Rep. Speier: Congress needs a hack demo to understand election vulnerabilities

“I think that if we can fashion some kind of an interactive experience for members to watch… then we’ve got their attention,” Rep. Jackie Speier told CyberScoop.

Lawmakers still need a hands-on demonstration of voting equipment vulnerabilities to fully grasp the urgency of election security, according to Rep. Jackie Speier, D-Calif.

“I think that if we can fashion some kind of an interactive experience for members to watch… then we’ve got their attention,” Speier, a member of the intelligence committee, said in an interview. “We need that moment and we need that equipment, and we need that hack. And so once we can do that and do it in a way that the average luddite can understand, then we’ll be golden.”

DEF CON, the hacking conference where researchers pick apart voting machines, provides that kind of visual demonstration. But Speier appeared to be the only lawmaker in attendance last week as the organizers of the DEF CON Voting Village presented their findings on Capitol Hill. (Some congressional staff did attend.)

Election security vaulted into the spotlight on Capitol Hill after the 2016 presidential campaign during which, according to U.S. officials, Russian-government-linked hackers probed the IT systems of 21 states and breached the Democratic National Committee to leak a trove of emails aimed at undermining Hillary Clinton’s candidacy. While activity on that scale has not yet surfaced this campaign season, U.S. officials have warned that the Russian government will continue to try to interfere in the 2018 midterms.

Speier credited DEF CON for bringing the challenges of election security to life for her, and said that her colleagues in Congress haven’t fully heeded the lessons of Russian interference in 2016. “I hadn’t focused on [the cybersecurity of election infrastructure] until after 2016, and then after I became aware of DEF CON and started really trying to immerse myself in understanding it,” she told CyberScoop. “Maybe I understand it 25 percent now, but I can tell you that I understand it about 90 percent more than most of my colleagues do.”

“I want to give [DEF CON representatives] every opportunity to be front-and-center” in the policy conversation in Washington, Speier added.

Voting Village organizers have clashed with top voting-equipment vendor Election Systems and Software, which has expressed concern over “unvetted” security researchers examining its machines. While ES&S says it supports rigorous third-party testing of its products, DEF CON’s backers say the vendor’s objections to the village raise questions about its willingness to proactively address security vulnerabilities. Speier seconded that criticism of voting-equipment vendors, though didn’t mention any by name.

“There’s not a tech company in my region that doesn’t have an army of software engineers that are always fixing bugs,” said Speier, who represents California’s 14^th District, bordering Silicon Valley. “And these are the premier Fortune 50 companies. So for us to allow [voting equipment vendors] to have such a hands-off relationship with authenticity is deeply troubling.”

Regardless of the extent to which voting vendors use third-party testing, there is still much to be done to secure voting equipment, according to Speier. She pointed to a decade-old flaw in a popular voting ballot machine made by ES&S that the report highlighted.

“It’s our obligation – the Congress of the United States – to guarantee to the American electorate that the equipment and software is fail-safe to the greatest extent possible,” Speier said.

Putting sufficient money toward that goal, however, has been a challenge.

In March, Congress allotted states $380 million to better secure their election infrastructure, funding that isn’t enough to replace less-secure paperless voting machines that are used in several states.  After the midterm elections on Nov. 6, attention in Washington will turn to what can be done to make the 2020 elections secure from foreign interference.

“If the Democrats were to retake the House, I think there would immediately be a strong bill to provide ample funding to provide more safeguards,” Speier said.

“[The] only way we’re going to fix this, in my view, is for the Congress to require that for federal elections the following steps have to be taken: paper ballots, optical scanning, audits,” she said.

Tina Peters, through attorney, backs off formal role in Shasta County elections

Peters still left the door open to working with Shasta County on elections and doubled down on her statements that electronic voting machines should be discontinued.

Trump threatens executive order on elections, claims states must obey

Georgia election officials withheld evidence in voting machine breach, group alleges

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure