This morning Secretary of the State, Denise Merrill selected 34 district for audit with the help of students at Wethersfield High School:
 |
 |
This morning Secretary of the State, Denise Merrill selected 34 district for audit with the help of students at Wethersfield High School:
|
|
List of selected districts: <press release>
From Buzzfeed’s Cyber Security Correspondent, Kevin Collier: A Year After Trump’s Victory, Our Elections Aren’t Much More Secure
But the focus on how Facebook and Twitter were used to sow division in the US electorate has diverted attention from one of the weakest spots in the system: … a simple cyberattack can be effective against weak infrastructure and unprepared IT workers. Whether that can be fixed by 2018 or even 2020 is an open question…
“We’re not doing very well,” Alex Halderman, a renowned election security expert, told BuzzFeed News. “Most of the problems that existed in 2016 are as bad or worse now, and in fact unless there is some action at a national policy level, I don’t expect things will change very much before the 2018 election.”
From Buzzfeed’s Cyber Security Correspondent, Kevin Collier: A Year After Trump’s Victory, Our Elections Aren’t Much More Secure <read>
The halfway point between the election of President Donald Trump and the 2018 midterms has come and gone, and it still isn’t fully clear what Russian hackers did to America’s state and county voter registration systems. Or what has been done to make sure a future hacking effort won’t succeed.
US officials, obsessed for now with evidence that Russia’s intelligence services exploited social media to sway US voters, have taken solace in the idea that the integrity of the country’s voting is protected by the system’s acknowledged clunkiness. With its decentralized assortment of different machines, procedures, and contractors, who could possibly hack into all those many systems to change vote totals?
But the focus on how Facebook and Twitter were used to sow division in the US electorate has diverted attention from one of the weakest spots in the system: the gap between those locally operated voting systems that are well-protected by sophisticated technology teams and those that are less prepared. Russia knows those gaps exist and that a simple cyberattack can be effective against weak infrastructure and unprepared IT workers. Whether that can be fixed by 2018 or even 2020 is an open question.
Most states’ elections officials still don’t have the security clearances necessary to have a thorough discussion with federal officials about what’s known about Russian, or others’, efforts to hack into their systems.
Seven states still use all-electronic voting systems whose results cannot be verified because there is no paper trail.
And hundreds of US counties rely on outside contractors to maintain their registration records and update the software on voting machines. Some of those contractors are small operations with few employees and minimal computer security skills.
Here we caution that it is not just Russia to be concerned with. Those same vulnerabilities are open to other foreign actors, foreign and U.S. hackers, along with elements of the the U.S. Government. Beyond that open to official and contractor insiders. Not being connected to the Internet does not preclude attack from any of these actors, especially insiders.
Seven states still use all-electronic voting systems whose results cannot be verified because there is no paper trail.
And hundreds of US counties rely on outside contractors to maintain their registration records and update the software on voting machines. Some of those contractors are small operations with few employees and minimal computer security skills.
Many local officials are reluctant to seek federal help, worried about ceding authority to outside agencies.
“We’re not doing very well,” Alex Halderman, a renowned election security expert, told BuzzFeed News. “Most of the problems that existed in 2016 are as bad or worse now, and in fact unless there is some action at a national policy level, I don’t expect things will change very much before the 2018 election.”…
But in the aftermath of last year’s vote, it has become clear that the sheer complexity of the system is no reassurance that it can’t be exploited by a determined hostile power. Halderman, the election security expert, says that just because it didn’t happen last time — or in the voting completed Tuesday — doesn’t mean it won’t.
“It’s only a matter of time, if we don’t have coordinated national action, until a major US election is disrupted, or even its outcome changed, by a foreign nation-state in a cyberattack,” [former FBI director James Comey] said.
To this day, DHS points to the fact that it’s never found evidence that vote tallies were changed
We add that DHS, as far as we know has not looked for such evidence anywhere, let alone everywhere.
As we have said before. Protecting databases and votes requires Prevention, Detection, and Recovery.
Paper ballots, properly secured, are the first requirement for detection and recovery of votes. Strong pre-election voter database backup and audits along with paper voter checkin lists are part, just a part, of recovery from corrupted or electronic voter lists, or election day power failure, equipment failure, and cyber attack.
The Purpose of the Citizen Audit is to increase integrity and confidence in elections, for the benefit of the voters of Connecticut. We provide independent audits, audit observations, and reports focusing on the integrity of elections and election administration. <More about the Citizen Audit>
Voters
Want
To Know:
You can Help Provide Answers!
Volunteer one day as a Post-Election Audit Observer.
The Connecticut Citizen Election Audit coordinates volunteers, like you, to observe the state’s post-election audit of voting machines. Non-partisan volunteers go “behind the scenes” with a checklist of best practices and interview questions. They gather information which is compiled into reports submitted to the public, election officials, and the Legislature.
Why Volunteer?
For good Government, to preserve our right to a free and accurate vote!
See the Results of Our Efforts In the Audit Reports Below:
The Purpose of the Citizen Audit is to increase integrity and confidence in elections, for the benefit of the voters of Connecticut. We provide independent audits, audit observations, and reports focusing on the integrity of elections and election administration. <More about the Citizen Audit>
Voters
Want
To Know:
You can Help Provide Answers!
Volunteer one day as a Post-Election Audit Observer.
The Connecticut Citizen Election Audit coordinates volunteers, like you, to observe the state’s post-election audit of voting machines. Non-partisan volunteers go “behind the scenes” with a checklist of best practices and interview questions. They gather information which is compiled into reports submitted to the public, election officials, and the Legislature.
Why Volunteer?
For good Government, to preserve our right to a free and accurate vote!
See the Results of Our Efforts In the Audit Reports Below:
The failure to remove Mr. Seabury’s name, either by having the ballots reprinted with the name of the replacement candidate, having stickers with the replacement candidate’s name placed on the ballots or, in the event no replacement has been nominated, “(C)caus[ing] blank stickers to be so affixed if the vacancy is not filled,” is in direct violation of Conn. Gen. Stat. § 9-460 (adding emphasis).
Our Opinion: We understand that diseased candidate Seabury was not elected, likely leaving the Democrats with no reason to go to court. Yet, the Registrars deserve an SEEC complaint and large fines for blatantly failing to follow the law.
From the Hat City Blog: Danbury Democrats threaten legal action over Seabury controversy <read>
Dear Mrs. Giegler, Mrs. Gallo and Ms. Doran: I am saddened by the recent passing of City Councilman Gregg Seabury. Gregg was a valued public servant and educator. Gregg’s passing is a loss for his family and the City of Danbury as a whole. My respect for Gregg makes me regret the need to draft this correspondence. Unfortunately, I believe it is necessary to make certain facts regarding Mr. Seabury’s presence on the Election Day ballot and the effect of his passing absolutely clear.
First, the law is well established that Conn. Gen. Stat § 9-460 governs what is to occur when a candidate passes less than twenty-four days but more than twenty-four hours before the opening of the polls on Election Day. Specifically, the statute permits the party who nominated the candidate to nominate a replacement candidate. Critically the statute does not allow, as is the law in some states, the candidate to remain on the ballot.
f passing occurred on a Saturday is of no legal moment and any claim to the contrary is simply not premised upon the law.Mr. Seabury’s passing, less than twenty-four days but more than twenty-four hours before the opening of the polls, created a vacant nomination. See, Conn. Gen. Stat. § 9-460 which clearly holds that in such circumstances the candidate may be replaced or his name removed from the ballot. The statute does not permit the name to remain on the ballot as I understand is intended.
The failure to remove Mr. Seabury’s name, either by having the ballots reprinted with the name of the replacement candidate, having stickers with the replacement candidate’s name placed on the ballots or, in the event no replacement has been nominated, “(C)caus[ing] blank stickers to be so affixed if the vacancy is not filled,” is in direct violation of Conn. Gen. Stat. § 9-460 (adding emphasis).
Secretary of the State Denise Merrill seems to agree:
“This is an emotional time and Secretary Merrill and the staff of her office have deep sympathy for the friends and family of Councilman Seabury.
Early yesterday afternoon, lawyers from the Secretary of the State’s office informed Danbury’s local election officials of the law regarding replacing a deceased candidate on the ballot. Connecticut law in this case is clear, and there is no basis in law to allow Gregg Seabury’s name to remain on the ballot, or to treat this situation as if there is a vacancy in office.
It is of great concern to read news reports this morning that Danbury officials have apparently decided to ignore the clear requirements of Connecticut law. It is the position of this office that all local election officials should follow the law as written.”
– Gabe Rosenberg, Communications Director for Connecticut Secretary of the State Denise Merrill
Our Opinion: We understand that diseased candidate Seabury was not elected, likely leaving the Democrats with no reason to go to court. Yet, the Registrars deserve an SEEC complaint and large fines for blatantly failing to follow the law.
Election hacking, especially the risks in Georgia explained to Samantha Bee.
Election hacking, especially the risks in Georgia explained to Samantha Bee.
More specific details on Brad Cast with Marilyn Marks, starting at 5min in <BradCast>
(Thanks to Wanda for the tip)
“Yesterday, along with representatives from the state’s information technology and public safety departments, I met with regional officials from the United States Department of Homeland Security to discuss how we can work together to ensure that Connecticut elections are safe from outside interference or manipulation. We had a productive meeting and I look forward to working together in the months and years to come to protect our elections, the bedrock of our democracy.” – Denise Merrill, Connecticut Secretary of the State
We applaud this step in the right direction. Last year as leader of the National Association of Secretaries of State, Merrill opposed the designation of elections as critical infrastructure, leading in expressing the concern for a Federal take-over of elections. We were critical of that stand then and remain so.
In our opinion this is just a step. There are several aspects to election security/integrity that should be addressed,. This step may assist in those that are under direct control of the of the the State, yet less so those under local control.
Secretary Merrill met with Homeland Security on Thursday:
Merrill Statement on Meeting with DHS Officials Regarding Election Cybersecurity
|
We applaud this step in the right direction. Last year as leader of the National Association of Secretaries of State, Merrill opposed the designation of elections as critical infrastructure, leading in expressing the concern for a Federal take-over of elections. We were critical of that stand then and remain so.
In our opinion this is just a step. There are several aspects to election security/integrity that should be addressed,. This step may assist in those that are under direct control of the of the the State, yet less so those under local control. It’s not an issue of a State take-over of local elections, but the impossibility of every town in the State doing what even the NSA has failed at – protecting their most sensitive systems from attack. Yet, like the NSA, the State is capable of doing ever better.
Cybersecurity from “outside interference or manipulation” is insufficient. We must prevent insider attacks. We must be able to recover from “interference and manipulation”, since complete prevention is not possible.. As we have said before, database and election integrity depends on Prevention, Detection, and Recovery.
Press Release: Rhode Island Takes Important Step to Secure Elections with Post-Election Audits – Adopts New Procedure to Check Election Results as Threats Increase
“Post-election audits are the best safeguard to making sure that votes are being counted as cast,” said Representative Edith Ajello (D-Providence), the House sponsor. “My community saw a simple administrative error almost turn into an incorrect election result,” added Senate sponsor, Senator James Sheehan (D-North Kingstown), “and this legislation will help assure voters that a system is in place to catch and correct future problems.”
The audits will begin as soon as September 2018. Rhode Island becomes the 32nd state to require post-election audits, and only the second state to require risk-limiting audits.
Press Release: Rhode Island Takes Important Step to Secure Elections with Post-Election Audits – Adopts New Procedure to Check Election Results as Threats Increase <read>
“Post-election audits are the best safeguard to making sure that votes are being counted as cast,” said Representative Edith Ajello (D-Providence), the House sponsor. “My community saw a simple administrative error almost turn into an incorrect election result,” added Senate sponsor, Senator James Sheehan (D-North Kingstown), “and this legislation will help assure voters that a system is in place to catch and correct future problems.”
The audits will begin as soon as September 2018. Rhode Island becomes the 32nd state to require post-election audits, and only the second state to require risk-limiting audits.
Passage came after two Rhode Island communities suffered from administrative errors in the November 2016 election that led to incorrect machine counts on election night. Because the results were obviously wrong, election officials reprogrammed the scanners and recounted the ballots. The correct results were reported, but the situation demonstrated the need for a manual check on the results of machine-counted ballots.
Connecticut was the first New England State with post-election audits. Unfortunately we are among the vast majority of states with post-election audits that do not provide sufficient public confidence. Connecticut’s audits suffer from an insufficient design, poor execution, and ll but no oversight. <See the Citizen Audit Reports>
To be fair, most experts only regard the post-election audits in two states, Minnesota and New Mexico, as adequate. Yet, the Risk Limiting Audits to be implemented this year in Colorado and over the next couple of years in Rhode Island are likely to lead the Nation in deserved confidence and efficiency.
PS: I have played a minor supporting role working with other advocates and computer scientists in assisting the development of rules in Colorado and in honing the Rhode Island law. From that ongoing experience it is clear that it takes a lot of detailed work, patience, commitment and participation to create good laws and see them through. Participation from willing and reluctant officials, legislators, advocates, and scientists. Expect some bumps along the way as these new laws are implemented – patience will be required over several election cycles to smooth out those bumps.
Almost every day lately there is news on the potential of future and past hacking, including election hacking. Today we suggest three recent articles and a report.
The N.S.A. bans its analysts from using Kaspersky antivirus at the agency, in large part because the agency has exploited antivirus software for its own foreign hacking operations and knows the same technique is used by its adversaries.
If Russia can attack our election, so can others: Iran, North Korea, ISIS, or even criminal or extremist groups.
Exactly a year after U.S. intelligence issued a stern warning about Russian interference in the 2016 presidential election, the Trump administration has failed to fill key homeland security posts responsible for preventing another Kremlin assault on the voting system…
It sounds like science fiction, or at least “Ocean’s 11,” but cybersecurity experts are frantically waving their hands, trying to get Americans to see that in foreign capitals, the American voting system just looks like easy opportunity.
Almost every day lately there is news on the potential of future and past hacking, including election hacking. Today we suggest three recent articles and a report.
Lets start with the story of a hack involving software from Kaspersky Labs in the New York Times: How Israel Caught Russian Hackers Scouring the World for U.S. Secrets <read>
Before we read the story, remember there is some history here. Russia is the enemy of choice for the U.S. these days. The media and Government are biased to attribute any attack to Russia, exaggerate any attack from Russia, and to conflate anything Russian with the Russian Government. The infamous Stuxnet attack which disabled some of Iran’s nuclear centrifuges was allegedly carried out by Israel and the United States – Kaspersky Labs was one of the main contributors in the discovery and investigation of the attack. We remain skeptical of claims that are not highly documented, yet aware undocumented claims may be true.
The Russian operation, described by multiple people who have been briefed on the matter, is known to have stolen classified documents from a National Security Agency employee who had improperly stored them on his home computer, on which Kaspersky’s antivirus software was installed. What additional American secrets the Russian hackers may have gleaned from multiple agencies, by turning the Kaspersky software into a sort of Google search for sensitive information, is not yet publicly known.
The current and former government officials who described the episode spoke about it on condition of anonymity because of classification rules…
Kaspersky Lab denied any knowledge of, or involvement in, the Russian hacking. “Kaspersky Lab has never helped, nor will help, any government in the world with its cyberespionage efforts,” the company said in a statement Tuesday afternoon. Kaspersky Lab also said it “respectfully requests any relevant, verifiable information that would enable the company to begin an investigation at the earliest opportunity.”…
The N.S.A. bans its analysts from using Kaspersky antivirus at the agency, in large part because the agency has exploited antivirus software for its own foreign hacking operations and knows the same technique is used by its adversaries.
Nobody knows who actually exploited the Kaspersky software, yet it could have been Israel:
The report did not name Israel as the intruder but noted that the breach bore striking similarities to a previous attack, known as “Duqu,” which researchers had attributed to the same nation states responsible for the infamous Stuxnet cyberweapon. Stuxnet was a joint American-Israeli operation that successfully infiltrated Iran’s Natanz nuclear facility, and used malicious code to destroy a fifth of Iran’s uranium centrifuges in 2010.
Kaspersky reported that its attackers had used the same algorithm and some of the same code as Duqu, but noted that in many ways it was even more sophisticated. So the company researchers named the new attack Duqu 2.0, noting that other victims of the attack were prime Israeli targets.
This week the DEFCON report on its Election Hacking Village was published: Report on Cyber Vulnerabilities in
U.S. Election Equipment, Databases, and Infrastructure <read>
It is a significant event with a short 18 page report. Well worth reading. The Forward summarizes it well:
last year’s attack on America’s voting process is as serious a threat to our democracy as any I have ever seen in the last 40+ years–potentially more serious than any physical attack on our Nation. Loss of life and damage to property are tragic, but we are resilient and can recover. Losing confidence in the
security of our voting process–the fundamental link between the American people and our government–could be much more damaging. Inshort, this is a serious national security issue that strikes at the core of our democracy…If Russia can attack our election, so can others: Iran, North Korea, ISIS, or even criminal or extremist groups. Time is short: our 2018 and 2020 elections are just around the corner and they are lucrative targets for any cyber opponent. We need a sense of urgency now. Finally, this is a national security issue because other democracies–our key allies and partners–are also vulnerable…
For over 40 years I voted by mailing an absentee ballot from wherever I was stationed around the world. I assumed voting security was someone else’s job; I didn’t worry about it. After reading this report, I don’t feel that way anymore. Now I am convinced that I must get involved. I hope you will read this report and come to the same conclusion.
Douglas E. LuteFormer U.S. Ambassador to NATOLieutenant General, U.S. Army, Retired
From Newsweek: Russians Still Have An Open Path to U.S. Election Subversion <read>
Although some of the references to Russian interference in the following story have been withdrawn and questioned, the basic theme that Congress and the Administration are basically not in action is cause for concern that noting of substance will be accomplished.
Exactly a year after U.S. intelligence issued a stern warning about Russian interference in the 2016 presidential election, the Trump administration has failed to fill key homeland security posts responsible for preventing another Kremlin assault on the voting system…
“The second thing is, the administration doesn’t seem to want to have anybody head up to the Hill and testify on issues that would be hot-button issues, namely anything to do with election security, cyber security, or the Russian acts from last year.”
Unless the administration puts its own political appointees in place at DHS, analysts say, the department will struggle to get protective systems up and running in time for the 2017 primaries and state and local races, let alone the 2018 elections.
And from Politico: Hacker study: Russia could get into U.S. voting machines <read> Not just Russia, however:
American voting machines are full of foreign-made hardware and software, including from China, and a top group of hackers and national security officials says that means they could have been infiltrated last year and into the future. American voting machines are full of foreign-made hardware and software, including from China, and a top group of hackers and national security officials says that means they could have been infiltrated last year and into the future…
“From a technological point of view, this is something that is clearly doable,” said Sherri Ramsay, the former director of the federal Central Security Service Threat Operations Center, which handles cyber threats for the military and the National Security Agency. “For us to turn a blind eye to this, I think that would be very irresponsible on our part.”
Often, voting machine companies argue that their supply chain is secure or that the parts are American-made or that the number of different and disconnected officials administering elections would make a widespread hack impossible. The companies also regularly say that since many machines are not connected to the internet, hackers’ ability to get in is limited.
But at the DEFCON event in Las Vegas, hackers took over voting machines, remotely and exposed personal information in voter files and more…
It sounds like science fiction, or at least “Ocean’s 11,” but cybersecurity experts are frantically waving their hands, trying to get Americans to see that in foreign capitals, the American voting system just looks like easy opportunity.
Recent events are a reminder that we must be eternally skeptical. We need to be especially skeptical of the mainstream media as well as other sources.
Today we add the most recent flurry about the “21 states hacked by Russia before the 2016 election”, and more. The story continues to fall apart, bit by bit. Yet, we suspect the truth is far from common knowledge.
And an Intercept story by Kim Zetter reviewing a report by Kaspersky Lab Masquerading Hackers Are Forcing a Rethink of How Attacks Are Traced. The title pretty much says it all. Attribution is difficult, yet often possible.
Not expecting to paraphrase George Wallace, a person about as far me politically or as a humanist as one can be. Yet, recent events are a reminder that we must be eternally skeptical. We need to be especially skeptical of the mainstream media as well as other sources. <here> <here>
Today we add the most recent flurry about the “21 states hacked by Russia before the 2016 election”, and more. The story continues to fall apart, bit by bit. Yet, we suspect the truth is far from common knowledge:
Our skepticism was justified, it would be even if the story proved true.
I am not a fan of the Russian government system, we should be concerned about China, Russia, and our own actions. Yet, I often read and learn from RT articles. I find them biased toward publishing factual articles supporting their point of view, yet no more so than FOX, CNN, MSNBC or many other players in the U.S. media. Like Al Jazeera, RT is journalism and largely accurate, often covering important stories not available elsewhere. RT and Al Jazerra are hardly Radio Free Europe or Tokyo Rose. The U.S. is far from innocent when it comes to manipulating elections. Right now I am in the middle of reading “In the Shadows of the 20th Century” Here is a quote:
According to a compilation at Carnegie Mellon University, between 1946 and 2000 the rival superpowers intervened in 117 elections, or 11 percent of all the competitive national-level contests held worldwide, via campaign cash and media disinformation. Significantly, the United States was responsible for eighty-one of these attempts (70 percent of the total) – including eight instances in Italy, five in Japan, and several in Chile and Nicaragua stiffened by CIA paramilitary action.
Now an Intercept story by Kim Zetter reviewing a report by Kaspersky Lab (another company recently trashed because it is Russian) Masquerading Hackers Are Forcing a Rethink of How Attacks Are Traced <read>
The title pretty much says it all. Attribution is difficult, yet often possible.
We add yes, but without trusted, multiple, third-parties reviewing the evidence and, even better, generating the evidence independently there is little basis for blind trust, while strong skepticism is justified – especially if the claims match the bias and agenda of the source.
CNN: For fair elections … can we get a recount?
We should not ignore calls for audits, recounts, and paper ballots just because the motivator for those calls may be simplistic. There are a multitude of risks beyond Russians, beyond foreigners, beyond skullduggery. Its not just fairness, it is accuracy and democracy.
CNN: For fair elections … can we get a recount? <read>
We should not ignore calls for audits, recounts, and paper ballots just because the motivator for those calls may be simplistic. There are a multitude of risks beyond Russians, beyond foreigners, beyond skullduggery. Its not just fairness, it is accuracy and democracy.
The latest reporting regarding the scope of attempted Russian cyber-interference in the 2016 presidential election suggests election officials made a mistake in ending efforts to recount the contest in key states. Those recounts offered the best opportunity to identify and resolve issues that are now coming to light. We should study our errors to avoid repeating them — and to make sure recounts in the future are better at detecting hacking and other threats.
Post-election efforts to recount the 2016 presidential vote did not get far. For example, the Michigan recount was shut down after just three days; a federal judge rejected a request to recount paper ballots in Pennsylvania; and while Wisconsin did conduct a recount, in many counties, officials neglected to hand-count paper ballots and did not examine vulnerable software in electronic voting machines.
Just as Donald Trump continues to resist the finding that Russia manipulated our democratic process, he furiously contested the need to investigate the vote…
One clear area of vulnerability then and now is our reliance on electronic voting machines and vote tabulating machines without conducting any meaningful post-election audits. Like any other technology, these devices can fail in unexpected ways. They can have bugs that might produce an incorrect result. When irregularities occur in an election — such as the approximately 84,000 ballots in Michigan on which there were reportedly no selections marked for president — we need to see if an error is to blame.