Russians Hacked Election Systems in 39 States According to Explosive New Report

Bloomberg News has published an explosive new report citing sources who say thirty-nine states were hacked by the Russians during the 2016 presidential election, almost twice the number previously reported.

Bloomberg’s sources report that the Obama administration was so concerned with the extent of Russian interference in the summer and fall of 2016 that they reached out to the Russian government via a Cold War-era backchannel, now technologically updated and repurposed to "allow urgent communication to defuse a possible cyber conflict". According to the article:

"The White House provided evidence gathered on Russia’s hacking efforts and reasons why the U.S. considered it dangerously aggressive. Russia responded by asking for more information and providing assurances that it would look into the matter even as the hacking continued, according to the two people familiar with the response.”

The evidence, which emerged initially in Illinois, where a part-time state board of elections contractor noticed unauthorized data leaving the system. Hackers had gained access to the state’s voter registration database, which includes information including "names, dates of birth, genders, driver’s licenses and partial Social Security numbers". The general counsel for the Illinois Board of Elections, Ken Menzel, reported that approximately 90,000 records were compromised.

Illinois became, for federal investigators, "patient zero":

"Using evidence from the Illinois computer banks, federal agents were able to develop digital "signatures” -- among them, Internet Protocol addresses used by the attackers -- to spot the hackers at work. The signatures were then sent through Homeland Security alerts and other means to every state. Thirty-seven states reported finding traces of the hackers in various systems...In two others -- Florida and California -- those traces were found in systems run by a private contractor managing critical election systems.”

Menzel explained the relationship between state and county election offices, which actually run poll locations:

"Counties upload records to the state, not the other way around, and no data moves from the database back to the counties, which run the elections...The state does, however, process online voter registration applications that are sent to the counties for approval..When voters are added to the county rolls, that information is then sent back to the state and added to the central database. This process, which is common across states, does present an opportunity for attackers to manipulate records at their inception."

Bloomberg’s sources did not report evidence of any votes being changed, but they noted that the cyber attacks would not need to change votes to be effective:

"the Obama administration believed that the Russians were possibly preparing to delete voter registration information or slow vote tallying in order to undermine confidence in the election...One former senior U.S. official expressed concern that the Russians now have three years to build on their knowledge of U.S. voting systems before the next presidential election, and there is every reason to believe they will use what they have learned in future attacks.”

"America’s disparate voting systems spread across more than 7,000 local jurisdictions" likely prevented the Russian hackers from having the time to actively disrupt votes, but that doesn’t mean they won’t develop that capability by 2020, or even 2018. Following the 2016 election, however, Bloomberg reports that states and the federal government agreed to designate state election systems as “national critical infrastructure”, which gives federal investigatory agencies broader powers to intervene and prevent future attacks.

The Bloomberg report, though unconfirmed by federal officials, is bolstered by a classified NSA document, released to the The Intercept, detailing Russian cyber-attacks of an elections systems vendor, VR Systems.

Should the federal and state governments prioritize steps to prevent further cyber attacks and protect state voting systems? Use the Take Action button to tell your reps what you think!

Take Action

— Asha Sanaker

(Photo Credit: City of Alexandria, VA / Creative Commons )