Cybersecurity Is Only 1 Part of Election Security

The DEF CON 2018 Voting Machine Hacking Village aimed to raise awareness in voting security through a full day of speakers and panel discussions along with a challenge for attendees to hack more than 30 pieces of voting equipment. A partnership with rOOtz Asylum offered youths between 8 and 16 years old an opportunity to hack replicas of the websites of secretaries of state to demonstrate that even hackers with limited years of experience can easily compromise critical systems. The goal was to break as many voting machine pieces as possible in order to draw attention to the vulnerabilities that will be present in the upcoming 2018 elections.

The focus on election equipment, however, ignores the greater danger caused by hacking into the diverse collection of sensitive information that flows through political campaigns and the electoral process, and using that to influence and sow distrust among voters. While changing a vote or voting results can be traced back to a particular stakeholder, changing people's understanding of facts is far more insidious.

What Security Risks Do Election Machines and Vendors Pose?
Election machines create two points of vulnerability. First, the voting machines provide a direct line to infiltrate and control votes, manipulating the election at its most basic level. Second, malicious actors can affect the integrity of the results just by planting the seed of potential tampering of election machines in the minds of voters, creating public distrust in the democratic process.

Third-party vendors typically are used to recording votes through one company, tally in another, and, possibly, aggregate in a third. Affecting the data integrity at any one of these vendors places the election results at risk.

What Is the "Election Ecosystem"?
The election ecosystem refers to state actors and the actual voter base along with think tanks, super PACs, political parties, election officials, lobbyists, and other invested groups. Voters rely on publicly available information to make their decisions, and this information needs to be secured.

The ecosystem presents a large attack surface and is a rich environment for exfiltrated data that could be used in an information campaign, such as compromising (in public) or coercing (in private) actors within the system.

What Types of Security Risks Exist within the Election Ecosystem?
Network security, DNS health, and patching cadence are the largest security concerns for governmental stakeholders.

Network Security
Many state and local governments leave their networks exposed to the Internet by not applying best practices to firewalls, intrusion-detection systems, packet-filtering routers, and advanced network threat-detection systems.

Endpoint Security
Exploit kits can be easily purchased on the Dark Web. They focus on outdated, insecure browser and operating systems to execute client-side exploitation attacks. While the federal government’s infrastructure budget increased, state and local governments remain underfunded. Most nongovernmental organizations continue to use outdated software to maintain compatibility with antiquated infrastructure, and the replacement cost for an entirely updated infrastructure outpaces their budget.

Patching Cadence
Most governmental stakeholders use outdated software and devices where patching updates may no longer be available. Additionally, underfunded IT departments get overwhelmed trying to maintain a regular patching cadence.

How Do Adversaries Use the Important Information They Siphoned?
They can use the information gained from specifically target individuals and organizations to coerce the campaign, or they release the information to swing public opinion to benefit their goals. Conspiracy theorists used John Podesta's spearphished emails to undermine his authority by spreading rumors across fake news sites and falsely connect high-ranking Democratic Party officials to a child-sex ring. Despite this theory being debunked, the information influenced the course of the election.

Even if the hacker’s candidate of-choice is not elected, the information's integrity becomes a distraction as authority figures are discredited, creating social and political instability. This pattern of information campaign sabotage is easily replicated. My last quarterly Center for Strategic International and Studies (CSIS) Cybersecurity fellows meeting was consumed with understanding where and when this will occur next. It is a leading conversation for security and policy professionals this year.

How Can We Protect the Election Ecosystem from the Biggest Risks?
Political information campaigns have existed for over 3,000 years. The cyber landscape makes espionage and information wars more efficient by removing physical proximity and access requirements. In Watergate, the malicious actors needed physical proximity and access to obtain the information. Today, they access information remotely, expanding the threat parameters.

Protecting the 2018 election cycle requires fixing the information infrastructure. Voters need to worry less about the election machines and more about the security of the organizations from where malicious actors obtain information. 

The vulnerabilities in state and local government security need to be addressed so that the indirect influence of hackers can be restrained. Additionally, nongovernmental organizations need help improving their cybersecurity posture.

However, none of the cybersecurity issues alone can protect the elections without finding a dampening solution for the use of social media as an accelerant to spread false information. Official government actors and private political stakeholders need to protect their data environments to begin rebuilding the trust that ensures election integrity.

Related Content:

Black Hat Europe returns to London Dec. 3-6, 2018, with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions, and service providers in the Business Hall. Click for information on the conference and to register.