Academic computer scientists began hacking them with ease more than a decade ago, and not much has changed.The Chicago lapse provided a rare moment of public accountability for the closely held businesses that have come to serve as front-line guardians of US election security.In this year’s midterms — as in the 2016 election — roughly 1 in 5 voters will use such electronic machines."The market isn’t functioning real well," he said."These systems are Frankenstein’s monster, essentially," Stauffer said.In an April 2014 meeting with Colorado elections officials, ES&S objected to a new state requirement for vulnerability testing because it didn’t allow for the results to be kept secret, Colorado Deputy Secretary of State Suzanne Staiert said in an interview. It has no oversight power and cannot sanction manufacturers for any shortcomings. A subsequent outside audit blamed sloppy system integration by an ES&S subsidiary during a database merge. Experts say they have long skimped on security in favour of convenience, making it more difficult to detect intrusions such as occurred in Russia’s 2016 election meddling. In 2017, for instance, Hart InterCivic refused to provide Virginia with a paperless e-Slate touchscreen voting machine for testing, said Edgardo Cortes, then the state election commissioner. Left unmentioned at the Chicago hearing: The exposed data cache included roughly a dozen encrypted passwords for ES&S employee accounts.While the top vendors claim to have stepped up their cybersecurity game, experts are sceptical." The company did not say whether the third problem was ever resolved.There’s no evidence any of this has happened, at least not yet."
At a July hearing, he accused the companies of "ducking, bobbing and weaving" on a series of basic security questions he’d asked them.During this year’s primary elections, ES&S technology stumbled on several fronts.A trio of companies — ES&S of Omaha, Nebraska; Dominion Voting Systems of Denver and Hart InterCivic of Austin, Texas — sell and service more than 90 per cent of the machinery on which votes are cast and results tabulated.At the federal level, no authority accredits election vendors or vets them or their subcontractors.Dominion’s vice president of government affairs, Kay Stimson, said her company has also had independent third parties probe its systems but would not name them or share details. Their tallies cannot be verified because they produce no paper record. No federal law requires them to report security breaches or to perform background checks on employees or subcontractors.Sen.Cook County elections director Noah Praetz said litigious behaviour only chills modernization. If anyone tried to break in and alter votes, he concluded, "there was really no way for us to tell if that had happened. Election-vendor executives routinely issue assurances, he said, but don’t encourage outsiders to inspect their code or offer "bug bounties" to researchers to seek out flaws in their software.The federal Department of Homeland Security began offering confidential vulnerability testing to vendors over the summer.ES&S did not directly respond to a query about this incident.In October, ES&S sued Cook County, Illinois, seeking to void its USD 30 million, 10-year contract with a competitor. Building truly secure systems would likely make them unprofitable, he said."Experts say they might take the industry’s security assurances more seriously if not for the abundant evidence of sloppy software development, a major source of vulnerabilities.Startups are hard-pressed to disrupt an industry whose main players rely heavily on proprietary technologies." Hart InterCivic’s vice president of operations, Peter Lichtenheld, did not dispute Cortes’ account in July Senate testimony but said its Virginia customers were already moving to newer machines. And voting equipment vendors have never seemed security conscious "in any phase of their design," he said."All three of the top vendors declined to discuss their finances and insist that security concerns are overblown. None of the big three vendors would say how many cybersecurity experts they employ. Its auditable voting system took two and a half years to win federal certification at a cost of USD 1 million."This is the type of stuff that leads to a complete compromise," he said. But the company would not name the testers and declined to provide documentation of the testing or its results.In 2014, the same contractor, Jacob Stauffer of the security firm Coherent Cyber, found "multiple critical vulnerabilities" in Dominion’s Democracy Suite that could allow skilled hackers to compromise an election’s outcome. Stimson said that "employee confidentiality and plain sock knitting machine security protections outweigh any potential disclosure.Cortes decided to decertify all such systems. ES&S CEO Tom Burt apologized and repeatedly stressed that there were no evidence hackers downloaded the data.
The businesses also face no significant federal oversight and operate under a shroud of financial and operational secrecy despite their pivotal role underpinning American democracy.ES&S hired its first chief information security officer in April. California, New York and Colorado are among states that keep a close eye on the vendors, but many others have cosier relationships with them. A few states ban such wireless connections; in Alabama, the state had to force ES&S to remove them from machines ordered for one of its counties earlier this year.ES&S told The Associated Press that it allows independent, open-ended testing of its corporate systems as well as its products.For instance, industry leader ES&S sells vote-tabulation systems equipped with cellular modems, a feature that experts say sophisticated hackers could exploit to tamper with vote counts."Many voting systems in use today across the more than 10,000 US election jurisdictions are prone to security problems.No such audit was done in Kansas’ most populous county after a different sort of error in newly installed ES&S systems delayed the vote count by 13 hours as data uploading from thumb drives crawled.It was the kind of security lapse that gives election officials nightmares.In Los Angeles County, more than 118,000 names were left off printed voter rolls.And the vendors can be recalcitrant. Such testing is now standard for the Pentagon and major banks. In a worst-case scenario, a sophisticated attacker could have used them to infiltrate company systems, said Chris Vickery of the security firm Upgard, which discovered the data lapse. It also recently threatened Louisiana and Douglas County, Kansas, with lawsuits for choosing other suppliers.On July 13, US special counsel Robert Mueller indicted 12 Russian military intelligence operatives for, among other things, infiltrating state and local election systems.The vendors say there’s no indication hackers have penetrated any of their systems. She said the company ultimately didn’t seek certification because the system it was offering didn’t meet state requirements. Competition and innovation are already hampered in an industry with "really low" margins, especially considering limited government funding for election equipment. ES&S and other vendors have jealously guarded them in court — and also unleash lawyers against election officials who purchase competitors’ products. ES&S said the passwords were only used to access the company’s Amazon cloud account and that "there was no unauthorized access to any data or systems at any time. ES&S, for instance, said in an email that "any assertions about resistance to input on security are simply untrue" and argued that for decades the company has "been successful in protecting the voting process.8 million registered voters — including addresses, birth dates and partial Social Security numbers — publicly exposed for months on an Amazon cloud server. Ron Wyden, an Oregon Democrat, has long criticised what he calls the industry’s "severe underinvestment in cybersecurity.(Source). Last year, a state security contractor found multiple vulnerabilities in ES&S’s Electionware system that could, for instance, allow an intruder to erase all recorded votes at the close of voting. But only one vendor has submitted to such testing, said an agency official who spoke on condition of anonymity because the official was not authorized to discuss the matter publicly.California conducts some of the most rigorous scrutinies of voting systems in the US and has repeatedly found chronic problems with the most popular voting systems.
The costs of inadequate security can be high."They cobble things together as well as they can," University of Connecticut election-technology expert Alexander Schwartzman said of the industry leaders. But authorities acknowledge that some election mischief or malware booby traps may have gone unnoticed."It seemed like there was a lot more emphasis about how cool the machines could be than there was actual evidence that they were secure," said John Bennett, the Alabama secretary of state’s deputy chief of staff."We can’t regulate," EAC chairman Thomas Hicks said during a July 11 congressional hearing when the question came up.Federal oversight is limited to the little-known Election Assistance Commission, a 30-employee agency that certifies voting equipment but whose recommendations are strictly voluntary.ES&S referred the AP to a brief California report that found "two out of the three initially identified vulnerabilities" were fixed and that a third would be handled in "future ES&S releases.Hackers could theoretically wreak havoc at multiple stages of the election process.Elections are run by the states, whose oversight of suppliers varies. Neither can DHS, even though it designated the nation’s election systems "critical infrastructure" in early 2017. Senior US intelligence officials say the Kremlin is well-positioned to rattle confidence in the integrity of elections during this year’s midterms, should it choose to.Election vendors have long resisted open-ended vulnerability testing by independent, ethical hackers — a process that aims to identify weaknesses an adversary could exploit. Dominion was Canadian-owned until July when a New York private equity firm bought a controlling interest.
A company spokeswoman said a review of company correspondence found no sign that it resisted the testing requirement, although it did "ask clarifying questions.In much of the nation, especially where tech expertise and budgets are thin, the companies effectively run elections either directly or through subcontractors.More competition might help, but industry barriers to smaller vendors are "absolutely enormous," said Larry Moore, president of upstart Clear Ballot. In 2017, a private contractor left data on Chicago’s 1. Hart InterCivic, the No. They could alter or erase lists of registered voters to sow confusion, secretly introduce software to flip votes, scramble tabulation systems or knock results-reporting sites offline.""The industry continues to stonewall the problem," said Bruce McConnell, a Department of Homeland cybersecurity czar during the Obama administration. 3 vendor, said it has done the same using the Canadian cybersecurity firm Bulletproof, but would not discuss the results.The three shifted uneasily on folding chairs as board members grilled them about what went wrong.Later, at a tense hearing, Chicago’s Board of Elections dressed down the top three executives of Election Systems & Software, the nation’s dominant supplier of election equipment and services.Election vendors don’t even have to be US companies.University of Iowa computer scientist Douglas Jones said both incidents reveal mediocre programming and insufficient pre-election testing.
:: بازدید از این مطلب : 46
|
امتیاز مطلب : 0
|
تعداد امتیازدهندگان : 0
|
مجموع امتیاز : 0