In the months before the 2016 presidential election, one U.S. state received a notification from a federally-backed cybersecurity group, warning about suspicious cyber activity directed at its networks. The state IT officials did not share the alert with other state government leaders and as late at January 2018, the same officials reported nothing \u201cirregular, inconsistent, or suspicious” took place before the vote.<\/p>\n\n\n\n
In fact, GRU, Russia\u2019s military intelligence agency, had scanned one of the state\u2019s \u201celection-related\u201d domains, according to a new Senate report.<\/p>\n\n\n\n
In another state, leaders did not turn over to the Senate which of its systems had been targeted by Russians. Officials told Senate investigators they hadn\u2019t seen evidence of scanning or attacks on its election infrastructure. Instead, they told the committee that they had seen a \u201cprobing\u201d of its state systems. Again, DHS told the committee that GRU had scanned the state\u2019s Secretary of State website.<\/p>\n\n\n\n
And in a third state, officials told Senate investigators they had not noticed a connection between their systems and the IP addresses listed in a warning from the federal government. And again, DHS told the committee that GRU scanned the state\u2019s government domain.<\/p>\n\n\n\n
A July 25 report from the Senate Select Committee on Intelligence detailed how Russian actors targeted state networks and election infrastructure in 20 anonymous states and Illinois. The Russians scanned networks, attempted SQL injections, relied on phishing and sent malicious emails. But the report also explains how numerous states had no idea that their networks were essentially being cased by hackers or lacked the technology to tell them so.<\/p>\n\n\n\n
In addition, the report outlines how state officials repeatedly refused federal government aid, were unaware of extensive scanning activities until they received government notification and sometimes did not even recognize the very malicious activity feds had warned about.<\/p>\n\n\n\n
The committee concluded it was likely every state had been targeted.<\/p>\n\n\n\n
Tom Kellermann, chief cybersecurity officer at Carbon Black, an endpoint security company, and a former commissioner on President Barack Obama\u2019s commission on cybersecurity, said states view security through a \u201cvery old-fashioned, a very antiquated lens\u201d of network security and need to move beyond their perimeter.<\/p>\n\n\n\n
\u201cIt\u2019s not all about network security,\u201d Kellermann said. \u201cFirewalls and encryption are not sufficient to stop the threats of today, nor is antivirus.\u201d<\/p>\n\n\n\n
Lisa Monaco, a former homeland security adviser, told the committee that DHS found some states didn\u2019t have their voter databases encrypted or backed up. Others in industry agreed that state security officials often failed to follow basic advice.<\/p>\n\n\n\n
\u201cNinety-nine percent of cybersecurity is basic hygiene,\u201d said Eric Cornelius, chief technology officer of Blackberry Cylance, a AI-based threat prevention and detection company.<\/p>\n\n\n\n
Understanding the interference<\/b><\/p>\n\n\n\n
The report, which is the first volume on the committee\u2019s findings on Russian interference, is heavily redacted and provides insights into the \u201cextensive\u201d Russian-backed cyber actions taken against Illinois and 20 other anonymous states.<\/p>\n\n\n\n
Officials from the Department of Homeland Security told the committee that the hacking attempts consisted of \u201cresearch\u201d on \u201cgeneral election-related web pages, voter ID information, election system software, and election service companies.\u201d<\/p>\n\n\n\n
The committee found that the Russian government activities against the U.S. election infrastructure began in 2014 and stretched in to \u201cat least 2017\u201d at the state and local level. There is no evidence that vote tallies changed.<\/p>\n\n\n\n
\u201cWhat it mostly looked like to us was reconnaissance,\u201d Michael Daniel, former special assistant to the president and cybersecurity coordinator, told the committee. \u201cI would have characterized it at the time as sort of conducting the reconnaissance to do the network mapping, to do the topology mapping so that you could actually understand the network, establish a presence so you could come back later and actually execute an operation.\u201d<\/p>\n\n\n\n
For example, at least 16 states in the report had state government or election infrastructure scanned by the Russian-backed cyber actors. Scanning a network – effectively casing a building before a robbery or rattling door knobs to learn which ones are unlocked – can\u2019t effectively be defended against, cybersecurity experts told Fifth Domain. However, officials can rely on numerous security measures to ensure its doors are secure.<\/p>\n\n\n\n
\u201cWhat you can do is you can put a fence around your house and you can lock your doors,\u201d said Cornelius.<\/p>\n\n\n\n
In one state, identified only as \u201cstate 6\u201d in the report, cyber actors scanned the entire state\u2019s IT network. The state told the committee that the \u201caffected systems\u201d were the state Secretary of State\u2019s web application and the election results site.<\/p>\n\n\n\n
\u201cIf the penetration had been successful, actors could have manipulated the unofficial display of the election tallies,\u201d the report said. State officials said they believed they would have noticed changes. This is not the same as altering vote tallies on a voting machine.<\/p>\n\n\n\n
DHS reported that the same state was also targeted repeatedly with SQL injections, a type of attack designed to access databases. It received the most SQL attacks of any state, but they were unsuccessful, the report said.<\/p>\n\n\n\n
\u201cIn the world of cybersecurity, SQL injection is very much cybersecurity 101,\u201d Cornelius said. \u201cIt is highly known, highly documented [and] easy to mitigate. There\u2019s no reason that those types of vulnerabilities should exist in these times.\u201d<\/p>\n\n\n\n
The report shows that leaders from another state, referred to as state 10, told committee officials that they received a \u201cthree-pronged attack\u201d with SQL-injection. That state was hit by SQL injection attempts on all its fields 1,500 times from an IP-address in the Netherlands, a U.S.-based address hit them on several fields and a SQL attempt from a Poland-based IP hit another field six or seven times.<\/p>\n\n\n\n
State 10 also said its firewall blocked malicious activity against its online voter registration system. DHS confirmed GRU SQL injection attempts against the state\u2019s voter services website and confirmed it was blocked by the firewall.<\/p>\n\n\n\n
\u201cIf someone doesn\u2019t have defenses in place for that, it just automatically becomes an attack,\u201d said Kevin Ford, chief information security officer at CyberGRX, a third-party risk management company. \u201cI wouldn\u2019t really call that a scan\u2026for vulnerabilities, I would call that an outright attack.\u201d<\/p>\n\n\n\n
And Illinois didn\u2019t have those defenses in place, in what may have been the most aggressive attack of the cycle.<\/p>\n\n\n\n
On June 23, 2016, Russian actors launched a SQL attack against the state\u2019s online voter registration website, the first known breach by Russian-backed of election infrastructure during the 2016 election, the report said. It took three weeks for IT staff to discover the breach after the site experienced spikes in the data flow on the database server. State officials said the discovery took so long because of the \u201clow-volume nature of the attack\u201d at first.<\/p>\n\n\n\n
In the end, the committee report says that the cyber actors penetrated Illinois\u2019 voter registration database and viewed up to 200,000 voter registration records. The amount of voter registration data the intruders ultimately scraped from the database is \u201cunknown,\u201d the committee wrote.<\/p>\n\n\n\n
The committee report also unveiled that the intruders were \u201cin a position to delete or change voter data\u201d but added it didn\u2019t have evidence that the actors tampered with or erased the records.<\/p>\n\n\n\n
The implications of this unfettered access to voter registration data can have significant implications for democratic elections and could discourage voters from going to the polls, experts argue. Cyber intruders could alter names, birthdays or addresses so they don\u2019t match a voter\u2019s ID, causing headaches for voters at the polls.<\/p>\n\n\n\n
\u201cAnd as a result, you\u2019ll become disenfranchised when you go to vote,\u201d Kellermann said. \u201cThey\u2019ll tell you \u2018your information doesn\u2019t match, and you\u2019re not allowed to vote.\u2019 And how many people are going to go fight that, argue with that, turn around and come back and prove that?\u201d<\/p>\n\n\n\n
Another state, described as state 4, had a statewide voter registration database breached as a result of a phishing attack on a county employee. According to the report, this actor also had an opportunity to modify county voter registration data, but not state data. DHS and the FBI said that there was \u201cno definitive tie to the Russian government.\u201d<\/p>\n\n\n\n
Counties in another state, referred to as state 2, also received warnings from the feds about potential phishing attacks. And yet another state, known as state 14, also received \u201cpotentially malicious\u201d emails.<\/p>\n\n\n\n
States skimp on government warnings<\/b><\/p>\n\n\n\n
A handful of states told the committee that their systems had been scanned but the Russians didn\u2019t enter. In what the report refers to as state 9, for example, state officials told the committee that the actors \u201cdidn\u2019t go in, but we don\u2019t know why.\u201d<\/p>\n\n\n\n
Kellermann said that states shouldn\u2019t be so sure that Russians didn\u2019t enter the networks.<\/p>\n\n\n\n
\u201cThey\u2019re all about deception, they\u2019re all about deploying secret passageways,\u201d Kellermann said. \u201cThey\u2019re all about setting your front yard on fire while they sneak in the kitchen window.\u201d<\/p>\n\n\n\n
Throughout the report, DHS told the committee it found cyber activity against states well-beyond what states reported to the committee.<\/p>\n\n\n\n
Many states were not aware they were being targeted until notifications from the federal government arrived months before the election. And even then, states still didn\u2019t catch the activity. For example, state 18 officials told the committee that they noticed no connection between their state systems and IP addresses listed in the notifications from the federal government. Later, DHS told the committee that GRU scanned state 18\u2019s government domain.<\/p>\n\n\n\n
\u201cThis is now – and will continue to remain – a talent problem. If you don\u2019t have people on staff who are knowledgeable in this, telling you to throw money at a technical problem is an irrelevant solution because tomorrow the technical problem will be different,\u201d Cornelius said.<\/p>\n\n\n\n
Understanding different trends in cybersecurity and how those basic pieces transform into more advanced threats requires \u201cskilled human beings,\u201d Cornelius said.<\/p>\n\n\n\n
\u201cStates and governments, and businesses in general, need to be investing in people,\u201d he said.<\/p>\n\n\n\n
For example, state 7 officials told the committee that they weren\u2019t worried about network security in larger counties, but they did worry about security in under-sourced areas like in places where \u201cthe part-time registrar…is also the town attorney and the town accountant and is working out of a 17th-century jail.\u201d<\/p>\n\n\n\n
In state 2, the FBI was in touch with several counties in state 2 about breaches, specifically warning about spearphishing attacks. The FBI told the counties that there was help available from DHS. According to the report, the four counties \u201chad not accepted DHS services\u201d as of June 11, 2018.<\/p>\n\n\n\n
\u201cThere needs to be better cooperation between federal government and the states,\u201d Ford said.<\/p>\n\n\n\n
He added, \u201ca small state is not going to be able to defend itself well against a large, advanced persistent threat like Russia.\u201d<\/p>\n\n\n\n
The report also details the states\u2019 views of DHS involvement, with several claiming the department didn\u2019t contact the appropriate officials or didn\u2019t provide the proper context of the threat.<\/p>\n\n\n\n
\u201cIn many cases, DHS had notified state officials responsible for network security, but not election officials, of the threat,\u201d the committee wrote. \u201cFurther, the IT professionals contacted did not have the context to know that this threat was any different than any other scanning or hacking attempt, and they had not thought it necessary to elevate the warning to election officials.\u201d<\/p>\n\n\n\n
DHS disputed that account. Jeannette Manfra, then-Acting Deputy Undersecretary of Homeland Security, told the committee that DHS held three conference calls in the final months of the 2016 election with top election officials in all 50 states.<\/p>\n\n\n\n
States need to change how they look at security<\/b><\/p>\n\n\n\n