Election commission hires cyber

Maurice Turner is set to join the federal commission at the end of the month as a senior adviser to the EAC's executive director.

The U.S. Election Assistance Commission is hiring a senior policy adviser to bolster its cybersecurity work with election officials and voting equipment vendors ahead of the 2020 presidential vote.

Maurice Turner is set to join the federal commission at the end of the month as a senior adviser to the executive director, supporting the EAC’s internal operations and programing.

Externally, he says he can help the commission with an update to important guidelines for voting systems security, and in supporting states as they set up programs to find and fix software vulnerabilities.

“I want election officials to expect that EAC is a place that they can go for this type of information,” Turner told CyberScoop. “Whether it’s about security standards or new methods for election administration.”

Turner has spent the last two years working on election security at the nonprofit Center for Democracy & Technology. He was previously a fellow in the Senate advising the Homeland Security and Governmental Affairs Committee on cybersecurity issues.

The EAC oversees certification of complex voting systems used in elections and has administered hundreds of millions of dollars in security assistance to states since Russia’s intervention in the 2016 election.

Turner wants to use his relationships with researchers and election officials to further the commission’s cybersecurity work. He has been a fixture at the “Voting Village” at DEF CON, one of the world’s largest hacking conferences, where researchers can scour voting equipment for vulnerabilities. At last year’s conference, he toured other hacking villages with election officials to show them what close collaboration with ethical hackers looked like.

“I try to be a bridge between the two,” he said of the ethical hacking and election administrator communities.

Tuner said there is a role for the EAC to support states that are trying to set up vulnerability disclosure programs that allow researchers to report bugs in IT systems that support voting. A handful of states are moving in that direction.

Voting equipment vendors themselves are also exploring vulnerability disclosure programs after years of resistance to the idea.

Turner said he is interested in finding “a more productive way of coming together [with equipment vendors] and letting those researchers do what they do best” – find and responsibly disclose software bugs.

The EAC has been hampered by tight budgets, but it did get $15 million in fiscal 2020 funding from Congress compared to $9 million the prior year.

The commission is using some of that money to hire cybersecurity personnel. In addition to Turner, it is bringing on a senior cybersecurity official who is a former engineer at the National Institute of Standards and Technology.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure