DHS holds election security exercise with states to prep for midterms

With less than three months until the midterm elections, federal agencies worked with 44 states on all types of attack scenarios.

With less than three months until the midterm elections, the Department of Homeland Security held a three-day exercise this week that allowed state and local officials to practice warding off an array of cyberthreats, from spearphishing campaigns to denial-of-service attacks.

The drills, which featured officials from 44 states, the National Security Agency and U.S. Cyber Command, among other federal agencies, “explored potential impacts to voter confidence, voting operations, and the integrity of elections,” according to a DHS statement.

The Election Assistance Commission, the federal agency charged with distributing $380 million in election-security funding to states, also took part.

DHS said private vendors participated in the exercise, but did not name them.

The exercise covered several scenarios, according to DHS: spearphishing against election officials; social media manipulation related to political candidates; “disruption” of voter registration IT systems; denial-of-service attacks and “web defacements” affecting board of election websites and web applications; “the exploitation of state and county board of election networks;”’ and “malware infections impacting electronic voting machines and election management system software.”

Grappling with those simulated attacks, federal, state and local officials tested their lines of communication and their ability to quickly share threat information. The drill also harped on the importance of having a cyber incident response plan with regards to election infrastructure. Specifically, participants examined “procedures for requesting state and federal incident response resources if county and state resources are exhausted,” according to the DHS statement.

“In this environment, if we prepare individually, then we fail collectively, and I am grateful for everyone’s participation and partnership this week,” Homeland Security Secretary Kirstjen Nielsen said in a statement.

The DHS-led exercise comes as U.S. officials warn that Russia will continue to interfere in U.S. elections, and as states ramp up their cybersecurity measures to prepare for the midterms.

In advance of the 2016 presidential election, Russian hackers probed the IT systems of 21 states, including Illinois, where they breached a voter registration database. While activity on that scale has not yet surfaced this campaign season, Sen. Claire McCaskill, a Democrat in a close race in Missouri, has confirmed that she was targeted by Russian spearphishers.

Election official says Tina Peters would be consultant, won’t have access to election systems

Shasta County registrar Clint Curtis told CyberScoop he needs Peters to help manage the county’s 2026 elections and he’s not concerned about her past conviction.

A California county wants to hire Tina Peters to help run its elections

State officials, election experts pan Trump speech: ‘This is what desperation looks like’

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure