing” of its state systems. Again, DHS told the committee that GRU had scanned the state’s Secretary of State website. And in a third state, officials told Senate investigators they had not noticed a connection between their systems and the IP addresses listed in a warning from the federal government. And again, DHS told the committee that GRU scanned the state’s government domain.

National: Bring Back Paper Ballots: Senate Intelligence Committee report shows how electronic voting systems are inherently vulnerable to hackers. | Fred Kaplan/Slate

Just hours after Senate Republicans blocked a vote on a bill to make elections less vulnerable to cyberattacks, the Senate Intelligence Committee released a 67-page report, concluding that, leading up to the 2016 election, Russians hacked voting machines and registration rolls in all 50 states, and they are likely still doing so. The heavily redacted document, based on a two-year investigation, found no evidence that the hackers altered votes or vote tallies, though it says they could have if they’d wanted to. However, three former senior U.S. intelligence officials with backgrounds in cybersecurity told me that the absence of evidence isn’t the same as the evidence of an absence. One of them said, “I doubt very much that any changes would be detectable. Certainly, the hackers would be able to cover any tracks. The Russians aren’t stupid.” Hacking individual voting machines would be an inefficient way to throw an election. But J. Alex Halderman, a computer scientist who has tested vulnerabilities for more than a decade, testified to the Senate committee that he and his team “created attacks that can spread from machine to machine, like a computer virus, and silently change election outcomes.” They studied touch-screen and optical-scan systems, and “in every single case,” he said, “we found ways for attackers to sabotage machines and steal votes.”

National: Myriad election systems complicate efforts to stop hackers | Christina A. Cassidy and Colleen Long/Associated Press

A new Senate report on Russian interference in U.S. elections highlighted one of the biggest challenges to preventing foreign meddling: the limited powers and ability of the federal government to protect elections run by state and local officials. That has given fuel to those who argue that a larger federal role is needed. The Senate Select Committee on Intelligence issued the first part of its report into Russian interference in the 2016 election on Thursday, noting that Russian agents “exploited the seams” between federal government expertise and ill-equipped state and local election officials. The report also emphasized repeatedly that elections are controlled by states, not the federal government. It called for the reinforcement of state oversight of elections — a view blasted as inadequate by Sen. Ron Wyden, an Oregon Democrat on the committee. He called on Congress to establish mandatory cybersecurity requirements across the country. “We would not ask a local sheriff to go to war against the missiles, planes and tanks of the Russian Army,” Wyden wrote. “We shouldn’t ask a county election IT employee to fight a war against the full capabilities and vast resources of Russia’s cyber army. That approach failed in 2016 and it will fail again.”

National: Mitch McConnell Received Donations from Voting Machine Lobbyists Before Blocking Election Security Bills | Nicole Goodkind/Newsweek

Senate Majority Leader Mitch McConnell squashed two bills intended to ensure voting security on Thursday, just one day after former special counsel Robert Mueller warned that Russians were attempting to sabotage the 2020 presidential elections “as we sit here.” McConnell said he wouldn’t allow a vote on the bills because they were “so partisan,” but, as previously reported, earlier this year McConnell received a slew of donations from four of the top voting machine lobbyists in the country. “Clearly this request is not a serious effort to make a law. Clearly something so partisan that it only received one single solitary Republican vote in the House is not going to travel through the Senate by unanimous consent,” said McConnell on the Senate floor. The plans would likely burden the two largest electronic voting machine vendors in the United States, Election Systems & Software and Dominion Voting Systems, with new regulations and financial burdens.

National: Russia Targeted Elections Systems in All 50 States, Report Finds | David E. Sanger and Catie Edmondson/The New York Times

The Senate Intelligence Committee concluded Thursday that election systems in all 50 states were targeted by Russia in 2016, an effort more far-reaching than previously acknowledged and one largely undetected by the states and federal officials at the time. But while the bipartisan report’s warning that the United States remains vulnerable in the next election is clear, its findings were so heavily redacted at the insistence of American intelligence agencies that even some key recommendations for 2020 were blacked out. The report — the first volume of several to be released from the committee’s investigation into Russia’s 2016 election interference — came 24 hours after the former special counsel Robert S. Mueller III warned that Russia was moving again to interfere “as we sit here.” While details of many of the hackings directed by Russian intelligence, particularly in Illinois and Arizona, are well known, the committee described “an unprecedented level of activity against state election infrastructure” intended largely to search for vulnerabilities in the security of the election systems.

National: Mueller Warns of Russian Sabotage and Rejects Trump’s ‘Witch Hunt’ Claims | Mark Mazzetti/The New York Times

Robert S. Mueller III warned lawmakers on Wednesday that Russia was again trying to sabotage American democracy before next year’s presidential election, defended his investigation’s conclusions about Moscow’s sweeping interference campaign in 2016 and publicly rejected President Trump’s criticism that he had conducted a “witch hunt.” The partisan war over Mr. Mueller’s inquiry reached a heated climax during nearly seven hours of his long-awaited testimony before two congressional committees. Lawmakers hunted for viral sound bites and tried to score political points, but Mr. Mueller consistently refused to accommodate them, returning over and over in a sometimes halting delivery to his damning and voluminous report. Mr. Mueller remained a spectral presence in Washington over the past two years as the president and his allies subjected the special counsel and his team of lawyers to withering attacks. Speaking in detail for the first time about his conclusions produced occasionally dramatic moments in which he ventured beyond his report to offer insights about Mr. Trump’s behavior.

National: Senate Intel finds ‘extensive’ Russian election interference going back to 2014 | Morgan Chalfant and Maggie Miller/The Hill

The Senate Intelligence Committee has released its long-awaited bipartisan report on election security and Russian interference in the 2016 presidential election. Among the key findings of the report, the committee writes that “the Russian government directed extensive activity, beginning in at least 2014 and carrying into at least 2017, against U.S. election infrastructure at the state and local level.” The report is heavily redacted in some areas and is 67 pages. The Senate panel, which has been investigating Russian interference for more than two years, released a summary version of its election security findings in May 2018. The panel released its redacted report one day after former special counsel Robert Mueller appeared on Capitol Hill to testify about his own 22-month investigation into Russian interference in the 2016 election and possible obstruction of justice by President Trump. The congressional document, which is the product of a bipartisan investigation led by Senate Intelligence Committee Chairman Richard Burr (R-N.C.) and Vice Chairman Mark Warner (D-Va.), recommended that officials give “renewed attention” to vulnerabilities in voting infrastructure, such as further securing voter registration databases.

National: Election infrastructure bill remains stalled as Senate Intelligence panel releases first volume of Russia report | Niels Lesniewski/Roll Call

As the Senate Intelligence Committee was releasing the first volume of its comprehensive report into Russian election interference in 2016, a Republican senator was making clear that he still wants to get support for encouraging states to have paper audit trails and to boost the ability of election officials to get timely security clearances. Sen. James Lankford of Oklahoma, who has been working with Minnesota Democrat Amy Klobuchar, told reporters Thursday that with the 2020 primaries and caucuses just around the corner, security enhancements would be meant for the next midterms. “The discussion now is not about 2020. That’s already resolved,” Lankford said. “They’re not going to add new stuff unless its already currently in the pipeline. It’s really 2022 at this point.” Lankford said that if he and Klobuchar can find a way to overcome objections from lawmakers concerned about undue federal influence in state and local elections, they will be looking for a legislative vehicle for their measure.

National: GOP blocks election security bills after Mueller testimony | Jotdain Carney/The Hill

Senate Republicans blocked two election security bills and a cybersecurity measure on Wednesday in the wake of former special counsel Robert Muellerwarning about meddling attempts during his public testimony before congressional lawmakers. Democrats tried to get consent to pass two bills that would require campaigns to alert the FBI and Federal Election Commission about foreign offers of assistance, as well as a bill to let the Senate Sergeant at Arms offer voluntary cyber assistance for personal devices and accounts of senators and staff. But Sen. Cindy Hyde-Smith (R-Miss.) blocked each of the bills. She didn’t give reason for her objections, or say if she was objecting on behalf of herself or the Senate GOP caucus. A spokesman didn’t immediately respond to a request for comment. Under Senate rules, any one senator can ask for consent to pass a bill, but any one senator is able to object. The floor drama comes after Mueller warned about election interference during his testimony before the House Intelligence Committee, saying Russia was laying the groundwork to interfere in the 2020 election “as we sit here.” “We are expecting them to do it again during the next campaign,” Mueller said.

National: DEF CON Invites Kids to Crack Campaign Finance Portals | Kelly Sheridan/Dark Reading