Tag Archives: election cybersecurity

The FBI released new guidelines on how it will approach cyberattacks on elections after facing years of criticism from lawmakers across the country for their response to Russian intrusion attempts during the 2016 election. State officials, particularly those in Florida, were incensed when the Mueller Report revealed that two county voting databases were breached by Russian hackers ahead of the 2016 election. The FBI never told state-level officials and only coordinated with people in the counties that had been hit, waiting nearly two years until meeting and explaining the situation to Florida Gov. Ron DeSantis. The new guidelines, explained on a media call last Thursday and in a press release last Friday, say the FBI will notify a state’s chief election official and other local election workers in the event of any cyberattack. “Understanding that mitigation of such incidents often hinges on timely notification, the FBI has established a new internal policy outlining how the FBI will notify state and local officials responsible for administering election infrastructure of cyber activity targeting their infrastructure,” the FBI statement said.

National: Weakening Encryption Could Impact Election Security, Coalition Says | Frank Konkel/Nextgov

A coalition for secure elections sent a letter to Attorney General William Barr Wednesday, criticizing the AG for recent comments he made calling on companies to create a “backdoor” through encryption. The letter, published by the Project on Government Oversight, warns such backdoors—even if expressly for use by law enforcement—would weaken the security of encrypted services and devices, “opening the door” for hackers to harm users. “While encryption does not guarantee safety from all forms of malicious hacking, it is a vital safeguard to minimize risk. The Department of Justice has previously asked companies to create a ‘backdoor’ through encryption that would be accessible to law enforcement—but it is simply not possible to create a ‘backdoor’ that could not also be accessed by malicious hackers,” the letter states.

National: Tech Companies Volunteer to Beef Up Presidential Campaigns’ Cybersecurity | Alexa Corse/Wall Street Journal

Nearly a dozen technology companies said they will provide free or reduced-cost cybersecurity services to presidential campaigns, which experts and intelligence officials have warned are ripe targets for intrusion and disinformation. They join a growing number of firms offering protection on a nonpartisan basis, a trend that has gained steam in the past 18 months or so, since federal regulators eased rules to make such offers permissible under campaign-finance laws. The Federal Election Commission made policy changes after urging from nonprofits and technology companies, including Microsoft Corp. Campaigns have struggled to make their information more secure in part because of budget pressures and the fast-moving nature of a campaign. “Any dollar that a campaign spends on extra levels of cybersecurity is a dollar they’re not spending on voter contact and getting their candidate elected,” noted Matt Rhoades, campaign manager for Republican Mitt Romney in 2012.

Iowa: Caucus app sparks election security concerns | Ben Popken/NBC

With less than two weeks until Iowans line up to cast the first votes to pick a Democratic presidential nominee, party officials are reassuring voters that a new app used to report its caucus votes is secure. It’s not clear if they are correct. The app will be used in Iowa and Nevada by caucus managers — local registered Democrats who sign up to organize and run the caucus process in each location — to expedite the process, calculate and assign delegates and report results back quickly. The app will also be used in satellite voting locations across the country and overseas. But questions about the app remain unanswered, including who developed it and whether it has been subjected to independent security testing. Security experts say that the app is a potential target for early election interference, particularly since it is downloaded on to the personal phones of the caucus managers. Party officials say operational security prevents them from disclosing specifics about the app. Kiersten Todt, managing director of the Cyber Readiness Institute, a nonprofit group that provides cybersecurity advice to small and medium-size businesses, said those phones “can be breached in a heartbeat.”

Nevada: Amid hacking fears, Nevada Democrats to use app for caucus results | Jason Hidalgo, Ryan Foley and Christina Cassidy/Reno Gazette Journal

Nevada is one of two early caucus states to use new mobile apps to report caucus results amid heightened worries about election hacking. The Silver State will be joining Iowa in using mobile apps to gather results from thousands of caucus sites. The decision to use the apps was made to increase transparency and help run the caucuses more smoothly, said Shelby Wiltz, director of the Nevada State Democratic Party Caucus, on Monday. “NV Dems has been committed to making our First in the West Caucus the most accessible, expansive and transparent caucus yet,” Wiltz said. “We developed a reporting application in order to streamline the caucus process and provide our volunteers with additional support to run their caucuses as efficiently as possible.” Although the technology is intended to make counting easier, however, it also raises concerns about the potential for hacking or glitches. Party officials said that they worked closely with the Democratic National Committee and security experts while picking and vetting the app vendor that was chosen. They declined to name the vendor, however, citing security reasons.

New Hampshire: Paper Ballots Are Hard to Hack, But That’s Only Part of the Election Security Puzzle | Casey McDermott/New Hampshire Public Radio

New Hampshire Secretary of State Bill Gardner has long projected confidence about the security of the state’s elections. In the fall of 2016, as national security officials were warning state elections offices to “be vigilant and seek cybersecurity assistance” from federal partners, Gardner declined — saying New Hampshire didn’t need the extra help. “We have a system that, we don’t have to be concerned that it’s going to be something different this time because of some imaginary foreign element out there or something that might be interfering with this election,” Gardner said at the time. Since then, Gardner — the nation’s longest serving elections chief — continued to downplay the risk facing New Hampshire. When asked about election security at a meeting of the state’s Ballot Law Commission a few months before the 2018 midterms, he had a simple response. “You want to know about being hacked? You see this pencil here?” Gardner said, holding one up for emphasis. “Want me to give it to you and see if you can hack this pencil? We have this pencil. This is how people vote in this state. And you can’t hack this pencil.”

Washington: Secretary of state questions online, mobile voting plan in King County race | David Gutman/The Seattle Times

Washington Secretary of State Kim Wyman expressed concerns Wednesday with newly announced plans to allow voters in one obscure King County election to vote online through mobile devices. The plan, which went into effect Wednesday, allows voters to cast ballots through a touch-screen device in the race for King Conservation District Board of Supervisors. That election, which is held annually for a volunteer position on a board with no regulatory power, has traditionally drawn voter turnout of only about 1%. Because of a quirk in state law, the conservation district has to hold its elections in the first three months of the year, so voting can’t piggyback on the primary or general election ballots in August or November. And, sending out paper ballots to all 1.2 million eligible voters in the district would eat up about a quarter of the small agency’s annual budget. So, they’re trying voting by mobile device, the first election in the country to offer that technology to every eligible voter. “Any time you connect a system online, it becomes vulnerable to attack,” said Wyman, a Republican, who oversees most of the state’s elections, but not those of conservation districts.

National: Hackers Are Coming for the 2020 Election — And We’re Not Ready | Andy Kroll/Rolling Stone

… Four years ago, for an embarrassingly modest price, Russia pulled off one of the more audacious acts of election interference in modern history. The Internet Research Agency, the team of Kremlin-backed online propagandists, spent $15 million to $20 million and wreaked havoc on the psyche of the American voter, creating the impression that behind every Twitter avatar or Facebook profile was a Russian troll. Russian intelligence agents carried out the digital version of Watergate, infiltrating the Democratic Party and the Clinton campaign, stealing tens of thousands of emails, and weaponizing them in the days and weeks before the election. Russian-based hackers tested election websites in all 50 states for weak spots, like burglars casing a would-be target. “The Russians were testing whether our windows were open, rattling our doors to see whether they were locked, and found the windows and doors wide open,” says Sen. Mark Warner (D-Va.), the top Democrat on the Intelligence Committee. “The fact that they didn’t interject themselves more dramatically into our election was, I think, almost luck.”

National: Acting DHS secretary says he expects Russia to attempt to interfere in 2020 elections | Maggie Miller/The Hill

Acting Homeland Security Secretary Chad Wolf said Friday that his agency “fully expects” Russia to attempt to interfere in U.S. elections in 2020. “As we saw in 2016, we fully expect Russia to attempt to interfere in the 2020 elections to sow public discord and undermine our democratic institutions,” Wolf said during an event hosted by the Homeland Security Experts Group in Washington, D.C. Wolf also highlighted cyber threats from China and Iran. According to the report compiled by former special counsel Robert Mueller and to findings by the U.S. intelligence community and the Senate Intelligence Committee, Russia launched a sweeping interference effort in the lead-up to the 2016 presidential election, using both hacking and disinformation tactics.

National: Amid hacking fears, key caucus states to use app for results | Ryan J. Foley and Christina A. Cassidy/Associated Press

Two of the first three states to vote in the Democratic presidential race will use new mobile apps to gather results from thousands of caucus sites — technology intended to make counting easier but that raises concerns of hacking or glitches. Democratic Party activists in Iowa and Nevada will use programs downloaded to their personal phones to report the results of caucus gatherings to the state headquarters. That data will then be used to announce the unofficial winners. Paper records will later be used to certify the results. The party is moving ahead with the technology amid warnings that foreign hackers could target the 2020 presidential campaign to try to sow chaos and undermine American democracy. Party officials say they are cognizant of the threat and taking numerous security precautions. Any errors, they say, will be easily correctable because of backups.

National: US election still vulnerable to attacks, despite security improvements | Cynthia Brumfield/CSO Online

Days away from the Iowa caucuses, and less than 11 months from the general election, voting and election security continues to be a challenge for the U.S political system. Threats to a secure election appear to loom as large today as they did in 2016, when Russian state-backed hackers and social media trolls threw U.S. political campaign and election efforts into chaos, turmoil that has only become clear after the fact. Certainly, voting security has made great strides since 2016. State and local governments took advantage of a funding boost under the Help America Vote Act to improve their infrastructure and better coordinate among themselves to harden election systems. Congress allocated an additional $425 million as part of a spending compromise that was passed and enacted in late-December, giving election officials even more latitude to make improvements. A spokesperson for the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) tells CSO that the agency has seen marked improvements in security over the past few years. “In our work with all 50 states and more than 2,400 local jurisdictions, we’ve seen a maturation in the risk management practices across the sector,” the spokesperson says. “Whether implementing controls like multifactor authentication and intrusion detection systems or exercising incident identification, communications, and response, the progress for election security is real.”

Georgia: A Georgia election server was vulnerable to Shellshock and may have been hacked | Dan Goodin/Ars Technica

Forensic evidence shows signs that a Georgia election server may have been hacked ahead of the 2016 and 2018 elections by someone who exploited Shellshock, a critical flaw that gives attackers full control over vulnerable systems, a computer security expert said in a court filing on Thursday. Shellshock came to light in September 2014 and was immediately identified as one of the most severe vulnerabilities to be disclosed in years. The reasons: it (a) was easy to exploit, (b) gave attackers the ability to remotely run commands and code of their choice, and (c) opened most Linux and Unix systems to attack. As a result, the flaw received widespread news coverage for months. Despite the severity of the vulnerability, it remained unpatched for three months on a server operated by the Center for Election Systems at Kennesaw State University, the group that was responsible for programming Georgia election machines. The flaw wasn’t fixed until December 2, 2014, when an account with the username shellshock patched the critical vulnerability, the expert’s analysis of a forensic image shows. The shellshock account had been created only 19 minutes earlier. Before patching the vulnerability, the shellshock user deleted a file titled shellsh0ck. A little more than a half hour after patching, the shellshock user was disabled.

Iowa: Linn auditor’s complaint that voter registration vulnerable dismissed | Jason Clayworth/Des Moines Register

Linn County Auditor Joel Miller’s complaint that Iowa’s voting system is prone to hackers was dismissed Friday by a state commission without a public hearing on the allegations, an action Miller contends violates federal law. “We won’t rush to judgment on what to do next, but I think there is a good case to appeal because federal law is very clear that a hearing shall be heard and that didn’t happen,” Miller said. Miller in an August complaint filed with Iowa Secretary of State Paul Pate said Iowa’s voter registration system does not meet security safeguards mandated under the federal Help America Vote Act. He has declined to offer details about how the system could be hacked, citing confidentiality concerns. In its 2-to-1 vote Friday, Iowa’s Registration Commission approved a motion filed by the Iowa Attorney General’s Office to dismiss the complaint in part because of its lack of specifics.

New Hampshire: Election security looms ahead of primary | Jake Lahut/Keene Sentinel

Amid ongoing efforts by foreign entities to influence American democracy, concerns have arisen nationwide about election security. At a 2018 “hackathon” in Florida, an 11-year-old was able to electronically break into a replica of the Sunshine State’s voter rolls in a matter of minutes, changing names and even election tallies. Legislation that would give states a total of $1 billion to require backup paper ballots in precincts nationwide — to be used alongside electronic machines to ensure an accurate recount if those machines are hacked — has been stalled in Washington by the Republican majority in the U.S. Senate. With each state using different election laws under the hyper-localized American system, the election security landscape remains complicated in the first general-election year since the Russian meddling efforts. An early test of voter confidence will come in the Granite State’s first-in-the-nation primary next month.

West Virginia: Mobile absentee voting proposed for people with disabilities | Steven Allen Adams/News and Sentinel

A mobile phone app used by deployed military service members to vote overseas could be the answer for helping people with disabilities and the blind to vote absentee, though concerns were raised Monday about potential hacking. Senate Bill 94 was introduced Jan. 8 by Senate Judiciary Committee Chairman Charles Trump, R-Morgan, at the request of Secretary of State Mac Warner. The bill would provide West Virginians with physical disabilities the ability to vote by an electronic absentee ballot. The bill easily made it through the state Senate eight days later, passing unanimously Jan. 15 as the first bill to cross over from the Senate to the House of Delegates. The House Judiciary Committee took up the bill Monday morning and was still talking about the bill Monday afternoon. The bill was recommended for passage and will be sent to the full House.

National: FBI will now notify state election officials when any part of their election systems is hacked | Ken Dilanian/NBC

The FBI will now notify state election officials about cyber breaches to election systems in their jurisdictions, even those that only affect a single county, FBI and Justice Department officials said Thursday. The change stems from a belief that the “traditional policy did not work in the election context,” an FBI official told reporters in a background call. Typically, the FBI notifies only the victim of a cyber intrusion. When it comes to election systems, the victim is often a county. But if the FBI only notifies local officials, “it may leave the state officials with incomplete knowledge of the threats,” the official said. The policy shift comes after a 2018 episode in Florida in which Democratic Sen. Bill Nelson said he had been told that Russian hackers gained access to some voting systems in his state, only to be accused of making that up by then-Gov. Rick Scott, the Republican running to unseat Nelson in that year’s election. Scott said state officials had not been notified of any such breach.

National: Cloudflare is giving away its security tools to US political campaigns | Zack Whittaker/TechCrunch

Network security giant Cloudflare said it will provide its security tools and services to U.S. political campaigns for free, as part of its efforts to secure upcoming elections against cyberattacks and election interference. The company said its new Cloudflare for Campaigns offering will include distributed denial-of-service attack mitigation, load balancing for campaign websites, a website firewall and anti-bot protections. It’s an expansion of the company’s security offering for journalists, civil rights activists and humanitarian groups under its Project Galileo, which aims to protect against disruptive cyberattacks. The project later expanded to smaller state and local government sites in 2018, with an aim of protecting from attacks servers containing voter registration data and other election infrastructure.

Georgia: Expert: Georgia election server showed signs of tampering | Frank Bajak/Associated Press

A computer security expert says he found that a forensic image of the election server central to a legal battle over the integrity of Georgia elections showed signs that the original server was hacked. The server was left exposed to the open internet for at least six months, a problem the same expert discovered in August 2016. It was subsequently wiped clean in mid-2017 with no notice, just days after election integrity activists filed a lawsuit seeking an overhaul of what they called the state’s unreliable and negligently run election system. In late December 2019, the plaintiffs were finally able to obtain a copy of the server’s contents that the FBI made in March 2017 and retained — after the state allegedly dragged its feet in securing the image. State officials have said they’ve seen no evidence that any election-related data was compromised. But they also long refused to submit the server image for an independent examination. Logan Lamb, a security expert for the plaintiffs, said in an affidavit filed in Atlanta federal court on Thursday that he found evidence suggesting the server was compromised in December 2014. Lamb said the evidence suggests an attacker exploited a bug that provided full control of the server. Lamb also said he determined that computer logs — which would have been critical to understanding what might have been altered on or stolen from the server — only go back to Nov. 10, 2016 — two days after Donald Trump was elected U.S. president. Two years later, Brian Kemp won the Georgia governor’s race by a narrow margin over Democrat Stacey Abrams.

Georgia: State’s Election Systems Feared at Risk in 2020 Vote | Kartikay Mehrotra/Bloomberg

The state of Georgia’s new voting system may be at risk of a cyber-attack leading up to the 2020 election because the state failed to eradicate malware that exposed sensitive data six years ago, a cybersecurity expert said as part of a lawsuit against the state. A server central to Georgia’s election system was infiltrated and taken over by a hacker in 2014, according to Logan Lamb, a cybersecurity expert who is part of a lawsuit between voting integrity advocates and the state over the election system. The server was wiped and taken offline in 2017, but the contract between Georgia and its new vendor, Dominion Voting Systems, indicates old data was “imported” into the new system. That old data could carry remnants of the “Shellshock” malware used to attack the state in 2014, according to filings in the lawsuit. Shellshock allowed unauthorized users to access sensitive layers of a network. “Because this compromised server is inextricably connected to Georgia’s voting systems past and present, it is unreasonable to assume that the new election system … is not already potentially compromised,” according to documents filed Thursday by the nonprofit Coalition for Good Governance. The group has filed its suit to block the state from destroying their old voting system records.

Iowa: Caucus results will be compiled over the internet, hacking threat aside | The Fulcrum

The first votes of the presidential election will be tabulated after the Iowa caucuses next month using the sort of internet-connected system that worries election security experts. They say preventing the sort of interference that sullied the 2016 election should be more of a priority than speed in compiling the returns. But the Iowa Democratic Party plans to deploy a smartphone app to officials running the caucuses across the state for use in calculating and transmitting the results the night of Feb. 3. Putting such vote totals into cyberspace makes them readily vulnerable to nefarious hacking. Party leaders say they are aware of the potential problems but believe their system will repel them. If that doesn’t happen, the opening round of the intense contest for the Democratic nomination will be condemned to global ridicule.

Washington: Secretary Of State Pushes ‘Election Security’ Bill | Associated Press

Washington Secretary of State Kim Wyman is seeking $1.8 million in state money for security in county election offices that would make Washington eligible for another $8.6 million in matching federal funds. The Seattle Times reports that the budget request is part of an election security proposal Wyman, a Republican, unveiled Wednesday. The bill also provides stricter penalties and restrictions surrounding the collection of ballots — which are mailed to each of the state’s nearly 4.5 million voters — and provides more thorough post-election audits for race recounts. It also would eliminate online ballots for military and overseas voters, to reduce the risk of potential malware coming into elections offices.

National: U.S. election security czar says attempts to hack the 2020 election will be more sophisticated | Ken Dilanian/NBC

The U.S. government is geared up as never before to combat foreign election interference, but there are limits to what American intelligence agencies can do, even as determined adversaries build on their 2016 playbook, the nation’s election security czar said Tuesday. In prepared remarks before an elections group, and in an exclusive interview afterward with NBC News, Shelby Pierson, the election security threats executive at the Office of the Director of National Intelligence, said a number of adversaries may be poised to attempt election interference. “The threats as we go into 2020 are more sophisticated,” she said. “This is not a Russia-only problem. Russia, China, Iran, North Korea, non-state hacktivists all have opportunity, means and potentially motive to come after the United States in the 2020 election to accomplish their goals.” Pierson spoke at an election summit sponsored by the U.S. Election Assistance Commission, an independent, bipartisan agency that certifies voting systems and serves as a national clearinghouse of information on election administration.

National: State election officials will get fresh intelligence briefing after Iran tensions | Sean Lyngaas/CyberScoop

In the wake of the U.S.-Iran standoff and just weeks before the first Democratic primary, the intelligence community’s lead official for election security will brief state officials on the top cyberthreats to the U.S. electoral process. Shelby Pierson, the intelligence community’s election threats executive, said that the briefing this Thursday will cover the full gamut of digital threats to U.S. elections, including those emanating from Iran. Asked if Iran is more likely to interfere in the 2020 election after the U.S. military killed Tehran’s top general earlier this month, Pierson told reporters Tuesday that “it certainly is something that we’re prepared for.” “As our adversaries look to the political climate … it wouldn’t surprise me at all that this is part of the calculus,” she added.

National: Democrats sound election security alarm after Russia’s Burisma hack | Maggie Miller/The Hill

Congressional Democrats are raising fresh concerns about 2020 election security following a report this week that Russian military officers hacked Burisma Holdings, the Ukrainian gas company at the center of President Trump’s impeachment. Several Democratic lawmakers are viewing the incident, reported by The New York Times on Monday night, as the first major sign that Moscow is gearing up for a repeat of its 2016 election interference. They cited what they call similarities between the Burisma attack and the Democratic National Committee hack four years ago. Sen. Gary Peters (Mich.), the top Democrat on the Senate Homeland Security Committee, said the hack confirmed that Russia will be back to interfere in U.S. elections this year. “The Russians are actively engaged in hacking all sorts of sites and businesses, and I am sure there was a political motivation behind it. We know the Russians are going to be actively involved in trying to cause problems in the 2020 election, and this is just a further confirmation of their active involvement in American politics,” Peters told The Hill.

National: Election officials are watching how their states respond to cyberattacks | Benjamin Freed/StateScoop

State election officials said Tuesday that they’ve been watching how their state governments have responded to incidents like ransomware attacks as lessons on what they would do if the voter registration databases, vote-total reporting systems and other components of election infrastructure that they manage were targeted. Though the ransomware incidents that have spread through state and local governments across the United States have largely spared election systems from the worst, debilitating effects, the Department of Homeland Security last year said that local officials could be targeted by viruses that lock them out of voter rolls unless they pay a financial demand. And at a conference in Washington hosted by the Election Assistance Commission, state officials said they are paying attention to ransomware wave.

Iowa: Despite Election Security Fears, Iowa Caucuses Will Use New Smartphone App | Kate Payne, Miles Parks/NPR