Securing Elections

guest · Jan 17, 2020

Complaint alleging Iowa voter registration prone to hacks is dismissed
January 17, 2020
https://eu.desmoinesregister.com/st...registration-vulnerable-dismissed/2774034001/

Linn County Auditor Joel Miller's complaint that Iowa’s voting system is prone to hackers was dismissed Friday by a state commission without a public hearing on the allegations, an action Miller contends violates federal law.

“We won’t rush to judgment on what to do next, but I think there is a good case to appeal because federal law is very clear that a hearing shall be heard and that didn’t happen,” Miller said.
Miller in an August complaint filed with Iowa Secretary of State Paul Pate said Iowa’s voter registration system does not meet security safeguards mandated under the federal Help America Vote Act. He has declined to offer details about how the system could be hacked, citing confidentiality concerns.
Click to expand...

guest · Jan 19, 2020

Buttigieg's CISO resigns, leaving no known cybersecurity chiefs among the 2020 candidates
January 15, 2020
https://ph.news.yahoo.com/buttigiegs-ciso-resigns-leaving-no-184913630.html

Presidential candidate Pete Buttigieg has lost his campaign's chief information security officer, citing "differences" with the campaign over its security practices.

The Wall Street Journal first reported the news. TechCrunch also confirmed Baccio's resignation, who left less than a year after joining the Buttigieg campaign.

"I had fundamental philosophical differences with campaign management regarding the architecture and scope of the information security program," Baccio told TechCrunch.
Baccio was the only known staffer to oversee cybersecurity out of all the presidential campaigns. News of his departure comes at a time just months to go before millions of Americans are set to vote in the 2020 presidential campaign.

But concerns have been raised about the overall security posture of the candidates' campaigns, as well as voting and election infrastructure across the United States, ahead of the vote.
A report from a government watchdog last March said Homeland Security "does not have dedicated staff" focused on election infrastructure
Click to expand...

guest · Jan 22, 2020

People Can Now Vote Online in a U.S. Election and Everyone Is A Little Nervous
January 22, 2020
https://gizmodo.com/people-can-now-vote-online-in-a-u-s-election-and-every-1841167599

For the first time in U.S. history, an election conducted by smartphone is underway. The race, a board of supervisors election in King County, Washington, is small potatoes compared to, say, a presidential election, but the world is watching to see how it turns out.
According to NPR, some 1.2 million voters in the county, which encompasses Greater Seattle, will be able to use a mobile web browser to vote from now until election day (Feb. 11).

Voters will navigate to the election website, enter their name and birth date, make their selections, then verify their ballot by signing their names on their phone’s screen. Election officials will verify the ballots by comparing signatures.

It’s unclear if any developed online voting system is impenetrable to all hostile attacks, and so the Senate has recommended that states say no to online voting.
Click to expand...

Democracy Live, a Seattle-based electronic voting company, is providing the technology for Kings County and Tusk Philanthropies, a nonprofit focused on mobile voting, is funding the rollout.
Tusk expects to fund between 35 and 50 percent of similar pilots over the next five years. CEO Bradley Tusk told NPR the group will use that data to prove that online voting is safe—if that turns out to be the case

“Everyone who doesn’t want this to happen is never going to say, ‘We oppose mobile voting because we don’t want higher turnout,’” Tusk told NPR. “They’re going to say, ‘It’s not safe.’ And if we have proven 30, 40, 50 times over that it is safe, it’s a lot harder for those objections and arguments to fly.”
Kings County residents who are skeptical of online voting will be able to print out their ballots and mail them in by election day.
Click to expand...

Minimalist · Jan 25, 2020

It takes too long to detect hacking after elections. Here’s 3 ways to help.

In 33 states in America, millions of voters are still at risk of having their ballots deliberately changed, uncounted, undercounted, misrecorded or otherwise subverted. Why? Simply because these states either permit some form of Internet voting or because one or more parts of their voting processes are connected to the Internet.
Click to expand...

https://www.fifthdomain.com/thought...hacking-after-elections-heres-3-ways-to-help/

guest · Jan 27, 2020

US appeals court rejects Tennessee election security lawsuit
January 27, 2020
https://www.dailymail.co.uk/wires/a...ects-Tennessee-election-security-lawsuit.html

A federal appeals court has sided with a lower court in rejecting a lawsuit that challenges the security of voting machines in Tennessee's largest county.

A three-judge panel of the 6th U.S. Circuit Court of Appeals on Friday upheld a September district court ruling against the Shelby Advocates for Valid Elections lawsuit.
Appellate judges wrote that the plaintiffs failed to show that there's an imminent risk that people will hack voting machines in the county.

"But even if we agreed with the court that examples of hackers disrupting those particular voting machines showed an imminent harm somewhere in Georgia - or for that matter anywhere in the United States - that does not translate into an imminent risk that individuals will hack the voting machines in Shelby County, Tennessee," the ruling states.
Click to expand...

xxJackxx · Jan 27, 2020

In 33 states in America, millions of voters are still at risk of having their ballots deliberately changed, uncounted, undercounted, misrecorded or otherwise subverted. Why? Simply because these states either permit some form of Internet voting or because one or more parts of their voting processes are connected to the Internet.
Click to expand...

An internet connection is not necessary for these things to be an issue.

Minimalist · Jan 30, 2020

Ransomware predicted to target U.S. 2020 election – and local governments are not prepared

As the 2020 U.S. election looms near, many fear that foreign interference may once again disrupt the electoral process and potentially impact the outcome of the presidential race.

In 2016, it was Russian hacking and disinformation campaigns. In 2020, we believe election interference may come in the form of a different type of cyberattack: ransomware.
Click to expand...

https://blog.emsisoft.com/en/35460/...ction-and-local-governments-are-not-prepared/

guest · Jan 31, 2020

Ransomware hits TV search engine popular among political campaigns
January 31, 2020
https://www.cnet.com/news/ransomware-hits-tv-search-engine-popular-among-political-campaigns/

One of this year's first hacks to affect the 2020 US presidential election happened Thursday. TVEyes, a broadcast television search engine used by political campaigns to monitor opponents and track ads, said Friday it was hit with a ransomware attack.
In a tweet, TVEyes wrote that its core server and engineering workstations were targeted by a ransomware attack, causing an outage for the service.

"We are rebuilding the system and expect to have TVEyes back online soon, but do not have an exact ETA," the company said in the tweet. "We appreciate your patience and will provide updates as they are available."
He didn't specify how much the ransom was for, or what type of ransomware it was.

There's a concern that if hackers were able to get past TVEyes' cybersecurity defenses, it's possible that they would also have access to customer data, including email addresses belonging to politicians running for president and other offices.
Click to expand...

guest · Feb 2, 2020

2020’s first election security test: Iowa
February 2, 2020
https://www.politico.com/news/2020/02/02/iowa-2020-election-security-110126

The Iowa caucuses on Monday night is practically as low-tech as elections come, involving the least-hackable voting process imaginable: People gathering in rooms and writing their choice on paper.

The process also relies on the integrity of Iowa’s voter registration database and, for the Democrats, an online check-in platform. These systems all require vigilance against intrusions, and the phone apps in particular have created controversy — but the political parties have offered almost no details about how they’re protecting them.

“If there is value, there will be an attack,” said Duncan Buell, a computer science professor and voting security expert at the University of South Carolina, who has documented flaws in vote-counting software in his home state.
Iowa’s Republican caucus relies almost entirely on paper records, including printed voter lists distributed to each precinct and slips of paper on which participants record their preferences.

The post-caucus phase is where both parties expose themselves to potential hacking.
Click to expand...

guest · Feb 3, 2020

Google and YouTube announce measures to protect the U.S. Presidential election
February 3, 2020
https://www.neowin.net/news/google-...sures-to-protect-the-us-presidential-election

With the Iowa caucuses beginning today, Google and YouTube have announced measures they plan to take to protect the upcoming Presidential election from misinformation and other forms of interference. The Alphabet firms will take measures we’ve seen before such as engaging with political campaigns to help protect themselves and remove videos from YouTube that aim to mislead voters.

For its part, Google says it will fight voter suppression and misrepresentation in its products including Google Ads and Google Play.
The firm also plans to work with the FBI’s Foreign Influence Task Force to identify and shut down the accounts of bad actors, it’ll also let users know if they may have been influenced by a bad actor

Speaking of YouTube, several measures specific to that platform were also announced. It said that content would be banned if it included manipulated or doctored footage, misleads people about voting or the census processes, or includes false claims.
From today, YouTube will also begin raising authoritative voices to give users the latest election coverage from reputable news sources.
Click to expand...

Google: Supporting the 2020 U.S. election
Youtube: How YouTube supports elections

guest · Feb 4, 2020

Iowa Caucus Results Saved by Plain Old Paper After App Fails
February 4, 2020
https://www.bnnbloomberg.ca/iowa-caucus-results-saved-by-plain-old-paper-after-app-fails-1.1384908

Iowa caucus results were available and verifiable thanks to the use of “paper documentation,” according to the Iowa Democratic Party. That has raised worries that reliance on technology may hurt voter confidence in 2020 and beyond. The episode augments a growing public wariness since reports that Russiaian cyber-attacks infiltrated state voting systems in the 2016 election.

The Department of Homeland Security didn’t conduct this type of testing on Iowa’s app for reporting caucus results, Chad Wolf, the department’s acting secretary, said Tuesday on Fox News. Even so, cybersecurity experts continue to wonder if new voting technologies -- even if they have been well tested -- are worth the added risks.

“There is this idea that we’re going to use this technology to improve access, without adequately reviewing security concerns,” said Susan Greenhalgh, vice president at the National Election Defense Coalition.
Click to expand...

When the new digital system broke down Monday in Iowa, caucus staff defaulted to a manual approach, according to the Iowa Democratic Party. “Staff activated pre-planned backup measures and entered data manually,” the party said in a statement.

“We will not be employing the same app or vendor used in the Iowa caucus,” William McCurdy II, the chairman of the Nevada State Democratic Party, said in a statement.
Still, Iowa is “a pretty graphic illustration” of why it’s a bad idea to connect election systems to the internet, said Rich DeMillo, a Georgia Institute of Technology computer science professor and former Hewlett-Packard chief technology officer.
Click to expand...

guest · Feb 5, 2020

Why every New Jersey voter should care about the Iowa caucus disaster | Opinion
February 5, 2020
https://www.nj.com/opinion/2020/02/...e-about-the-iowa-caucus-disaster-opinion.html

The 2020 Iowa caucuses were a mess. Despite having four years to prepare, the Iowa Democratic Party used a tabulation app without properly vetting it. The IDP ignored warnings from computer security experts and election integrity groups that the app could distort election results. And that is exactly what happened.

What does this have to do with New Jersey? A great deal. Almost all 6.1 million registered voters in New Jersey vote on antiquated voting systems (using 1970s technology) that have been in use for roughly 20 years.
New Jerseyans should be more worried than Iowans, however.
If there is a problem with New Jersey’s voting computers on primary day on June 2nd, or in the General Election in November, we won’t know it. Our voting machines do not have back-up paper ballots.

There is no reason for our votes to be so vulnerable. In 2006, New Jersey passed legislation requiring voting machines to produce paper ballots, [...] In 2008, the state passed an auditing law, [...] Those laws have never been implemented.
Click to expand...

hawki · Feb 5, 2020

mood said: ↑

Iowa Caucus Results Saved by Plain Old Paper After App Fails
February 4, 2020
https://www.bnnbloomberg.ca/iowa-caucus-results-saved-by-plain-old-paper-after-app-fails-1.1384908
Click to expand...

"The Iowa Caucuses App Had Another Problem: It Could Have Been Hacked

While there is no evidence hackers intercepted or tampered with the results, a security firm consulted by ProPublica found that the app lacks key safeguards...

The IowaReporterApp was so insecure that vote totals, passwords and other sensitive information could have been intercepted or even changed, according to officials at Massachusetts-based Veracode, a security firm that reviewed the software at ProPublica’s request. Because of a lack of safeguards, transmissions to and from the phone were left largely unprotected..."

https://www.propublica.org/article/...had-another-problem-it-could-have-been-hacked

guest · Feb 6, 2020

Russian Election Interference: A Timeline
February 6, 2020
https://www.rollingstone.com/politi...st-petersburg-russian-federation-17-feb-2018/

In his recent story, “The Hack Next Time” (from the February 2020 issue of Rolling Stone magazine), Andy Kroll reported exclusive details about how the Trump White House, from Day One, shut down progress on detecting and stopping future Russian election interference.

It includes a never-before-reported December 2019 FBI alert showing a 400-percent increase in attacks on government facilities by the vicious Ryuk ransomware — this comes heading into the 2020 election year. Here, we look back to 2013 to today to see how Russia’s election hacking schemes have been thwarted — until they weren’t.
Click to expand...

guest · Feb 6, 2020

Watchdog says DHS still hasn’t got a 2020 election security plan
February 6, 2020
https://techcrunch.com/2020/02/06/dhs-cybersecurity-watchdog-2020-election/

Homeland Security’s cybersecurity advisory unit “has not yet completed” its plans to secure the 2020 presidential election, a government watchdog has said.

The report, published on Thursday by the Government Accountability Office, said the unit, CISA, is “not well-positioned to execute a nationwide strategy for securing election infrastructure prior to the start of the 2020 election cycle.”
The watchdog said the unit should “urgently finalize” its plans to help state and local officials secure their election infrastructure.

Sara Sendek, a spokesperson for CISA, said the agency had spent three years working to secure elections and that the cybersecurity unit was “prepared and ready” to support the election community.

“Our work is not done, we continue to build and grow every day, but we understand the threat and the need to take action to keep our systems safe, and we are ready for 2020,” said the spokesperson.
Click to expand...

guest · Feb 8, 2020

America's Election Security Is Lagging Behind—It's Dangerous
Hacking into voting machines remains far too easy
February 8, 2020
https://nationalinterest.org/blog/buzz/americas-election-security-lagging-behind—its-dangerous-120501

It is too soon to say for sure what role cybersecurity played in the 2020 Iowa caucuses, but the problems, which are still unfolding and being investigated, show how easily systemic failures can lead to delays and undermine trust in democratic processes. That’s particularly true when new technology – in this case, a reporting app – is introduced, even if there’s no targeted attack on the system.
The vulnerabilities are not just theoretical.
How has the US government responded?
More than two-thirds of U.S. counties are using voting machines that are at least a decade old. Because many of these machines are running outdated operating systems, they are vulnerable to exploitation.
To date, the U.S. response has been weak.

In December 2019, Congress and the president agreed to spend a further $425 million on election cybersecurity, [...] But this is still less than a quarter of the amount Congress appropriated – nearly $4 billion – to upgrade U.S. voting systems after the confusion of the 2000 election.
Click to expand...

guest · Feb 9, 2020

Personal info of 6m. Israelis leaked after Likud uploads voter info
The leaked information includes names, identification numbers, phone numbers and addresses
February 9, 2020
https://www.jpost.com/Israel-Electi...-leaked-after-Likud-uploads-voter-info-617048

The personal information of 6,453,254 Israelis was leaked after the Likud Party uploaded the entire Israeli national voter registry to an application, according to Haaretz.
The last leak of this size happened in 2006, when an employee at the Interior Ministry stole the population registry and published it illegally.

Last week, Prime Minister Benjamin Netanyahu called on Likud supporters to download the application in order to help draft more supporters and voters. The company that developed the application told Haaretz that this was "a specific incident that was taken care of immediately and afterwards security was strengthened substantially."
Click to expand...

hawki · Feb 10, 2020

mood said: ↑

Personal info of 6m. Israelis leaked after Likud uploads voter info
The leaked information includes names, identification numbers, phone numbers and addresses
February 9, 2020
https://www.jpost.com/Israel-Electi...-leaked-after-Likud-uploads-voter-info-617048
Click to expand...

"Benjamin Netanyahu’s election app potentially exposed data for every Israeli voter...

There were no immediate indication that any of the information had been downloaded before the breach was repaired, the paper said.

The app’s developer told Haaretz that the flaw was quickly fixed and new security measures implemented. But a person close to Likud said the party was braced for the possibility that information could have leaked..."

https://www.washingtonpost.com/worl...f606c0-4bfe-11ea-967b-e074d302c7d4_story.html

xxJackxx · Feb 10, 2020

There should be a paper trail for any votes. Electronic results should be trusted by nobody. You can make a computer spit out any results you want.

guest · Feb 10, 2020

mood said: ↑

Research: Email remains a weak link in U.S. election infrastructure
December 5, 2019
https://www.valimail.com/email-in-election-infrastructure/
Click to expand...

Presidential Candidates' Use of DMARC Improves, but Remains Short of Optimum
February 10, 2020
https://www.securityweek.com/presidential-candidates-use-dmarc-improves-remains-short-optimum

Presidential candidates' protection of their domains is improving, but could improve further. More specifically, of the 15 current candidates, eight now protect their domains from email spoofing with enforced DMARC.

In May 2019, when there were still 23 candidates, only three were protected by DMARC.
Today, three domains have no DMARC (Bennet, Walsh and Wend), while four more have unenforced DMARC (Delaney, Patrick, Sanders and Trump). Although running DMARC in 'unenforced' mode is often an indication that DMARC is in process of implementation, for so long as it is unenforced, there is no protection.

The authors of the survey, Valimail, note further that while Bloomberg has DMARC configured with an enforcement policy, a problem with the underlying SPF record (it exceeds the limit of 10 DNS lookups specified in the SPF standard) could cause problems with security, visibility and enforcement.
Click to expand...

Valimail: Presidential campaigns reach email security milestone

guest · Feb 11, 2020

How New Hampshire votes: Pencils and paper
February 11, 2020
https://www.nbcnews.com/politics/2020-election/how-new-hampshire-votes-pencils-paper-n1134696

New Hampshire’s election system is decidedly old school: paper ballots hand-marked by voters.

That’s mostly a good thing, election technology experts told NBC News. After Iowa’s caucuses were thrown off in part due to a faulty smartphone app, election technology is now the focus of national scrutiny.
When asked about his state’s election security during a meeting of the state's Ballot Law Commission before the 2018 midterms, New Hampshire Secretary of State Bill Gardner held up a pencil.

"Want me to give it to you and see if you can hack this pencil?” Gardner said. “We have this pencil. This is how people vote in this state. And you can't hack this pencil."

“While vulnerabilities exist in any voting system, the optical scan and hand-counted ballots used in New Hampshire are of less concern since the ballots can be counted without software in an audit or recount,” wrote Warren Stewart, head data scientist for Verified Voting, a nonpartisan election integrity organization, in an email.
Click to expand...

guest · Feb 11, 2020

Google offers free Titan security keys to help secure political campaigns
February 11, 2020
https://www.engadget.com/2020/02/11/google-free-titan-security-keys-secure-political-campaigns/

While Facebook stands firm on its decision not to ban false political ads, Google is moving in the other direction.
In partnership with non-profit Defending Digital Campaigns (DDC), the search giant will be distributing its Titan security keys for free to political groups.

Political campaigns -- particularly in the US -- have shown multiple security vulnerabilities in recent times, and with just nine months until Election Day, concerns about hackers and data loss are at an all-time high. Indeed, Democrat Brianna Wu recently announced that her Google accounts had been comprised by bad actors.

The transient nature of political campaigns means that digital security is less likely to be a priority than it might be for more permanent organizations. As such, a number of initiatives have sprung up to help tackle this issue -- DDC itself already offers reduced-price YubiKeys to those it engages with.
Click to expand...

Until now, digital companies such as Facebook and Google have mainly played roles in limiting misinformation around political events. This move from Google -- albeit something of a PR stunt -- could have a real impact if it means teams don't have to use passwords or rely on their personal devices to access sensitive information
Click to expand...

guest · Feb 12, 2020

Florida county election office hit by ransomware before 2016 presidential election
Ransomware incident was kept secret and never reported, current county election supervisor says
February 12, 2020
https://www.zdnet.com/article/flori...ransomware-before-2016-presidential-election/

In long belated news, it was reported today that a Florida county's election office had its computer systems infected and encrypted by ransomware just weeks before the 2016 US presidential elections.

News of the ransomware attack was reported today by the Palm Beach Post after an interview with Wendy Sartory Link, the current election supervisor of the Palm Beach County election office.
Link said the ransomware infection took place in September 2016 during the term of the previous election supervisor.
The Palm Beach County election supervisor told reporters that the incident doesn't appear to have been reported to either the FBI or DHS.
Click to expand...

hawki · Feb 13, 2020

" 'Sloppy' Mobile Voting App [Voatz] Used in Four States Has 'Elementary' Security Flaws

MIT researchers say an attacker could intercept and alter votes, while making voters think their votes have been cast correctly, or trick the votes server into accepting connections from an attacker...

The app, called Voatz, also has problems with how it handles authentication between the voter’s mobile phone and the backend server, allowing an attacker to impersonate a user’s phone.

Even more surprising, although the makers of Voatz have touted its use of blockchain technology to secure the transmission and storage of votes, the researchers found that the blockchain isn’t actually used in the way Voatz claims it is, thereby supplying no additional security to the system..."

https://www.vice.com/en_us/article/...-in-four-states-has-elementary-security-flaws

guest · Feb 16, 2020

mood said: ↑

Personal info of 6m. Israelis leaked after Likud uploads voter info
The leaked information includes names, identification numbers, phone numbers and addresses
February 9, 2020
https://www.jpost.com/Israel-Electi...-leaked-after-Likud-uploads-voter-info-617048
Click to expand...

Once Again, Two New Election App Breaches Exposed Personal Data on Millions of Israelis
February 16, 2020
https://www.calcalistech.com/ctech/articles/0,7340,L-3793858,00.html

Less than a week after Calcalist reported a severe security breach compromising the personal data of over 6 million Israeli voters, two new security breaches were discovered in the campaign management app used by Israel’s ruling Likud party.

In addition to the personal details of almost 6.5 million Israelis which leaked for the second time, the new flaws also revealed correspondence between activists and potential voters as well as the app’s source code, according to activist hacker Noam Rotem and Ran Bar-Zik, a senior developer at Verizon Media, who discovered the leaks.
Both breaches were apparently fixed by the app’s developer Elector Software Ltd. last week, one on Thursday and the other on Friday, following Calcalist’s request for comment.
Click to expand...

The two new breaches shed light on the inaptitude of the relevant state authorities, Rotem said. If they had taken the system down following the first report, the two additional breaches would not have occurred and sensitive information on Israeli citizens would not be out there putting people at risk, he said.

“The Israel National Cyber Directorate is supposed to safeguard the purity of the country’s election process, but when a major system used by the country’s ruling party is breached, not once but twice, its silence and failure to take action send out a clear message to everyone involved,” he said.
Click to expand...

Log in or Sign up

Securing Elections

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

xxJackxx Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

xxJackxx Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

Log in or Sign up

Securing Elections

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

xxJackxx Registered Member

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

xxJackxx Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

hawki Registered Member

guest Guest

Useful Searches