Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


01:50 PM
Connect Directly

Election Security: Recovering from 2016, Looking Toward 2020

Researchers publish the results of a four-year investigation and discuss whether the US is ready to secure its largest elections.

Months away from another presidential election, many wonder whether the United States has the protections and processes in place to secure its most important elections. Research shows 2016 was a wake-up call of sorts, prompting federal, state, and local officials to work together.

Cisco Talos researchers began a long-term investigation into election security issues following the 2016 breach of the Democratic National Committee's servers. Four years of research are summarized in a new report, which encompasses the elements of US election infrastructure, the complex role of political theory, the progress made since 2016, and the work that still needs to be done to protect elections.

"The big thing was just how complicated the field of play is here," says Matt Olney, director of threat intelligence and interdiction with Cisco Talos. The factors in an election-focused attack range from the federal government, which has a limited role in elections but an outsize role in terms of intelligence and capabilities, to the local level, where people sign on to help with elections and find themselves in the crosshairs of advanced and highly targeted cyberattacks.

Researchers say the attackers' primary motivation is to undermine not only the core integrity of individual elections but the faith and trust people have in state institutions to fairly run them.

This is more than a technical problem, Olney says; it's a public perception problem. Officials also must consider how they can technically secure elections in a way that reinforces their community's faith that they're doing their job well. Adversaries understand how they can weaken the trust between people and government, reducing officials' ability to address issues.

"It's a play to reduce the ability for the US to react and affect work affairs," Olney explains.

In the report, Talos researchers detail various parts of election infrastructure and how officials should approach their security. Election management systems (EMSs), for one, coordinate the roles of the states and localities, and may include jury pool management, voter registration, ballot management, and election reporting. The EMS is a high-profile target for attackers because it's an accepted way for localities to change the voter registration database, the researchers report.

Voter registration databases — central databases holding registration information about voters — have been targeted in the past and are expected to be in the crosshairs going forward. 

The biggest improvement made between 2016 and 2020 is the growth of information sharing, says Olney. The Cybersecurity and Infrastructure Security Agency has taken on a role as a "security focal point" for the federal government. The agency has begun to offer phishing tests and vulnerability scanning; its staff members have flown to different states to provide support and share their understanding of security threats.

Information sharing goes both ways, Olney explains. The creation of the Election Infrastructure ISAC (EI-ISAC) "has been critical" in terms of pulling information into a centralized location to better understand the threats that states and localities are facing. EI-ISAC has deployed Albert intrusion detection and flow analysis systems to state and local authorities, the report states.

"The most important relationship, really, in election security is that state and local bond," he says. "Ultimately, the things that are being attacked are part of the state and local networks." Because states and localities cannot face state-sponsored actors alone, this collaboration, and the communication of efforts to voters, are essential to protect the integrity of US elections.

Related Content:



Register now for this year's fully virtual Black Hat USA, scheduled to take place August 1–6, and get more information about the event on the Black Hat website. Click for details on conference information and to register.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Guru
7/21/2020 | 9:16:49 AM
Re: Mail-In Voting, Pandemic, Postponement
As a Security expert I am well versed in Risk Analysis and the fact of the matter is that it is still more dangerous to drive a vehicle in the US than the risk of dying from COVID-19.  Prior posters suggest that mail-in ballots need to be required to keep people safe, that poster needs to realize that at this point there is little to nothing the government can do to keep everyone safe. COVID is out there and it now has a documented risk factor, it is everyone's personal responsibility to manage this risk for themselves.  Back to my initial statement we never forced mail-in ballots in the past because it was to dangerous to drive to the polls, so why would we now all of the sudden be worried about people going to the polls.  I guess in summary with all of the threats out there COVID is not the biggest threat in the world at this time.

User Rank: Strategist
7/20/2020 | 6:43:19 PM
DNC server hack
Let's get the facts straight...just ask Seth Rich....oops we can't.
User Rank: Strategist
7/20/2020 | 6:40:55 PM
Fair elections
Require ID cards to secure a punch ballot and ink stain finger of voter. Anything else invites voter fraud - just ask the Democrats in Chicago how easy it has been to cast fraudulent ballots for decades. The more digital the greater the fraud - it's that simple.
User Rank: Ninja
7/20/2020 | 1:13:06 PM
Mail-In Voting, Pandemic, Postponement
While presently mail-in voting is only a reality for a subset of states doesn't it make sense that instead of endangering the lives of citizens of this country that we postpone the election until after this global crisis is resolved?

That or more heavily invest in alternative methods of voting that don't involve a physical presence.
Overcoming the Challenge of Shorter Certificate Lifespans
Mike Cooper, Founder & CEO of Revocent,  10/15/2020
7 Tips for Choosing Security Metrics That Matter
Ericka Chickowski, Contributing Writer,  10/19/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-10-21
BigBlueButton through 2.2.8 uses Ghostscript for processing of uploaded EPS documents, and consequently may be subject to attacks related to a "schwache Sandbox."
PUBLISHED: 2020-10-21
BigBlueButton before 2.2.8 (or earlier) does not set the secure flag for the session cookie in an https session, which makes it easier for remote attackers to capture this cookie by intercepting its transmission within an http session.
PUBLISHED: 2020-10-21
In BigBlueButton before 2.2.8 (or earlier), the client-side Mute button only signifies that the server should stop accepting audio data from the client. It does not directly configure the client to stop sending audio data to the server, and thus a modified server could store the audio data and/or tr...
PUBLISHED: 2020-10-21
In BigBlueButton before 2.2.8 (or earlier), uploaded presentations are sent to clients without a Content-Type header, which allows XSS, as demonstrated by a .png file extension for an HTML document.
PUBLISHED: 2020-10-21
BigBlueButton through 2.2.8 records a video meeting despite the deactivation of video recording in the user interface. This may result in data storage beyond what is authorized for a specific meeting topic or participant.