State and county election officials across the country employ thousands of computers in election administration, most of them are connected (from time to time) to the internet (or exchange data cartridges with machines that are connected). In my previous post I explained how we must audit elections independently of the computers, so we can trust the results even if the computers are hacked.
Still, if state and county election computers were hacked, it would be an enormous headache and it would certainly cast a shadow on the legitimacy of the election. So, should the DHS designate election computers as “critical cyber infrastructure?”
This question betrays a fundamental misunderstanding of how computer security really works. You as an individual buy your computers and operating systems from reputable vendors (Apple, Microsoft, IBM, Google/Samsung, HP, Dell, etc.). Businesses and banks (and the Democratic National Committee, and the Republican National Committee) buy their computers and software from the same vendors. Your security, and the security of all the businesses you deal with, is improved when these hardware and software vendors build products without security bugs in them. Election administrators use computers that run Windows (or MacOS, or Linux) bought from the same vendors.
Parts of the U.S. government, particularly inside the NSA, have “cyberdefense” teams that analyze widely used software for security vulnerabilities. The best thing they could do to enhance our security is notify the vendors immediately about vulnerabilities, so the vendors can fix the bugs (and learn their lessons). Unfortunately, the NSA also has “cyberoffense” teams that like to save up these vulnerabilities, keep them secret, and use them as weak points to break into their adversaries’ computers. They think they’re so smart that the Russkies, or the Chinese, will never be able to figure out the same vulnerabilities and use them to break into the computers of American businesses, individuals, the DNC or RNC, or American election administrators. There’s even an acronym for this fallacy: NOBUS. “NObody But US” will be able to figure out this attack.
Vulnerability lists accumulated by the NSA and DHS probably don’t include a lot of vote-counting software: those lists (probably) focus on widely used operating systems, office and word-processing, network routers, phone apps, and so on. But vote-counting software typically runs on widely used operating systems, uses PDF-handling software for ballot printing, network routers for vote aggregation. Improvements in these components would improve election security.
So, the “cyberdefense” experts in the U.S. Government could improve everyone’s security, including election administrators, by promptly warning Microsoft, Apple, IBM, and so on about security bugs. But their hands are often tied by the “cyberoffense” hackers who want to keep the bugs secret—and unfixed. For years, independent cybersecurity experts have advocated that the NSA’s cyberdefense and cyberoffense teams be split up into two separate organizations, so that the offense hackers can’t deliberately keep us all insecure. Unfortunately, in February 2016 the NSA did just the opposite: it merged its offense and defense teams together.
Some in the government talk as if “national cyberdefense” is some kind of “national guard” that they can send in to protect a selected set of computers. But it doesn’t work that way. Our computers are secure because of the software we purchase and install; we can choose vendors such as Apple, IBM, Microsoft, HP, or others based on their track record or based on their use of open-source software that we can inspect. The DHS’s cybersecurity squad is not really in that process, except as they help the vendors improve the security of their products. (See also: “The vulnerabilities equities process.”)
Yes, it’s certainly helpful that the Secretary of Homeland Security has offered “assistance in helping state officials manage risks to voting systems in each state’s jurisdiction.” But it’s too close to the election to be fiddling with the election software—election officials (understandably) don’t want to break anything.
But really we should ask: Should the FBI and the NSA be hacking us or defending us? To defend us, they must stop hoarding secret vulnerabilities, and instead get those bugs fixed by the vendors.
Worse, if the NSA is hacked, its viruses detected by the other side, or infiltrated, those holes found at great expense can be made available to the hackers, infiltrators, or to the highest bidders. I believe some of that is what was disclosed last week. Who knows how long we have been exposed.
The problem is also simple economics when the product is faulty.
If a toaster has a defect and starts causing fires, it is recalled and the manufacturer is held liable.
Maybe toaster manufacturers should include a shrink-wrap licensing agreement and we can get rid of the CPSC.
Software is now becoming a critical “appliance”, so when it fails it can cause as much or more damage.
The collision is occurring now with the “Internet of Things” – can a hacker alter your thermostat so your pipes freeze?
No complex system can be defect free, but cars are very complex and we handle problems when they are found.
Software makers could build in more security, but until they have to pay themselves in some way for defects and the damage caused, it won’t happen. Security is right now a public good.