Election (in)security

Delivered every Monday by 10 a.m., Weekly Cybersecurity examines the latest news in cybersecurity policy and politics.

Nov 06, 2023 View in browser   By Joseph Gedeon — With help from Maggie Miller and Daniel Lippman Driving the day — America’s voting infrastructure is still vulnerable to security concerns as we approach the 2024 election, which is now loaded with new threats to manipulate voters and the nationwide loss of experienced election officials. HAPPY MONDAY, and welcome to MORNING CYBERSECURITY! It was the New York Marathon this weekend, and that motivated me to get moving. My dog and I doubled our walk time … to two circles around our apartment complex. Have any tips or secrets to share with MC? Or thoughts on what we should be covering? Email me at jgedeon@politico.com. You can also follow @POLITICOPro and @MorningCybersec on X. Full team contact info is below. Let’s dive in. Want to receive this newsletter every weekday? Subscribe to POLITICO Pro. You’ll also receive daily policy news and other intelligence you need to act on the day’s biggest stories. Today's Agenda It's Day One of the CyberSatGov on all things cyber and satellites, and ONCD’s assistant national cyber director for cyber policy Nicholas Leiserson is delivering the keynote. Starts at 9 a.m. CISA Director Jen Easterly, Sens. Jack Reed (D-R.I.) and Sheldon Whitehouse (D-R.I.) and others launch the Institute for Cybersecurity and Emerging Technologies at Rhode Island College. 10:30 a.m. University of Southern California cybersecurity manager Judy Kang and Public Diplomacy Council president Adam Clayton Powell III join George Washington University for a discussion on election cybersecurity as public diplomacy. Noon. Election Security IT’S THAT TIME — Do you feel that November adrenaline in the air? It’s not the pumpkin spice, but the fact that we are approximately one year out from the 2024 presidential election. And election experts are racing against time to warn the nation that its voting infrastructure is still vulnerable to attack — with some states setting the stage with their own elections this week.  The biggest threats to election security in the United States today remain largely the same as they were in 2020 and 2022, chief technology officer at The Elections Group Trevor Timmons tells MC — with the ever-present risk of foreign and domestic disinformation campaigns and cyberattacks. But there are some significant new differences too. — Election officials: One of the biggest differences Timmons notices is the large loss of both federal and state election officials following previous chaotic elections, which could hurt the country’s ability to respond to threats. Many seasoned volunteers who were made scapegoats by voters over the last two national elections are choosing now to step away from the polls either due to retirement, fatigue or threats. Timmons estimates thousands have moved on. But the hollowed out ranks could mean that institutional knowledge leaves with them — with less-experienced officials less aware of resources, which could lead to admin mistakes that could fuel more election conspiracy and disinformation. — New tech, who this: Another challenge on the horizon is the potential for attackers to use AI to manipulate voters. And following a disinformation-ridden 2020 election, targeted political messages and the ability to generate life-like images and videos in seconds could have a damaging effect on campaign season in the coming year. "I don't think we know yet about how malicious actors are going to leverage AI systems to try to improve their campaigns,” Timmons said. The Federal Election Commission is worried as it weighs a proposal to regulate AI-generated deepfakes in political ads. Still, the AI-powered threat hasn’t quite panned out on a large scale to manipulate elections just yet: Other than deepfakes, most examples in the wild are boosting the credibility of and fixing grammar for phishing attacks. — Still in good shape: Despite the complications, Timmons argued the decentralized nature of elections in the U.S. actually helps the country protect against attacks. — More to learn: Kentucky, Louisiana, Mississippi, New Jersey and Virginia are holding state-wide elections tomorrow. And states including Ohio, Texas and New York will hold statewide referendums. Timmons, along with other election security experts, will be joining CISA in its “national situation room” to monitor the elections for any threats and disruptions and be better prepared to respond. "The national situation room has been effective in the past at helping election officials to respond to threats such as telephone-based campaigns with voicemails and robo calls, and denial-of-service attacks," Timmons said. Critical Infrastructure GAZA BLACKOUT — A third telecommunications blackout in 10 days again plunged Gaza into total darkness on Sunday — but this time it comes as Secretary of State Antony Blinken traverses the region pushing for a humanitarian pause in fighting in the blockaded Strip. The “new collapse in connectivity” across Gaza, first reported by global internet monitoring group Netblocks, knocked out Gaza’s last major telecoms provider to provide connectivity: Paltel. — The causes: An unnamed senior U.S. official told The Washington Post during the first blackout that Israel had intentionally shut off communications and turned them back on after pressure from Washington. This time, cyber experts speculate the connectivity issue likely resulted from an artillery attack. “The disruption happens pretty much exactly at the moment the large airstrikes hit Gaza in livestreams,” Netblocks founder Alp Toker tells Morning Cyber. “And that would point to kinetic impact rather than a premeditated blackout.” Toker adds that it could also be a power outage, “but it would have to be something that doesn’t need major work to fix, given that it’s coming back eventually each time.” — Shuttle diplomacy: Ahead of the outage on Sunday, Blinken had met with Palestinian Authority President Mahmoud Abbas in the West Bank as part of a weekend visit pushing to limit regional escalation and to find a way to implement a humanitarian pause in hostilities to help civilians in Gaza. Still, a previous airstrike that knocked out network connectivity in Gaza for over a day last month was met soon after with a widely-anticipated ground invasion — perhaps a signal that another significant operation is coming while the internet is down this latest time. The State Department and the White House did not respond to a request for comment on whether they are working to get the network back on. The Israeli Defense Forces declined to comment. The first outage lasted around 36 hours, while the second outage lasted a few hours. According to Netblocks, connectivity returned Monday after more than 12 hours offline. The International Scene ENCRYPTION COURT — A behemoth criminal trial kicks off in Belgium today that looks to jail and punish more than 120 defendants for crimes ranging from drug and arms trafficking to attempted murder and acts of torture, POLITICO’s Brussels correspondent Elisa Braun writes in. — The catch: The cases before the court hinge — to a large extent — on data gathered in the encryption bust operations against EncroChat and Sky ECC, two tech firms providing confidential communication services to anyone who wanted it (and it turned out criminals were one group that definitely wanted it). Drug gangs are the main target of the investigations that came from the hacked datasets. The trial is a triumph of law enforcement services that have complained for years that encryption cut them off from electronic evidence needed to find, charge and jail criminals. “This is a trial that will make history,” said Eric Van Duyse, spokesperson of the Belgian prosecutor’s office. The methods used to crack the cases had been “a revolution,” he said. — The defense begs to differ: But for those in the digital rights community (and defense lawyers), the trial is a little more complicated. Defense practitioners claim the evidence from the Sky ECC criminal proceedings were illegally obtained and voice deep concerns over privacy infringements. — Role of encrypted chats: In the fallout of the crackdowns, police pointed fingers at the firms running EncroChat and especially Sky ECC. The latter has previously argued that it isn’t responsible for who uses its services, it just runs them. The trial deals with the investigations that came out of the data, but the issue of how it was gathered will play a major role, not least because lawyers have intended to invalidate charges in their entirety based on questions related to the methods used. CYBER BATTLE — Hackers linked to the Iranian government spent much of 2023 targeting the Israeli education and technology sectors even before the Oct. 7 attacks by Hamas on Israel, new research published Monday found. As Maggie writes in, a report from cybersecurity group Palo Alto’s Unit 42 found that a group known as “Agonizing Serpens” aimed cyberattacks against these Israeli organizations between January and October of this year. Unit 42 researchers have tracked Agonizing Serpens since 2020, and assessed that it has “strong links” to Iran. The attacks have involved data theft and the use of wipers to try to destroy the systems targeted and erase their tracks. The threat group then publishes this data on social media or Telegram, and Unit 42 researchers concluded that the likely goal is to “sow fear or inflict reputational damage,” along with “inflicting considerable damage by wiping as many endpoints as possible.” — Wider context: The research was compiled during dates prior to the Hamas attacks on Israel early last month. Hamas is known to be backed by the Iranian government, which has launched cyberattacks against Israel often in the past — with Israel having also launched high-octane attacks against Iran as well. People on the Move Ben Haas is now chief of staff of the Bureau of Industry and Security at the Department of Commerce. He most recently was principal senior adviser at the Office of the National Cyber Director. Tweet of the Day Rule number one: don’t be vulnerable in your systems or on social media. SIDELOADERS — Google Play Protect now recommends real-time code scanning for new apps that have never been scanned before, to help catch malicious or fake sideloaded apps, report Zack Whittaker and Jagmeet Singh for TechCrunch. BACK IN TIME — The British Library in London was hit by a cyber incident on Saturday, which has caused its website, online catalog and Wi-Fi to go down. As a result, the library has essentially gone back to a predigital age, with users having to look up catalog numbers in hardback books and hand them to librarians to order books, writes The New York Times’ Alex Marshall. WormGPT: Dark web’s new AI weapon for cyberattacks (Interesting Engineering) Chat soon.  Stay in touch with the whole team: Joseph Gedeon (jgedeon@politico.com); John Sakellariadis (jsakellariadis@politico.com); Maggie Miller (mmiller@politico.com); and Heidi Vogt (hvogt@politico.com).   Follow us on Twitter Heidi Vogt @HeidiVogt Maggie Miller @magmill95 John Sakellariadis @johnnysaks130 Joseph Gedeon @JGedeon1   Follow us

To change your alert settings, please log in at https://www.politico.com/_login?base=https%3A%2F%2Fwww.politico.com/settings This email was sent to rouf@idiot.cloudns.cc by: POLITICO, LLC 1000 Wilson Blvd. Arlington, VA, 22209, USA Please click here and follow the steps to unsubscribe.