Why cyberattack misattribution is our top election security threat

With less than a month to go until Election Day, there is a palpable tension across the country. Exacerbated by a still-raging pandemic that has quickly scrambled the voting landscape and security concerns from 2016 still fresh in voters’ minds, anxieties are high. And those conditions have made this year especially ripe for election-related cyberattacks.

The eyes of the world are on this election, and that attention is all but daring attackers of all stripes -- from nation-states to bored teenagers looking to prove themselves -- to launch ransomware and other attacks on election administration systems.

To deploy appropriate countermeasures to withstand these attacks, it is important election officials keep adversary motivations top of mind. Election tampering is about gaining power, sowing discord and creating chaos. Those motivations are what drive attacks and are key to fulfilling attackers’ three main overlapping goals:  

• Disrupting and delaying election results for key precincts, where the delay can be advantageous to the adversary’s preferred outcome.
• Sowing public doubt in the integrity of election results.
• Triggering hasty misattribution.

While misattribution may not feel like the most immediate threat to election security, it goes hand-in-hand with these other objectives. Bad actors are well aware that misattribution of an attack’s source can be just as detrimental to election security as the attacks themselves. Deliberate misdirection of an attack’s source muddies the waters, causing victims to waste valuable time and resources on trying to assign the blame rather than focusing on the immediate responses needed to prevent further harm.

Rushing to attribution plays into the hands of adversaries

During an active attack on voting systems, neutralizing the active attack is most important, followed closely by avoiding a jump to conclusions on attribution, based on early evidence that may or may not have been planted to create misdirection.

On the one hand, yes, an attack is an attack. The most important thing is ensuring elections are secure, free and fair by identifying and addressing an attack as soon as it happens. It isn’t absolutely necessary to know the identities of the actors behind the attack to ensure ballot integrity and to provide assurance to voters.

At the same time, this is also exactly what makes (mis)attribution such a critical issue. Immediate gratification is human nature. Should reports of issues arise on election night, finding out who is responsible will be top of mind. The rush to point fingers and lay blame during an already turbulent election season, however, will only make it that much easier to sow confusion and distrust. And it’s a strategy that some governments are all too eager to take advantage of.

For example: Nation 1 wants to cause chaos in the U.S. November elections, but for their own reasons, they do not want the attacks attributed to them. Instead, they compromise hosts in Nation 2 and use those hacked hosts to launch DDOS attacks on a battleground state’s vote reporting site on election night. As we saw in this year’s Iowa caucuses, lengthy, tech-driven delays in tabulating and reporting results can immediately lead to frustration for voters and rampant confusion around who exactly won.

Now imagine that happening in any number of swing states on Nov. 3, and the delays could cause days or weeks of uncertainty around the election results. Even if it were an isolated incident, when it becomes clear that vote reporting sites were disrupted or hacked, observers will look at the attack logs, see IP addresses that can be traced back to Nation 2 and likely jump to the errant conclusion that it was Nation 2 that attacked the election.

This isn’t just a hypothetical. In 2018, Russian hackers compromised hundreds of computers and routers associated with the Winter Olympics’ opening ceremony -- except they used North Korean IP addresses to do so. As a result, the first wave of accusations landed at North Korea’s feet -- a country that, at least in this particular case, appeared to have been innocent. While the ceremony was ultimately unaffected, the incident clearly illustrated the danger of rushing to judgment based on faulty, yet still commonly accepted, processes for identifying blame.

Securing a complex electoral system

Elections in the U.S. are extremely complicated, in no small part because systems for managing them are so decentralized and bifurcated on a state and local level. However, because of how complex the system is, it forces adversaries to invest heavily into preattack planning, investment and coordination needed to pull off a successful attack.

At this late stage of the election cycle, understanding what is needed to enhance security against threats requires addressing many different potential attack surfaces in the electoral system.

Voter registration systems and e-pollbooks, voting machines, users and systems involved in elections administration, vote tallying and reporting systems, as well as locations where election results are transferred to, tabulated or posted all are prime targets for attacks.

In the near term, defending these systems should focus on:

• Running fully patched systems with competent, properly configured and monitored endpoint protection and detection agents and controls for all component systems involved in tabulating and transmitting results.
• Providing simple, clear and concise guides to local election officials. Lengthy runbooks or security manuals commonly favored by government officials are not effective for Election Day.
• Enabling available visibility, investigation and response capabilities that can be put in place prior to November.
• Ensuring highly qualified personnel know how to determine what signals matter and how to respond to swiftly neutralize active threats.

In the long run -- i.e. prior to the next national election cycle -- we must focus on updating recertification requirements to ensure that digital voting system vendors are adding the technical and procedural controls necessary to cover foundational security capabilities for system integrity, vote record non-repudiation, attack visibility and response capabilities.

While adoption will vary from state to state and precinct to precinct, these measures will almost certainly be an effective uses of resources to minimize potential disruptions.

Cyberwarfare is asymmetric. Opportune targets are those where attacks can cause notable disruption or embarrassment, adversaries can obtain exceptionally valuable information or access or the target is unable to defend itself against a well-resourced attacker. Attackers, meanwhile, only have to exploit a single weakness.

Playing the (mis)attribution game will only distract focus from more pressing concerns. Ultimately, the attribution doesn’t and shouldn’t matter to anyone but law enforcement agencies responsible for investigating and bringing charges against cyberattackers, be they other countries or hackers within our own borders.

For everyone else -- namely voters and those in charge of overseeing fair and secure elections -- the primary concern must be on assuring the integrity of voting systems over these next few critical weeks.