1 of 31

Securing the 2020

U.S. Presidential Elections from Foreign Interference

David Levine – Election Security Fellow

Bret Schafer – Fellow for Media and Digital Disinformation

2 of 31

Background: The Federal Role

Congressional authority to regulate elections derives from various legal sources, depending on the type of election.
Congress has passed legislation in major functional areas of the voting process, such as voter registration and prohibitions against discrimination

3 of 31

Background: The States’ Role

Responsibility for the administration of state and federal elections generally resides at the state level
States regulate many aspects of the elections, including the registration procedures, absentee and early voting requirements, and Election Day procedures

4 of 31

Background: The Local Jurisdiction’s Role

Within each state, responsibility for managing, planning and conducting elections is largely a local process, with over 8,000 local election jurisdictions nationwide
Some states have state-mandated election administration guidelines and procedures for the conduction of elections, whereas other states have guidelines that generally give local jurisdictions considerable autonomy and discretion.
Local elections also register eligible voters; educate voters on how to use voting technology; provide information on the candidates and ballot measures; recruit, train; organize and mobilize poll workers; prepare and testing voting equipment for use; and count ballots.

5 of 31

The Election Process

Pre-election activities include providing opportunities for voter registration, maintaining the voter registration database, recruiting poll workers, selecting polling locations, preparing voting materials, testing equipment, qualifying candidates for office, and early-voting processes.

Election Day activities include opening and closing polling places, setting up voting machines and voting booths, checking in voters, and providing opportunities for voters to cast ballots.

Post-election activities include securing equipment and ballots, transferring physical ballots or vote count records, determining the outcome of the election, publishing unofficial results, certifying official results, and performing recounts, if required.

6 of 31

Types of Election Disinformation

Voter Suppression

False info about how, when and where to vote
False claims of violence/intimidation/arrests
Can occur before/during elections
Usually violates TOS

Voter Fraud

False claims of Illegal voting
False claims of machine malfunctions
Can occur before and after elections
May or may not violate TOS

Political

False claims about candidates, political parties, or supporters
Can occur before/during/after elections
Rarely violates TOS

7 of 31

Election Disinformation: Voter Suppression

8 of 31

Election Disinformation: Voter Fraud

9 of 31

Election Disinformation: Political

10 of 31

Election Disinformation: COVID Concerns

More voters will seek out alternative voting options, meaning more are likely to come in contact with false information
Changes (especially last minute changes) to standard election procedures may lead to genuine voter confusion
Likely increase in voter fraud narratives around mail-in and absentee ballots
Mail-in ballots will lead to slower vote counts, especially in urban centers
All of the above create opportunities for disinformation

11 of 31

Disinformation ABCs

Actor – Individuals or groups who engage in manipulative behavior

(foreign adversaries, political groups, individuals, governments, etc.)

Content – False, misleading, or manipulated information

(images, text, video, or audio)

Behavior – Tactics and techniques used to deceive audiences

(impersonation, misrepresentation, coordination, etc.)

See: https://www.annenbergpublicpolicycenter.org/disinformation-abc-other-strategies-address-malevolent-speech-online/

12 of 31

Information Manipulation

13 of 31

Information Manipulation

14 of 31

Marketplace of Manipulation

15 of 31

Search Engine Manipulation

High-volume posts

Multiple sources

Multiple platforms

Repetition

Fill data voids

Tactics & Techniques

“If you make it trend, you make it true”

16 of 31

Search Engine Manipulation

Search terms for which the available relevant data

is limited, non-existent, or deeply problematic.

-Danah Boyd (Data & Society)

Data Voids

17 of 31

Information Laundering Ecosystem

White -Overt

Grey

Black - Covert

18 of 31

Impersonation/Misrepresentation

19 of 31

How to Combat Disinfo

Focus on prebunking instead of debunking
Ensure communication channels are secure, verified, and active
Serve as trusted voices within local communities
Flood social/traditional media with factual information
Create information sharing mechanisms so local activists can share threats
Form relationships with social media platforms to elevate threats to appropriate parties
Work with state/local officials to improve information security and to ensure changes to election procedures are messaged early and often

20 of 31

What is Election Infrastructure?

It includes, but is not limited to:

Voter registration databases and associated IT systems
IT infrastructure and systems used to manage elections
Voting systems and associated infrastructure
Storage facilities for election and voting system infrastructure
Polling places, including early voting locations

IT infrastructure and systems used to manager elections (such as the counting, auditing and display of election results) and post-election report to certify and validate results)

As the U.S. Select Committee on Intelligence noted in Volume 1 of a five part series detailing Russian Active Measures Campaigns and Interference in the 2016 U.S. Elections, “in June 2016, Illinois experienced the first known breach by Russian actors of state election infrastructure during the 2016 election. As of the end of 2018, the Russian cyberactors had successfully penetrated Illinois’s voter registration database, viewed multiple database tables and accessed up to 200,000 voter registration records. The compromise resulted in the exfiltration of an unknown quantity of voter registration data. Russian Cyber actors were in a position to delete or change voter data, but the Committee is not aware of any evidence that they did so.”

21 of 31

What is Election Infrastructure?

It does not include:

Political action committees
Campaigns
Or any other non-state or local government election related group

That doesn’t mean adversaries’ targets are limited only to election infrastructure. As the law enforcement and intelligence community has previously noted, Russia, China, Iran and other foreign nations will seek to interfere in the voting process or influence voter perceptions through any variety of means, including social media campaigns and disinformation operations, in addition to cyberattacks on state and local election infrastructure. While an adversary would need compromise or disrupt election infrastructure to prevent voting, change vote counts, or disrupt the ability to tally votes, there are other ways adversaries can undermine confidence in the U.S. election process.

Earlier this month, it was reported that China hackers were targeting the personal Gmail accounts of campaign staff members working for former Vice President Joseph R. Biden, Jr.
Earlier this month, it was reported that Iranian hackers had targeted the Gmail accounts of staffers working on the Presidential campaign of President Trump.
Last month, the National Security Agency reportedly warned that Russia state hackers targeted an email program used by many congressional candidates to steal emails, as Russian hackers also did four years ago.

22 of 31

Critical Infrastructure:

Election Infrastructure’s Designation

Under the designation, DHS provides many services that state and local election officials can use to reduce both cyber and physical risk to their election systems and facilities.
The designation allows DHS to provide services on a prioritized basis at the request of state and local election officials.

1) Many of the services offers to state and local election jurisdictions are provided through its Cybersecurity and Infrastructure Security Agency (CISA). CISA helps state and local election officials secure election infrastructure from threats through regional support and assistance, education, and information sharing. This can include things like continuous scanning of internet-accessible systems for known vulnerabilities, assessments of potential network security vulnerabilities, remote testing of externally accessible systems for potential vulnerabilities, assessments of states’ and local jurisdictions’ susceptibility to malicious emails, and educational posters on cybersecurity.

Some states have mandated statewide election administration guidelines and procedures that foster uniformity in the way their local jurisdictions conduct elections, whereas other states have guidelines that generally permit local election jurisdictions considerable autonomy and discretion in the way they run elections.

As a result, elections can be administered quite differently across states and even within them.

Unless states request otherwise, local jurisdictions generally have discretion over activities such as election officials’ training and in most cases the purchase of voting technology

23 of 31

Election Infrastructure Assets

The election process relies on various assets – such as information technology systems, networks, equipment and facilities.
These assets can be broadly categorized as physical, cyber and human components of the Election Infrastructure.
These assets are susceptible to intentional and unintentional threats.

24 of 31

Election Infrastructure: Physical Components

Description:

Equipment, materials, and facilities that support or provide protection for election activities

Examples of assets:

Voting equipment, storage facilities, ballot processing facilities, voting locations, paper poll books, and ballots.

25 of 31

Election Infrastructure: Cyber Components

Description:

Hardware and software, including computers, servers, databases, and other information technology systems used in election activities

Examples of assets:

Voter registration systems; electronic poll books; election-night reporting systems; election management systems; public websites with voter data; and electronic voting equipment.

Examples of assets: Voter registration systems, electronic poll books; election-night reporting systems; election management systems; public websites with voter data; and electronic voting equipment such as direct recording electronic machines, optical scanners, and ballot marking devices.

** election management systems are systems that handle all the backend activities for elections, including the designing and building of ballots, programming the election database, and reporting the results

Cyber adversaries may make of various techniques, tactics and practices to adversely affect an organization’s computers, software or networks, or to intercept or steal valuable or sensitive information.

For example, voting equipment may be susceptible to a supply chain attack in which the malicious actor may use the voting equipment vendor as a pathway to plant malware to modify or compromise ballot definition files before they reach the hands of election officials.

26 of 31

Election Infrastructure: Human Components

Description:

Personnel with unique training, certification, knowledge, skills, authorities, or roles whose absence could hinder election activities.

Examples of assets:

State and local election officials, information technology staff, temporary staff such as poll workers, and vendor support staff.

27 of 31

Election Infrastructure

Pre-election Infrastructure

Online voter registration systems
Internal communication systems
Storage locations

Election Day Infrastructure

Electronic pollbooks
Voter registration systems
Vote casting devices

Post-election Infrastructure

Election management systems
Official websites

28 of 31

Threats: Physical, cyber and human assets comprising the election infrastructure are susceptible to unintentional or intentional threats

Unintentional threat sources include equipment failures, software coding errors, the accidental actions of employees (human errors), and other failures within sectors on which the election infrastructure depends.
Intentional threats:

Targeted and untargeted attacks
The adversaries may vary in terms of capabilities of the actors, their willingness to act, and their motives, which can include seeking monetary gain or pursuing an advantage of some sort

Cyber adversaries may make use of various techniques, tactics and practices to adversely affect an organization’s computers, software or networks, or to intercept or steal valuable or sensitive information. These exploits are carried out through various conduits.

Unintentional threat sources: include equipment failures, software coding errors, the accidental actions of employees (human errors), and other failures within sectors on which the election infrastructure depends, such as power grid failures in the energy sector

Intentional threats:

Targeted and untargeted attacks include foreign nations, terrorists, and criminal groups

The adversaries may vary in terms of capabilities of the actors, their willingness to act, and their motives, which can include seeking monetary gain or pursuing an advantage of some sort

Cyber adversaries may make use of various techniques, tactics and practices to adversely affect an organization’s computers, software or networks, or to intercept or steal valuable or sensitive information. These exploits can be carried out through various conduits, including:

Websites, email, wireless and cellular communications, internet protocols, portable media and social media.

29 of 31

How Foreign Actors Could Interfere

Hacking and leaking information
Using state controlled media arms to propagate election theme narratives to target audiences
Using economic and business levers to influence political objectives inside the U.S.
Relying on fake social media personas to promote foreign interests and sway American opinion
Targeting election infrastructure, such as voter registration databases and vote tallying systems
Covertly advising candidates and campaigns

Threats to this year’s election:

Many of the threats listed above come from a memo that cyber experts at the Department of Homeland Security and FBI sent states earlier this year when they warned of possible Russian tactics for this year’s elections.

The memo was prepared before the coronavirus outbreak, so it doesn’t reflect how the pandemic might affect the tactics Russia or other countries might use to interfere with the election.

Some of the threats have been executed during the 2016 presidential election.

E.g., Hacking and leaking information. Who can forget the emails that were stolen from the Clinton campaign by Russian military hackers and published by Wikileaks
State voter registration databases were targeted in the 2016 election.

Some of the threats have been executed previously in other countries

Covertly advising candidates and campaigns: Russian strategists were believed to have been involved in political campaigning in approximately 20 African countries during 2019. Russia has sought to take advantage of countries that have perceived loopholes in laws preventing foreign campaign assistance.

*The sheer breadth of possible tactics helps explain why the Alliance for Securing Democracy brings together experts on a wide range of subjects including malign finance, emerging technologies, economic coercion, and cybersecurity, in addition to elections integrity and disinformation, to develop strategies to deter, defend against, and raise the costs on authoritarian efforts to undermine and interfere in democratic institutions.

30 of 31

Protecting Infrastructure

Provide additional state and local election cybersecurity assistance
Review and audit voter registration databases
Have enough ballots on hand to accommodate high voter turnout
Have sufficient numbers of extra voting machines and epollbooks
Have paper copies of electronic pollbook voter registration records
Use paper ballots
Implement robust post-election audits to validate results
Have strong chain of custody protocols
Establish election day contingency procedures to deal with the unexpected, including complications arising from COVID-19.

31 of 31

Thank you!

www.securingdemocracy.org