A Plan to Engage Hackers in Election Security

In this Sept. 25, 2019 photo, Indiana Secretary of State Connie Lawson demonstrates an upgraded voting machine on Wednesday, Sept. 25, 2019, at the Indiana Statehouse office in Indianapolis.

In this Sept. 25, 2019 photo, Indiana Secretary of State Connie Lawson demonstrates an upgraded voting machine on Wednesday, Sept. 25, 2019, at the Indiana Statehouse office in Indianapolis. AP Photo/Tom Davies

 

Connecting state and local government leaders

The Information Technology-Information Sharing and Analysis Center wants to create a coordinated vulnerability disclosure program that could alert vendors about security flaws in their voting systems.

Fueled by monetary rewards and curiosity, hackers have played a significant role in helping companies discover and fix security vulnerabilities in a variety of technology and software applications.

But one year out from the 2020 presidential election, can they do more to help secure voting systems? Technology researchers hope so.

The Information Technology-Information Sharing and Analysis Center (IT-ISAC) is evaluating the feasibility of creating a coordinated vulnerability disclosure (CVD) program that could alert voting system companies about weaknesses.

The first step in establishing a CVD program requires voting vendors to have a system in place for receiving information about discovered vulnerabilities and acting on that information—procedures several vendors have already begun to implement, said Scott Algeier, the executive director of IT-ISAC, a non-profit that serves as a clearinghouse for information on cyber threats to critical infrastructure.

Where the industry can use help is in developing a way to crowd-source vulnerability detection on voting systems.

To address these concerns, IT-ISAC issued a request for information seeking to address challenges unique to rolling out a program across the industry. Since the comment period closed Oct. 21, the group has been reviewing the input provided.

Since U.S. intelligence officials confirmed the extent of Russian interference in the 2016 elections, states and local governments have sought to improve election security, with some transitioning to paper ballots and others purchasing new voting machines. But challenges remain and as foreign adversaries continue to target U.S. elections, “there is a sense of urgency” to shore up voting systems as the 2020 presidential election nears, Algeier said.

Responses IT-ISAC received from its request for information include input on how broad the scope of the CVD program should be, including whether it should incorporate vulnerabilities related to only voting machines or also other election-related infrastructure, Algeier said. There was also a recognition that some modernization will be required on the part of the Election Assistance Commission’s certification processes so that when weak points are found, patches can be deployed and voting systems recertified in a timely manner, he said.

One of the difficulties researchers are trying to address in the request for information is how they can deploy a CVD program centered on elections equipment that is not designed to be connected to the internet. Researchers need physical access to the equipment, so there are security concerns. Because elections systems have been deemed critical infrastructure, Algeier likens it to giving unvetted researchers access to a nuclear power plant.

“You want to make sure the people you are giving access to the voting machines aren’t agents of a foreign power, aren’t people with malicious intent,” he said. “Nobody is suggesting that any random person be able to go inside a nuclear power plant and say ‘I’m a researcher and I want to find out how your code interacts with your nuclear power plant and make sure everything works OK.’”

Despite the difficulties in figuring out a solution, cybersecurity experts say CVD programs should not be optional for voting system vendors given the nature of what is at stake.  

“We should not allow our election vendors to put their heads in the sand and pretend vulnerabilities don’t exist,” said Alex Rice, the chief technology officer and co-founder of HackerOne, an online platform that connects companies with hackers who are paid to find the flaws that could let others in.

Companies involved in other aspects of election security have started to roll out disclosure programs to address vulnerabilities. Microsoft recently announced a bug bounty program that could pay up to $15,000 to security researchers who find weaknesses in its ElectionGuard program, which allows voters to verify online that their vote was counted and not altered.

Unlike deploying a software patch through a few lines of code, fixing vulnerabilities discovered on a voting machine can be a time-consuming process that involves physically working on every machine. Algeier said vendors are particularly concerned with ensuring that any problems are communicated in a confidential manner to give them time to fix the issue before information is made public so that vulnerabilities are not exploited.

Such concerns have made headlines during Def Con, an annual hacker conference where participants can test the security of election systems at the conference’s “Voting Village.”

The event has produced scathing reports on security flaws in vendors’ elections systems that have created tension between researchers and the voting system vendors.

The Voting Village event shows there is plenty of interest in the hacker community to address voting system vulnerabilities, Rice said. But without vendor participation, discoveries made at the event may not be helpful.  

“There are vulnerabilities that are overblown and there are solutions that are not practical,” Rice said of some of the flaws disclosed through the event. “You need both parties there collaborating to prepare a comprehensive review of what matters and what doesn’t.”

The point of developing a CVD program is to ensure both sides are working together to communicate information about vulnerabilities, Algeier said.

The IT-ISAC is currently reviewing comments it received through the request for information and plans to announce next steps after that review is complete, Algeier said.

Andrea Noble is a staff correspondent with Route Fifty.

FEATURED CASE STUDIES
Powered By The Atlas
Orlando Protects Citizens During Heavy Rain Events by Optimizing Water Data Intelligence
Orlando, FL, USA
Small city of Baldwin, GA with <5K residents reduces info calls to City Hall by 50%
Baldwin, GA, USA
Integrated city systems, unified data, & automation drive 316% increase in field efficiency
Seattle, WA, USA

NEXT STORY: The Toxic Bubble of Technical Debt Threatening America

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.