Tag Archives: election cybersecurity

The FBI, NSA and CIA all agree that the Russian government tried to influence the 2016 presidential election by hacking candidates and political parties and leaking the documents they gathered. That’s disturbing. But they could have done even worse. It is entirely possible for an adversary to hack American computerized voting systems directly and select the next commander in chief.

A dedicated group of technically sophisticated individuals could steal an election by hacking voting machines in key counties in just a few states. Indeed, University of Michigan computer science professor J. Alex Halderman says that he and his students could have changed the result of the November election. Halderman et al. have hacked a lot of voting machines, and there are videos to prove it. I believe him.

Halderman isn’t going to steal an election, but a foreign nation might be tempted to do so. It needn’t be a superpower like Russia or China. Even a medium-size country would have the resources to accomplish this, with techniques that could include hacking directly into voting systems over the Internet; bribing employees of election offices and voting-machine vendors; or just buying the companies that make the voting machines outright. It is likely that such an attack would not be detected, given our current election security practices.

Netherlands: Dutch will count votes on offline PCs to prevent hacking | EU Observer

Dutch municipalities will be allowed to use computers to count the votes cast in the 15 March elections, but only if those are not connected to the Internet, the Dutch government said on Wednesday (15 February). Officials were also banned from using USB-sticks or other devices to bring the results from municipalities to the headquarters of the 20 electoral districts, The measures are part of Plasterk’s attempt to rule out hacking, especially from Russia, and follows a report by Dutch broadcaster RTL at the end of January. RTL said the software that was used to register the votes was vulnerable to hacking because it did not contain any security requirements for computeDutch municipalities will be allowed to use computers to count the votes cast in the 15 March elections, but only if those are not connected to the Internet, the Dutch government said on Wednesday. Officials were also banned from using USB-sticks or other devices to bring the results from municipalities to the headquarters of the 20 electoral districts, The measures are part of Plasterk’s attempt to rule out hacking, especially from Russia, and follows a report by Dutch broadcaster RTL at the end of January. RTL said the software that was used to register the votes was vulnerable to hacking because it did not contain any security requirements for computers it was used on. Plasterk then decided that the registering of votes should be done by hand. Registering votes was the only part of the electoral process that was theoretically open to hacking.rs it was used on.

France: Marine Le Pen rival Macron targeted by hundreds of Russian hack attacks and fake news smears | IBT

The most likely candidate to win France’s May elections Emmanuel Macron has been the target of hundreds if not thousands of Russian hacks and a fake news smear campaign the head of his party has said. Richard Ferrand the chief of Macron’s independent Onwards Party has said Kremlin controlled media including Russia Today and Sputnik have engaged in a fake news campaign against the candidate. “Two big media outlets belonging to the Russian state Russia Today and Sputnik spread fake news on a daily basis, and then they are picked up, quoted and influence the democratic (process),” Ferrand was quoted by Reuters as saying. Macron has been accused by the Russian media as being part of the US global banking elite by both international facing but Kremlin backed outlets. The party official’s comments come on the heels of an interview given by WikiLeaks founder Julian Assange in which he claimed to have damaging information on the centre-left candidate.

National: U.S. lawmakers push for answers on Trump team’s Russia ties | Reuters

A crisis over the relationship between President Donald Trump’s aides and Russia deepened on Wednesday as a growing number of Trump’s fellow Republicans demanded expanded congressional inquiries into the matter. Trump sought to focus attention on what he called criminal intelligence leaks about his ousted national security adviser, Michael Flynn. Trump forced Flynn out on Monday after disclosures he had discussed U.S. sanctions on Russia with the Russian ambassador to the United States before Trump took office, and that he later misled Vice President Mike Pence about the conversations. The drama of Flynn’s departure was the latest in a series of White House missteps and controversies since the Republican president was sworn in on Jan. 20. At a news conference with Israeli Prime Minister Benjamin Netanyahu on Wednesday, Trump said Flynn, a retired U.S. Army lieutenant general, was a “wonderful man” who had been mistreated by the news media.

Editorials: Russia, Trump and the 2016 election: What’s the best way for Congress to investigate? | Jordan Tama/The Conversation

Exactly how will the U.S. conduct a fair and accurate investigation into Russian meddling in the 2016 election and links with President Donald Trump’s campaign? U.S. congressional leaders are discussing options. Senate Majority Leader Mitch McConnell, a Republican, said that the Senate intelligence committee is best suited to investigate any concerns related to Russia. Senator Lindsey Graham, a leading Republican voice on foreign policy, suggested Congress should establish a select, or special, committee of lawmakers to probe the matter. Nancy Pelosi, the Democratic leader in the House of Representatives, urged the creation of “a bipartisan, independent, outside commission” to investigate it. Each of these alternatives may seem reasonable, but there are key differences between them. My research on more than 50 government investigations reveals that independent commissions, like the one Pelosi is advocating for, are more likely than regular or select congressional committees to achieve consensus about controversial events.

France: Foreign Minister Warns Russia Over ‘Interference’ In Presidential Election | RFERL

France says it will not accept meddling by Russia or any other country in its upcoming presidential election, and that it could respond to such interference with “retaliatory measures.” The remarks by French Foreign Minister Jean-Marc Ayrault on February 15 come in the wake of what U.S. intelligence officials have described a Kremlin-directed campaign of hacking and public-opinion manipulation that aimed to help President Donald Trump win the 2016 U.S. presidential election. “We will not accept any interference whatsoever in our electoral process, no more from Russia, by the way, than from any other state,” Ayrault told parliament. Ayrault said France could respond to such meddling with “retaliatory measures when that is necessary.”

National: Locking down voting tech | GCN

State election officials are making plans to tighten security all along the voting chain – from voter registration to machine integrity, audit trails and help from the Department of Homeland Security under the new critical infrastructure designation. At a Feb. 13-14 meeting of the Election Assistance Commission, New Jersey State Department’s division of elections Bob Giles said that although his state’s voting machines are not connected to the internet, the attention garnered by Russia’s reported electoral influence has led to a rethinking of his agency’s cybersecurity protocols. Giles said cyber hygiene practices such as improving password strength and multifactor authentication will be included in the state’s plan to modernize its voter registration system. “The other thing we heard a lot about this election is who is making our voting machines,” he said, adding that moving forward, New Jersey will partner with the DHS to ensure voting machine security.

National: White House under siege over probe into Russian contacts with Trump campaign | USA Today

A months-long inquiry into contacts between Russian government officials and associates of President Trump’s campaign and business interests will continue despite the firing of national security adviser Michael Flynn for misleading White House officials about his communication with Russia, a U.S. official told USA TODAY on Wednesday. The federal inquiry — which has amassed intercepts of telephone calls, business records and subject interviews — is looking at how Russian officials sought to meddle in the November election, said the official who is not authorized to comment publicly. The official added that there was no current evidence of collusion to tilt the election. The extent and purpose of those alleged contacts, believed to involve a limited number of Trump campaign and business associates, continue to be weighed, including whether the associates were aware they were communicating with Russian intelligence officials or those working on behalf of the Russian government, the official said. TheNew York Times reported Wednesday that phone records and intercepted calls show Trump campaign officials had repeated contacts with senior Russian intelligence officials in the year before the election.

National: Schumer warns of possible cover-up by Trump administration | The Hill

Following an emergency Democratic caucus meeting Wednesday, Senate Minority Leader Charles Schumer (N.Y.) warned that Trump officials might try to cover up improper contacts with Russian intelligence. Schumer said there is legitimate concern that President Trump’s circle of advisers may try to destroy evidence that could shed light on the substance of reported conversations with Russian agents. “There is real concern that administration, transition and campaign officials may try to cover up ties to Russia by deleting emails, texts and other records that could shine a light on those connections,” Schumer said at a press conference outside the Senate chamber following the meeting. He said such electronic records are “likely to be the subject” of congressional investigations and “must be preserved.”

National: Senate Democrats unify around congressional probe of Trump ties to Russia | Washington Post

Senate Democratic leaders agreed Wednesday to a bipartisan probe inside Congress of allegations that people linked to President Donald Trump – including ousted national security adviser Michael Flynn – had frequent contacts with Russia during and after the 2016 presidential campaign. Democrats agreed to push forward with an ongoing Intelligence Committee investigation into Russia’s purported activities into the election, expanding the probe to include contacts made by Flynn and perhaps other Trump campaign officials with the Kremlin. They united around this course of action despite pressure from some Democrats to demand an independent commission to pursue the matter from outside Congress.

France: Foreign Minister warns Russia against meddling in election | Reuters

France said on Wednesday it would not accept interference by Russia or any other state in its presidential election, and would retaliate if necessary. The pledge by Foreign Minister Jean-Marc Ayrault followed complaints by the party of election frontrunner Emmanuel Macron that his campaign was the target of ‘fake news’ put out by Russian media, as well as internet attacks on its databases. “We will not accept any interference whatsoever in our electoral process, no more from Russia by the way than from any other state. This is a question of our democracy, our sovereignty, our national independence,” Ayrault told parliament. He said France would set clear limits, “including retaliatory measures when that is necessary, because no foreign state can influence the choice of the French, no foreign state can choose the future president of the Republic.”

National: State election officials say DHS vague on rules for election aid | FCW

State election officials had more questions than answers after a Department of Homeland Security presentation explaining why election systems should be deemed critical U.S. infrastructure. Geoff Hale, DHS’ cybersecurity strategy and integration program manager, outlined the changes and benefits that the recent designation provides during a Feb. 14 Election Assistance Commission meeting. The primary benefits, Hale said, are added protections against nation-states, guaranteed priority in DHS assistance requests and greater access to information on vulnerabilities. “Without institutionalizing this through a designation of critical infrastructure, there’s no guarantee the services would be available,” he said. “Being critical infrastructure, there are a set of international norms that” prevent countries from attacking these networks, said Hale. “And potentially waiting nine months for a risk and vulnerability assessment may not work on a procurement timeline” for election officials. Hale also stressed that the “full threat information” available to states that opt in for DHS assistance is not subject to state sunshine laws or Freedom of Information Act requests.

National: New Mac malware pinned on same Russian group blamed for election hacks | Ars Technica

APT28, the Russian hacking group tied to last year’s interference in the 2016 presidential election, has long been known for its advanced arsenal of tools for penetrating Windows, iOS, Android, and Linux devices. Now, researchers have uncovered an equally sophisticated malware package the group used to compromise Macs. Like its counterparts for other platforms, the Mac version of Xagent is a modular backdoor that can be customized to meet the objectives of a given intrusion, researchers from antivirus provider Bitdefender reported in a blog post published Tuesday. Capabilities include logging passwords, snapping pictures of screen displays, and stealing iOS backups stored on the compromised Mac. The discovery builds on the already considerable number of tools attributed to APT28, which other researchers call Sofacy, Sednit, Fancy Bear, and Pawn Storm. According to researchers at CrowdStrike and other security firms, APT28 has been operating since at least 2007 and is closely tied to the Russian government. An analysis Bitdefender published last year determined APT28 members spoke Russian, worked mostly during Russian business hours, and pursued targets located in Ukraine, Spain, Russia, Romania, the US, and Canada.

National: Senators from both parties pledge to deepen probe of Russia and the 2016 election | The Washington Post

Top Republican and Democratic senators pledged Tuesday to deepen their investigation of Russian involvement in the 2016 presidential election in the wake of Michael Flynn’s resignation as President Trump’s national security adviser, opening a new and potentially uncomfortable chapter in the uneasy relationship between Trump and Capitol Hill. Senate Majority Leader Mitch McConnell (R-Ky.) said such an investigation is “highly likely,” and the top two members of the Senate Intelligence Committee, Sen. Richard Burr (R-N.C.) and Sen. Mark R. Warner (D-Va.), stood side by side Tuesday to announce that the committee’s ongoing probe must include an examination of any contacts between Trump campaign officials and the Russian government. Flynn resigned late Monday after revelations of potentially illegal contacts with Russia last year and misleading statements about the communication to senior Trump administration officials, including Vice President Pence. “We are aggressively going to continue the oversight responsibilities of the committee as it relates to not only the Russian involvement in the 2016 election, but again any contacts by any campaign individuals that might have happened with Russian government officials,” said Burr, the chairman of the intelligence panel.

France: Did Russia Hack French Elections? Kremlin Denies Pro-Marine Le Pen Cyberattacks, Despite Emmanuel Macron Claims | IBT

Russia denied meddling in French elections Tuesday after a top aide to French presidential candidate Emmanuel Macron alleged Russia hit Macron’s campaign with hundreds of cyberattacks. Jean-Yves Le Drian, France’s defense minister, said last week French intelligence agencies were attempting to fortify cybersecurity surrounding the election. The announcement followed allegations Russia intended to interfere in French elections in favor of far-right candidate Marine Le Pen, who is sympathetic to Russian President Vladimir Putin. Intelligence agencies said they were concerned Russia would saturate the internet with bots leaving pro-Le Pen comments.

National: Should Americans trust their voting tech? | FCW

February 14, 2017

Despite finding no signs of foul play during the 2016 elections’ actual ballot-casting, state officials told the Election Assistance Commission they are looking to shore up the cybersecurity of voting systems to ensure that Americans are confident in their election results. Director of the New Jersey State Department’s division of elections Bob Giles said at an EAC meeting Feb. 13 that although “cybersecurity wasn’t as big a concern” entering the 2016 election because his state’s voting machines were not connected to the internet, the attention garnered by Russia’s reported electoral influence has led to a rethinking of his agency’s cybersecurity protocols. Giles said cyber hygiene practices such as improving password strength and multifactor authentication will be included in the state’s plan to modernize its voter registration system.

Editorials: Why do Virginia lawmakers want to make our elections hackable? | Dale Eisman/Richmond Times-Dispatch

February 14, 2017

When all 17 agencies in the federal government’s worldwide intelligence network agree that Russian cyber-spies penetrated voter registration and record-keeping systems in at least four states last year, you’d think that state legislators would shy away from embracing new, expensive, and vulnerable-to-hacking election technologies. And when the Department of Defense — which, despite billions of dollars invested in protecting its own computers — has fallen victim to hackers and concluded it can’t guarantee the integrity of ballots cast online by troops stationed overseas, you’d think online voting would be totally off-the-table. But in Virginia, you’d be wrong. State senators ignored warnings from a non-partisan group of computer scientists and voted 36-4 last week for an internet voting “pilot program” pushed by Sen. William DeSteph, R-Virginia Beach. SB 1490 may be the worst bill you’ve never heard of in the 2017 legislative session and it’s now halfway to passage.

National: New administration will uphold election system’s designation as critical infrastructure | Reuters

U.S. Homeland Security Secretary John Kelly on Tuesday said he backed a decision in the Obama administration’s final days to designate elections systems as critical infrastructure in order to boost their cyber defenses, after the government concluded Russian hackers tried to influence the 2016 presidential race. Some conservative states, such as Georgia, had expressed concerns that the Obama administration move amounted to a federal takeover of elections traditionally run by state and local governments. The designation means voting machines, voter registration systems, polling places and other assets important to holding elections are eligible for priority cyber-security assistance from the Department of Homeland Security (DHS). “I believe we should help all of the states … to make sure that their systems are protected in future elections,” Kelly told the U.S. House of Representatives’ Committee on Homeland Security in response to a question from Democratic U.S. Representative Cedric Richmond. “I would argue that, yes, we should keep that in place.”

National: Russian election hacks exploited legal grey zone: lawyers | AFP

Russia’s alleged computer hacking to interfere in US elections was no act of war, but exploited a legal grey zone that makes justifying retaliation hard, international lawyers specializing in cyber issues said Wednesday. Moscow’s interference in the presidential campaign last year by hacking Democratic Party computers and leaking embarrassing communications was an act of espionage — legal under international law — and at worst a slight violation of US sovereignty, the lawyers said. But it was definitely no act of war, as some American politicians have suggested, US lawyer Michael Schmitt said, adding that calling it such “is very destabilizing.” Speaking at the launch of a new manual on cyber attacks and international law, he said the reaction to the Russia-US hacking case heightens the need for accepted international standards for countries to assess and counter cyber attacks proportionately.

National: Flynn Is Said to Have Talked to Russians About Election Hacking Sanctions Before Trump Took Office | The New York Times

Weeks before President Trump’s inauguration, his national security adviser, Michael T. Flynn, discussed American sanctions against Russia, as well as areas of possible cooperation, with that country’s ambassador to the United States, according to current and former American officials. Throughout the discussions, the message Mr. Flynn conveyed to the ambassador, Sergey I. Kislyak — that the Obama administration was Moscow’s adversary and that relations with Russia would change under Mr. Trump — was unambiguous and highly inappropriate, the officials said. The accounts of the conversations raise the prospect that Mr. Flynn violated a law against private citizens’ engaging in diplomacy, and directly contradict statements made by Trump advisers. They have said that Mr. Flynn spoke to Mr. Kislyak a few days after Christmas merely to arrange a phone call between President Vladimir V. Putin of Russia and Mr. Trump after the inauguration. But current and former American officials said that conversation — which took place the day before the Obama administration imposed sanctions on Russia over accusations that it used cyberattacks to help sway the election in Mr. Trump’s favor — ranged far beyond the logistics of a post-inauguration phone call. And they said it was only one in a series of contacts between the two men that began before the election and also included talk of cooperating in the fight against the Islamic State, along with other issues.

France: Defense Council fearful over Russian hacking in presidential election | The Times of Israel