House Dems release report, propose bill addressing election cyberthreats

The bill would provide more than $1 billion for states to use for modernizing and securing their election infrastructure.

House Democrats released a report and new legislation on Wednesday urgently calling for more attention and federal funding to the U.S. election process in order to stop foreign hacking and other interference.

The bill and accompanying report mark the culmination of an eight-month effort by the Democratic Election Security Task Force to develop a plan to deal with election threats, and the latest in a series of congressional legislative efforts to do so.

Much of what the bill, the Election Security Act, is calling for has been covered by other legislation proposed in recent months. Those bills haven’t seen much progress in the way of being passed.

The largest chunk of funding would be a $1 billion Election Assistance Commission grant available to states to replace old, insecure voting machines with machines that scan auditable paper ballots. The grant is limited to purchases from election vendors certified by the EAC and Department of Homeland Security. The bill would also provide states with $20 million in federal funding for “risk-limiting audits” of voter counts after an election in order to verify whether the reported results are accurate. States would also get $1 per voter who participated in the most recent election to spend toward maintaining election security.

DHS would be required to expedite security clearances for state election officials so that they can review information about about potential cyberthreats, another measure proposed in past bills.

DHS in January 2017 declared election technology as one of its critical infrastructure sectors. The department also notified 21 states in September that some element of their voting process was scanned by Russian actors for vulnerabilities.

“States cannot fight sophisticated adversaries like Russia alone,” said Rep. Bennie Thompson, D-Miss., who heads the task force, in a statement. “It is time for Congress to act to institute reforms and provide substantial assistance.”

The 56-page task force report also names Iran, North Korea and China as potential election threats because of their prowess in cyberspace.

The bill also tries to set broad federal government strategy. It directs the president to issue a national strategy to “protect U.S. democratic institutions against cyber attacks, influence operations, disinformation campaigns, and other activities that could undermine the security and integrity of such institutions” within a year of enactment. It would also create a bipartisan commission to develop recommendations, emphasizing lessons learned from “European allies” to combat such meddling.

The report released alongside the bill asserts that “the Trump Administration and Republican Members of Congress still refuse – a year later – to pursue the facts and defend our democracy.” The task force draws heavily on findings from the U.S. intelligence community. Intelligence agencies concluded in January 2017 that Russian President Vladimir Putin ordered efforts to hack and influence the 2016 presidential election.

Intelligence officials told members of the Senate Intelligence Committee on Tuesday that they believe Russia will attempt to influence U.S. elections again.

You can read the full report below.

[documentcloud url=”http://www.documentcloud.org/documents/4379700-TFESReport.html” responsive=true]

Trump turns to private sector in offensive hacking operations memo

One expert called it a “pretty big shift in U.S. cyber policy,” and there have been reservations in the past about opening the door to private sector…

Most federal cybersecurity reporting rules are duplicative, study finds

House intel bill includes provisions on state and local threat intelligence, election security, AI

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure