FBI says hackers attacked state election computers; here's what they might be up to
Yahoo has published the FBI flash. (Click for PDF)
The FBI has issued a warning that state board of election websites are being targeted by hackers, and in at least one case, voter data has been stolen. Yahoo News Michael Isikoff first reported the attack and posted the FBI warning online (against the FBI's wishes). It's very serious. Clearly the FBI is taking it seriously. The agency has warned others states to scan their logs for attacks and offered to help them secure their systems just a few months before a major national election.
As with all such hacking stories, it's always challenging to right-size the scare, however. Isikoff reported -- outside of the bulletin -- that the state of Illinois' system was successfully attacked and hackers stole data on 200,000 residents through the state's voter registration system.
That sounds scary, but on the surface, it's not. Voter registration records are for sale in most places. And they have found their way online before. Here's a story about 190 million voter records being exposed.
Many states now have "check your voting registration record" portals online. Find yours now! All I needed was a name and a birthday to find mine, so that's easily "hackable." But all you get when you "hack" me is my street address and a list of elections I've voted in (not who I've voted for, just when I voted.)
So "hacking" a few hundred thousand such records isn't that scary.
On the other hand, there could very well be more going on. For starters, the notion that someone is probing state election web sites for holes is scary enough, let alone finding holes. Maybe it's someone just looking for birthdays. But it's easy to imagine it's someone looking to use those computers as a jumping-off point -- to escalate privileges. When you saw this headline, your mind immediately jumped to the possibility that a hacker could impact votes themselves, and possibly change an election outcome. You might imagine a hacker escalating from board of elections servers to vote tabulation machines. That's a pretty big leap, however. Very few states us electronic voting machines. so paper records are available to double check election results.
More alarming, however, is the servers those board of election computers talk with. In most states, voters can be required to provide some kind of authentication document, like a driver's license. How are licenses squared with voter records? The databases have to talk somehow. And that's where you can start to imagine all kinds of chaos. Can board of elections hackers find their way to driver license numbers? Photographs? Other data that would be a treasure to ID thieves?
For guidance on this, I turned to Harri Hursti and Margaret MacAlpine. The duo routinely perform audits on voting systems in the U.S. and around the world. Hursti is also creator of the famous "Hursti Hack," which was the first documented attack on Diebold electronic voting machines that managed to actually change votes.
For starters, both confirmed that in states they've audited, voter registration lists maintained by states can contain data beyond what's typically considered voter registration data -- name, address, and party affiliation.
MacAlpine offered up this list of potential horribles that hackers could accomplish with stolen registration data:
Wipe (voters) in order to cause havoc
Send people to impersonate (voters)
Wipe people strategically.
Intimidate (voters) if they've got the "wrong" voting record
Major distrust to the democratic systems' ability to protect people's information. People may choose not to register or maintain their registration if this became a widespread threat.
Hursti add to the list that even a small theft could wreak havoc in a specific voting area.
"With 200,000 records you can throw election into chaos," he said.
But he was even more worried about an often-overlooked attack plan -- adding records. Creating fake voters.
"Is there a field in this database where you can insert records?" he asked. "People are always looking at what is stolen, but sometimes you steal things to distract people from what you are adding."
Maggie MacAlpine
There are plenty of steps in the U.S. election process -- clunky as it is -- that would mitigate such an attack. Should voters be erased from registration records, they can still fill out provisional ballots at polling places, for example. (Here's a nice explanation of that and other checks). So again, it's important to right-size the fear here.
To answer the question hanging in the air -- it would be difficult for Russian hackers to flat-out steal a presidential election electronically. (It would be much easier in an election like 2000, where a few votes in predictable places could cause a swing. But those problems go far beyond Russian hackers, as I'm sure you know).
On the other hand, it's not hard to imagine a local election being wrecked by hackers; and already-skeptical voters becoming even more disillusioned with our democratic process, which might be the biggest hack of all.
That's why MacAlpine says this incident is an important reminder that the U.S. needs to invest a lot more in election integrity.
"This reinforces the importance of treating voting as critical infrastructure," she said. "There are small counties where they would never discover this kind of attack. They don't have infrastructure or budget to do a cyber audit. We only care about this because it's a presidential election year . But we can't care about election security only once every four years."
If you've read this far, perhaps you'd like to support what I do. That's easy. Sign up for my free email list, or click on an advertisement, or just share the story.