Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:50 PM
Connect Directly

Election Security: Recovering from 2016, Looking Toward 2020

Researchers publish the results of a four-year investigation and discuss whether the US is ready to secure its largest elections.

Months away from another presidential election, many wonder whether the United States has the protections and processes in place to secure its most important elections. Research shows 2016 was a wake-up call of sorts, prompting federal, state, and local officials to work together.

Cisco Talos researchers began a long-term investigation into election security issues following the 2016 breach of the Democratic National Committee's servers. Four years of research are summarized in a new report, which encompasses the elements of US election infrastructure, the complex role of political theory, the progress made since 2016, and the work that still needs to be done to protect elections.

"The big thing was just how complicated the field of play is here," says Matt Olney, director of threat intelligence and interdiction with Cisco Talos. The factors in an election-focused attack range from the federal government, which has a limited role in elections but an outsize role in terms of intelligence and capabilities, to the local level, where people sign on to help with elections and find themselves in the crosshairs of advanced and highly targeted cyberattacks.

Researchers say the attackers' primary motivation is to undermine not only the core integrity of individual elections but the faith and trust people have in state institutions to fairly run them.

This is more than a technical problem, Olney says; it's a public perception problem. Officials also must consider how they can technically secure elections in a way that reinforces their community's faith that they're doing their job well. Adversaries understand how they can weaken the trust between people and government, reducing officials' ability to address issues.

"It's a play to reduce the ability for the US to react and affect work affairs," Olney explains.

In the report, Talos researchers detail various parts of election infrastructure and how officials should approach their security. Election management systems (EMSs), for one, coordinate the roles of the states and localities, and may include jury pool management, voter registration, ballot management, and election reporting. The EMS is a high-profile target for attackers because it's an accepted way for localities to change the voter registration database, the researchers report.

Voter registration databases — central databases holding registration information about voters — have been targeted in the past and are expected to be in the crosshairs going forward. 

The biggest improvement made between 2016 and 2020 is the growth of information sharing, says Olney. The Cybersecurity and Infrastructure Security Agency has taken on a role as a "security focal point" for the federal government. The agency has begun to offer phishing tests and vulnerability scanning; its staff members have flown to different states to provide support and share their understanding of security threats.

Information sharing goes both ways, Olney explains. The creation of the Election Infrastructure ISAC (EI-ISAC) "has been critical" in terms of pulling information into a centralized location to better understand the threats that states and localities are facing. EI-ISAC has deployed Albert intrusion detection and flow analysis systems to state and local authorities, the report states.

"The most important relationship, really, in election security is that state and local bond," he says. "Ultimately, the things that are being attacked are part of the state and local networks." Because states and localities cannot face state-sponsored actors alone, this collaboration, and the communication of efforts to voters, are essential to protect the integrity of US elections.

Related Content:



Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Guru
7/21/2020 | 9:16:49 AM
Re: Mail-In Voting, Pandemic, Postponement
As a Security expert I am well versed in Risk Analysis and the fact of the matter is that it is still more dangerous to drive a vehicle in the US than the risk of dying from COVID-19.  Prior posters suggest that mail-in ballots need to be required to keep people safe, that poster needs to realize that at this point there is little to nothing the government can do to keep everyone safe. COVID is out there and it now has a documented risk factor, it is everyone's personal responsibility to manage this risk for themselves.  Back to my initial statement we never forced mail-in ballots in the past because it was to dangerous to drive to the polls, so why would we now all of the sudden be worried about people going to the polls.  I guess in summary with all of the threats out there COVID is not the biggest threat in the world at this time.

User Rank: Strategist
7/20/2020 | 6:43:19 PM
DNC server hack
Let's get the facts straight...just ask Seth Rich....oops we can't.
User Rank: Strategist
7/20/2020 | 6:40:55 PM
Fair elections
Require ID cards to secure a punch ballot and ink stain finger of voter. Anything else invites voter fraud - just ask the Democrats in Chicago how easy it has been to cast fraudulent ballots for decades. The more digital the greater the fraud - it's that simple.
User Rank: Ninja
7/20/2020 | 1:13:06 PM
Mail-In Voting, Pandemic, Postponement
While presently mail-in voting is only a reality for a subset of states doesn't it make sense that instead of endangering the lives of citizens of this country that we postpone the election until after this global crisis is resolved?

That or more heavily invest in alternative methods of voting that don't involve a physical presence.
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-18
An issue was discovered in the Source Integration plugin before 2.4.1 for MantisBT. An attacker can gain access to the Summary field of private Issues (either marked as Private, or part of a private Project), if they are attached to an existing Changeset. The information is visible on the view.php p...
PUBLISHED: 2021-01-18
Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...