Russia’s meddling in the 2016 election may not have altered the outcome of any races, but it showed that America’s voting system is far more vulnerable to attack than most people realized. Whether the attackers are hostile nations like Russia (which could well try it again even though President Trump has raised the issue with President Vladimir Putin of Russia) or hostile groups like ISIS, the threat is very real. The question is this: Can the system be strengthened against cyberattacks in time for the 2018 midterms and the 2020 presidential race? The answer, encouragingly, is that there are concrete steps state and local governments can take right now to improve the security and integrity of their elections. A new study by the Brennan Center for Justice identifies two critical pieces of election infrastructure — aging voting machines and voter registration databases relying on outdated software — that present appealing targets for hackers and yet can be shored up at a reasonable cost. … The report identifies three immediate steps states and localities can take to counter the threat.
As new reports emerge about Russian-backed attempts to hack state and local election systems, U.S. officials are increasingly worried about how vulnerable American elections really are. While the officials say they see no evidence that any votes were tampered with, no one knows for sure. Voters were assured repeatedly last year that foreign hackers couldn’t manipulate votes because, with few exceptions, voting machines are not connected to the Internet. “So how do you hack something in cyberspace, when it’s not in cyberspace?” Louisiana Secretary of State Tom Schedler said shortly before the 2016 election. But even if most voting machines aren’t connected to the Internet, says cybersecurity expert Jeremy Epstein, “they are connected to something that’s connected to something that’s connected to the Internet.” … While it’s unclear if any of the recipients took the bait in the email attack, University of Michigan computer scientist Alex Halderman says it’s just the kind of phishing campaign someone would launch if they wanted to manipulate votes.
Revelations that Russian hackers tried to break into Dallas County’s web servers, likely with the intention of accessing voter registration files, in the lead up to last November’s election renewed concerns about Texas election security. Both Wednesday night’s news out of Dallas and a Bloomberg report on Monday—which said that the Russian hacking attempts affected 39 states—are forcing states to look inward and re-examine the security of their local and state-level electoral technologies. The particular targets of Russian hackers were the accounts of elections officials and voter registration rolls, which are connected to the internet and are unlike the voting systems that actually do the recording and vote tallying. But a possible security breach of one area of electoral technologies has the potential to ripple out and affect the integrity of other ones. “The reason why this whole Russian hacking thing is a wake-up call is because we’ve been caught not paying as much attention as we should have in an area that all of us didn’t think was that vulnerable,” Dana DeBeauvoir, the Travis County clerk since 1987, says. “And yet it has turned out to be extremely vulnerable in ways we did not expect.”
Hackers will target American voting machines—as a public service, to prove how vulnerable they are. When over 25,000 of them descend on Caesar’s Palace in Las Vegas at the end of July for DEFCON, the world’s largest hacking conference, organizers are planning to have waiting what they call “a village” of different opportunities to test how easily voting machines can be manipulated. Some will let people go after the network software remotely, some will be broken apart to let people dig into the hardware, and some will be set up to see how a prepared hacker could fiddle with individual machines on site in a polling place through a combination of physical and virtual attacks.
In January, America’s main intelligence agencies issued a report concluding that Russia interfered in the 2016 election, using a combination of cyber-intrusion, espionage, and propaganda. In addition to the details provided in this account, media outlets have since reported that several election databases were hacked before and after the election. While the Department of Homeland Security found no evidence any of these efforts manipulated vote tallies, the assaults have left many Americans asking: Just how safe are voting machines from cyberattack? The answer is not reassuring. For more than a decade, independent security experts have repeatedly demonstrated that many electronic voting machines are dangerously insecure and vulnerable to attack and manipulation by bad actors.
Elections clerks across Montana could find themselves increasingly challenged to serve voters with severe physical disabilities because of a dwindling supply of polling equipment designed especially for people who cannot use traditional voting machines. Existing inventories of voting machines for disabled voters are antiquated, some nearly two decades old. Many units are in disrepair and elections officials have been unable to replace the aging machines with newer, modern equipment because of state law. In 2008, a disabled voter sued Missoula County for not being in full compliance with federal law when it did not have a backup unit for a malfunctioning machine specially designed for people who do not have full function of their limbs.
At an April 4 Election Assistance Commission public hearing, a senior Department of Homeland Security official sought to stress one thing: The designation of election systems as critical infrastructure doesn’t cut into states’ autonomy. Concerns over DHS control have simmered since then-Secretary Jeh Johnson first suggested the critical infrastructure designation last summer. Yet Neil Jenkins, DHS’ director of the Enterprise Performance Management Office, said at the EAC hearing that his agency sees the National Association of Secretaries of State (NASS) Election Cybersecurity Task Force as the main point of contact for deciding when DHS system-scanning tools are needed. Jenkins also said he sees the EAC as a critical point of contact for local officials who may be interested in utilizing DHS scanning and security products.
At least once a year, staffers in one of Texas’ largest election offices scour the web for a relic from a bygone technology era: Zip disks. The advanced version of the floppy disk that was cutting edge in the mid-1990s plays a vital role in tallying votes in Bexar County, where like other places around the U.S., money to replace antiquated voting equipment is scarce. “I’d be dead in the water without our technical support people looking online to buy the pieces and parts to keep us going,” said Jacque Callanen, elections administrator in the county that includes San Antonio and had 1 million-plus registered voters in the 2016 election. Purchased in 2002, Bexar County’s voting equipment is among the oldest in Texas. The Zip disks the county uses to help merge results and allow paper ballots to be tallied with final election totals are no longer manufactured, so staff members snap them up by the dozens off of eBay and Amazon.
Georgia: FBI investigating alleged breach in Georgia at KSU’s elections center | Atlanta Journal-Constitution
The Federal Bureau of Investigation is investigating an alleged data breach in Georgia at the Center for Election Systems at Kennesaw State University, The Atlanta Journal-Constitution has learned. The situation is still developing, although the Secretary of State’s Office said Friday that the investigation is not related to its own network and is not a breach of its database containing the personal information on Georgia’s 6.6 million registered voters. The office referred all other questions to both university and federal officials.
The Secretary of State’s office finalized its contract to replace the state’s ailing voting machines with new equipment in time for the August 2018 primaries. The Board of State Canvassers on Tuesday approved a plan the State Administrative Board previously authorized. It could grant vendors up to $82.1 million over the next 10 years to replace the state’s voting machines with new optical scanners expected to be up and running by August 2018. The new machines still use paper ballots, so not much changes for voters in the polling booth, said state Elections Director Chris Thomas. But the new technology will make things easier for election workers by setting up a statewide repository showing results all in one place. “The voters themselves are not gonna notice a whole lot,” Thomas said. “Just to have a statewide repository for all elections – it just doesn’t exist right now. It’s a big step forward. No question.”