2016: The year of election tampering?

Justin Fier, Director of Cyber Intelligence | Friday November 4, 2016

The 2016 U.S. election is roiled by fears over election tampering and cyber-warfare. While such anxiety threatens to undermine confidence in the results, the up-side is that for the first time since 2000, the election is generating thoughtful discussion on the intersection of cyber-security and voting.

After the high-profile hack of the Democratic National Committee, and after attacks on voter registration databases in 20 states, these fears are certainly justified. After all, we live in a new era of threat, where foreign powers don’t hesitate to use cyber-tools for economic and political gain. The White House has now formally blamed Russia for the DNC hack, but they’re hardly the only nation-state willing to engage in cloak-and-dagger cyber-warfare.

Further complicating matters is that our voting machines are in desperate need of an overhaul. In 2006, computer scientists proved that in less than a minute, an e-voting machine could be hacked and installed with vote-changing malware, and it can even be done remotely. But intentional manipulation may not even be our biggest concern — in 2004, North Carolina lost 4,438 votes because of a system error.

If you’re thinking paper ballots are the answer, I don’t blame you. Most states would agree: only five states currently use digital voting alone, and 75 percent of all voting is done on paper ballots.

But after the 2000 election, when the infamous ‘hanging chads’ forced millions of votes to be invalidated, it became clear that paper ballots are not only cumbersome, but inaccurate. Two years later, Congress passed the Help America Vote Act and introduced digitized voting and registration databases across America. Unfortunately, the new machines were plagued with errors, and many of them are still in use today.

Growing concern over election tampering prompted 33 state election agencies to petition the Department of Homeland Security for aid. The DHS responded by offering “cyber hygiene scans on Internet-facing systems as well as risk and vulnerability assessments.”

This is a good start, but hardly a long-term solution. Cyber-security for the future has to go beyond one-off scans and retrospective assessments. The answer has to involve intelligently monitoring and analyzing millions of devices — from voting machines to vulnerable IoT devices — in order to mitigate risk from unknown threats. Whether it be a state-sponsored hack or tampering from a politically motivated insider, the integrity of our elections is at stake, and its security deserves the utmost attention.

To hear more of my thoughts on the modern threat landscape, sign up for my webinar on November 9.

Blog Archive

Thursday January 10, 2019
Monday December 3, 2018
Thursday November 22, 2018
Thursday October 25, 2018
Thursday October 4, 2018
Monday August 20, 2018
Monday July 16, 2018
Friday June 22, 2018
Wednesday May 9, 2018
Monday April 16, 2018
Wednesday March 7, 2018
Tuesday February 13, 2018
Friday February 2, 2018
Monday January 22, 2018
Friday December 8, 2017
Monday November 27, 2017
Monday October 30, 2017
Wednesday October 25, 2017
Thursday October 12, 2017
Monday October 2, 2017
Monday September 18, 2017
Monday July 31, 2017
Thursday June 29, 2017
Wednesday June 21, 2017
Wednesday May 17, 2017
Monday May 8, 2017
Wednesday April 5, 2017
Monday March 6, 2017
Monday February 13, 2017
Monday January 30, 2017
Monday January 9, 2017
Friday December 16, 2016
Monday December 5, 2016
Friday November 18, 2016
Friday November 4, 2016
Monday October 24, 2016

About the authors

Justin Fier

Justin Fier is the Director for Cyber Intelligence & Analytics at Darktrace, based in Washington D.C. Justin is one of the US’s leading cyber intelligence experts, and his insights have been widely reported in leading media outlets, including Wall Street Journal, CNN, the Washington Post, and VICELAND. With over 10 years of experience in cyber defense, Justin has supported various elements in the US intelligence community, holding mission-critical security roles with Lockheed Martin, Northrop Grumman Mission Systems and Abraxas. Justin is also a highly-skilled technical specialist, and works with Darktrace’s strategic global customers on threat analysis, defensive cyber operations, protecting IoT, and machine learning.

Dave Palmer

Dave Palmer is the Director of Technology at Darktrace, overseeing the mathematics and engineering teams and project strategies. With over ten years of experience at the forefront of government intelligence operations, Palmer has worked across UK intelligence agencies GCHQ & MI5, where he delivered mission-critical infrastructure services, including the replacement and security of entire global networks, the development of operational internet capabilities and the management of critical disaster recovery incidents. He holds a first-class degree in Computer Science and Software Engineering from the University of Birmingham.

Andrew Tsonchev

Andrew advises Darktrace’s strategic Fortune 500 customers on advanced threat detection, machine learning and autonomous response. He has a technical background in threat analysis and research, and holds a first-class degree in physics from Oxford University and a first-class degree in philosophy from King’s College London. He was most recently featured on BBC World, BBC Morning and Al Jazeera to comment on the news regarding the GRU.

Max Heinemeyer

Max is a cyber security expert with over eight years’ experience in the field specializing in network monitoring and offensive security. At Darktrace, Max works with strategic customers to help them investigate and respond to threats as well as overseeing the cyber security analyst team in the Cambridge UK headquarters. Prior to his current role, Max led the Threat and Vulnerability Management department for Hewlett-Packard in Central Europe. He was a member of the German Chaos Computer Club, working as a white hat hacker in penetration testing and red teaming engagements. Max holds a MSc from the University of Duisburg-Essen and a BSc from the Cooperative State University Stuttgart in International Business Information Systems.