DHS officials plan Europe trip to brief allies on election security, gather intel for 2020

“If I can go over there and get ahead of the curve … and bring those defensive measures back to the blue team here, I think we’ll be better off for [2020],” DHS's Chris Krebs said.

Department of Homeland Security officials plan to visit European allies to share lessons learned from defending the 2018 U.S. midterm elections, a top DHS official said Tuesday.

“What we’re doing is taking some of the ’16 and ’18 lessons learned, packaging them together, and then doing a bit of a roadshow,” Chris Krebs, head of DHS’s Cybersecurity and Infrastructure Security Agency, told reporters. Details of the trip are still being finalized, but Krebs said it also would offer CISA officials an update from the field on adversary activity ahead of the 2020 U.S. presidential election.

Many millions of Europeans are expected to head to the polls in late May to choose new representatives in the European Union parliament. European officials have issued a series of warnings that Russia is likely to interfere in the vote, including an assessment last week from Estonia’s foreign intelligence agency.

In another key election, Ukrainians will choose a president later this month. The Ukrainian president has already accused the Russian government of conducting distributed denial-of-service attacks on Ukraine’s election commission website.

All of those threats matter to the CISA teams charged with protecting the 2020 vote in the U.S.

“I know what [the Russians] did in ’16,” Krebs said. “I know what they tried to do in ’18. I don’t know what they’re going to do in ’20, but I guarantee you, the Russians are road-testing it right now in certain spaces in Europe.”

Attention to election-security-related issues in Europe has only grown more acute in recent weeks. In February, Microsoft revealed hacking attempts on European think tanks. The tech giant said a hacking group linked to the Russian government was responsible.

“If I can go over there and get ahead of the curve … and bring those defensive measures back to the blue team here, I think we’ll be better off for [2020],” he added.

Before the 2018 midterms, U.S. Cyber Command went on a European trip in that same spirit, conducting defensive exercises with Ukraine, North Macedonia, and Montenegro.

There is plenty of recent data for DHS officials to draw on in sharing U.S. experiences with election security. During the 2016 presidential campaign, Russian intelligence operatives conducted an incisive hack-and-leak operation designed to support Donald Trump’s candidacy, the U.S. intelligence community concluded. After that intervention, federal officials poured resources into shoring up defenses at the state and local level. The 2018 midterms passed without evidence of  large-scale intervention approaching that of 2016.

There is now a recognition in the election security community that 2016 was a watershed – that foreign adversaries will continue to use digital tools to try to meddle in the electoral process for the foreseeable future.

That “new normal” was reflected in the fact that CISA put election security on its shortlist of priorities as the agency came back to full staff in late January following the record 35-day partial government shutdown. The agency spent a good portion of the RSA Conference in San Francisco this month meeting with allies to discuss election security, according to Krebs.

“We’re not waiting until six months before the [2020] election” to prepare, he said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure