Voting Village brings equipment to lawmakers to boost urgency on election security

This time, they brought the equipment.

A year from the 2020 election and with a new round of election security funding stalled in Congress, the DEF CON Voting Village organizers have again taken to Capitol Hill to raise awareness about software vulnerabilities in voting equipment. This time, they brought the equipment with them to drive home their point.

“If we’re going to meaningfully introduce funding or introduce new technologies for 2020, time is rapidly running out to be able to do that,” Matt Blaze, a professor at Georgetown University and co-organizer of the Voting Village, told CyberScoop. “We need to act pretty fast.”

A handful of House Democrats and their staffers sauntered up to equipment on display, including a ballot-marking device and an electronic voting machine, to ask the researchers about the software bugs they found.

“This is really helpful in understanding that these aren’t just abstract problems, that these are real things,” Blaze, an expert in cryptology, told CyberScoop.

This is the second time in a month that the Voting Village has hosted an event on Capitol Hill. Last month, Blaze and Harri Hursti, another village organizer, unveiled the village’s annual report on flaws in voting gear that could be exploited by hackers.

On Tuesday, Rep. Cedric Richmond, D-La., approached a ballot-marking device made by Election Systems & Software, the country’s biggest voting equipment vendor. A young man was using a screwdriver to open the machine up and examine it.

“It goes to show why we need to be serious about election security, why we should invest in election security,” Richmond said of the briefing from Voting Village organizers.  He chairs the House Homeland Security Committee’s cybersecurity-focused panel.

State officials are still spending the $380 million Congress gave them last year to better secure their voting infrastructure. But election security advocates say much more money is needed to implement key upgrades for equipment. New York University’s Brennan Center for Justice puts the price tag for replacing old voting machines, upgrading voter registration systems, and other security measures at $2.2 billion.

Although Senate Majority Leader Mitch McConnell, R-Kentucky, last month expressed support for an additional $250 million in funding for states, that bill hasn’t moved in the Senate.

Rep. Bennie Thompson, D-Miss., chairman of the House Homeland Security Committee, lamented that the Senate election security funding bill was “languishing.” There needs to be federal incentives for election officials to buy new and more secure election equipment, Thompson said at the Voting Village briefing.

The nation’s voting vendors say they take the security of their equipment seriously, and they are setting up a vulnerability disclosure program with security researchers to fix software bugs.

While Blaze welcomed that progress, he said the vendors still had a long way to go. He wants the Voting Village to expand beyond voting machines to include the election management systems (EMS) that are used to configure the machines. But on that front, he said, the vendors are putting up stiff resistance. Whereas the village can buy voting machines on eBay, EMS are harder to acquire.

“Unfortunately, the vendors have been very aggressive in trying to prevent us from getting our hands on these systems,” Blaze told CyberScoop, referring to the three biggest vendors — ES&S, Dominion Voting Systems, and Hart InterCivic.

Kay Stimson, vice president of government affairs at Dominion Voting Systems, said EMS has been a topic of discussion for collaboration with the Voting Village.

“The bottom line is we need to put the ‘village’ in the Voting Village,” Stimson told CyberScoop. “Effective industry-researcher collaboration is standard practice for most of the other villages at DEF CON.  It’s something that must be addressed for 2020.”

A spokesperson for ES&S did not address Blaze’s charge related to EMS software, but instead said generally that ES&S submits its equipment to independent security testing.

A spokesperson for Hart InterCivic did not respond to a request for comment on Blaze’s comments by press time.

Trump threatens executive order on elections, claims states must obey

The provisions mentioned by the president, such as banning mail-in voting and voting machines, are viewed by many experts as plainly unconstitutional.

Picketed at work, confronted at church: Why election workers have left the job

Cyberattack hits Georgia county at center of voting software breach

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure