This article is from the source 'guardian' and was first published or seen on . It last changed over 40 days ago and won't be checked again for changes.
You can find the current article at its original source at https://www.theguardian.com/us-news/2018/aug/13/us-election-cybersecurity-hacking-voting
The article has changed 4 times. There is an RSS feed of changes available.
| Version 0 | Version 1 |
|---|---|
| Why US elections remain 'dangerously vulnerable' to cyber-attacks | Why US elections remain 'dangerously vulnerable' to cyber-attacks |
| (about 5 hours later) | |
| Sixteen months ago, Marilyn Marks was just another political junkie watching a high-profile congressional election on her laptop when she saw something she found abnormal and alarming. | Sixteen months ago, Marilyn Marks was just another political junkie watching a high-profile congressional election on her laptop when she saw something she found abnormal and alarming. |
| The date was 18 April 2017, and the election was in Georgia’s sixth congressional district, where the Democrats were hoping to pull off an upset victory against a crowded Republican field in the wake of Tom Price’s (short-lived) elevation to the Trump cabinet as health and human services secretary. | The date was 18 April 2017, and the election was in Georgia’s sixth congressional district, where the Democrats were hoping to pull off an upset victory against a crowded Republican field in the wake of Tom Price’s (short-lived) elevation to the Trump cabinet as health and human services secretary. |
| By mid-evening, Jon Ossoff, the leading Democrat, had 50.3% of the vote, enough to win outright without the need for a run-off against his closest Republican challenger. Then Marks noticed that the number of precincts reporting in Fulton County, encompassing the heart of Atlanta, was going down instead of up. Soon after, the computers crashed. | By mid-evening, Jon Ossoff, the leading Democrat, had 50.3% of the vote, enough to win outright without the need for a run-off against his closest Republican challenger. Then Marks noticed that the number of precincts reporting in Fulton County, encompassing the heart of Atlanta, was going down instead of up. Soon after, the computers crashed. |
| Election officials later blamed a “rare error” with a memory card that didn’t properly upload its vote tallies. When the count resumed more than an hour later, Ossoff was suddenly down to 48.6% and ended up at 48.1%. (He lost in the run-off to Republican Karen Handel.) | Election officials later blamed a “rare error” with a memory card that didn’t properly upload its vote tallies. When the count resumed more than an hour later, Ossoff was suddenly down to 48.6% and ended up at 48.1%. (He lost in the run-off to Republican Karen Handel.) |
| Marks was not rooting for Ossoff – she is a registered Republican and lives in North Carolina, two states to the north – but she cared deeply about the integrity of the vote and she knew that Georgia’s 15-year-old all-electronic voting system was almost impossible to audit because it produced no independently verifiable paper trail to check against the computer-generated tallies. | Marks was not rooting for Ossoff – she is a registered Republican and lives in North Carolina, two states to the north – but she cared deeply about the integrity of the vote and she knew that Georgia’s 15-year-old all-electronic voting system was almost impossible to audit because it produced no independently verifiable paper trail to check against the computer-generated tallies. |
| Was Ossoff robbed, or did the system right whatever went wrong? The point, Marks felt, was that it was impossible to be sure. | Was Ossoff robbed, or did the system right whatever went wrong? The point, Marks felt, was that it was impossible to be sure. |
| Cybersecurity experts have warned for years that malfeasance, technical breakdown or administrative incompetence could easily wreak havoc with electronic systems and could go largely or wholly undetected. This is a concern made much more urgent by Russia’s cyber-attacks on political party servers and state voter registration databases in 2016 and by the risk of a repeat – or worse – in this November’s midterms. | Cybersecurity experts have warned for years that malfeasance, technical breakdown or administrative incompetence could easily wreak havoc with electronic systems and could go largely or wholly undetected. This is a concern made much more urgent by Russia’s cyber-attacks on political party servers and state voter registration databases in 2016 and by the risk of a repeat – or worse – in this November’s midterms. |
| “The moment the machines went down, that’s when I decided I was going to work in Georgia,” Marks said. And she didn’t know the half of it yet. | “The moment the machines went down, that’s when I decided I was going to work in Georgia,” Marks said. And she didn’t know the half of it yet. |
| Access to voter data | Access to voter data |
| The previous summer, about a month after Donald Trump publicly invited Russia to hack Hillary Clinton’s email server, a cybersecurity expert named Logan Lamb was conducting his own casual investigation into Georgia’s voting systems when he inadvertently downloaded a vast trove of confidential information that the state’s designated election security subcontractor had left on an open website. | The previous summer, about a month after Donald Trump publicly invited Russia to hack Hillary Clinton’s email server, a cybersecurity expert named Logan Lamb was conducting his own casual investigation into Georgia’s voting systems when he inadvertently downloaded a vast trove of confidential information that the state’s designated election security subcontractor had left on an open website. |
| The files, which had been open long enough for Google to cache versions of many of them, included the voter histories of Georgia’s 6.3 million registered voters; their personal information, including driver’s license and social security numbers; tabulation and memory card programming databases; instructions on managing election systems; and the passwords to get in. | The files, which had been open long enough for Google to cache versions of many of them, included the voter histories of Georgia’s 6.3 million registered voters; their personal information, including driver’s license and social security numbers; tabulation and memory card programming databases; instructions on managing election systems; and the passwords to get in. |
| Lamb, a former government cyber-consultant now in private practice, immediately alerted the subcontractor, the Center for Election Systems at Kennesaw State University outside Atlanta, and assumed the problem would be addressed. Seven months later, however – just a few weeks before the sixth district special election – a friend of his visited the same website and downloaded much the same information. | Lamb, a former government cyber-consultant now in private practice, immediately alerted the subcontractor, the Center for Election Systems at Kennesaw State University outside Atlanta, and assumed the problem would be addressed. Seven months later, however – just a few weeks before the sixth district special election – a friend of his visited the same website and downloaded much the same information. |
| When they raised the alarm a second time, the data was secured at last. But state officials still refused to acknowledge there had been a serious security breach and offered no evidence that they were checking to ensure the system was still functioning correctly after seven months or more with the doors left unlocked. Georgia’s secretary of state, Brian Kemp – himself a candidate in a keenly watched race for governor this November – insisted that his office had never encountered a problem and interpreted protestations to the contrary as the partisan bleatings of disgruntled liberals. | When they raised the alarm a second time, the data was secured at last. But state officials still refused to acknowledge there had been a serious security breach and offered no evidence that they were checking to ensure the system was still functioning correctly after seven months or more with the doors left unlocked. Georgia’s secretary of state, Brian Kemp – himself a candidate in a keenly watched race for governor this November – insisted that his office had never encountered a problem and interpreted protestations to the contrary as the partisan bleatings of disgruntled liberals. |
| He’d taken a similar tack in 2016, when Georgia was one of just two states to refuse the help of the Obama-era Department of Homeland Security in locking down its election system against the threat of Russian attack. “Because of the DNC [Democratic National Committee] getting hacked, they now think our whole system is on the verge of disaster,” he told Politico at the time. “I mean, anything is possible, but it is not probable at all, the way our systems are set up.” | He’d taken a similar tack in 2016, when Georgia was one of just two states to refuse the help of the Obama-era Department of Homeland Security in locking down its election system against the threat of Russian attack. “Because of the DNC [Democratic National Committee] getting hacked, they now think our whole system is on the verge of disaster,” he told Politico at the time. “I mean, anything is possible, but it is not probable at all, the way our systems are set up.” |
| Marks teamed with a number of Georgia voting rights activists and filed suit against Kemp to demand an immediate switch to a safer voting system. “Virtually every American voter has come to understand that the nation’s election infrastructure is susceptible to malicious manipulation from local and foreign threats,” the suit reads. | Marks teamed with a number of Georgia voting rights activists and filed suit against Kemp to demand an immediate switch to a safer voting system. “Virtually every American voter has come to understand that the nation’s election infrastructure is susceptible to malicious manipulation from local and foreign threats,” the suit reads. |
| “Yet, Georgia’s election officials continue to defend the state’s electronic voting system that is demonstrably unreliable and insecure, and have repeatedly refused to take administrative, regulatory or legislative action to address the election security failures.” | |
| ‘They can get us to delegitimize our own democracy’ | ‘They can get us to delegitimize our own democracy’ |
| And Georgia is far from the only cause of concern this election season. Four other states still depend almost entirely on outdated electronic voting systems with no paper trail. Eight more states will be using such systems over at least part of their territory in November. And while Congress offered $380m in March to shore up election security systems for the mid-terms, that money has been spent unevenly, without expert guidance from the federal government, and is widely regarded as insufficient to address the full range of problems. | And Georgia is far from the only cause of concern this election season. Four other states still depend almost entirely on outdated electronic voting systems with no paper trail. Eight more states will be using such systems over at least part of their territory in November. And while Congress offered $380m in March to shore up election security systems for the mid-terms, that money has been spent unevenly, without expert guidance from the federal government, and is widely regarded as insufficient to address the full range of problems. |
| “The big picture is that US election infrastructure remains dangerously vulnerable to cyber-attacks,” said Alex Halderman, a leading voting security expert from the University of Michigan. “Many states are making progress, but the progress is patchy and there are major gaps … Forty states are using computer technology that is a decade old or more and often they are not receiving software updates or security patches.” | “The big picture is that US election infrastructure remains dangerously vulnerable to cyber-attacks,” said Alex Halderman, a leading voting security expert from the University of Michigan. “Many states are making progress, but the progress is patchy and there are major gaps … Forty states are using computer technology that is a decade old or more and often they are not receiving software updates or security patches.” |
| These vulnerabilities are only made worse by a rancid political environment in which the president himself subscribes to conspiracy theories of mass voter fraud. Several Republican-run states – including Georgia – have passed strict voter ID legislation and other measures to restrict ballot access, especially to minority voters, and both parties have gerrymandered congressional districts to distort voting outcomes in their favor. | These vulnerabilities are only made worse by a rancid political environment in which the president himself subscribes to conspiracy theories of mass voter fraud. Several Republican-run states – including Georgia – have passed strict voter ID legislation and other measures to restrict ballot access, especially to minority voters, and both parties have gerrymandered congressional districts to distort voting outcomes in their favor. |
| In other words, just when fair-minded election administrators might feel most inclined to reassure anxious voters that their votes will be handled properly, they are being betrayed by the facts on the ground. And that is making fear of hacking almost as dangerous to America’s democratic well-being as the threat of an actual hack. | In other words, just when fair-minded election administrators might feel most inclined to reassure anxious voters that their votes will be handled properly, they are being betrayed by the facts on the ground. And that is making fear of hacking almost as dangerous to America’s democratic well-being as the threat of an actual hack. |
| “The research is very strong that voters have unusually low trust that the elections are going to be fair or that the technology is reliable,” said David Becker of the Center for Election Innovation and Research, which works with state and local officials to find nonpartisan, nonpolitical solutions to problems of election administration. “That’s troubling to me … because talk of [voter roll] purges, vote rigging and hacking all feeds into a larger narrative that affects whether people are going to vote. | “The research is very strong that voters have unusually low trust that the elections are going to be fair or that the technology is reliable,” said David Becker of the Center for Election Innovation and Research, which works with state and local officials to find nonpartisan, nonpolitical solutions to problems of election administration. “That’s troubling to me … because talk of [voter roll] purges, vote rigging and hacking all feeds into a larger narrative that affects whether people are going to vote. |
| “The tough thing is that the Russians don’t have to be successful to achieve their goals. They don’t necessarily need to change the outcome or races or change voter records. What they can do is attack our systems and get us to delegitimize our own democracy.” | “The tough thing is that the Russians don’t have to be successful to achieve their goals. They don’t necessarily need to change the outcome or races or change voter records. What they can do is attack our systems and get us to delegitimize our own democracy.” |
| Activists like Marks believe that certain hyperpartisan state officials like Brian Kemp in Georgia and Kris Kobach in Kansas – who is also running for governor and may soon be embroiled in a recount of his own primary race – are doing a lot of that delegitimizing already by politicizing their offices and failing, in her view, to act in the public interest. | Activists like Marks believe that certain hyperpartisan state officials like Brian Kemp in Georgia and Kris Kobach in Kansas – who is also running for governor and may soon be embroiled in a recount of his own primary race – are doing a lot of that delegitimizing already by politicizing their offices and failing, in her view, to act in the public interest. |
| Four days after Marks and her group, the Coalition for Good Governance, first filed suit against Kemp last year, the Center for Election Systems at Kennesaw State wiped its server clean of election data – thus destroying what could have been vital evidence in the case and perhaps shed more light on the “rare error” in the sixth district. A month later, the case moved to federal court, and within a day the CES had erased the data on a backup server too. | Four days after Marks and her group, the Coalition for Good Governance, first filed suit against Kemp last year, the Center for Election Systems at Kennesaw State wiped its server clean of election data – thus destroying what could have been vital evidence in the case and perhaps shed more light on the “rare error” in the sixth district. A month later, the case moved to federal court, and within a day the CES had erased the data on a backup server too. |
| This was too much even for Brian Kemp, who abruptly ended the state’s relationship with CES last October, decrying its “undeniable ineptitude” and “reckless behavior”. (The center’s actions were also in apparent violation of a federal law which mandates that states keep election records for at least 22 months.) Kemp’s office then took oversight of election security in-house, while maintaining that the system itself was fine. | This was too much even for Brian Kemp, who abruptly ended the state’s relationship with CES last October, decrying its “undeniable ineptitude” and “reckless behavior”. (The center’s actions were also in apparent violation of a federal law which mandates that states keep election records for at least 22 months.) Kemp’s office then took oversight of election security in-house, while maintaining that the system itself was fine. |
| That has struck Marks and many other voting rights activists and political observers as a flagrant conflict of interest. Last week, the Georgia Democratic party and several not-for-profit advocacy groups called on Kemp to resign as secretary of state so he could run for governor free of suspicion that he might double-deal on his own behalf. Some, but not all, previous Georgia secretaries of state have stepped aside when running for higher office. (Kemp said he had no intention of resigning.) | That has struck Marks and many other voting rights activists and political observers as a flagrant conflict of interest. Last week, the Georgia Democratic party and several not-for-profit advocacy groups called on Kemp to resign as secretary of state so he could run for governor free of suspicion that he might double-deal on his own behalf. Some, but not all, previous Georgia secretaries of state have stepped aside when running for higher office. (Kemp said he had no intention of resigning.) |
| “At least in other states, the counties do their own ballot programming and counting,” Marks said. “In this case, the software that controls the count and the ballots and the machines is all controlled right out of Kemp’s office, with no oversight. He’s running an election that is both unverifiable and has no outside controls on it. This is what they do in Cuba.” | “At least in other states, the counties do their own ballot programming and counting,” Marks said. “In this case, the software that controls the count and the ballots and the machines is all controlled right out of Kemp’s office, with no oversight. He’s running an election that is both unverifiable and has no outside controls on it. This is what they do in Cuba.” |
| ‘Nothing has been decontaminated’ | ‘Nothing has been decontaminated’ |
| And there is more: in his indictment of 12 suspected Russian cyberspies last month, the special counsel Robert Mueller undid much of Kemp’s previous rhetoric that Georgia had never been targeted by cyber-spies by alleging that the Russians had scoped out counties in Georgia, Florida and Iowa on the eve of the 2016 election for possible computer vulnerabilities. Kemp’s office responded that the indictment mentioned only “visits” to websites, not actual penetration. | And there is more: in his indictment of 12 suspected Russian cyberspies last month, the special counsel Robert Mueller undid much of Kemp’s previous rhetoric that Georgia had never been targeted by cyber-spies by alleging that the Russians had scoped out counties in Georgia, Florida and Iowa on the eve of the 2016 election for possible computer vulnerabilities. Kemp’s office responded that the indictment mentioned only “visits” to websites, not actual penetration. |
| Discovery materials in the lawsuit, meanwhile, have highlighted a host of problems, including a precinct in north Georgia with 242% more votes cast than eligible voters in a local election in May and similar inconsistencies in other jurisdictions that the poll workers appear to have made no effort to investigate or reconcile. Logan Lamb’s discoveries seem to belie claims by Kemp’s office that election workers keep voting machinery “air-gapped” from the internet – he found instructions to administrators to go online and download vital software on a routine basis before election day. Similar questions about reliability and cybersecurity have dogged Georgia’s electronic system from the outset. | Discovery materials in the lawsuit, meanwhile, have highlighted a host of problems, including a precinct in north Georgia with 242% more votes cast than eligible voters in a local election in May and similar inconsistencies in other jurisdictions that the poll workers appear to have made no effort to investigate or reconcile. Logan Lamb’s discoveries seem to belie claims by Kemp’s office that election workers keep voting machinery “air-gapped” from the internet – he found instructions to administrators to go online and download vital software on a routine basis before election day. Similar questions about reliability and cybersecurity have dogged Georgia’s electronic system from the outset. |
| The stance taken by Kemp and resistant officials in other states concerns computer security experts, who say it would not be that onerous or expensive to secure electronic systems before November. Mostly these would consist of pre-existing best practices for computer security: backing up systems regularly so anomalies can be rectified quickly and painlessly, having paper backups not just for ballots but also for electronic poll books containing the names and details of eligible voters, and so on. | The stance taken by Kemp and resistant officials in other states concerns computer security experts, who say it would not be that onerous or expensive to secure electronic systems before November. Mostly these would consist of pre-existing best practices for computer security: backing up systems regularly so anomalies can be rectified quickly and painlessly, having paper backups not just for ballots but also for electronic poll books containing the names and details of eligible voters, and so on. |
| Likewise, there is little mystery about the safest available voting technology – optically scanned paper ballots, now used by about 80% of US voters. Some of the states that don’t have this technology, like Louisiana, would like it but don’t have the funds to switch. Others, like Georgia and South Carolina, simply aren’t interested in ditching their all-electronic systems despite the compelling reasons to do so. | Likewise, there is little mystery about the safest available voting technology – optically scanned paper ballots, now used by about 80% of US voters. Some of the states that don’t have this technology, like Louisiana, would like it but don’t have the funds to switch. Others, like Georgia and South Carolina, simply aren’t interested in ditching their all-electronic systems despite the compelling reasons to do so. |
| “Unfortunately, the states who are pushing back often lack technical expertise or experience with being on the frontlines of international cyberwarfare,” Alex Halderman said. “The federal agencies do have that experience. We need more cooperation but also more leadership on a national level.” | “Unfortunately, the states who are pushing back often lack technical expertise or experience with being on the frontlines of international cyberwarfare,” Alex Halderman said. “The federal agencies do have that experience. We need more cooperation but also more leadership on a national level.” |
| Marks can’t help thinking back to last year’s special congressional election and everything she’s learned since about the troubling circumstances surrounding it. “I think there is more reason than ever to question the result of that election,” she said. “Georgia’s system was compromised, and it has not been decontaminated. We’ve got a national security issue going on, and nothing has been decontaminated.” | Marks can’t help thinking back to last year’s special congressional election and everything she’s learned since about the troubling circumstances surrounding it. “I think there is more reason than ever to question the result of that election,” she said. “Georgia’s system was compromised, and it has not been decontaminated. We’ve got a national security issue going on, and nothing has been decontaminated.” |
| US politics | US politics |
| Cybercrime | Cybercrime |
| Georgia | Georgia |
| Hacking | Hacking |
| Russia | Russia |
| features | features |
| Share on Facebook | Share on Facebook |
| Share on Twitter | Share on Twitter |
| Share via Email | Share via Email |
| Share on LinkedIn | Share on LinkedIn |
| Share on Pinterest | Share on Pinterest |
| Share on Google+ | Share on Google+ |
| Share on WhatsApp | Share on WhatsApp |
| Share on Messenger | Share on Messenger |
| Reuse this content | Reuse this content |