Tagged critical democracy infrastructure

Election Technology Enigmas Considered Harmful

I have one last comment of CAP’s recent report9 Solutions to Secure America’s Elections” in addition to my previous comments and those of my colleagues here at the OSET Institute. I don’t agree that any 9 steps can “Secure America’s Elections” and especially not CAP’s 9 steps. Their recommendations are fundamentally about gradualism: the belief that what’s in place can be incrementally improved until we are “secure.” Though we can never be completely “secure”, we need more than gradualism to create fundamental changes that can significantly reduce risks to our elections, especially cyber security risks.

Curiously, despite the report’s bold title, I’m not sure the authors actually intended to advocate for only gradual improvements, because of their agreement on 2 key points. What’s missing is the explicit logical conclusion from those 2 points. The brief version is simply this:

  • If you think elections are critical to national security; and
  • If you think that current election technology is way too weak for our adversaries;
  • Then you can’t honestly limit your recommended response to Band-Aids; you have to consider wholesale replacement with solutions built for the challenges of the current threat environment.

But further, it is an enigma to me why this logic isn’t more widely accepted. I have a couple theories, related to my most important point: that wholesale replacement does not require anything like an Election Manhattan Project. In fact, the core tech has already been proven in use in other fields for years.

Agreement: It’s National Security

I’ll start with the two points that I agree with the most. The first point is national security. Elections are indeed a matter of national security, a bedrock part of our sovereignty and our ability to democratically affect the course of governance of our country. That bedrock is broadly understood of course, but only recently has there been broad awareness of how we are at risk. Our elections are in the cross-hairs of our nation-state adversaries, well funded and well equipped for hybrid cyber-operations, information operations, disinformation campaigns, and social media cyber-operations. In 2016 we saw a warm-up exercise by one adversary, but we know that there are several. Some of them have demonstrated capabilities well beyond what the public saw in 2016.

Kudos to CAP authors Danielle Root and Liz Kennedy for coming straight out with the point about national security risks. Not so long ago, a small group of election integrity and technology experts were routinely belittled with nursery-rhyme epithets about crying wolf and skies falling. Along with recent work by the Brennan Center, the EAC, Congressional testimony by DHS, among others, this CAP report helps put to rest a host of baseless optimisms about early 21st century election security. I’m grateful, but I wish I had been more a louder voice in that earlier Cassandra Chorus.

Agreement: It’s Massively Vulnerable and Exploitable

The second point that I agree with the most is the CAP report’s several observations of prior work on two points: demonstrations of the technological vulnerabilities of current voting systems; assessment of the set of broader risks to elections that are enabled by voting technology insecurity. The CAP report provides another important voice for the observation that our current technology for election infrastructure (“EI”) is mismatched for the present and future; it was never designed for or intended to operate in the current threat environment of nation state adversaries with the sophisticated capabilities that I noted above.

I believe that there is certainly room for varying assessments or assumptions about the likelihood of various types of attack, and of the likelihood of detection, and the likely consequences of detection or lack thereof. But the bottom line is that EI technical vulnerabilities are gift to our adversaries, regardless of one’s assessment of how those gifts might be used to our detriment.

Disagreement: Focus on Mitigation and Incremental Improvement

I truly respect the CAP authors’ intent of collating the most important steps that many have identified as essential for mitigation of risk, and incremental improvement of EI. Within the narrow scope of voter records management, I mostly agree with gradualism. And yes, there are some important caveats on a few items of agreement, as noted by my colleague Sergio Valente. And yes, I have some significant disagreements on the way that the CAP report treats stakeholders. But these caveats aside, I fundamentally disagree with the implied statement — which I hope the authors didn’t fully intend — that it’s enough to do gradual in-place mitigation of existing vulnerable EI.

In place mitigation is important, but as band-aids for fundamentally vulnerable EI. Apply the band-aids while getting a replacement prepared, and then jettison the band-aided EI in favor of fundamentally stronger replacement technology. Let me apologize here for the convenient short hand term “band-aid” which is really about extra-ordinary efforts in 1000’s of elections offices to mitigate the potential harm from the fundamental vulnerabilities of existing EI. This existing EI technology, which “gradualists” would have us accept as unavoidable reality, requires these extra efforts, but the efforts could well be on the short end of asymmetric conflict with word-class cyber-warriors. If that sounds fanciful to you, I respect your risk assessment of a low risk, but I ask: “Risk assessment aside, should we really accept the vulnerabilities that create the risk? Especially given the existence of proven technology alternatives?”

“But Captain, That Is Not Logical”

As I said, I understand that everyone has their own views, risk assessments, realpolitik, and numerous other factors that color their conclusions on what to do with EI that is a national security asset. Everyone is entitled to their own opinions, and increasingly to the opinion that they are entitled to their own facts. But nobody is entitled to their own logic; or at least Commander Spock and I hope not. Here is the logic:

  • If you accept the national security CI protection viewpoint that I and the CAP authors and many others espouse (and I know that not everyone does);
  • And if you accept that the CI that is elections infrastructure does have fundamental vulnerabilities (and I know that many have not yet understood this);
  • Then it is illogical to believe that it is sufficient to rely on unfunded labor-intensive mitigations that could well be overcome by our adversaries.

Captain, that is not logical. It is an enigma! The only 2 things that I can thing of that make sense for a blinkered view of this logical conundrum are: market dogma, and unawareness of existing alternatives.

No Manhattan Project Needed

The market dogma is what I sum up as:

“What the for profit market has no ability or incentive to develop and deliver to the government, the government will never have.”

I disagree! At the local level, that’s understandable for all but a handful of county governments who have developed a broader assessment of EI. But at a national strategy level, that assumption’s falsity is demonstrated by the history of ARPAnet, DARPA, NSFnet, e-commerce, the Global Information Grid, and the digital world at your fingertips on your “phone”.

But suppose that you admit that, in general, strategic technological hurdles can be largely overcome with basic R&D, applied R&D, and technology transfer. Admitting that, you could well believe that there is simply no fiscal or political will for an Elections Manhattan Project. Could be — and the good news is that it’s not needed. The basic R&D and applied R&D has already been done on trustworthy computing (especially fault tolerant, high assurance, fixed function, dedicated systems), and applied in practice from satellites to carriers to in-theater ad-hoc mesh networks for C4I. The task at hand is not to invent the base technology for trustworthy computing for a critical infrastructure – including that of elections. That’s already been done. The task is to:

  1. Re-use the existing core technology, applied to critical elements of voting systems;
  2. Layer on top of the core all and only the critical functions of ballot casting and counting, and back-office functions that they depend on;
  3. Do the stakeholder-centered usability engineering to ensure that the technology fits the existing resources and practices for our locally-operated, state-managed elections;
  4. Manage the technology transfer to enable the for-profit market to deliver the fruits of these labors, in a healthy competitive environment of government IT procurement for system integration and IT support services.

That’s not a Manhattan Project. The pessimistic might compare it in logistical complexity to Operation Overlord. But for elections, we did that operation already. It was called HAVA – the Act of Congress; the billions of dollars; and the replacement of punch cards and butterfly ballots and paperless mechanical voting machines. That wasn’t a great success, in part because the result included paperless electronic voting machines. But that experience provided many lessons learned in the elections community. If steps 1, 2, 3 above can be done expeditiously, then step 4 could be done faster, better, and far cheaper, given the experience of HAVA.

— EJS

 

A Response to POLITICO: Election Infrastructure as Critical Infrastructure

Below is a letter prepared by co-founders Gregory Miller and John Sebes sent to Tim Starks and Cory Bennett of POLITICO, who cover cyber-security issues.  A formatted version is here.  The signal-to-noise ratio on this subject is rapidly decreasing.  There seems to be some fundamental misunderstandings of the challenges local election officials (LEOs) face; the process by which the equipment is qualified for deployment (albeit decrepit archaic technology by today’s standards); what the vulnerabilities are (and are not); and why a designation of “critical infrastructure” is an important consideration.  We attempt to address some of those points in this response to Tim’s otherwise really good coverage.

Tim Starks
tstarks@politico.com
Morning Cybersecurity Column
POLITICO
1000 Wilson Blvd, 8th Floor,
Arlington, VA, 22209

RE:      11.August Article on Whether to Designate Election Infrastructure as Critical Infrastructure

Greetings Tim

I am a co-founder of the OSET Foundation, a 501.c.3 nonprofit election technology research institute in the Silicon Valley.  I’m writing in response to your article this week in Morning Cybersecurity:

ANOTHER VIEW ON ELECTIONS AS “CRITICAL INFRASTRUCTURE” –
Maybe classifying the election system as part of the nation’s “critical infrastructure” isn’t so wise.

We’ve been on a public benefit mission to innovate electoral technology since 2006.  We’re a group of tech-sector social entrepreneurs bringing years of experience from our former employers like Apple, Facebook, Mozilla, Netscape, and elsewhere to bear on innovating America’s “critical democracy infrastructure” —a term we coined nearly a decade ago.

We’re working with elections officials across the country to develop a publicly owned democracy operating system called ElectOS™ in order to update and upgrade America’s voting systems with innovations that will increase integrity and improve participation for 1/3rd the cost of today’s aging systems.  ElectOS will innovate voting machinery the way Android® has innovated smart phones and mobile devices.  Both are freely available (oropen source”), and like Android, we believe ElectOS will one day enjoy a flourishing commercial market to sustain its continued innovation, deployment, and support.

We’ve been studying the challenges of election administration infrastructure for a decade.  So, we read with great interest your article regarding another viewpoint about making a critical infrastructure designation for our nation’s deteriorating, obsolete, and vulnerable voting infrastructure.  There are elements of your article we agree with (and more specifically comments of Cris Thomas), and there are points that we disagree with because they reveal some misunderstanding of the realities of election administration and the processes of managing the machinery today.  Thus, we were compelled to write you and share these clarifications.

We hope our comments are helpful going forward as you continue to cover this important topic, especially in light of the current election season and the delicate issues being raised by at least one candidate and other media.  Good on you for covering this. Below please find our (hopefully helpful) contributions to your effort.  Relevant portions of your article appear indented in blue.

In recent days, a growing chorus of experts and policy makers have backed a proposal to give elections the same level of federal security protections that the government already grants other so-called critical infrastructure, such as the power grid or financial industry.

First, we believe it’s important to be very clear on what elections infrastructure are we talking about?  We should be discussing voting technology operated by Local Election Officials (“LEOs”), and not web sites and eMail servers run by political NGOs.

Sure, the recent attacks on NGOs are a wake-up call for a variety of potential attacks on real Election Infrastructure (“EI”) and peripheral targets.  But the Critical Infrastructure (“CI”) designation should be for core EI; that is, voting machines and the election administration software and systems that manage voting machinery.

But an old school hacker who was part of the L0pht collective says such a change might do more harm than good.  “Classifying voting computers as critical infrastructure is going to cause a lot of headaches at the local level,” Cris Thomas, aka “Space Rogue,” tells MC [MC = “POLITICO Morning Cybersecurity”].

Critical Election Infrastructure (“CEI”) is not very different than other locally managed CI.  Not all CI is big corporate IT like financial transaction processing systems, or government-operated systems like the ATC, or quasi-public technology like the power grid operated by a variety organizations, but subject to many government regulations.  By contrast, we already have CI that is local, including local government operated.  For example, there are small local water utilities and municipal water treatment organizations.  Local first responders’ infrastructure is CI as well.  So, there is plenty of precedent for giving a CI designation to locally managed assets.

Because elections, even national elections, have been historically treated as a local event; having a federal designation as critical infrastructure will fundamentally change how we have handled our elections for the last 240 years.

CEI designation will not cause a fundamental change in the current situation where U.S. elections are a local matter.  Mr. Thomas is mistaken on this one point.  Local election organizations will have the same responsibilities, plus some new ones for managing CI.  But a county election administrator will still manage elections the day after or even the year after a critical infrastructure designation.  That cannot, should not, and will not change.

Thomas, now a strategist at Tenable Network Security, says the idea misses the point: We need to remain focused on the security concerns of the current system, which fall into two areas. First, many manufacturers are not testing the systems well enough before selling them to municipalities, often using off-the-shelf hardware and software with minimal security and using things like default, hard-coded passwords.

Of course, the existing voting machines have technical security issues—and at the risk of reading like we’re overly defending vendors, what computing system has none?  And of course, it’s also true that a CI designation won’t change these products’ default security posture.

at the same time, the local government certification agencies seldom have the time, resources and knowledge to properly test these computers for vulnerabilities, …

The same is true regarding certification process, although Mr. Thomas is mistaken about that process itself.  There are notlocal certification agencies,” but rather Federal and State organizations that certify the systems local (county) election jurisdictions are authorized to use. Nevertheless a CI designation will not increase the rigor of the certification process, and it won’t increase the capability of LEOs to do technical scrutiny of their own.

and often just accept a manufacturer’s claims of security.

We must also take exception on Mr. Thomas’s last comment.  The idea of certification sometimes amounts to “just accepting vendor security claims” —cannot be, and is not the case.  Although the current certification process isn’t as strong as we’d like, and though nearly all stakeholders want improvement, there are already clear requirements for vendors to demonstrate compliance with security related requirements.  On the other hand, misleading vendor claims about security can sway LEOs when selecting a certified system (and the choices are down to three vendors).

[T]he result is a system that our entire democracy depends on, which is run with minimal, easily bypassed security.

Sure, but its a mistake to focus solely on technical security problems of voting machines, particularly since these systems are not going to be replaced with better technology immediately upon a CI designation.  In the near term, the impact of CEI will be more on people and process, and less on technology itself.  LEOs will need help to build organizational capacity and expertise to manage physical assets as critical infrastructure, with physical security, personnel security, increased operational security processes, and the ability to demonstrate that a variety of kinds of people and process controls are actually being followed rather than merely mandated.

So, improvements in the human aspects and processes are the immediate value of a Critical Election Infrastructure designation.  Such a designation would need to clearly state that our local election officials (LEOs) are custodians of not just critical infrastructure, but infrastructure that is critical to our national security.

That’s never been a responsibility for LEOs, and many LEOs will be dismayed that they will be called upon to operate in ways that they never imagined would be important.  It will require long-term capacity building.  In the short term, there are many improvements in people and process that are possible, although unlikely unless there is a high sense of urgency and importance.  The designation of election infrastructure and critical infrastructure, however, can help create and maintain that urgency.

A better approach, Thomas says, is to increase funding for the National Voluntary Laboratory Accreditation Program run by NIST and the U.S. Election Assistance Commission.

We agree in principle, but this is not mutually exclusive with Critical Infrastructure.  Clearly, there is room for improvement, and NIST and EAC have important roles.  With Critical Election Infrastructure, their roles would need to enlarge, but reasonably so.

We also agree that more funding for these organizations’ election integrity efforts are necessary, but doing so is not an either / or decision in consideration of other aspects of CEI.  If Election Infrastructure is truly “critical” then several things must occur, including, but not limited to the additional support for NIST and EAC that Mr. Thomas is encouraging.

Here are three examples of improvement that a Critical Election Infrastructure designation would enable —though additional funding and expertise would be required.

  1. Do not connect anything relating to ballots, counting, voter check-in, etc. to the Internet, ever—and in many cases no local wireless networking should be allowed.  With CEI, using an Internet connection is no longer a convenience or shortcut in the grey area of safety—it’s a possible vulnerability with national security implications.
  2. Physically secure the election back-office systems.  The typical election management system (EMS) is a nearly decade old Microsoft Windows based application running on Personal Computers no longer manufactured, that are as easy to break into (“black hack”) as any ordinary PC.  Yet, they are the brains of the voting system, and “program” the voting machines for each election.  So put them in locked rooms, with physical access controls to ensure that only authorized people every touch them, and never one person alone.
  3. Perform physical chain of custody really well (i.e., for machines, paper ballots, poll books, precinct operations logs, —everything), with measurable compliance, and transparency on those measurements.  It’s just not reasonable to expect LEO Operations to do excellent physical chain of custody routinely everywhere, if these physical assets are not classed as CI.  They’re not funded or trained to operate physical security at a CI level.  So, there is plenty of room for improvement here, including new responsibility, resources, training, and accountability.  All of this may be low hanging fruit for improvement (not perfection) in the near term, but only if the mandate of CEI is made.

We hope this is helpful.  We’re glad to discuss issues of election integrity, security, and innovation whenever you want.  The co-founders have been in the technology sector for three decades.  Both have worked on critical infrastructure initiatives for the government.  The OSET CTO, John Sebes has been in digital security for over 30-years and is deeply experienced with the policy, protocols, and tools of systems and facilities security.  Our Advisory Board includes former US CTO Aneesh Chopra, digital security expert and CSO of Salesforce.com, Dr. Taher Elgamal, global expert on elections systems integrity, Dr. Joe Kiniry, DHS Cyber-Security Directorate Dr. Douglas Maughan, and several former state election officials.

Respectfully,

Gregory A. Miller
Co-Founder & Chief Development Officer