Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Cyberwarfare

Homeland Security Head: Colorado Tops US in Vote Security

Colorado, whose election systems are ranked among the nation’s safest, held a cyber-security and disaster exercise Thursday for dozens of state, county and federal elections officials to reinforce the state’s preparedness for, and public confidence in, November’s midterm elections.

Colorado, whose election systems are ranked among the nation’s safest, held a cyber-security and disaster exercise Thursday for dozens of state, county and federal elections officials to reinforce the state’s preparedness for, and public confidence in, November’s midterm elections.

Participants included Department of Homeland Security cyber experts working with county elections clerks to confront a rapid-fire sequence of scenarios. In a brief appearance, Homeland Security Secretary Kristjen Nielsen praised Colorado as a national leader in safeguarding elections.

On Wednesday, Nielsen called election security one of the nation’s highest priorities. She said the biggest threats are coming online from malicious nation-states seeking to disrupt democracy.

The U.S. intelligence community has said Russia had tried to influence the 2016 election to benefit President Donald Trump. Nielsen frequently has said the Russians attempted to sow discord and undermine faith in the democratic process and, over time, developed a preference for then-candidate Trump.

On Thursday, Nielsen reiterated her concerns about potential Russian hacking or interference, particularly of voter databases this year. But she said no attempts have been detected so far that match the scale of the 2016 effort.

“Any attempt to interfere in our elections is a direct attack on our democracy and is unacceptable,” Nielsen told participants at a Denver hotel. Turning to Colorado’s record, she declared: “We’d love to continue to use you as an example of what other states can adopt.”

Among them, she said, her department wants all 50 states to conduct postelection risk-limiting audits, which strictly ensure the accuracy of vote counts, by 2020. It’s standard practice in Colorado.

Advertisement. Scroll to continue reading.

Colorado’s Republican Secretary of State, Wayne Williams, said the exercise aimed to increase public confidence that votes are safe.

“So we can tell you that nobody in Russia, nobody in China, nobody anywhere else in the world can change a ballot in Colorado,” Williams said.

Colorado was the only one among 21 targeted states to report to Homeland Security — not the other way around — that Russian interests attempted to hack into its systems in 2016, said state elections director Judd Choate.

It’s invested in new vote tabulating machines and creates a separate paper trail of each ballot cast. Since 2013, it’s required two-factor authentication for elections systems operators to access equipment. The secretary of state’s office has more internet technology staff than purely elections-related staff, and it has plans, which Choate wouldn’t disclose for security reasons, to guarantee security and privacy in the remote case the state’s voter registration database is hacked.

This year, the state also will monitor Facebook, Twitter and Instagram starting well ahead of the election to detect and respond to false rumors about voting procedures, outages, and other voting problems. It also will collect intelligence on efforts to sway voters on social media, Choate said. He noted that Colorado’s collaboration with Homeland Security is strong.

Choate warned the dozens of clerks, database experts and others that Thursday’s exercise would be tough, involving, among a cascade of other problems, attempts to hack voter rolls, detect possible malware planted in voting systems weeks beforehand, phishing and responding to social media posts claiming systems were hacked or voters turned away. The exercise concerned both the weeks leading up to the election and election day itself.

“Like the worst possible election day and election that you’ve ever seen in your life. So there’s every single disaster that you probably thought couldn’t happen, and then about 15 that you wouldn’t even thought through,” Choate said.

Paul Huntsberger, database chief for Denver County’s elections division, worked with colleagues from across the state responding or devising responses to the disaster scenarios: Def Con hackers in Las Vegas, electricity outages, security patches, verifying clearances and background checks for personnel, responding to ransomware attacks in other states.

Throughout, officials masquerading as citizens and news reporters demanded immediate answers to security questions.

“All of this is needed,” Huntsberger said during a brief break. “And we’re proving that communication, secure communication, is key to making it work.”

Written By

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.

Register

Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.

Register

Expert Insights

Related Content

Cyberwarfare

WASHINGTON - Cyberattacks are the most serious threat facing the United States, even more so than terrorism, according to American defense experts. Almost half...

Cyberwarfare

Websites of German airports, administration bodies and banks were hit by DDoS attacks attributed to Russian hacker group Killnet

Cyberwarfare

The war in Ukraine is the first major conflagration between two technologically advanced powers in the age of cyber. It prompts us to question...

Application Security

Fortinet on Monday issued an emergency patch to cover a severe vulnerability in its FortiOS SSL-VPN product, warning that hackers have already exploited the...

Cyberwarfare

Iranian APT Moses Staff is leaking data stolen from Saudi Arabia government ministries under the recently created Abraham's Ax persona

Application Security

Virtualization technology giant VMware on Tuesday shipped urgent updates to fix a trio of security problems in multiple software products, including a virtual machine...

Cyberwarfare

Russia-linked cyberespionage group APT29 has been observed using embassy-themed lures and the GraphicalNeutrino malware in recent attacks.

Cyberwarfare

ENISA and CERT-EU warn of Chinese threat actors targeting businesses and government organizations in the European Union.