Voting Tech Experts to GA SOS Kemp RE FBI criminal probe into cyber attack of GA election systems
Last edited Mon May 22, 2017, 10:15 PM - Edit history (1)
I hope someone who is connected to Ossoff can get this info to him and that he is
prepared to demand a forensic audit of the voting machines if he does not win. Verified Voting is a highly credible organization. Why does media not pay attention to this? The state of our elections is critical.
Verified Voting Blog: Technology Experts’ Letter to Georgia Secretary of State Brian Kemp
Mar 15 2017
This letter was sent to Georgia Secretary of State Brian Kemp on March 14, 2017. Download PDF
On March 3rd it was reported that the Federal Bureau of Investigations is conducting a criminal investigation into an alleged cyber attack of the Kennesaw State University Center for Election Systems. According to the KSU Center for Election Systems’ website, “the Secretary of State authorized KSU to create a Center for Election Systems, dedicated to assisting with the deployment of the Direct Record Electronic (DRE) voting technology and providing ongoing support.”[1] The Center is responsible for ensuring the integrity of the voting systems and developing and implementing security procedures for the election management software installed in all county election offices and voting systems.
The Center has access to most if not all voting systems and software used in Georgia. It also is responsible for programming these systems and accessing and validating the software on these systems. It is our understanding that the Center also programs and populates with voter records the electronic poll books used in polling places statewide. A security breach at the Center could have dire security consequences for the integrity of the technology and all elections carried out in Georgia.
In order for citizens to have faith and confidence in their elections, transparency is crucial, including about events such as the KSU breach, and its extent and severity. While we understand that this investigation is ongoing and that it will take time for the full picture to emerge, we request that you be as forthcoming and transparent as possible regarding critical information about the breach and the investigation, as such leadership not only will be respected in Georgia but also emulated in other states where such a breach could occur. We expect that you are already pursuing questions such as the following, regarding the breach, and trust that you will make public the results of such inquiry:
Can you estimate when the attacker breached KSU’s system?
How did the attacker breach KSU’s system?
How was the breach discovered?
Which files were accessed?
Were any files accessed that related to software or “hashes” for the voting machines?
Is there any evidence that files were modified? If so, which files?
Had KSU begun ballot builds for the upcoming special election?
To whom are these attacks being attributed? Could this be an insider attack? Has the FBI identified any suspects or persons of interest?
Has the FBI examined removable media for the possibility of implanted malware?
Has the FBI examined the hash or verification program for tampering?
What mitigations are planned for the near- and long-term?
In any state an attack on a vendor providing software and system support with such far-reaching responsibilities would be devastating. This situation is especially fragile, because of the reliance on DRE voting machines that do not provide an independent paper record of verified voter intent. KSU has instead sought to verify the validity of the software on the voting machines by running a hash program on all machines before and after elections in an effort to confirm that the software has not been altered. However, if KSU’s election programming were compromised, it is also possible that the verification program could have been modified to affirm that the software is correct, even if it were not. This is a risk of using software to check the correctness of software.
Of course all Georgia elections are important. This month and next include special elections as well. If these upcoming elections are to be run on DREs and e-pollbooks that are maintained and programmed by KSU while the KSU Center for Election Systems is itself the subject of an ongoing criminal investigation, it can raise deep concerns. And today’s cyber risk climate is not likely to improve any time soon.
We urge you to provide Georgia’s citizens with information they need to confirm before going to vote that their name will appear correctly on the voter rolls, as well as back-up printed voter lists in case anomalies appear. Most importantly, we urge you to act with all haste to move Georgia to a system of voter-verified paper ballots and to conduct post-election manual audits of election results going forward to provide integrity and transparency to all of Georgia’s elections. We would be strongly supportive of such efforts and would be willing to help in any way we can.
Sincerely,
Dr. Andrew W. Appel
Eugene Higgins Professor of Computer Science,
Princeton University
(Signed by 20 cyber security experts, all with equally impressive credentials)
https://www.verifiedvoting.org/verified-voting-letter-to-georgia-secretary-of-state-brian-kemp/
= new reply since forum marked as read
