The newest risks for state election systems: Russian owners and remote access
Connecting state and local government leaders
A top voting machine vendor admits to putting remote-access software on systems for years, while Maryland officials are seeking DHS' help after discovering a different contractor's Russian connection.
Maryland officials are asking the Department of Homeland Security for help evaluating its election systems after learning that a vendor with whom the Maryland State Board of Elections was working for voting services and registration infrastructure had been acquired by a company linked to a Russian oligarch.
“While the information relayed to us did not indicate that any wrongdoing or criminal acts have been discovered, we are fast approaching an election in November, and even the appearance of the potential for bad actors to have any influence on our election infrastructure could undermine public trust in the integrity of our election system,” Gov. Larry Hogan said in a statement.
In a July 13 letter to DHS Secretary Kirstjen Nielsen, Maryland officials asked for help from the agency's Office of Cybersecurity and Communications to evaluate network security, audit network integrity and provide other technical support and guidance within the “shortest time possible” to allow for corrective actions before the 2018 elections.
State elections officials and federal lawmakers have been turning up the heat on election equipment vendors over the past 18 months, asking questions about the security of their systems. Officials from Elections Systems and Software admitted to Sen. Ron Wyden (D-Ore.) that the firm had installed remote-access software on "a small number" of election management systems sold from 2000 to 2006, Motherboard reported on July 17.
Wyden is an avid critic of elections system manufacturers, and he introduced legislation in June to require all states to use paper ballots and conduct risk-limiting audits. At least 60 percent of all ballots cast in the United States were tabulated using ES&S systems in 2006, according to Motherboard.
The pcAnywhere remote-access software is used by system administrators to conduct maintenance and make upgrades and help with technical support. Even though election management systems are supposed to be air-gapped systems for security reasons, ES&S equipment running pcAnywhere also had modems that allowed admins to dial into the systems, which could create an entry point for hackers.
The company quit installing pcAnywhere on election systems equipment in December 2007, but not before hackers had stolen the source code for the program and a critical vulnerability was discovered that let attackers take control of a system running pcAnywhere, Motherboard said.
A February analysis of the 2016 election by ProPublica found that over two-thirds of counties used machines that are over a decade old. For the 2018 election, most of those jurisdictions will be still be using that equipment.