Tag Archives: election cybersecurity

Government officials have expressed mounting concerns for how the COVID-19 virus could diminish voter turnout during the 2020 presidential election. As a partial solution, a handful of states have turned to Internet voting pilot programs: New Jersey, Delaware and West Virginia have all recently launched pilots, most of which are limited in scope and focus mainly on alleviating barriers for disabled and overseas voters. However, the computer science community — long critical of internet voting — sees the programs as a slippery slope towards a looming security risk. David Dill, a computer science professor at Stanford University, is one of the prolific naysayers. Having spent much of his career researching holes in software code, Dill said that there is just simply no way to ensure that devices and apps are free of malware that might manipulate a voter’s choices. Similarly, a hacker from an adversarial foreign government could always theoretically hack their way into these systems and change or manipulate votes. “Between your keyboard and your vote going into an electronic ballot box on the other end of the Internet, there are a lot of bad things that could happen,” he said. “This problem is not fixable, at least not in practical terms.”

National: What to make of HBO’s ‘Kill Chain: The Cyber War on America’s Elections’ | Abel Morales/The Fifth Domain

With the election now only months away, officials are desperately trying to find solutions to protect the integrity of our election systems. The big question that remains is, “Will it work?” Kill Chain: The Cyber War on America’s Elections is a new HBO documentary that takes viewers through a journey to discover the weaknesses of today’s election technology. Being a security engineer, it is my job to help analyze some of the techniques that hackers are using in order to better protect the organizations I serve. I decided to watch Kill Chain to understand the minds of the adversaries who are conducting the attacks on our election system. Below are my takeaways from the film. In the documentary, one of the hackers at DEF CON successfully took over a voting machine and forced the system to shut down. The hacker achieved command line access. Within a three-day period, hackers learned from the presenter and found dozens of vulnerabilities. These were just hackers at a three-day conference limited to the resources they held within the conference center. Nation-state attackers have the time and resources to acquire these machines, identify the vulnerabilities and plan a strategic and coordinated attack to impact an election.

National: Commission that pushed a cybersecurity overhaul hopes coronavirus boosts the effort | Joseph Marks/The Washington Post

The lawmakers behind an ominous report about America’s lack of preparedness for a major cyberattack are hoping the coronavirus pandemic will boost their calls to overhaul the nation’s digital defenses. The Cyberspace Solarium Commission on March 11 released its 182-page report calling for a far more muscular stance against U.S. digital adversaries such as Russia and China and new cybersecurity executives with broad powers to cut through red tape at the White House and State Department. But the commission’s bold recommendations were largely lost in the shuffle two days later when President Trump declared the coronavirus a national emergency and official Washington rushed to deal with the pandemic. A planned media tour by the commission’s congressional co-chairs, Sen. Angus King (I-Maine) and Rep. Mike Gallagher (R-Wis.), was also put on ice.

National: What’s lost, gained as Black Hat and DEF CON go virtual | Bradley Barth/SC Media

As Black Hat and DEF CON organizers, researchers and members of the cyber community scramble to figure out how they can salvage or, better yet, enhance the experience as the events go virtual amid the COVID-19 pandemic, security will be a top priority. Meanwhile, other aspects of the conferences are expected to change more drastically, for better or worse. Organizers of the August 2020 events are aware the remote shows will have to emphasize security, as the new format presents a tempting challenge to adversaries who may want to make a name for themselves by hacking into the shows’ remote infrastructure, perhaps hijacking a presentation or disrupting access. While members of the cyber community acknowledged the issue, they don’t seem to be fretting it too heavily. “Sure, there is always a concern, but if cybersecurity conferences can’t figure out how to secure their virtual events, well, they probably shouldn’t claim to be a cybersecurity conference,” said Patrick Wardle, a frequent Black Hat/DEF CON presenter, principal security researcher at Jamf, and founder of Objective-See. “And such conferences already have had to secure their websites and networks at in-person events. And oftentimes such networks were part of a public venue or… belonged to the venue itself, and thus a purely virtual event may be in a way, simpler to secure.”

New Jersey: Lawsuit aims to halt any more online voting in New Jersey | Sara Swann/The Fulcrum

New Jersey piloted a new online voting system for people with disabilities this week, but a lawsuit could stop the state from using it again. Human rights activists and law school students are challenging the new voting system, arguing it’s unfair to expose only one category of voters to significant risk their ballots will get hacked with impunity. Using a special app to vote over the internet is denigrated by most cybersecurity experts, who say the threat of votes being compromised is hardly worth the convenience. Four federal technology, law enforcement and election agencies united behind a report this month bluntly warning states against adopting online voting because “ensuring ballot integrity and maintaining voter privacy is difficult, if not impossible, at this time.” New Jersey ran its first test of online voting in 33 local elections Tuesday. The system was only available for people with disabilities, who would have had difficulty casting ballots in contests that were otherwise conducted entirely by mail because of the coronavirus pandemic.

New Jersey: Lawsuit tries to block Internet voting in New Jersey | Joseph Marks/The Washington Post

May 15, 2020

Human rights activists and New Jersey law students are suing to block the state from using Internet-based voting systems, which security experts say are fundamentally insecure against hacking. The effort is a shot across the bow for the online systems, which some states have embraced as a solution for people who have trouble voting by mail during the pandemic despite widespread security concerns. New Jersey piloted an app-based system on Tuesday in a collection of 33 small elections for people with disabilities that make it impractical for them to vote by mail. Everyone else had to vote by mail and there was no in-person voting option. New Jersey officials haven’t said whether they plan to repeat the pilot in the state’s July primary or the general election, but the lawsuit is trying to stop those plans before they start. It’s essentially an offshoot of an earlier lawsuit that challenged the security of the state’s voting machines and also dealt with the danger of voting systems going online. “It’s critical that voting be accessible for everybody but not at the expense of security and the risk of a group of people having their votes manipulated,” said Penny Venetis, director of Rutgers University Law School’s International Human Rights Clinic, which is challenging the use of online voting on behalf of Coalition for Peace and its New Jersey division as well as a state legislator.

Utah: Experts agree this year’s election is a big target for hackers, disinformation and foreign interference | Connor Sanders/The Salt Lake Tribune

May 15, 2020

As the 2020 election nears, the need to strengthen cybersecurity and dispel misinformation grows. “You have to assume you will be targeted by disinformation and misinformation,” said Adam Clayton Powell III, executive director of the Election Cybersecurity Initiative. “Elections and campaigns are too easy of a target for adversaries both foreign and domestic.” Powell and Clifford Neuman, director of USC’s Center for Computer Systems Security, outlined during an online conference Tuesday how hackers and foreign adversaries can not only influence elections through infiltrating the voting system, but also through spreading false information. Neuman mentioned that the first, but rarest, way an election can be compromised is through actual manipulation of the vote count on Election Day. Utah’s transition to mail-in voting not only makes it well-equipped to handle voting in a COVID-19 world, it also makes it difficult for hackers to skew an election through an electronic voting apparatus. But the reach of a hacker extends beyond the ballot box. Powell reported that China, Russia and Iran have already begun to spread false reports online, and foreign countries are now echoing each other’s messages by citing another country’s fake reports as a source.

National: Why A Voting App Won’t Solve Our Problems This November | Kaleigh Rogers/FiveThirtyEight

At 106, MacCene Grimmett is one of the oldest voters in the state of Utah. Though women didn’t have the right to vote when she was born in 1913, by the time she was of voting age, the 19th Amendment had passed. She has voted in every election since, she told her local Fox affiliate, including the Utah County municipal general election last November. But that time, the centenarian cast her ballot in a novel way: She voted via an app. America is 174 days away from a presidential election. It’s also in the middle of a pandemic that upended normal life, requiring mass shutdowns and social distancing. Those two things don’t exactly jive. Having millions of Americans stand in crowded polling places for hours to cast a ballot on Election Day sounds like the makings of a public health disaster — especially if there is a second surge of COVID-19 infections in the fall, as some experts predict. So now, election officials are looking for ways to hold elections remotely. One option that has been proposed is voting via an app on a smartphone or electronic device, just like Grimmett did last fall (though so far, states seem to only be considering this option for certain groups of voters, such as voters with disabilities).

National: Experts sound alarms about security as states eye online voting | Maggie Miller/The Hill

Experts are sounding alarms about potential security risks as several states consider allowing online voting amid the COVID-19 pandemic. Delaware, New Jersey and West Virginia are planning to allow overseas military personnel and voters with disabilities to return their ballots electronically for elections this year amid concerns about voting during a pandemic. But federal officials and cybersecurity experts are strongly urging states to stay away from online voting, arguing that it could open up new avenues for interference less than four years after Russia meddled in the 2016 elections. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) joined a group of federal agencies in condemning the idea of online voting in guidelines first reported by The Guardian last week. The guidelines, sent to states privately, described online voting as “high risk.” “Electronic ballot return, the digital return of a voted ballot by the voter, creates significant security risks to voted ballot integrity, voter privacy, ballot secrecy, and system availability,” the agencies wrote in the guidelines. “Securing the return of voted ballots via the internet while maintaining voter privacy is difficult, if not impossible, at this time.”

National: Experts say mobile voting tech isn’t the answer to COVID-19 | Alexander Culafi/TechTarget

Despite a need for alternatives to in-person voting during the COVID-19 pandemic, experts say mobile voting will not be ready for this year’s general election. Nearly a dozen pilot programs for mobile voting apps and internet voting portals have been launched across the U.S. in the last few years. And that was prior to the coronavirus pandemic, which postponed some state and primary elections this spring and caused concern over the safety of potentially crowded polling locations. “It’s pretty obvious that the coronavirus is making it difficult to have our standard election. That’s having an even bigger impact in urban centers where voting lines can already last for hours and be quite packed. And people are looking for other ways we can have the constitutionally mandated vote without putting people at risk,” said Jim Hendler, artificial intelligence researcher at Rensselaer Polytechnic Institute as well as a fellow at the Association for Computing Machinery (ACM).

Connecticut: State making plans to protect elections from cyber threats, pandemic | Joe Wojtas/The Day

Secretary of the State Denise Merrill is scheduled Monday afternoon to announce a plan to secure election systems across the state from cyberattack this fall and prepare polling places to safely operate during the COVID-19 pandemic. Deputy Secretary of the State Scott Bates outlined the challenges the state faces to ensure a safe and secure election in an op-ed published Monday in The Day. “We’re trying to do all we can do before this election to address the twin challenges of the pandemic and cyber security,” he told The Day on Sunday. Bates said the state will be using more than $15 million in federal funding to ensure outside groups can not interfere with the election and to make polls safe for both voters and workers.

West Virginia: Online Voting Has Worked So Far. That Doesn’t Mean It’s Safe | Lily Hay Newman/WIRED

May 13, 2020

West Virginia state delegate Eric Porterfield is blind and usually votes at a polling place using an accessible voting machine. He would need assistance to fill out a regular mail-in paper ballot, reducing his ability to keep his votes private. But thanks to a state law passed in January to address accessible remote voting, Porterfield has a new alternative for his state’s June 9 primary. For the first time, he plans to submit his absentee ballot online. “The gold standard for you or me or anyone is to be able to fulfill our constitutional right to vote by private ballot,” Porterfield says. The Covid-19 pandemic has made internet voting options more tempting than ever for election officials across the US. But election integrity advocates and security experts continue to warn that remote digital voting systems, whether mobile apps or cloud portals, do not have strong enough security guarantees for prime time. On Friday, a group of federal agencies including the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency and the Election Assistance Commission sent a risk assessment to states, warning that “electronic ballot return technologies are high-risk even with controls in place.”

Florida: Florida becomes hot spot in the election security wars | Joseph Marks/The Washington Post

May 13, 2020

Florida, which is a perennial swing state in presidential elections, is now shaping up as a battleground over election security efforts during the pandemic. Officials there have yet to say whether they’ll accept $20 million in federal money that lawmakers and experts say is vital to manage a surge in voting by mail and other changes brought on by the novel coronavirus. The money is Florida’s share of $400 million in election security funding Congress included in the coronavirus stimulus bill in March. But Congress also mandated states match that money with 20 percent of their own funds and it’s not clear whether Gov. Ron DeSantis (R) and the state legislature are prepared to foot the $4 million bill. “Florida doesn’t have a great record of administering elections during normal times, so during a pandemic the lack of planning and the lack of additional resources could be catastrophic,” Rep. Stephanie Murphy (D-Fla.), told me. Florida is the only remaining state that hasn’t signaled its intentions regarding the federal money. If officials there don’t accept it, lawmakers fear that could lead to a dramatic failure on Election Day that throws the winner of the presidential election or control of Congress into question and plays into the hands of U.S. adversaries that want to undermine confidence in democracy.

National: Internet-based voting is the new front in the election security wars | Joseph Marks/The Washington Post

Voting systems that rely on the Internet are fast becoming a major conflict zone in the battle to secure the 2020 election against hacking. The development comes as states are scrambling to revamp their voting procedures to respond to the novel coronavirus pandemic. In some cases that means allowing digital voting to play a more prominent role, despite persistent warnings from experts that it’s highly insecure and often unverifiable. The Department of Homeland Security, the FBI and the Election Assistance Commission jumped into the fray on Friday, sending guidance to states warning about the major security challenges posed by all voting systems that use the Internet in some way. The guidance covers ballots sent digitally to voters; ballots sent and marked online but printed out and returned by physical mail; and ballots that are received and returned entirely digitally. The agencies warned about dangers related to all three systems but especially the third, which they say poses “significant security risks.” Among those risks: Hackers could change large numbers of votes, block votes from being recorded or undermine ballot secrecy.

National: DHS memo: ‘Significant’ security risks presented by online voting | Sean Lyngaas/CyberScoop

The Department of Homeland Security has told election officials and voting vendors that internet-connected voting is risky to the point that ballots returned online “could be manipulated at scale” by a malicious attacker. The advisory that DHS’s Cybersecurity and Infrastructure Security Agency sent states on Fri ay is perhaps the federal government’s sternest warning yet against online voting. It comes as officials weigh their options for conducting elections during a pandemic and as digital voting vendors see an opportunity to hawk their products. While the risk of election officials delivering ballots to voters via the internet can be managed, the return of those ballots by voters “faces significant security risks to the confidentiality, integrity, and availability of voted ballots,” CISA said in the guidance, which CyberScoop reviewed. “These risks can ultimately affect the tabulation and results and, can occur at scale.” The guidance, which is marked “For Official Use Only” and is not public, cites a theoretical “man-in-the-middle” attack, in which a hacker intercepts and alters data, as one risk to voters who return ballots electronically. Other federal agencies involved in election security — the Election Assistance Commission, the FBI, and the National Institute of Standards and Technology — signed off on the document.

National: Federal Agencies Warn States Online Voting Is ‘High Risk’ | Miles Parks/NPR

The federal government is letting states know it considers online voting to be a “high-risk” way of running elections even if all recommended security protocols are followed. It’s the latest development in the debate over Internet voting as a few states have announced they plan to offer it to voters with disabilities this year, while security experts have voiced grave warnings against doing so. An eight-page report distributed to states last week recommends mail-in ballots as a more secure method of voting. It was co-authored by four federal agencies, including the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. “We recommend paper ballot return as electronic ballot return technologies are high-risk even with controls in place,” says the document, according to a copy obtained by The Wall Street Journal. A source with knowledge of the document confirmed its authenticity to NPR. West Virginia, Delaware and New Jersey all have confirmed plans to pilot a system provided by the Seattle-based company Democracy Live in upcoming elections to allow military and overseas voters as well as some voters with disabilities the option to vote online.

National: Putin Is Well on His Way to Stealing the Next Election #DemocracyRIP | Franklin Foer/The Atlantic

Jack Cable sat down at the desk in his cramped dorm room to become an adult in the eyes of democracy. The rangy teenager, with neatly manicured brown hair and chunky glasses, had recently arrived at Stanford—his first semester of life away from home—and the 2018 midterm elections were less than two months away. Although he wasn’t one for covering his laptop with strident stickers or for taking loud stands, he felt a genuine thrill at the prospect of voting. But before he could cast an absentee ballot, he needed to register with the Board of Elections back home in Chicago. When Cable tried to complete the digital forms, an error message stared at him from his browser. Clicking back to his initial entry, he realized that he had accidentally typed an extraneous quotation mark into his home address. The fact that a single keystroke had short-circuited his registration filled Cable with a sense of dread. Despite his youth, Cable already enjoyed a global reputation as a gifted hacker—or, as he is prone to clarify, an “ethical hacker.” As a sophomore in high school, he had started participating in “bug bounties,” contests in which companies such as Google and Uber publicly invite attacks on their digital infrastructure so that they can identify and patch vulnerabilities before malicious actors can exploit them. Cable, who is preternaturally persistent, had a knack for finding these soft spots. He collected enough cash prizes from the bug bounties to cover the costs of four years at Stanford.

Utah: Hackers, COVID-19 and foreign disinformation create challenges for Utah elections this year | Lee Davidson/The Salt Lake Tribune