Nov 7, 2019

Why all infrastructure systems are election systems

Illustration: Eniola Odetunde/Axios

Protecting elections from hacking threats means a lot more than protecting election systems from being hacked. Malicious hackers can find plenty of other ways to interfere with elections — notably by discouraging voting through election-day attacks on municipal systems.

Driving the news: Security firm Cybereason has been exploring that kind of election tampering in a series of tabletop simulations over the last year. Tuesday, at the third exercise — essentially a Dungeons and Dragons-style game for law enforcement, government employees and security researchers — a "red team" pretended to attack a city, while a "blue team" defended it.

How it works: Imagine a strategically placed traffic jam outside a polling place in a heavily Republican district. A hacker tampering with traffic lights is just one way someone could sway an election by influencing which voters can show up, all without touching the systems most associated with voting.

  • With so much focus on voting machines, we may be missing the threat of these kinds of attacks.

Here are additional lessons from Cybereason's games:

1. Everything is a weapon. The red team has used transportation, energy and gas, telecommunications, and government and emergency services networks in attacks. And it's easy to see how any aspect of infrastructure could be weaponized on Election Day, from causing a run on banks or a fire in a strategically chosen factory.

2. A key term to know: asymmetry. The main goal of local law enforcement, the first people who would respond to this type of attack, is to protect public safety. The main goal of someone disrupting an election is to, well, disrupt an election. The goals are asymmetrical — they don't require one group to lose for the other one to win.

  • That's something that could be exploited by the attacker. A fire at a factory near a polling place might mean city officials reroute voters to a different polling place. The city wins because people stay safe, yet the attacker wins because casual voters won't put in the extra effort to figure out where they need to go to vote.

3. It's good to have friends. Teams, often composed of law enforcement officials, have struggled to quickly call in federal agencies to handle the problems only federal agencies are equipped to solve or to request state resources when the local police are overburdened.

4. Worry about more than social media: Since 2016, the public has come to realize that social media disinformation is cheap and requires little technical background to launch. But it's not necessarily the most effective way for a sophisticated attacker to shape an election.

  • Social media meddling is "low-hanging fruit," said Sam Curry, chief security officer at Cybereason.
  • But it's a limited tool for affecting votes in terms of reach, effectiveness and time before being identified. For someone with technical skill, the traffic jam may cause more chaos and affect more votes.

The bottom line: The frightening truth is that all critical infrastructure is election infrastructure. Weak links anywhere can be exploited to shape how voters act.

Go deeper

DHS announces election audits tool

Homeland Security's main cyber division Thursday announced a new tool to help election officials audit voting machines — the first version of which is already deployed in six states.

Why it matters: While a lot of attention gets paid to voting machine security, auditing machines during an election is equally as important: It's the only way to tell whether machines were hacked or malfunctioned.

Go deeperArrowNov 21, 2019

The myth of the sophisticated hacker

Illustration: Aïda Amer/Axios

On Tuesday, the U.K.'s Labour Party became the latest in a decade-long line of victims to claim they were targeted by a "sophisticated" cyberattack that wasn't, actually, very sophisticated.

The big picture: It's the latest lexical stretch for an adjective that's widely used in reports of cybersecurity incidents — and widely loathed by researchers as a result. If everything is sophisticated, nothing is sophisticated.

Go deeperArrowNov 14, 2019

Pro-Trump group finds swing voters are unconvinced on impeachment

Photo: Mandel Ngan/AFP via Getty Images

The pro-Trump group America First says focus groups show that suburban swing voters — even some who strongly dislike President Trump — remain skeptical about impeachment.

Why it matters: These early findings will help shape Republican messaging about impeachment and Trump's top Democratic rivals.

Go deeperArrowNov 19, 2019