And large-scale controversy, increasingly, brings bad actors in cyberspace looking to capitalize. After all, cybercrime is perpetrated by opportunists looking for the simplest path to success. Take, for example, the cascade of fraudulent unemployment claims targeting the billions of dollars in CARES Act funding flowing to states from the federal government earlier this year as COVID-19 decimated entire sectors of the economy. According to cybersecurity company Agari, one Nigeria-based group used stolen personal information to take advantage of abbreviated validation periods brought on by the emergency circumstances of the pandemic. Work is ongoing to recover the hundreds of millions of dollars that were stolen.
And as Nov. 3 nears, experts are pointing to a perfect storm of vulnerabilities to American election infrastructure. Government Technology has extensively covered the rise of ransomware over the past few years, documenting devastating attacks on school districts, cities, state agencies and more. In August, authorities from the federal Cybersecurity Infrastructure Security Agency and the FBI sounded the ransomware alarm as it relates to voter registration databases.
And as we saw in 2016, an attack doesn’t have to be technically successful to cause chaos. Myriad news reports documented the fact that foreign adversaries breached voter databases in states across the country. In Illinois, attackers accessed the personal data of more than 75,000 voters. But state elections officials insist that voter data was not altered, nor could it have been.
“We know where they got in and we know what the permissions were once you broke into that area,” Matt Dietrich, State Board of Elections spokesperson, told The Chicago Tribune. “It wouldn’t have allowed you to change or edit or delete any data.”
But the breach did shake the public’s confidence in election systems more generally. And despite broad agreement from cybersecurity officials that tampering with actual vote counts is incredibly unlikely, lingering doubts from the public are harder to overcome.
The decentralized nature of elections in this country helps guard against threats, since it’s more difficult to orchestrate a large-scale attack against so many distributed targets. And elections officials across the country have been diligently working to secure every aspect of the voting process, to preserve the integrity of this most fundamental aspect of our democracy. It requires constant vigilance. But resources are scarce and levels of preparedness vary widely.
“We look at each and every system and process, no matter if it is seen as less risky or not,” Aman Bhullar, CIO of the Los Angeles County Registrar-Recorder/County Clerk, told GT recently. “Even a system as simple as email is very important during an election. We look at every threat vector as an opportunity to harden our systems [and] processes so that there is no way an attacker has an advantage.”
Elections officials should use every available resource — and there’s ample evidence that they are — to ensure U.S. elections infrastructure is as impenetrable as possible. This includes lining up the right private-sector partners and heeding best practices guidance from organizations like the EI-ISAC, the Elections Infrastructure organization of the Information Sharing and Analysis Center. The future of fair elections depends on it.
