{"id":4796,"date":"2016-07-29T23:45:42","date_gmt":"2016-07-29T23:45:42","guid":{"rendered":"http:\/\/www.lifeandnews.com\/articles\/?p=4796"},"modified":"2019-04-06T09:03:05","modified_gmt":"2019-04-06T09:03:05","slug":"how-vulnerable-to-hacking-is-the-us-election-cyber-infrastructure","status":"publish","type":"post","link":"https:\/\/www.lifeandnews.com\/articles\/how-vulnerable-to-hacking-is-the-us-election-cyber-infrastructure\/","title":{"rendered":"How Vulnerable to Hacking is the US Election Cyber Infrastructure?"},"content":{"rendered":"

Richard Forno<\/a>, University of Maryland, Baltimore County<\/a><\/em><\/p>\n

Following the hack of Democratic National Committee emails and reports of a new cyberattack against the Democratic Congressional Campaign Committee<\/a>, worries abound that foreign nations may be clandestinely involved in the 2016 American presidential campaign. Allegations swirl that Russia<\/a>, under the direction of President Vladimir Putin, is secretly working to undermine the U.S. Democratic Party. The apparent logic is that a Donald Trump presidency would result in more pro-Russian policies. At the moment, the FBI is investigating<\/a>, but no U.S. government agency has yet made a formal accusation.<\/p>\n

The Republican nominee added unprecedented fuel to the fire by encouraging Russia to \u201cfind\u201d<\/a> and release Hillary Clinton\u2019s missing emails from her time as secretary of state. Trump\u2019s comments drew sharp rebuke from the media and politicians on all sides. Some suggested that by soliciting a foreign power to intervene in domestic politics, his musings bordered on criminality or treason. Trump backtracked, saying his comments were \u201csarcastic,\u201d<\/a> implying they\u2019re not to be taken seriously.<\/p>\n

Of course, the desire to interfere with another country\u2019s internal political processes is nothing new. Global powers routinely monitor their adversaries and, when deemed necessary, will try to clandestinely undermine or influence foreign domestic politics to their own benefit. For example, the Soviet Union\u2019s foreign intelligence service engaged in so-called \u201cactive measures<\/a>\u201d designed to influence Western opinion. Among other efforts, it spread conspiracy theories about government officials and fabricated documents intended to exploit the social tensions of the 1960s. Similarly, U.S. intelligence services have conducted their own secret activities against foreign political systems \u2013 perhaps most notably its repeated attempts to help overthrow<\/a> pro-communist Fidel Castro in Cuba.<\/p>\n

Although the Cold War is over, intelligence services around the world continue to monitor other countries’ domestic political situations. Today\u2019s \u201cinfluence operations<\/a>\u201d are generally subtle and strategic. Intelligence services clandestinely try to sway the \u201chearts and minds\u201d of the target country\u2019s population toward a certain political outcome.<\/p>\n

What has changed, however, is the ability of individuals, governments, militaries and criminal or terrorist organizations to use internet-based tools \u2013 commonly called cyberweapons<\/a> \u2013 not only to gather information but also to generate influence within a target group.<\/p>\n

So what are some of the technical vulnerabilities faced by nations during political elections, and what\u2019s really at stake when foreign powers meddle in domestic political processes?<\/p>\n

\"\"<\/a>
Ohio citizens using electronic voting machines during the 2012 presidential election.<\/span>
\nAaron Josefczyk\/Reuters<\/span><\/span><\/figcaption><\/figure>\n

Vulnerabilities at the electronic ballot box<\/h2>\n

The process of democratic voting requires a strong sense of trust \u2013 in the equipment, the process and the people involved.<\/p>\n

One of the most obvious, direct ways to affect a country\u2019s election is to interfere with the way citizens actually cast votes. As the United States (and other nations<\/a>) embrace electronic voting, it must take steps to ensure the security \u2013 and more importantly, the trustworthiness \u2013 of the systems. Not doing so can endanger a nation\u2019s domestic democratic will and create general political discord \u2013 a situation that can be exploited by an adversary for its own purposes.<\/p>\n

As early as 1975, the U.S. government examined the idea of computerized voting<\/a>, but electronic voting systems were not used until Georgia\u2019s 2002 state elections<\/a>. Other states have adopted the technology since then, although given ongoing fiscal constraints, those with aging or problematic electronic voting machines are returning to more traditional<\/a> (and cheaper) paper-based ones.<\/p>\n

New technology always comes with some glitches \u2013 even when it\u2019s not being attacked. For example, during the 2004 general election, North Carolina\u2019s Unilect e-voting machines \u201clost\u201d 4,438 votes<\/a> due to a system error.<\/p>\n

But cybersecurity researchers focus on the kinds of problems that could be intentionally caused by bad actors. In 2006, Princeton computer science professor Ed Felten<\/a> demonstrated how to install a self-propagating piece of vote-changing malware on Diebold e-voting systems<\/a> in less than a minute. In 2011, technicians at the Argonne National Laboratory showed how to hack e-voting machines remotely<\/a> and change voting data.<\/p>\n

Voting officials recognize that these technologies are vulnerable. Following a 2007 study of her state\u2019s electronic voting systems, Ohio Secretary of State Jennifer L. Brunner announced that<\/a><\/p>\n

the computer-based voting systems in use in Ohio do not meet computer industry security standards and are susceptible to breaches of security that may jeopardize the integrity of the voting process.<\/p><\/blockquote>\n

As the first generation of voting machines ages, even maintenance and updating become an issue. A 2015 report found that electronic voting machines in 43 of 50 U.S. states are at least 10 years old<\/a> \u2013 and that state election officials are unsure where the funding will come from to replace them.<\/p>\n

Securing the machines and their data<\/h2>\n

In many cases, electronic voting depends on a distributed network, just like the electrical grid or municipal water system. Its spread-out nature means there are many points of potential vulnerability.<\/p>\n

First, to be secure, the hardware \u201cinternals\u201d of each voting machine must be made tamper-proof at the point of manufacture. Each individual machine\u2019s software must remain tamper-proof and accountable, as must the vote data stored on it. (Some machines provide voters with a paper receipt of their votes, too.) When problems are discovered, the machines must be removed from service and fixed. Virginia did just this in 2015 once numerous glaring security vulnerabilities were discovered<\/a> in its system.<\/p>\n

Once votes are collected from individual machines, the compiled results must be transmitted from polling places to higher election offices for official consolidation, tabulation and final statewide reporting. So the network connections between locations must be tamper-proof and prevent interception or modification of the in-transit tallies. Likewise, state-level vote-tabulating systems must have trustworthy software that is both accountable and resistant to unauthorized data modification. Corrupting the integrity of data anywhere during this process, either intentionally or accidentally, can lead to botched election results.<\/p>\n

However, technical vulnerabilities with the electoral process extend far beyond the voting machines at the \u201cedge of the network.\u201d Voter registration and administration systems operated by state and national governments are at risk too. Hacks here could affect voter rosters and citizen databases. Failing to secure these systems and records could result in fraudulent information in the voter database that may lead to improper (or illegal) voter registrations and potentially the casting of fraudulent votes.<\/p>\n

And of course, underlying all this is human vulnerability: Anyone involved with e-voting technologies or procedures is susceptible to coercion or human error.<\/p>\n

\"\"<\/a>
Voting machines in the warehouse before they are sent out to local precincts.<\/span>
\nChris Keane\/Reuters<\/span><\/span><\/figcaption><\/figure>\n

How can we guard the systems?<\/h2>\n

The first line of defense in protecting electronic voting technologies and information is common sense. Applying the best practices<\/a> of cybersecurity, data protection, information access and other objectively developed, responsibly implemented procedures makes it more difficult for adversaries to conduct cyber mischief. These are essential and must be practiced regularly.<\/p>\n

Sure, it\u2019s unlikely a single voting machine in a specific precinct in a specific polling place would be targeted by an overseas or criminal entity. But the security of each electronic voting machine is essential to ensuring not only free and fair elections but fostering citizen trust in such technologies and processes \u2013 think of the chaos around the infamous hanging chads<\/a> during the contested 2000 Florida recount<\/a>. Along these lines, in 2004, Nevada was the first state to mandate e-voting machines include a voter-verified paper trail<\/a> to ensure public accountability for each vote cast.<\/p>\n

Proactive examination and analysis of electronic voting machines and voter information systems are essential to ensuring free and fair elections and facilitating citizen trust in e-voting. Unfortunately, some voting machine manufacturers have invoked<\/a> the controversial Digital Millennium Copyright Act<\/a> to prohibit external researchers from assessing the security and trustworthiness of their systems.<\/p>\n

However, a 2015 exception to the act<\/a> authorizes security research into technologies otherwise protected by copyright laws. This means the security community can legally research, test, reverse-engineer and analyze such systems. Even more importantly, researchers now have the freedom to publish their findings without fear of being sued for copyright infringement. Their work is vital to identifying security vulnerabilities before they can be exploited in real-world elections.<\/p>\n

Because of its benefits and conveniences, electronic voting may become the preferred mode for local and national elections. If so, officials must secure these systems and ensure they can provide trustworthy elections that support the democratic process. State-level election agencies must be given the financial resources to invest in up-to-date e-voting systems. They also must guarantee sufficient, proactive, ongoing and effective protections are in place to reduce the threat of not only operational glitches but intentional cyberattacks.<\/p>\n

Democracies endure based not on the whims of a single ruler but the shared electoral responsibility of informed citizens who trust their government and its systems. That trust must not be broken by complacency, lack of resources or the intentional actions of a foreign power. As famed investor Warren Buffett once noted<\/a>, \u201cIt takes 20 years to build a reputation and five minutes to ruin it.\u201d<\/p>\n

In cyberspace, five minutes is an eternity.<\/p>\n

\"The<\/p>\n

Richard Forno<\/a>, Senior Lecturer, Cybersecurity & Internet Researcher, University of Maryland, Baltimore County<\/a><\/em><\/p>\n

This article was originally published on The Conversation<\/a>. Read the original article<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"

Richard Forno, University of Maryland, Baltimore County Following the hack of Democratic National Committee emails and reports of a new cyberattack against the Democratic Congressional Campaign Committee, worries abound that foreign nations may be clandestinely involved in the 2016 American presidential campaign. Allegations swirl that Russia, under the direction of President Vladimir Putin, is secretly […]<\/p>\n","protected":false},"author":40,"featured_media":5064,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[46,295],"tags":[794,796,798,612,473,479,799,474,800,797,793,477,760,475,795],"_links":{"self":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/4796"}],"collection":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/users\/40"}],"replies":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/comments?post=4796"}],"version-history":[{"count":3,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/4796\/revisions"}],"predecessor-version":[{"id":5180,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/posts\/4796\/revisions\/5180"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media\/5064"}],"wp:attachment":[{"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/media?parent=4796"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/categories?post=4796"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.lifeandnews.com\/articles\/wp-json\/wp\/v2\/tags?post=4796"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}