Wyden asks election commission to issue fresh cybersecurity guidance

Another day, another letter from Sen. Ron Wyden questioning the federal government's tech priorities.

Sen. Ron Wyden, D-Ore., has asked the Election Assistance Commission to issue updated cybersecurity guidance to states to protect their voting infrastructure ahead of the 2018 midterm elections.

Congress allotted $380 million to states through a March spending bill to help secure their voting systems, a move that analysts welcomed as necessary, but insufficient to replace paperless voting machines that could fall prey to digital manipulation. “Absent guidance from the EAC, some states may opt to spend these new funds on insecure voting technology,” Wyden wrote in a letter obtained by CyberScoop.

“Election security experts have worked tirelessly to understand and articulate the vulnerabilities certain types of machines can introduce into elections,” Wyden wrote, adding that new EAC guidance must incorporate those findings.

The senator also wants the EAC to answer a series of questions by July 15, including whether the commission has any fulltime cybersecurity experts on staff and if it has ever revoked a voting system’s certification because of cybersecurity concerns.

In addition, Wyden asks what processes the EAC has in place to make sure states’ voting systems adhere to cybersecurity best practices. The senator also wants to know if EAC supports things like penetration testing and red-teaming of systems, and if so, what it has done to spread those practices.

The Department of Homeland Security has been offering states vulnerability assessments and classified briefings to prepare them for the midterm elections. A top DHS official told Wyden in April, however, that the department had not assessed whether individual election-system vendors had followed good cybersecurity practices.

CyberScoop has asked the EAC for comment on the letter from Wyden and will update this story if any is provided. The EAC approved updated voting security guidelines in 2015, and again in April 2018, according to the commission’s website.

Nonetheless, Wyden says, “the guidelines still encourage states to adopt policies – including certifying machines that make auditing difficult and permitting voting systems to be connected to the internet – that are wildly inconsistent with modern cybersecurity best practices.”

You can read the full letter below.

[documentcloud url=”http://www.documentcloud.org/documents/4501634-Wyden-Election-Assistance-Commission-Letter-1.html” responsive=true]

Wyden seeks upgraded NSA security guidance on commercial VPN use

it’s the latest in a sequence of letters to feds from Sen. Ron Wyden, D-Ore., on commercial VPNs.

Tina Peters, through attorney, backs off formal role in Shasta County elections

Election official says Tina Peters would be consultant, won’t have access to election systems

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure