Arizona and Illinois election systems targeted by foreign hackers
Connecting state and local government leaders
The hack that took data on 200,000 registered voters in Illinois and another that penetrated an Arizona election system are suspected to have originated in Russia.
Election systems in Arizona and Illinois were the target of foreign hackers earlier this summer, according to a report in Yahoo News.
On Aug. 18, the FBI Cyber Division issued a warning titled “Targeting Activity against State Board of Election Systems,” which did not specify which states had been the victim of the hack. But Yahoo News quotes “sources familiar with the document” who said Arizona and Illinois were the targets.
An Illinois official told Yahoo that the attack resulted in the exfiltration of personal information for 200,000 Illinois voters. There was no information downloaded in the Arizona hack.
On an Aug. 15 conference call, Department of Homeland Security Secretary Jeh Johnson highlighted DHS’ resources that can help states secure their voting systems. He also discussed the possibility that the U.S. election system could be classified as critical infrastructure. This classification would give DHS oversight and security responsibilities for the election system the same way that it works with the power grid or the financial services sector.
Officials think the hacks in Arizona and Illinois could be connected because there was an IP address that appeared in both attacks. On cybersecurity professional told Yahoo that one of the IP addresses listed in the alert has shown up in connection with Russian hacker forums.
To help states harden their systems, the FBI shared a number of security measures via the Multi-State Information Sharing and Analysis Center (MS-ISAC). Recommendations included conducting vulnerability scans, patching software and applications, validating user input before forwarding to a database and using static queries.
Thomas F. Duffy, chair of MS-ISAC, spoke on the threat directed at the voting system earlier this month at the National Association of State Technology Directors annual conference. “How secure are our voting systems? There has been a lot of talk of voter registration databases being probed, and we’ve confirmed that people are doing phishing campaigns at local elected officials, some of that successful.”
Duffy said these databases were basically “big telephone directories” with the only personal information being date of birth. One audience member suggested this information could allow hackers to influence elections by targeting younger people who are less likely to vote.
“You’re going to hear a lot of buzz on this over the next month or two,” Duffy said, “So if you haven’t anticipated it, anticipate it now.”
NEXT STORY: Derived credentials for mobile on the horizon?