Tag Archives: election cybersecurity

Two top government officials with broad cybersecurity and election-integrity portfolios have announced they are stepping down this month, a loss of expertise in a critical area less than a year before the 2020 presidential election. Amy Hess, the executive assistant director of the Criminal, Cyber, Response, and Services Branch of the Federal Bureau of Investigation will depart for a job as the chief of public services in Louisville, Ky. Jeanette Manfra, the most senior official dedicated exclusively to cybersecurity at the Department of Homeland Security, will leave her post at year’s end for a job in the private sector. Both women have announced their departure in recent weeks. Senior U.S. intelligence officials have warned the elections are likely to be targeted online by Russia and other foreign adversaries following Moscow’s success in disrupting the 2016 race. The FBI and DHS are two of the primary agencies responsible for combating foreign influence operations online, along with intelligence agencies including the National Security Agency. The FBI established a Foreign Influence Task Force in 2017 and has made investments to deepen its cybersecurity capabilities. DHS is the lead federal partner for state and local election officials with a focus on safeguarding voting systems from hackers.

Ohio: Deadline looming for Ohio’s county elections boards to complete new state security requirements for 2020 | Andrew J. Tobias/Cleveland Plain Dealer

While Ohio’s 88 county boards of elections are at various stages of completing a mandatory pre-election security check-list, Ohio Secretary of State Frank LaRose said Friday that he’s confident Ohio will have a secure 2020 election. During a security briefing in Columbus on Friday, LaRose, a Republican, urged local elections officials to get working on the security directive his office issued last June. Counties are required, among other things, to install a device that can automatically detect hacking attempts, and to conduct criminal background checks on elections workers who hold sensitive jobs. LaRose’s office, which oversees state elections, set a Jan. 31 deadline to get everything done. LaRose’s office emphasized that 52 of Ohio’s 88 counties are at least half done completing the security check-list. But that means 36 aren’t. And a handful are far behind, LaRose said. Only 13 counties have installed the devices that detect hacking attempts. LaRose drew chuckles and whispering from local elections officials when he said the current period — after last November’s election and before the Dec. 17 filing deadline for the March primary election — could be a slower time where elections board can get caught up.

Ohio: Few county boards of elections have adopted digital alarm used to detect hacks | Rick Rouan/The Columbus Dispatch

The vast majority of Ohio’s county boards of elections haven’t installed the digital burglar alarm that Secretary of State Frank LaRose says helped his office detect a hacking attempt of his office’s website on Election Day. With less than two months to go before the deadline LaRose imposed for installation of the so-called Albert systems, just 13 out of Ohio’s 88 county boards of elections have operational alarms. The remaining 75 have until Jan. 31 to install them. “The most important consequence is not being prepared,” LaRose said Friday after the start of a daylong security conference for county elections officials in Columbus. “This is too important to take lightly.” Franklin County has had an Albert sensor in place since May 2018, with other network sensors in place at the Franklin County data center before that. But even with the threat of digital attacks, LaRose said Ohio’s election procedures are secure. None of the equipment used to cast or tally ballots is connected to the internet. Doing so would violate Ohio law.

Oklahoma: State increases election security efforts | Addison Kliewer/NonDoc

With the end-of-the-year deadline to pass election security measures in Congress quickly approaching, Sen. James Lankford (R-OK) said Oklahoma has already taken steps to secure elections from foreign interference. Lankford, who has been pushing election security to keep American democracy from foreign interference, said there is “no question” that Russia tried to meddle in the 2016 election. “We were one of the 21 states that were identified early by the FBI that the Russians tried to get into, but they couldn’t get into our system in 2016, so they moved along to others,” Lankford said. In 2017, this information was brought to the Oklahoma State Election Board, encouraging the board to partner with numerous federal and state agencies to address the issue of election security. “We met regularly to discuss risks and plan for contingencies. We arranged for unclassified briefings and security training for county election officials, and shared ‘best practices’ with state and county election employees,” said Election Board Secretary Paul Ziriax in a June congressional testimony.

China: Fear of China’s election meddling triggers reforms across Pacific | Fumi Matsumoto & Kensaku Ihaha/Nikkei Asian Review

From Taiwan to Australia, governments across the Pacific are launching new laws and organizations to guard against possible Chinese interference in upcoming elections. A slew of reports alleging Chinese attempts to influence local politics have fueled concern throughout the region. Beijing denies these claims, but other countries in Asia-Pacific could follow suit. Taiwan’s ruling Democratic Progressive Party unveiled a bill at the end of November to curb “hostile” external influence in the island’s elections, which it aims to pass by the end of the year. The legislation would impose a sentence of up to five years for those who campaign, make political donations, or spread fake news under the instructions of a hostile power — a veiled reference to Beijing. Many Taiwanese worry that Beijing is covertly steering their island toward reunification with the mainland. A June rally against Chinese intervention drew more than 100,000 attendees. Recent reports of a self-proclaimed Chinese spy, who said he was part of operations to meddle with Taiwan’s local elections last year and is now seeking asylum in Australia, have further stoked concerns.

National: The voting machine certification process is making it harder to secure elections | Chris Iovenko/Slate

A judicial election in Northampton County, Pennsylvania, in November produced a literally unbelievable result. About 55,000 votes were cast on newly purchased electronic voting machines, but only 164 votes were registered for the Democratic candidate. Luckily, the touch-screen machines produced a backup paper trail, which allowed for an accurate recount. Ultimately, the Democrat won by some 5,000 votes. The root cause of this systemic vote switching is still under investigation. Whatever the case, though, the mass malfunction of these machines highlights the reliability and security issues around electronic voting systems that are mostly already primed for use in the 2020 elections. As disturbing as the Northampton County miscount is in its own right, it throws into relief a grave general issue that applies to voting systems across the country. One would hope that whatever glitch or virus, once identified, that caused the massive malfunction will be quickly and easily fixed, patched, or updated so that those machines can be relied upon to work properly going forward. Further, one would also assume that other vulnerable voting systems around the country will be updated prophylactically to prevent similar malfunctions in next year’s elections. However, neither of those things is very likely to happen. Our current regimen for certifying electronic voting systems makes changing or updating election systems in the run-up to an election very difficult—and as Election Day 2020 gets closer, that maintenance becomes virtually impossible.

National: Just How Regulated Are Our Nation’s Elections? | Hadley Hitson/Fortune

The U.S. federal government subjects nearly every industry to a slew of operational rules and regulations. Defense contractors are prohibited from utilizing certain Chinese telecommunications companies like Huawei in order to prevent theft of the nation’s military technology. Power companies must abide by mandatory reliability standards and report any attempted or successful breaches of their systems to a federal commission. National banks implement federally required security procedures to prevent robberies. These sectors are meticulously managed with hundreds of requirements specifically because the Department of Homeland Security considers them so vital that their incapacitation would have a “debilitating effect” on the country as a whole. But when it comes to elections, a cornerstone of American democracy, the vendors whose voting equipment is used throughout the country largely lack the level of federal oversight and direction that protect other critical infrastructure industries from domestic and foreign interference.

National: What Is Election Hacking, and Can It Change Who Wins? | Kartikay Mehrotra & Andrew Martin/Bloomberg

Americans have relied on computers to tally votes since at least 1964, when two Georgia counties used them to count punch-card ballots in a primary election. Over time, high-tech election systems largely supplanted paper ballots and gear-and-lever machinary, a trend hastened by the contested 2000 presidential election between George W. Bush and Al Gore. (Remember hanging chads?) But ever-greater reliance on digital voter registration, electronic voting and computerized tabulation have created the opportunity, at least, for hackers to sabotage elections, and Americans aren’t the only ones who are fearful.

1. What is meant by ‘election hacking’?

It’s sometimes used as a catch-all phrase to encompass all sorts of underhanded efforts to subvert elections, including the type of social media disinformation campaign undertaken by Russia to taint elections in the U.S., Europe and Africa. But in its most literal form, election hacking refers to computer breaches that are intended to manipulate voter data, change a vote tally or otherwise discredit tabulated results.

National: Email Infrastructure Seen as Lingering Vulnerability for Elections | MeriTalk

New research shows that email is still a weak link in U.S. election infrastructure, with only five percent of the nation’s largest counties protecting election officials from impersonation attempts. The latest research from Valimail finds that an “overwhelming majority of cyberattacks can be traced to impersonation-based phishing emails,” with 90 percent of attacks involving phishing, and 89 percent of phishing involving impersonation. Valimail looked at Sender Privacy Framework (SPF) and Domain-based Message Authentication, Reporting & Conformance (DMARC) status for 187 domains that were used by election officials in each state’s three largest counties. The researchers then sought to determine whether each domain is protected from impersonation attacks by a correctly configured DMARC record with a policy of enforcement.

Florida: Website hack could be as bad as vote attack, warns Florida official | Mary Ellen Klas/Tampa Bay Times

Florida’s top election official on Tuesday warned that attackers could attempt to disrupt elections without even breaking into the voting systems — by simply changing the results on election websites. Secretary of State Laurel Lee told the governor’s Cybersecurity Task Force that Florida’s elections tabulation system is secure, but state and county elections websites “are far more vulnerable to being attacked or defaced and pose a very real threat, not of changing election results, but of undermining voter confidence.” “If our website is defaced such that it reflects that the losing candidate won, and I have to go out the next morning and explain to the press and the public that the actual winner was the other candidate, we’ve lost critical public trust,’’ Lee told the group meeting at Florida International University in Miami. To address that possibility, Lee said the department is “working very hard to secure those sites and stay on top of evolving threats and tactics to keep them secure.”

Ohio: Russian-owned company caught trying to hack Ohio voting systems on Election Day | Igor Derysh/Salon

A Russian-owned company tried to hack the Ohio office that oversees the state’s voting systems on Election Day, according to Ohio Secretary of State Frank LaRose. LaRose told the Columbus Dispatch that the state’s internal systems detected an “SQL injection” attack that attempted to insert malicious code onto his office’s website. LaRose said that the attack originated in Panama but was traced back to a Russian-owned company. He downplayed the attempted hack as “relatively unsophisticated.” “Some of these unsophisticated attacks are ways that they probe for vulnerabilities. They are poking around for soft spots,” LaRose explained. He went on to credit the state’s “Albert” alert system that quickly identified the attack. “The good guys won that day and the bad guys lost,” he said. LaRose said that similar attacks are designed to disrupt or undermine the credibility of elections but he is confident that hackers cannot access voting machines because they are not connected to the internet. LaRose’s announcement came several months after Florida Gov. Ron DeSantis revealed that Russian hackers had breached the voting systems of two counties in the state in 2016, though he said there was “nothing that affected the vote count.”

Wisconsin: Heading Into 2020, Election Security In Wisconsin Remains At Forefront | Maayan Silver/WUWM

In this tech-heavy world, it’s a new landscape when it comes to election security. Nation states like Russia could be poised to hack voting machines or systems. And Wisconsin clerks in small towns and municipalities — often with no information technology department — must make sure elections are secure. So, over the last few years, the Wisconsin Elections Commission has implemented more election security measures. They include: a cybersecurity training program, multifactor authentication for people who access the state election management system and voter list (WisVote), and a grant program where qualified election clerks get up to $1,200 in federal funding to buy new computers or update operating systems. At Monday’s meeting of the commission, administrator Meagan Wolfe summarized her staff’s efforts for election commissioners: “One of the major ones is alerting and educating clerks about the importance of having a .gov email address or an HTTPS website, especially for our county clerks,” she says.

Russia: U.S. Targets Russian ‘Evil Corp’ Hacker Group With Sanctions, Indictments | Ian Talley & Sadie Gurman/Wall Street Journal

The Trump administration Thursday placed a $5 million bounty on the leader of a Russian hacker group called Evil Corp for his alleged work for Moscow’s intelligence agency, part of what U.S. officials say is a broader reprisal for a Kremlin-directed cyber offensive against the U.S. The State Department’s action against Maksim Yakubets coincides with Treasury Department sanctions and indictments by the Justice Department and the U.K.’s National Crime Agency against core members of the group, which is accused of orchestrating the theft of more than $100 million from more than 300 banks in the U.S. and dozens of other countries. The cyber theft, using malware that stole credentials and passwords, isn’t believed to be directed by Russian intelligence, though a senior administration official said the activities couldn’t have been carried out without the knowledge of the Russian government. But the Treasury Department said Mr. Yakubets was conducting separate work for Russia’s Federal Security Service as of 2017, and was seeking a license to handle classified intelligence with the agency in April of last year. The State Department bounty is for information that leads to the capture or conviction of Mr. Yakubets.

United Kingdom: Labour’s Ben Bradshaw claims he was target of Russian cyber-attack | Luke Harding/The Guardian

The Labour candidate Ben Bradshaw has said he has been the victim of a suspected Russian cyber-attack after he received an email from Moscow with attachments containing sophisticated malware. Bradshaw – who has repeatedly raised the subject of Kremlin interference in British politics, including in the EU referendum – received the email at his election gmail address. The sender – “Andrei” – claimed he was a whistleblower from inside Vladimir Putin’s presidential administration. The email contained several apparently genuine documents. They showed how the Kremlin has set up a secret “fake news unit” in Russia’s far east region which is used to suppress negative stories and to boost pro-government sentiment. However, two of the documents carried malicious code.

Louisiana: Cyber Attack Has Louisiana State Lawmakers Asking Questions | Chuck Smith/Red River Radio

The ransom-ware cyberattack that occurred two weeks ago on Louisiana’s state government computer servers disrupted several state agency operations and prompted Governor John Bel Edwards to declare a state of emergency. The state activated its cybersecurity response team following the ransomware attack on government servers, and according to a press release the state did not lose any data nor pay any ransom, AND no personal data was compromised as state cyber-experts explained the attack was aimed at disrupting state server operations only. The shut-down was to prevent any unauthorized access and allow tech teams to take necessary cyber-security measures. While inconvenient the breach was nowhere near the worst-case scenario, of widespread data theft or crippled government services for weeks or months. During a recent meeting of the Joint House and Senate Budget Committee, Republican Sen. Sharon Hewitt from Slidell praised the quick response from Louisiana’s technology services office to the Nov. 18th ransom-ware, but asked about potential vulnerabilities for future attacks.

Ohio: Official: Russian-Owned Company Attempted Ohio Election Hack | Associated Press

Ohio detected and thwarted an election-related cyber attack earlier this month, the state’s elections chief said. Republican Secretary of State Frank LaRose said the “relatively unsophisticated” hacking attempt on Nov. 5, which was Election Day, originated in Panama but was traced to a Russian-owned company. LaRose told The Columbus Dispatch Tuesday that the would-be attackers were looking around for vulnerabilities in his office’s website. “They are poking around for soft spots,” LaRose said. The ultimate goal of such attacks is disrupting and undermining the credibility of elections, but LaRose said Ohio’s election results are safe because neither the election machines nor the ballot counters the state uses are connected to the internet.

Australia: Government steps up against foreign interference | Casey Tonkin/ACS

Australia’s top intelligence agents will form a new taskforce to target foreign interference. A joint statement from Prime Minister, Scott Morrison; Home Affairs Minister, Peter Dutton; and Defence Minister, Linda Reynolds outlined some of the scope given to the Counter Foreign Interference Tasforce. “The number one priority of our Government is to keep Australians safe which is why we’re investing $87.8 million for a new Counter Foreign Interference Taskforce,” the statement said. “It highlights our focus on stepping up our efforts as the threats to Australia evolve.” The taskforce will be led by a senior ASIO officer and combines members of the AFP, AUSTRAC, the Australian Signals Directorate, the Australian Geospatial Intelligence Organisation, and the Office of National Intelligence. “This is a boost to our ability to discover, track and disrupt foreign interference in Australia,” the statement said. “The increase in intelligence collection, assessment and law enforcement capabilities will help turn more intelligence assessments into operational disruptions to better protect Australians from foreign interference. “The new dedicated capability of the Taskforce will also increase the collaboration and streamline the decision-making between agencies, and strengthen Australia’s analysis of the sophisticated disinformation activities happening across the world, particularly against democratic processes and elections.”

United Kingdom: Elections: A New Battleground For Cyber Confidence | Stuart Reed/Minutehack

Elections make for a volatile time, not only in politics but also in terms of resilience to cyber attack. They offer an opportunity for citizens to have an opinion on the governance of their country and beg the question, ‘do you have trust in the country’s governance?’. The consequences of a cyber attack during an election campaign can therefore be extremely damaging; with the potential to both undermine trust and give life to disinformation campaigns that may have otherwise been ignored. The Labour Party knows this only too well after suffering the consequences of two DDoS attacks in 24 hours. While Labour has publicly said that they have dealt with the incident ‘quickly and efficiently’, it has led to a wider debate around cyber security and underlines that attacks do not necessarily have to be sophisticated in nature to succeed. Consequently, getting the security basics right is now more essential than ever before. Our research has shown that this disconnect isn’t so unusual. When surveying almost 300 CISOs we found that the cyber confidence among CISOs often doesn’t align with that of the business. Indeed, more than a third of security professionals were not moderately or very confident with the final choice of security solution, despite 71% saying that their organisation touts its cyber robustness to partners and customers.

National: As the 2020 US election nears, voter systems still vulnerable | Lydia Emmanouilidou/BBC

With a little less than a year to go before the 2020 US presidential election, security experts and lawmakers say progress has been made to guard against foreign interference. But they warn the country’s election infrastructure could be vulnerable to the types of hacking operations that took place in the lead-up to the 2016 election. One such attack was directed at the Illinois State Board of Elections, an agency that oversees and facilitates parts of election processes in the state, including a statewide voter registration system. “One of our IT people noticed that our [voter registration] system was running extremely slowly,” said Matt Dietrich, a spokesperson for the agency. “It had practically shut down.” The IT member inspected the system, and discovered that an intruder had exploited a vulnerability on the board’s online voter application, broken into the statewide voter registration database and gained access to voter information, including names, addresses and drivers’ license numbers. “It was terrifying. … We took the entire system down,” Mr Dietrich said. In the immediate aftermath of the incident – which took place in July 2016 – Mr Dietrich said the agency didn’t know who was behind the intrusion. But in July 2018, then-Special Counsel Robert Mueller indicted 12 Russian military officers over alleged cyber operations to interfere with the 2016 US presidential election.

National: Senators advocate for increased election security funding in 2020 budget | Melina Druga/Homeland Preparedness News

A group of 39 Democratic senators recently sent a letter to the leaders of the House and Senate Appropriations Committees urging the panels to better fund election security. The senators requested funding for election security grants and for the Election Assistance Commission (EAC) in the Fiscal Year 2020 Financial Services and General Government Appropriations bill. The EAC is an independent and bipartisan commission established in the Help America Vote Act that ensures elections across the country are secure, accurate, and accessible. It sets voting standards, certifies voting equipment, and conducts the Election Administration and Voting Survey. The senators urged the committees to fund the EAC fully. Currently, the House has appropriated roughly $16.2 million for the commission, and the Senate has appropriated nearly $12 million. The commission has half the staff it did when it was founded in 2010, and EAC’s budget for salaries and administration is $10 million less.

Editorials: More openness, less secrecy, on election security | Tampa Bay Times

State Sen. Annette Taddeo said on national television Sunday that she has been advised to stop talking about how Russian hackers released confidential information regarding her 2016 congressional campaign. That’s an issue from Washington to Tallahassee to county courthouses. Less than a year from the 2020 election, voters need more transparency, not more secrecy, about foreign interference in our democracy and what is being done at every level to combat it. There were few new revelations in the 60 Minutes report that featured Taddeo, a Miami Democrat who narrowly lost a primary race for Congress in 2016. But it provided a succinct, compelling narrative that reminded viewers how Russian interference in the elections stretched well beyond the race for president. The report also included a frank warning from a former FBI cyber-security expert that the Russians have not abandoned their efforts to influence U.S. elections and can be counted on to refine their methods for 2020.

Ohio: State Takes Steps to Ensure Cyber Security at the Polls | Andrew Meyer/WKSU

We’re less than a year away from the 2020 presidential election, and concern about Russian interference in the 2016 election persists. Have states, including Ohio, done everything they need to ensure that the vote next time will be safe and secure? We spoke with Jen Miller, executive director of the League of Women Voters of Ohio. She says the state is in pretty good shape, but there’s still work to be done. Miller says in terms of security, Ohio already has a pretty good system that’s “well ahead of other states.” Ohio’s voting machines are not hooked up to the internet, so they can’t be hacked. But Miller advises it’s important to be ready for what comes next. She points to Sec. of State Frank LaRose, who worked with the Ohio Senate to craft Senate Bill 52. Gov. Mike DeWine signed this cybersecurity into law. According to Miller, the law gives the secretary of state a seat on the Homeland Security Council. “Clearly, elections are critical infrastructure,” she said. The law also creates a cyber-information officer seat within the secretary of state’s office, and it would codify postelection audits, Miller said. On that last point, Miller says that’s something the League of Women Voters secured from a lawsuit following the 2004 election.

Ohio: Election Day cyber attack attempt traced to Panama | Rick Rouan/The Columbus Dispatch

Ohio Secretary of State Frank LaRose said that the “SQL injection” attack was detected by the state’s internal systems. He called the attack “relatively unsophisticated.” The Ohio Secretary of State’s office was the subject of a thwarted foreign cyber attack on Election Day. Ohio Secretary of State Frank LaRose said Tuesday that the so-called “SQL injection” attack was detected by the state’s internal systems. The attack was attempting to insert malicious code into his office’s website. The attempted hack originated in Panama and was traced to a Russian-owned company, he said, but was “relatively unsophisticated.” “Some of these unsophisticated attacks are ways that they probe for vulnerabilities. They are poking around for soft spots,” LaRose said, noting that the cyber attack was looking for vulnerabilities in his office’s website.

Texas: Report finds 20% of Texas counties are following best website security practices | Wes Rapaport/Nexstar

With a big election year coming up, one Texas group says improvements to election security are still needed. A new survey from the League of Women Voters of Texas found 20% of Texas county election websites are following best security practices. The review looked at nine points of criteria:
Website security: counties earned points for having secure websites, including “.gov” domains and “https” URLs.
Mobile friendly: each website was tested for its compatibility with mobile devices.
Accessibility: the sites were judged on keywords like “election” or “voting” on the home page.
Election information: reviewers looked at ease of accessible voter and election information like detailed contact information for county election offices, dates and hours for early voting and Election Day, registration information, polling locations, and personnel, sample ballots, election results and candidate filing.
Help for special categories of voters: the survey reviewed how much information was provided for military and overseas voters, students, and voters with special needs

Louisiana: No data lost, no ransom paid in Louisiana cyber attack; Ardoin says no impact on state elections | Mark Ballard/The Advocate

November 25, 2019

Monday’s ransomware attack, which crippled about 10% of the state’s computer network servers just hours after votes were tallied in statewide elections for governor, legislative seats and other positions prompted many to look for intrigue, a legislative panel heard Friday. “A lot of the conspiracy theorists are calling me,” said state Sen. Bodi White, R-Central. He questioned whether the attack, which kept many in state government from using their computers throughout much of the week, could cause problems for certification of election results or changed numbers in election returns. Secretary of State Kyle Ardoin said no. “Nothing impacted our system,” Ardoin said in an interview Friday. The website was down for a while. But, for the most part, the election office’s databases for voters and votes are separate from the state system.

National: House Panel Zeroes in on Election Security Ahead of 2020 | MeriTalk

With election security firmly in place as the popular policy de jour on Capitol Hill in the ramp-up to the 2020 election cycle, House members from both sides of the aisle voiced support at a Nov. 19 hearing for more focus on cyberattacks targeting election infrastructure, with a particular focus on ransomware exploits. The hearing of the House Homeland Security Committee subcommittee on Cybersecurity, Infrastructure Protection, and Innovation featured testimony from officials in the Federal government, academia, and the private sector, but mainly targeted efforts the private sector is making to protect U.S. elections infrastructure and political campaigns from malicious actors. Subcommittee Chairman Cedric Richards, D-La., began the hearing by highlighting Russia’s malicious cyber activity in the 2016 elections, saying, “The Russian government’s covert malicious foreign interference campaign attacked every aspect of our elections.” He further pointed to two new countries he said are working towards attacking U.S. elections – Iran and China. Rep. Richards said those countries are “weaponizing new technologies to disrupt our democracy, distort the daily news, and compromise our election security.”

National: On election security, U.S. government leaving much on the table | Derek B. Johnson/FCW

Expert witnesses warned Congress that the U.S. government has largely failed to address known security shortfalls leading up to 2020 and future elections.Much of the election security debate in Washington since 2016 has focused on improving baseline protections for voting machines, but witnesses at a Nov. 19 House Homeland Security Committee hearing noted that similar deficiencies also exist when it comes to protecting political campaigns from compromise by foreign intelligence services and preventing foreign and domestic disinformation. In his opening statement, Georgetown University professor Matthew Blaze noted that the current generation of voting machines used in U.S. elections were never designed to combat attacks or threats from adversarial foreign governments with the resources to penetrate the global supply chain or obtain software source code before it’s even shipped to election officials. “The intelligence services of even small nations can marshal far greater financial, technical and operational resources than would be available to even highly sophisticated criminal conspiracies,” Blaze said.

National: DHS cyber agency invests in election auditing tool to secure 2020 elections | Maggie Miller/The Hill

The Department of Homeland Security’s (DHS) cybersecurity agency announced Thursday it would partner with election officials and private sector groups to develop an election auditing tool that can be used to help ensure the accuracy of votes in 2020. DHS’s Cybersecurity and Infrastructure Security Agency (CISA) is partnering with non-profit group VotingWorks on an open-source software tool known as Arlo, which is provided to state and local election officials for free. According to CISA, Arlo conducts an audit of votes by selecting how many ballots and which ballots to audit and comparing the audited votes to the original count. The tool has already been used to conduct post-election audits across the country, including during the recent 2019 elections. Election officials in Pennsylvania, Michigan, Virginia, Ohio and Georgia have signed on to partner with CISA on Arlo, with more officials expected to join.

National: Senior DHS cyber official Jeanette Manfra to step down | Sean Lyngaas/CyberScoop