The BBC has reported that a report outlines major flaws in voting hardware, weeks before US mid-term elections. One ballot machine, used in 23 US states, carries a cybersecurity flaw that was reported over a decade ago, the hackers claim.
Ross Rustici, senior director of threat intelligence at Cybereason, gives the following 5 takeaways for dealing with potential election hacking scenarios.
1. Make route communication between local, state and federal agencies. This will insure that when a crisis happens, all sides are coordinating effectively and conveying the same message across all levels of government.
2. The ability to get ahead of the consequences is the key to stopping this type of attack. Joint task forces between state and federal resources are the only way to achieve this. But to be successful, a traditional police approach of assess, collect evidence, arrest cannot be taken. Disruptive operations is really important.
3. When disinformation is being spread, the narrative needs to be controlled early. Not countering the fake social media posts as soon as they appear is a big disadvantage for the defenders. Local and state governments need staff monitoring social media and sending out messages to counter any false information that’s posted.
4. There is a fundamental difference in capability between a human saboteur and a cyber one. The speed at which cyber actors can layer real world effects easily overwhelm local responders if they aren’t prepared for it.
5. Election meddling is greater than the direct effects and it is often the indirect means that have the ability to do the most harm. The second and third order effects leave greater room for doubt.
This comes just days after Cybereason conducted a Tabletop Election Security Exercise at its headquarters, showcasing how a team of hackers could try to disrupt the 2018 midterm election.
With the midterm elections approaching on November 6, and the news almost exclusively focused on the prospect of foreign countries influencing how people vote, the event shifted the attention to jeopardising voting integrity on election day. Rather than stealing voter registration roles or hacking electronic voting machines, the simulation revealed less obvious but equally effective methods, such as taking out emergency services, disrupting electricity supplies and spreading fake news through social media.
Event participants included a Red Team comprised of Cybereason employees, Boston College students and staff from Boston Mayor Marty Walsh’s office. A Blue Team comprised former Boston Police Commissioner Ed Davis, Massachusetts State Police, Lowell Police and Boston College Police. A White Team included staff from Ed Davis LLC, Cybereason and Massachusetts Governor Charlie Baker’s office.
“The hackers’ goal was not to manipulate or stop the vote, it was to get voters to question the validity of the system itself. This exercise showed how hackers can go beyond just hacking the polls and instead create long-term doubt in our nation’s electoral process,” said Ross Rustici, Cybereason’s senior director of intelligence services and the white team leader.
More details on Cybereason’s Election Hacking tabletop exercise is available here: https://www.cybereason.com/blog/election-cybersecurity-cyberattack