A Florida Election Software Company targeted by Russians in 2016 inadvertently Opened a Potential Pathway for Hackers to Tamper with Voter Records in North Carolina on the eve of the Presidential Election.
VR Systems, based in Tallahassee but with Customers in Eight States, used what’s known as Remote-Access Software to Connect for several hours to a Central Computer in Durham County, North Carolina, to Troubleshoot Problems with the Company's Voter List Management Tool. The Software Distributes Voter Lists to Electronic Poll Books, which Poll Workers use to Check in Voters and Verify their Eligibility to cast a Ballot.
In New York, their Vendors, VR Systems and ES&S also had Internal Hardware and Software for Internet Remote Diagnostics. They made the Vendors Disable it.
Election Security Experts widely Condemn Remote Connections to Election-related Computer Systems, not only because they can Open a Door for Intruders but because they can also give Attackers Access to an Entire Network, depending on how they’re Configured.
In Durham County’s case, the Computer in question communicated with North Carolina’s State Board of Elections to Download the County’s Voter List before Elections, which could have potentially Opened a Gateway to the State System as well.
That wouldn’t have allowed Intruders to Alter the vote Tallies, and No Evidence has surfaced that anyone Hacked North Carolina's Election Results. But Interference with Voter Records or Electronic Poll Book software could allow an Attacker to alter Records in a way that Prevents People from Voting, by removing them or changing their Party Affiliation, especially in crucial Swing Precincts.
Investigations are still ongoing into whether any such Tampering might have happened in North Carolina.
I think it happened in Florida, when in 2017-2018, many Voters had trouble Voting in Primaries due to errors in the Voter Rolls.
The Revelation about VR Systems indicates that the Practice of Remotely Accessing critical Election Infrastructure is more Widespread than previously believed. “Vulnerabilities in voting machines get most of the attention, but the security and availability of poll books is as critical to the integrity of elections as voting machines themselves,” said Matt Blaze, a Professor of Law and Computer Science at Georgetown University and longtime Election Security Expert. “If poll books are compromised, this can selectively disenfranchise voters, create long lines at polling places, and cast doubt on the legitimacy of election results.”
The Critical Security Lapse, previously Undisclosed Publicly, is the latest cause for concern surrounding VR Systems, a Company hit by a Malicious Email Campaign targeting its own Employees in August 2016 that was believed to be linked to Russia. VR Systems has long maintained that the so-called Spearphishing attempt, which it reported to the FBI at the time, was Unsuccessful and that a Forensic investigation it commissioned from a Top Cybersecurity firm proved it was never Hacked.
But that Investigation wasn’t done until a year after the Spearphishing Campaign, raising the possibility that any Intruders could have Erased their Tracks from the Company’s Systems during that time. Federal Investigators indicated in the recent Report from Special Counsel Robert Mueller, and other Documents, that Russian Hackers successfully compromised a Voting Technology Company that fits VR Systems' Description, and installed Malware on its Network.
Almost Three years after the First Public revelation of Hackers' interference in the 2016 Presidential Race, the Department of Homeland Security (DHS) has decided to conduct a Forensic Analysis of Computers used in Durham County during that Election.
Even if VR Systems wasn’t Hacked in 2016, the revelation that it used Remote-Access Software to Connect to a Critical Election system at the height of concerns around Russian Hacking alarmed State Officials at North Carolina’s State Board of Elections when they learned about the Incident nearly a year later.
VR Systems has since agreed not to do it anymore, at least in North Carolina. But VR “cited the need to be able to service customer systems and troubleshoot, and that remote access was part of that process — a feature, not a bug.”
VR Systems has Customers in California, Florida, Illinois, Indiana, North Carolina, Virginia, and West Virginia. Sixty-Two of Florida’s 67 Counties used VR Systems in 2016, including Miami-Dade, the State’s most Populous. Twenty-Three of North Carolina’s 100 Counties, including some of its Largest, also used VR Systems’ Technology. Both Florida and North Carolina were Critical to President Trump’s Victory in November 2016: Trump won Florida by 1.2 percentage points, or 119,770 Votes, and North Carolina by 3.8 percentage points, or 117,529 Votes.
The FBI recently revealed that Russian Hackers had Successfully Infiltrated Two Counties in Florida before the 2016 Election, but Details about how the Hacks occurred, or the Connection if any to VR Systems, are still Unclear.
Sen. Ron Wyden (D-OR), a Leading Critic of VR Systems, said the Company needs to explain itself. “Remotely accessing voting systems the day before Election Day is serving up our democracy on a silver platter to foreign hackers,” Wyden said. “No company that plays such a critical role in our elections should be taking such a reckless shortcut with the cybersecurity of its state and local customers." He added: "The fact that we’re just learning about this practice two years after the election, and after any evidence of hacking has likely been destroyed, is inexcusable. Americans need to know if VR Systems still has remote access to election computers in other states, and how often this occurred.”
The Remote-Access Incident occurred in Durham after the County Experienced Problems Loading Voter Data onto USB Sticks used with its Electronic Poll Books. Before an Election, Durham Loads a Digital File containing each Precinct’s Voter List onto the USB Drives. The Sticks, or Activators as VR Systems calls them, are Inserted into Laptops running VR Systems’ Electronic Poll Book Software, known as EViD. There’s One Activator for each EViD Laptop and often Multiple Laptops in a Precinct. When a Poll Worker types a Voter’s Name into a Laptop, the EViD Software checks the Registration List on the USB Stick to Verify that the Person is Eligible to Cast a Ballot.
On the Sunday before the 2016 election, and again the next day, it was taking “multiple times longer than normal” to Load the Voter List to the USB Sticks, the Person familiar with the Episode said. Seeking to find out why it was taking so long, VR Systems Remotely Accessed the County Computer used to Load the Voter Lists but never came to a Conclusion. The Election Night problem with the USB Sticks had not been previously Reported. But subsequent Problems that occurred with the County’s Electronic Poll Books did make Headlines.
Electronic Poll Books at Five Precincts began having Problems almost immediately after Polls Opened on Election Day. Some Crashed, some Incorrectly told Poll Workers they had to ask Voters for a Photo ID, and others Erroneously indicated that at least Nine Voters had already Cast a Ballot when they had Not.
When the State Election Board learned about the Problems, it Ordered the City Mid-Morning to Switch to Paper Backups of the Voter List. But this created Delays and Long Lines that led some Voters to Leave without Casting a Ballot. After the Election, Durham County hired an Outside Cybersecurity Firm to investigate the Poll Book Problem. The Firm, Protus3, concluded that Errors by Poll Workers were the Problem for at least Three Voters who were told Incorrectly they had already Voted. The Report speculated about the Causes of other Problems, but ultimately the State determined that the Findings were Inconclusive.
There was also a Problem with the Scope of the Investigation, which did Not appear to Focus on whether Malicious Actors had Hacked the Electronic Poll Books or the Voter List, according to a Copy of the Protus3 Report. Though Portions of the Report are Blacked Out, its Unredacted Summary doesn’t mention any Attempts to Examine the County’s Network for Signs of an Intrusion for Malware, or to look for Malware on the Electronic Poll Books and Central Computer, though it does say the Poll Books and Central Computer were Imaged and Analyzed.
Although the Russian Spearphishing Operation against VR Systems was Not Publicly known when Protus3 conducted its Investigation, VR Systems had sent an Email to or Called All of its Customers on Nov. 1st, 2016, to Warn them about a Malicious Email Campaign sent to Some of its Customers that was Designed to look like an Email from the Company.
The North Carolina State Board of Elections sought to obtain an Unredacted Version of the Protus3 Report, but was Denied, according to the Person familiar with the Inquiry. The Board considered the Protus3 Investigation Incomplete but didn’t press the matter.
That changed in June 2017 when the Intercept Published a Leaked NSA Document that Revealed that Russian Hackers had sent Employees of a Voting Technology Company Malicious Emails in August 2016 with the intent of Hacking into their Company Email Accounts. The Document suggested the Attackers may have Successfully compromised at least One Employee Account but didn’t Identify the Company by Name. Several Details strongly pointed to VR Systems being the Company.
North Carolina Election Board Officials realized immediately that they had to consider the Possibility that Russian Intruders could have caused the Problems with Durham’s Electronic Poll Books on Election Day if they had either Breached VR Systems or gained Entry through VR Systems’ Remote-Access connection. “Until the [NSA] leak … Durham and everybody else thought [the problem] was administrator error, and there was not an overriding need to nail down what happened exactly,”. The State Board then Launched its own Investigation, and from Interviews with Durham County Workers, learned about the Remote-Access Issue and the USB Problem that prompted it.
This wasn’t the First time State Election Officials had developed concerns about VR Systems’ Security Practices. Sometime around March 2016, officials had Uncovered Information from Counties that appeared to indicate VR Systems Software was using an Unsecured Method to Transmit Voter Data to Counties that it had obtained from the State Board. VR Systems insisted to State Officials that its File Transfer System was Secure.
Fears of Russian Interference hadn't yet Surfaced at that time. But Officials were worried about Identity Theft, because the Transmitted Data included Voters’ Social Security Numbers. So between March and the November Election, the State initiated a New Process in which Sensitive Information was Removed from Versions of the Voter Data intended for EViD Poll Books before it was Transmitted.
Despite all of these Concerns, and Lingering Questions about what occurred on Election Day with Durham’s Electronic Poll Books, the State has never Completed its own Investigation into what happened, even though it obtained, and still has in its possession, Mirror Images of the Poll Books.
Board Spokesperson Patrick Gannon said last Month in an Email that State Investigators believe that “human error on the part of Durham County election and poll workers likely contributed to the 2016 incident,” but the Investigation remains Open because the Agency “does not have the technical expertise to conduct a forensic examination of the laptops.”
But now DHS is stepping in. In a Statement regarding its Investigation in North Carolina, the Department said it will Work with the State Election Board "to analyze the laptops used in Durham County elections in 2016. This support may help to provide a better understanding of previous issues and help to secure the 2020 election." DHS went on to say that it currently doesn't have "information that there is any previous or ongoing issues regarding election systems in the state of North Carolina and all services are being provided in a proactive manner at the request of the state."
NYC Wins When Everyone Can Vote! Michael H. Drucker
No comments:
Post a Comment