15 ms·

DHS, FBI say election systems in all 50 states were targeted in 2016

161 points by howard941 8y ago

Top19 8y ago
Yeah not surprising. Used to work for the Texas Gov Storage IT. Those guys left the single file server for all of Secretary of State (department that manages elections) up on the internet for months to make remote access / working from home possible. SSL certs, keebase backups, it was all there. Behind a single user/pass form with a 12 char pass. Would be stupid to not target these states. This was in September 2018.
- veryworried 8y ago
  Not sure why you posted something so specific and fairly recent, it was easy to find more data. They could put you in prison for this dox.
OneWordSoln 8y ago
Does anyone know if there is a statistically significant difference between the electronic and paper machines in the swing states? I seem to remember hearing that Wisconsin had a very skewed correlation based upon county machine type, but would love to see the actual breakdown.
carrja99 8y ago
But what will they do about it? Absolutely nothing. Republican politicians don't care and I honestly don't understand why not. Election security should be a truly non-partisan issue, yet whenever they talk about election security it's not this it's about disenfranchising certain voting blocks.
- blackflame7001 8y ago
  Then why are Democrats against showing an ID to prove you are who you say you are? Why are Democrats OK with allowing ballot harvesting in California when the election in North Carolina was invalidated for the same reason?
  - throwaway5752 8y ago
    Ballot harvesting is not de facto bad. It can help increase turnout with indigent, disabled, and elderly. However, what happen in North Carolina was 1) ballot harvesting 2) alteration of the harvested ballots. They picked up the ballots and then changed the ballots they collected Did that happen in California?
    - akhilcacharya 8y ago
      (It didn't!) The results in NC-9 are also incredibly suspicious even back down to the Republican primary.
      - jerf 8y ago
        "(It didn't!)" How do you know? And moreover, why should I know that? Elections have no purpose if nobody trusts the results afterwards. That dominates all other concerns about elections, because if you don't have that, your election with all the other desirable characteristics is still just so much wasted time.
        kevingadd 8y ago
        Assuming ballots were modified is kind of a weird stance to take, isn't it? I mean, you're welcome to assume it, but we don't have many historical cases of it happening until recently. It'd be one thing to assume it by default in every state if we knew there was a long history of it happening everywhere... instead we seem to be treating the possibility as an excuse for making it harder for citizens to vote. Weird how that works. We could always verify the ballots after the fact if you're really concerned that every absentee ballot is being forged.
        jerf 8y ago
        "Assuming ballots were modified is kind of a weird stance to take, isn't it?" No, it's perfectly sensible stance to take. The stakes are enormous and the idea that everyone's just so peachy-keen on fair play that we don't have to structure the system to be robust against hostile modification is refuted merely by stating the case. Just bring up whoever are your political bogeymen and ask yourself if they're that moral. The answer is no, obviously. They're the bad guys. (Besides, didn't we just spend two years agreeing that the Russians were deeply involved with our elections in all sorts of nefarious ways? Now suddenly elections are all totally safe and anyone who questions it is obviously racist and just wants to keep the brown people from voting. You'll pardon me if I can't keep up with all the shifts in the Official Opinions. I'm sure no Russians have looked at our remote ballots and thought about what they could do with it. Or whomever else you like.) In addition to the first-order security concerns around getting a fair ballot count, there's also the second-order concerns that elections must not just be fair, but have all the appearance of being fair. They don't appear fair when the ballots are filled in, and then disappear from the pipeline for arbitrary periods of time, only to re-appear somewhere else. Even if the system is stipulated to be entirely fair, when the loser (who could be the Good Guys, you know, because obviously the Bad Guys are waaay more likely to cheat than the Good Guys) says "Hey, the vote may have been manipulated!", how do you prove them right or wrong? Personally, I have my own conspiracy theory which is that it rather suits our Powers that Be that the increasing number of absentee ballots and similar voting "options" makes the elections easier to forge, and citing "oh, what if poor suffering people don't get to vote?" is a rather convenient cudgel for them to pick up and hit anyone who wants to ensure security in voting with.
- chabes 8y ago
  “Republican politicians don't care and I honestly don't understand why not.” If your party is the minority (in votes, not representatives), but you need votes to win, gerrymandering, vote suppression, unaccountability, and fraud are all welcome tactics. Majority party does it too, but doesn’t rely on it quite as much
  - man2525 8y ago
    Gerrymandering can be used to unseat an incumbent, but often it creates a safe district for one. The candidate can then loan out their warchest to members of their caucus running in closer elections. Ending the practice may end the horse trading that takes place behind closed doors. Maybe then GOP senators can spend July 4th at home rather than in Moscow presumably as some kind of a low man on the totem pole cleanup crew.
motohagiography 8y ago
It's worth the down votes each time I add a comment on this topic, but it bears repeating that since electronic elections are not verifiable in any meaningful way, their legitimacy is suspect, and electronic voting actively creates the conditions for violence in response to contested results. Everybody knows this now and the effects are so predictable it brings into question the motives of people who have an interest in both undermining and discrediting the democratic process by using these machines.
- asveikau 8y ago
  The first time I remember people making comments of this nature on tech sites was close to 20 years ago, when in the aftermath of the 2000 elections, some said electronic voting was the answer, but the companies promoting such solutions seemed universally slimey and not security conscious. I don't think anything has changed since those days. I think part of the problem has got to be that non-experts cannot judge how good a security solution is, so local governments are ill equipped to view it with a skeptical eye. There might also be in some way a downside of federalism here - if the states pooled more resources perhaps they would be able to solve the problem once instead of 50 times.
- Fnoord 8y ago
  The first line of your post is not necessary, and against HN guidelines. Your post doesn't need such either as it stands on its own. It only weakens your argument as an appeal to pity. Don't do that please.
  - deleted 8y ago
    [deleted]
  - drharby 8y ago
    With all due respect, that appeal to pity only weakens the argument of his post is read from a persuasive writing perspective. However, in viewing this post in an exchange of ideas, it carries necessary information. OP cites the unpopularity not as an appeal to pity but as an expression of ideas. To require all posts adhere to a framework of persuasion is unnecessary speech censorship.
dahfizz 8y ago
Do we know anything about what these hackers accomplished / what effect they had on the election? The idea that our election infrastructure is "targeted" is scary but not very surprising. Every web server on the internet is "targeted", so why wouldn't something as valuable as election infrastructure?
- howard941 8y ago
  > Do we know anything about what these hackers accomplished / what effect they had on the election? Reports of attacks that aren't repelled corrodes trust in the integrity of elections. http://time.com/5510100/risk-limiting-audit-election-security/ http://time.com/5510100/risk-limiting-audit-election-securit...
  - dahfizz 8y ago
    >.. attacks that aren't repelled... I guess this is what I'm asking. Were the attacks repelled, or did the hackers actually hack/break/change something? What was that thing? I'm genuinely asking.
- penagwin 8y ago
  That's what I was wondering too. I mean, I'd expect all major Nation States to "research" each other's voting systems and "direct visits to—election websites". Duh why wouldn't you? Like, okay? Here's my state's website. Have fun? https://www.michigan.gov/sos/0,4670,7-127-1633-49313--,00.html https://www.michigan.gov/sos/0,4670,7-127-1633-49313--,00.ht...
deleted 8y ago
[deleted]
throwaway5752 8y ago
This is incredible. Rules of engagement are in profound need of overhaul. This is nothing less than a military attack on the US, via computer. No sufficiently large nation state is innocent, but targeting voting systems (and potentially vote totals) should be a glaring red line that has consequences, taking into account that attribution is falsifiable and hard.
- everdev 8y ago
  How do you feel about any foreign political intervention? I'd guess that 50+% of 3rd world leaders are supported by some foreign government financially or militarily which keeps them in power. But yes, it doesn't feel good when a foreign government tries to pick a winner in our elections.
  - throwaway5752 8y ago
    Correct me if I am wrong, but it sounds like you are asking me if I think changing voting results is equivalent to attempting to influence voters? No, I do not think those are remotely equivalent.
    - kurthr 8y ago
      Yeah, it's sort of like conflating asking for money with stealing... they may result in the same outcome, but result from extremely different actions.
    - everdev 8y ago
      Sorry, I think the point I was trying to make was that most governments try to openly influence politics in other countries rather than protecting free elections. I totally agree that vote rigging would be particularly egregious. However, I'm not sure that backing a regime with money / weapons / training, etc. that then goes ahead and rigs the vote is that much better. I think it's more like one scenario is stealing money and the other is investing in a gang that steals money. I just find it interesting that we openly try to pick political winners and losers in other countries.
everdev 8y ago
Does anyone know the details of these "election systems"? > Russian cyber actors in the summer of 2016 conducted online research and reconnaissance to identify vulnerable databases, usernames, and passwords in webpages of a broader number of state and local websites than previously identified This makes it sound like just election-related state websites. > a Russian campaign seeking vulnerabilities and access to election infrastructure For me, the term "Election infrastructure" sounds like it would include voting machines, voter registries, vote counts, etc.
charlesdaniels 8y ago
One of the faculty at my university has conducted some detailed analysis on the practice of electronic voting in the US. I believe this is the most up-to-date publication on the subject: https://cse.sc.edu/~buell/Public_Data/2019_VotingMachines.pdf https://cse.sc.edu/~buell/Public_Data/2019_VotingMachines.pd... I would also recommend the documentary "I Voted" (https://www.imdb.com/title/tt4081950/ https://www.imdb.com/title/tt4081950/). These aren't about the 2016 election in particular, but it would seem that there is strong evidence that the security practices in place by many US states are inadequate, and there is often no "paper trail" to verify that results were tallied accurately after the fact if a recount is needed. Considering the poor security, if the 2016 election was targeted, it is likely that the attacker(s) succeeded.
mrobot 8y ago
Is there really proof of much of anything in here? Seems like more Russia hysteria. Lots of use of the word "probably" and "likely" in this article.
fuckYoooouuuu 8y ago
You fucking suck. Get raped. In the ass. With AIDS.
zaroth 8y ago
> Between June and October of 2016, the group associated with the election hacking "researched websites and information related to elections in at least 39 states and territories, according to newly available FBI information," the bulletin states. "The same actors also directly visited websites in at least 30 states, mostly election-related government sites at both the state and local level—some of which overlap with the 39 researched states." > The "actors" performed their research "in alphabetical order by state name," the bulletin states, "suggesting that at least the initial research was not targeted at specific states." The research focused on Secretary of State voter registration and election results sites, but it also drilled down on some local election officials' webpages. As they accessed sites, actors "regularly attempted to identify and exploit SQL database vulnerabilities in webservers and databases." Voter registration information is public (although not technically to Russian citizens!). Visiting the front end websites of the state election authorities and attempting SQL injection on the web forms is not what some downthread are calling a military attack. However, I think it’s great to be sent such a wake up call in the form of a “tap on the shoulder” because these systems should be heavily monitored and better protected. The true election systems should require feet on the ground to compromise in any form. And they should not be electronic without a proper auditable paper record.
zyxzevn 8y ago
Until now this has all been bullshit accusations. The "false positives" are very common in these security reports, because they want a warning when there might be an attack. They do not list the numerous internal attacks that were reported too. These actually modified the votes. These votes can only be changed via physical access. But this is probably not politically interesting, and it involves corrupt staff members and such. I have been following a lot of this kind of security news. But let's follow the money. Homeland security has already prepared a plan to take over the election system in all states (from before 2016). It seems to me that these accusations are used to push to take over the voting system. Such a change would theoretically be good, but who watches the watchers? And why does DHS not report on the internal problems that actually changed votes?
ataturk 8y ago
This is fake news. Russians "visiting websites" is different than "targeting" them. There's really no substance to that article at all, it's simply more of generalized "Russian collusion" narrative that is supposed to lead the reader to believe that the 2016 Presidential election was tampered with by hackers in Russia for the benefit of Donald Trump. Except that it isn't true. There is no actual evidence any such thing took place. Furthermore, every single IP address is routinely "targeted" by all kinds of bots looking to add nodes to their bot nets. That some originated in Russia is not surprising. It doesn't mean that the machines were known to be part of voting apparatus. The whole "prove a negative" thing comes into play here. Prove Russia didn't hack the election. Sorry, I can't. Nobody can prove a negative. What was uncovered during the recounts was evidence of massive vote tampering in many large cities and counties, all to the benefit of the Democrat candidate(s). That's the news the media refuses to tell you, however.

161 points by howard941 8y ago

Yeah not surprising. Used to work for the Texas Gov Storage IT. Those guys left the single file server for all of Secretary of State (department that manages elections) up on the internet for months to make remote access / working from home possible. SSL certs, keebase backups, it was all there. Behind a single user/pass form with a 12 char pass. Would be stupid to not target these states. This was in September 2018.

veryworried 8y ago
Not sure why you posted something so specific and fairly recent, it was easy to find more data. They could put you in prison for this dox.

OneWordSoln 8y ago

Does anyone know if there is a statistically significant difference between the electronic and paper machines in the swing states? I seem to remember hearing that Wisconsin had a very skewed correlation based upon county machine type, but would love to see the actual breakdown.

carrja99 8y ago

But what will they do about it? Absolutely nothing. Republican politicians don't care and I honestly don't understand why not. Election security should be a truly non-partisan issue, yet whenever they talk about election security it's not this it's about disenfranchising certain voting blocks.

blackflame7001 8y ago
Then why are Democrats against showing an ID to prove you are who you say you are? Why are Democrats OK with allowing ballot harvesting in California when the election in North Carolina was invalidated for the same reason?
- throwaway5752 8y ago
  Ballot harvesting is not de facto bad. It can help increase turnout with indigent, disabled, and elderly. However, what happen in North Carolina was 1) ballot harvesting 2) alteration of the harvested ballots. They picked up the ballots and then changed the ballots they collected Did that happen in California?
  - akhilcacharya 8y ago
    (It didn't!) The results in NC-9 are also incredibly suspicious even back down to the Republican primary.
    - jerf 8y ago
      "(It didn't!)" How do you know? And moreover, why should I know that? Elections have no purpose if nobody trusts the results afterwards. That dominates all other concerns about elections, because if you don't have that, your election with all the other desirable characteristics is still just so much wasted time.
      - kevingadd 8y ago
        Assuming ballots were modified is kind of a weird stance to take, isn't it? I mean, you're welcome to assume it, but we don't have many historical cases of it happening until recently. It'd be one thing to assume it by default in every state if we knew there was a long history of it happening everywhere... instead we seem to be treating the possibility as an excuse for making it harder for citizens to vote. Weird how that works. We could always verify the ballots after the fact if you're really concerned that every absentee ballot is being forged.
        jerf 8y ago
        "Assuming ballots were modified is kind of a weird stance to take, isn't it?" No, it's perfectly sensible stance to take. The stakes are enormous and the idea that everyone's just so peachy-keen on fair play that we don't have to structure the system to be robust against hostile modification is refuted merely by stating the case. Just bring up whoever are your political bogeymen and ask yourself if they're that moral. The answer is no, obviously. They're the bad guys. (Besides, didn't we just spend two years agreeing that the Russians were deeply involved with our elections in all sorts of nefarious ways? Now suddenly elections are all totally safe and anyone who questions it is obviously racist and just wants to keep the brown people from voting. You'll pardon me if I can't keep up with all the shifts in the Official Opinions. I'm sure no Russians have looked at our remote ballots and thought about what they could do with it. Or whomever else you like.) In addition to the first-order security concerns around getting a fair ballot count, there's also the second-order concerns that elections must not just be fair, but have all the appearance of being fair. They don't appear fair when the ballots are filled in, and then disappear from the pipeline for arbitrary periods of time, only to re-appear somewhere else. Even if the system is stipulated to be entirely fair, when the loser (who could be the Good Guys, you know, because obviously the Bad Guys are waaay more likely to cheat than the Good Guys) says "Hey, the vote may have been manipulated!", how do you prove them right or wrong? Personally, I have my own conspiracy theory which is that it rather suits our Powers that Be that the increasing number of absentee ballots and similar voting "options" makes the elections easier to forge, and citing "oh, what if poor suffering people don't get to vote?" is a rather convenient cudgel for them to pick up and hit anyone who wants to ensure security in voting with.
chabes 8y ago
“Republican politicians don't care and I honestly don't understand why not.” If your party is the minority (in votes, not representatives), but you need votes to win, gerrymandering, vote suppression, unaccountability, and fraud are all welcome tactics. Majority party does it too, but doesn’t rely on it quite as much
- man2525 8y ago
  Gerrymandering can be used to unseat an incumbent, but often it creates a safe district for one. The candidate can then loan out their warchest to members of their caucus running in closer elections. Ending the practice may end the horse trading that takes place behind closed doors. Maybe then GOP senators can spend July 4th at home rather than in Moscow presumably as some kind of a low man on the totem pole cleanup crew.

motohagiography 8y ago

It's worth the down votes each time I add a comment on this topic, but it bears repeating that since electronic elections are not verifiable in any meaningful way, their legitimacy is suspect, and electronic voting actively creates the conditions for violence in response to contested results. Everybody knows this now and the effects are so predictable it brings into question the motives of people who have an interest in both undermining and discrediting the democratic process by using these machines.

asveikau 8y ago
The first time I remember people making comments of this nature on tech sites was close to 20 years ago, when in the aftermath of the 2000 elections, some said electronic voting was the answer, but the companies promoting such solutions seemed universally slimey and not security conscious. I don't think anything has changed since those days. I think part of the problem has got to be that non-experts cannot judge how good a security solution is, so local governments are ill equipped to view it with a skeptical eye. There might also be in some way a downside of federalism here - if the states pooled more resources perhaps they would be able to solve the problem once instead of 50 times.
Fnoord 8y ago
The first line of your post is not necessary, and against HN guidelines. Your post doesn't need such either as it stands on its own. It only weakens your argument as an appeal to pity. Don't do that please.
- deleted 8y ago
  [deleted]
- drharby 8y ago
  With all due respect, that appeal to pity only weakens the argument of his post is read from a persuasive writing perspective. However, in viewing this post in an exchange of ideas, it carries necessary information. OP cites the unpopularity not as an appeal to pity but as an expression of ideas. To require all posts adhere to a framework of persuasion is unnecessary speech censorship.

dahfizz 8y ago

Do we know anything about what these hackers accomplished / what effect they had on the election? The idea that our election infrastructure is "targeted" is scary but not very surprising. Every web server on the internet is "targeted", so why wouldn't something as valuable as election infrastructure?

howard941 8y ago
> Do we know anything about what these hackers accomplished / what effect they had on the election? Reports of attacks that aren't repelled corrodes trust in the integrity of elections. http://time.com/5510100/risk-limiting-audit-election-security/ http://time.com/5510100/risk-limiting-audit-election-securit...
- dahfizz 8y ago
  >.. attacks that aren't repelled... I guess this is what I'm asking. Were the attacks repelled, or did the hackers actually hack/break/change something? What was that thing? I'm genuinely asking.
penagwin 8y ago
That's what I was wondering too. I mean, I'd expect all major Nation States to "research" each other's voting systems and "direct visits to—election websites". Duh why wouldn't you? Like, okay? Here's my state's website. Have fun? https://www.michigan.gov/sos/0,4670,7-127-1633-49313--,00.html https://www.michigan.gov/sos/0,4670,7-127-1633-49313--,00.ht...

deleted 8y ago

[deleted]

throwaway5752 8y ago

This is incredible. Rules of engagement are in profound need of overhaul. This is nothing less than a military attack on the US, via computer. No sufficiently large nation state is innocent, but targeting voting systems (and potentially vote totals) should be a glaring red line that has consequences, taking into account that attribution is falsifiable and hard.

everdev 8y ago
How do you feel about any foreign political intervention? I'd guess that 50+% of 3rd world leaders are supported by some foreign government financially or militarily which keeps them in power. But yes, it doesn't feel good when a foreign government tries to pick a winner in our elections.
- throwaway5752 8y ago
  Correct me if I am wrong, but it sounds like you are asking me if I think changing voting results is equivalent to attempting to influence voters? No, I do not think those are remotely equivalent.
  - kurthr 8y ago
    Yeah, it's sort of like conflating asking for money with stealing... they may result in the same outcome, but result from extremely different actions.
  - everdev 8y ago
    Sorry, I think the point I was trying to make was that most governments try to openly influence politics in other countries rather than protecting free elections. I totally agree that vote rigging would be particularly egregious. However, I'm not sure that backing a regime with money / weapons / training, etc. that then goes ahead and rigs the vote is that much better. I think it's more like one scenario is stealing money and the other is investing in a gang that steals money. I just find it interesting that we openly try to pick political winners and losers in other countries.

everdev 8y ago

Does anyone know the details of these "election systems"? > Russian cyber actors in the summer of 2016 conducted online research and reconnaissance to identify vulnerable databases, usernames, and passwords in webpages of a broader number of state and local websites than previously identified This makes it sound like just election-related state websites. > a Russian campaign seeking vulnerabilities and access to election infrastructure For me, the term "Election infrastructure" sounds like it would include voting machines, voter registries, vote counts, etc.

charlesdaniels 8y ago

One of the faculty at my university has conducted some detailed analysis on the practice of electronic voting in the US. I believe this is the most up-to-date publication on the subject: https://cse.sc.edu/~buell/Public_Data/2019_VotingMachines.pdf https://cse.sc.edu/~buell/Public_Data/2019_VotingMachines.pd... I would also recommend the documentary "I Voted" (https://www.imdb.com/title/tt4081950/ https://www.imdb.com/title/tt4081950/). These aren't about the 2016 election in particular, but it would seem that there is strong evidence that the security practices in place by many US states are inadequate, and there is often no "paper trail" to verify that results were tallied accurately after the fact if a recount is needed. Considering the poor security, if the 2016 election was targeted, it is likely that the attacker(s) succeeded.

mrobot 8y ago

Is there really proof of much of anything in here? Seems like more Russia hysteria. Lots of use of the word "probably" and "likely" in this article.

fuckYoooouuuu 8y ago

You fucking suck. Get raped. In the ass. With AIDS.

zaroth 8y ago

> Between June and October of 2016, the group associated with the election hacking "researched websites and information related to elections in at least 39 states and territories, according to newly available FBI information," the bulletin states. "The same actors also directly visited websites in at least 30 states, mostly election-related government sites at both the state and local level—some of which overlap with the 39 researched states." > The "actors" performed their research "in alphabetical order by state name," the bulletin states, "suggesting that at least the initial research was not targeted at specific states." The research focused on Secretary of State voter registration and election results sites, but it also drilled down on some local election officials' webpages. As they accessed sites, actors "regularly attempted to identify and exploit SQL database vulnerabilities in webservers and databases." Voter registration information is public (although not technically to Russian citizens!). Visiting the front end websites of the state election authorities and attempting SQL injection on the web forms is not what some downthread are calling a military attack. However, I think it’s great to be sent such a wake up call in the form of a “tap on the shoulder” because these systems should be heavily monitored and better protected. The true election systems should require feet on the ground to compromise in any form. And they should not be electronic without a proper auditable paper record.

zyxzevn 8y ago

Until now this has all been bullshit accusations. The "false positives" are very common in these security reports, because they want a warning when there might be an attack. They do not list the numerous internal attacks that were reported too. These actually modified the votes. These votes can only be changed via physical access. But this is probably not politically interesting, and it involves corrupt staff members and such. I have been following a lot of this kind of security news. But let's follow the money. Homeland security has already prepared a plan to take over the election system in all states (from before 2016). It seems to me that these accusations are used to push to take over the voting system. Such a change would theoretically be good, but who watches the watchers? And why does DHS not report on the internal problems that actually changed votes?

ataturk 8y ago

This is fake news. Russians "visiting websites" is different than "targeting" them. There's really no substance to that article at all, it's simply more of generalized "Russian collusion" narrative that is supposed to lead the reader to believe that the 2016 Presidential election was tampered with by hackers in Russia for the benefit of Donald Trump. Except that it isn't true. There is no actual evidence any such thing took place. Furthermore, every single IP address is routinely "targeted" by all kinds of bots looking to add nodes to their bot nets. That some originated in Russia is not surprising. It doesn't mean that the machines were known to be part of voting apparatus. The whole "prove a negative" thing comes into play here. Prove Russia didn't hack the election. Sorry, I can't. Nobody can prove a negative. What was uncovered during the recounts was evidence of massive vote tampering in many large cities and counties, all to the benefit of the Democrat candidate(s). That's the news the media refuses to tell you, however.