Tag Archives: election cybersecurity

With 23 days until Election Day, state and local election officials, as well as the FBI and the Department of Homeland Security, are on their highest-ever level of alert for hackers trying to meddle with the vote. But it’s not vote rigging or the takeover of electronic voting booths that has officials most concerned. … Rather, officials are more concerned by the discovery in recent weeks that hackers, including ones believed to be working for the Russian government, are trying to access voter registration files, perhaps to alter or delete them, inmore than 20 states. … This unprecedented focus on election security was prompted both by a suspected Russian campaign to hack emails and documents from U.S. political organizations, as well as the news that, last summer, election systems were compromised by hackers in Arizona and Illinois, where the perpetrators are believed to have absconded with files on 200,000 voters. “When you suddenly had two states with reports of registration breaches, regardless of the effect or the impact, which appear to have been minor, it gave everybody a sense that this isn’t necessarily theoretical anymore,” Pam Smith, the president of Verified Voting, a nonprofit group that advocates transparency and security in U.S. elections, told The Daily Beast.

National: Despite Fears, This Election Could Be More Secure Than Ever | MIT Technology Review

Fear that hackers could exploit vulnerabilities in our voting systems could undermine voter confidence this November, especially if the vote ends up being close. The good news is that it is also helping fuel an important discussion about how the U.S. should secure its elections. Recent hacks on the Democratic National Committee, for which the White House has officially blamed Russia, along with reports that hackers have targeted online voter registration databases in more than 20 states, have made it clear that adversaries are inclined to disrupt the American political system using cybercrime. The attacks prompted the U.S. Department of Homeland Security to begin assisting state and local election boards on cybersecurity matters. Congress has held multiple hearings to assess the national election system’s technical weaknesses and explore ways to account for them. And there have been countless media reports (including some from MIT Technology Review) cataloguing vulnerabilities like Internet-connected voting registration databases and absentee ballot-return systems, as well as electronic voting machines that don’t produce paper audit trails.

National: Elections at Risk in Cyberspace, Part I: Voting Lists | Signal Magazine

As U.S. elections increasingly are digitized, the same threats faced by other users of cyberspace loom as potential vulnerabilities to voting and ballot tallies. Candidates and interest groups have expressed concern about the validity of the upcoming election based on real and perceived cyber threats. Voting systems connected to the Internet as well as those that are isolated are susceptible to intrusions that could shake up an election. The threat to an election can take two forms. One is an attack that actually changes the outcome by altering the vote count to favor one candidate over another. The other threat is tampering that may not clearly change the outcome but sows doubt among the electorate and reduces public trust about the validity of an election and the sanctity of the democratic system. The Office of the Director of National Intelligence (ODNI) and the Department of Homeland Security (DHS) issued a joint statement on October 7 expressing confidence that the Russian government “directed the recent compromises of emails from U.S. persons and institutions, including from U.S. political organizations. … These thefts and disclosures are intended to interfere with the U.S. election process.”

Florida: Federal investigators find evidence Florida election-systems vendor was hacked | CNN

Federal investigators believe Russian hackers were behind cyberattacks on a contractor for Florida’s election system that may have exposed the personal data of Florida voters, according to US officials briefed on the probe. The hack of the Florida contractor comes on the heels of hacks in Illinois, in which personal data of tens of thousands of voters may have been stolen, and one in Arizona, in which investigators now believe the data of voters was likely exposed. The FBI, in the coming days, is preparing to provide updated guidance to state elections officials around the US aiming to help them spot suspicious activity on their computer networks. Several states have reported attempted scans of their computer systems, which often is a precursor to a breach.

National: Elections at Risk in Cyberspace, Part III: Vote Database Security Ultimately Could Determine an Election Result | SIGNAL Magazine

Any attempts to sabotage an election through cyber attacks ultimately would be geared to affecting the vote count, either to change the outcome of the race or to sow doubt on the validity of the election itself. Just as banks strive to secure their depositors’ assets, governments also work to ensure the fidelity of their election returns. But, as bank accounts are vulnerable to cyber attacks, so are vote totals—to varying degrees. While most tabulation databases are safe from everyday hacker threats, nation-states with highly advanced cyber operations theoretically might be able to mount an effective cyber attack on a U.S. national election by bringing their best offensive cyber capabilities to bear. State governments, which are responsible for the voting process, pay close attention to tabulation security. Ron Bandes is a network security analyst in the CERT division of the Software Engineering Institute of Carnegie Mellon University. He also is president of VoteAllegheny, a nonpartisan election integrity organization. Bandes points out that in many states, two tallies occur. One is done at the local level, usually by the county. The other is a statewide count comprising all the county totals. These counts are cross-validated. “The outputs from the voting machines have to match the inputs to the tally system,” Bandes points out.

National: Intelligence Analyst: Russian Cyberattacks Could Roil US Elections | VoA News

Malcolm Nance is extremely worried about what might happen as U.S. votes are tallied on Nov. 8, election night. A career U.S. counterterrorism and intelligence official with 33 years of experience, Nance said he had overwhelming evidence that Russia is seeking to interfere in U.S. elections to put “not just a finger, but their whole hand” on the scale to help Republican nominee Donald Trump and hurt Democratic nominee Hillary Clinton. Nance said a number of private companies had traced cyberattacks exposing potentially damaging Democratic Party emails and voicemails back to cyber “fingerprints” clearly identified in the past as those of Russian state hackers. He said the same fingerprints were found in what turned out to be Russian hacking of power plants in Ukraine and of the German parliament. … U.S. federal investigators believe Russian hackers are also behind cyberattacks on a contractor for Florida’s election system that may have exposed the personal data of Florida voters.

National: Two State Elections Databases Have Been Hacked. The Russians Aren’t the Only Suspects. | Mother Jones

Arizona Secretary of State Michele Reagan was in the backyard of her home last June when she got a call from her chief of staff. “The first words out of his mouth were, ‘Can you sit down?'” Reagan told Mother Jones. He then said that her office had been “contacted by the FBI, and it looks like there’s a computer password and username that belongs to our database for sale on the dark web.” Reagan is the chief elections officer for the state of Arizona, and the credential that was for sale on the “dark web”—a collection of websites that hide their IP addresses to obscure where they’re hosted and who runs them—would potentially give the buyer access to a database containing personal information for nearly 4 million voters. With help from the FBI, the Arizona Department of Homeland Security, and the Arizona Department of Administration, Reagan and her staff determined that an employee in Gila County, Arizona, had opened a Microsoft Word document attached to an email. That document likely contained software that may have tracked the employee’s key strokes, which eventually led to the attacker getting a username and password to one of the state’s election-related databases.

Voting Blogs: The Russian Hack of U.S. Election Systems is About Delegitimizing, Not Changing, the Result, and It Feeds Trump Vote-Rigging Claim | Election Law Blog

The headlines over the last few weeks are suggesting Russian “hacks” of U.S. election systems. But the kinds of election systems hacked are not the ones that would change election results (at least so far). Instead, I think the Russians are playing a different, also dangerous, game involving misinformation and disruption. Let’s start with what we know. We know that it is Russia behind the hacking. Most people know about the Wikileaks revelations from the Podesta emails, with the goal of embarrassing the Clinton administration and potentially affecting the outcome of the election. Maybe if Trump were not the opponent, these leaks would have more of an effect. But beyond that there have been numerous reports of Russian hackers going after U.S. election systems, such as going after the voter registration databases of Illinois and Arizona.

Arizona: After hack, Arizona working to keep its elections database secure | CBS

The hacking attempt on Arizona’s voter database started in rural Gila County when an elections worker opened an email attachment. Michelle Reagan, Arizona’s secretary of state, said it was malware meant to attack servers holding the voter information of 4 million people. Reagan was alerted by the FBI, and experts believe the Russian government is to blame. She said she was shocked and dismayed when she first heard about the breach. “We’ve never had to worry about foreign invaders coming in and trying to mess with our confidence and our election system,” Reagan said.

Florida: FBI: Russia likely hacked Florida election contractor and Clinton campaign chairman | SC Magazine

U.S. intelligence officials’ concerns of a Russian hacking operation against political targets continues to escalate, as FBI officials now believe Russian intelligence agencies likely orchestrated the hacks of emails belonging to a contractor for Florida’s election system and Hillary Clinton’s campaign chairman John Podesta, according to a report in The Wall Street Journal. Podesta’s emails were released in the latest batch of emails released by Wikileaks. Trump advisor Roger Stone admitted Wednesday that he had “back-channel communication” with WikiLeaks founder Julian Assange. A day earlier, Podesta told Bloomberg on Tuesday that it is “a reasonable assumption or at least a reasonable conclusion” that the Trump campaign knew about the most recent WikiLeaks leaks before their release. He pointed to a tweet from Stone that claimed: “Trust me, it will soon the Podesta’s time in the barrel.”

National: Elections at Risk in Cyberspace, Part II: Variety is the Spice of Hacking for Voting Machines | Signal Magazine

Election-day activities center on polling places and their voting machines, and this is where the public interest in vote security is most acute. Each state is in charge of acquiring and managing voting machines, and many states have different types of machines within their borders. The wide variety of voting machines used across the United States, rather than deterring hackers, actually helps empower them if they want to change the outcome of people’s votes, say many cybersecurity experts. Many voting machines are so old that modern security has not yet caught up to them. The differences among voting machines also mean that no single tactic could be employed to cause them to give misleading vote totals. Any coordinated effort to use the machines to affect voting outcomes would have to be tailored to each type of machine and would require an extensive network of operatives to be effective on a large scale. Some electronic voting machines still in use in the United States date back to the last millennium, according to a report by the Brennan Center for Justice, a liberal nonpartisan policy and law institute connected with New York University School of Law. The oldest machines have all the security of an ATM—which is to say, very little. Newer machines still are vulnerable because they provide access points for cybermarauders to inject malware that could change votes outright.
Direct-reporting voting machines that offer no paper backup are the most vulnerable, states Chuck Brooks, vice president of government relations and marketing for Sutherland Government Solutions. Also, the diversity of electronic voting machines precludes any easy security fix. Few have had software updates, he says.

National: What it takes to secure the elections | TechCrunch

While virtually every industry and domain is flourishing and being revolutionized by technological advances, more than three-quarters of U.S. citizens will vote for their next president on paper ballots this November. The main reason for this is concern over cybersecurity threats against the electoral system and process. In the wake of major breaches, such as the hacking of the Democratic National Convention and attacks against voter registration databases in at least two states, it is now feared more than ever that the presidential elections might be influenced or compromised by nation-states such as Russia. And that’s why any form of technology being used in elections is generally frowned upon and regarded as a potential attack vector for malicious actors. But is this a pattern that has to repeat itself every four years? Are we doomed to choose our leaders in settings that one expert described to me as reminiscent of the dark ages for fear of major hacks, or is it possible to see future elections leverage the full power of the newest tech without fearing cyber threats?

National: Election cyber threats: More states request DHS help | CNN

More states and local election boards have asked the Department of Homeland Security to help with cybersecurity, the department announced Monday night. The total, which has been steadily rising in recent weeks, has reached 33 state and 11 county or local election agencies, DHS said. More than two dozen states were known to have requested help before the updated tally. DHS has been urging states to take advantage of its resources, which include scanning systems for vulnerabilities and recommendations for improving cybersecurity on election and voter registration systems. The update from Secretary Jeh Johnson warned those on the fence to make a decision.

National: Senator wants nationwide, all-mail voting to counter election hacks | Ars Technica

“It’s not a question of if you’re going to get hacked—it’s when you’re going to get hacked.” Those were the words of Verizon CEO Lowell McAdam as he sought to assure investors last week that the company is still interested in purchasing Yahoo despite the massive data breach of Yahoo consumer accounts. Whether McAdam’s words ring true for the hodgepodge of election systems across the US is anybody’s guess. But in the wake of the Obama administration’s announcement that the Russian government directed hacks on the Democratic National Committee and other institutions to influence US elections, a senator from Oregon says the nation should conduct its elections like his home state does: all-mail voting.

National: Obama Considers ‘Proportional’ Response to Russian Hacking in U.S. Election | The New York Times

President Obama is weighing a “proportional” response to Russia’s efforts to interfere with this fall’s election campaign through hacking, the White House announced Tuesday. “The president has talked before about the significant capabilities that the U.S. government has to both defend our systems in the United States but also carry out offensive operations in other countries,” Josh Earnest, the White House press secretary, told reporters traveling with Mr. Obama on Air Force One to Greensboro, where he was holding a town hall-style meeting with students and campaigning for Hillary Clinton. “There are a range of responses that are available to the president, and he will consider a response that is proportional,” Mr. Earnest said. Whatever the president opts to do would probably not be announced in advance and may never be acknowledged or disclosed if it is carried out, Mr. Earnest said. On Friday, the Obama administration publicly acknowledged for the first time that it believed that the Russian government was responsible for stealing and disclosing emails from the Democratic National Committee and a range of other institutions and prominent individuals, most recently Hillary Clinton’s campaign chairman, John D. Podesta. The emails were posted on the well-known WikiLeaks site and two newer sites, DCLeaks.com and Guccifer 2.0.

National: John Podesta Says Russian Spies Hacked His Emails to Sway Election | The New York Times

In his first remarks since WikiLeaks began releasing thousands of his hacked emails, John D. Podesta, Hillary Clinton’s campaign chairman, said Tuesday that Russian intelligence officials intent on swaying the election to Donald J. Trump had been responsible for the illegal breach into his account. “I’ve been involved in politics for nearly five decades,” Mr. Podesta told reporters aboard the Clinton campaign plane. “This definitely is the first campaign that I’ve been involved with in which I’ve had to tangle with Russian intelligence agencies,” he added, “who seem to be doing everything that they can on behalf of our opponent.” Without verifying the authenticity of the emails, Mr. Podesta said that he had spoken with the F.B.I. “as a victim” of hacking. The Obama administration, like Mr. Podesta, believes the Russian government has been trying to help Mr. Trump with its hacking, including the theft of emails of the Democratic National Committee this year. Mr. Podesta said Mr. Trump had “essentially adopted lock, stock and barrel” a foreign policy that would favor the interests of President Vladimir V. Putin.

National: Department of Homeland Security helps 33 states with election cybersecurity | The Hill

Thirty-three states and 11 county and local election agencies have sought help from the Department of Homeland Security (DHS) to shore up their voting infrastructure against cyberattacks, according to the agency. The department urged other states to take advantage of its services — such as scanning internet-facing systems to identify vulnerabilities — noting that less than 30 days remain until Election Day. “Time is a factor,” the agency wrote in a notice sent late Monday. “It can take up to two weeks from the time we receive authorization to run the scans and identify vulnerabilities. It can then take at least an additional week for state and local election officials to mitigate any vulnerabilities on systems that we may find.” The alert comes amidst heightened fears that the Russian government is attempting to interfere in the U.S. election.

National: Why US fears Russia is hacking its presidential election | The Nation