Coronavirus brings election security threats. Experts say tech community must help - CNET

Election security, meet the coronavirus pandemic. That was the theme of the Black Hat security conference Wednesday, a meeting of cybersecurity experts from around the world that is taking place virtually this year to help limit the spread of COVID-19.

The public health emergency will change voting. As a result, voters will have to plan ahead for election day, consider participating as a poll worker or other volunteer, and be patient for the final tally of votes, said Christopher Krebs, director of the Cybersecurity and Infrastructure Security Agency. His agency, a department of the US Department of Homeland Security, is responsible for programs to secure elections throughout the US.

Now playing: Watch this: Blackhat 2020: Tech community must help secure elections

5:06

"Be a part of the solution," Krebs told the audience of security experts.

In a keynote address, cybersecurity expert Matt Blaze made a similar call to action. Blaze noted that US elections officials will have to overcome major logistical hurdles to scale up vote-by-mail options while also creating a surplus of in-person voting locations. With less than 100 days until the 2020 presidential election, Blaze said it's imperative for people with tech knowledge to get involved and ask local election officials what help they need.

"This community is precisely the one whose help is going to be needed," Blaze said.

The talks highlighted one of the biggest concerns leading up to the 2020 presidential election: How can everyone who wants to vote do so safely and without getting discouraged? Concerns have swirled around the security of mail-in ballots, with US President Donald Trump tweeting there could be high rates of fraud, even though those concerns aren't backed up by research. The bigger problem, elections experts say, is scaling up a vote-by-mail system fast enough to accommodate all voters who want it. And while some states are reportedly considering expanding online voting, security experts say the process isn't safe and shouldn't be on the table. With less than 100 days left until the election, the problem of giving registered voters a safe and secure way to cast ballots needs solutions, fast.

The irony is that election security was improving back in February, Blaze and Krebs both said. Following years of research and recommendations from security experts, states were moving away from paperless voting machines and starting to adopt measures that can help make sure software is counting votes correctly. The US Department of Homeland Security had deemed elections as part of the country's "critical infrastructure" and offered funding and security training to state and local election officials.

"There was reason for optimism," Blaze said. "And then, the pandemic came along."

Election security experts agreed with Blaze's assessment. Those who have in the past warned of the vulnerabilities in electronic voting machines are now turning their critical eye to problems caused by worries that voters will be exposed to the coronavirus in long lines at polling places, and that demand for mail-in ballots will overwhelm election officials.

"The biggest problem we have with this election is it's risky for anybody to vote in person," said Kim Alexander, president of the California Voter Foundation. "There's a pandemic."

A big increase in vote by mail

Scaling up mail-in voting (also called absentee voting) will take a great deal of work. While some states already allow anyone to sign up for mail-in ballots, others require an "excuse" from voters, or a reason why they can't come to the polling place. Being over the age of 65 or having a disability are valid "excuses" in many cases. The states of Washington, Oregon and Utah have universal vote-by-mail systems.

Observers have called for states that require excuses from residents to let voters receive a mail-in ballot.

"It's unconscionable not to allow anybody to use postal voting who wants to use it," said Dan Wallach, a computer science professor at Rice University who has focused on election security. That being said, he added that the increase in vote by mail ballots will create a huge logistical burden for election directors around the country. Proper funding, as well as security measures to make sure ballot scanners are working correctly, will be needed to successfully run the elections.

What's more, a massive education effort needs to be mounted to let voters know how to return the ballots correctly. Ballots can be set aside for errors like forgetting to sign the ballot, putting all ballots from one household into a single envelope, or having a signature that doesn't match the one on file. 

In calling on Black Hat audience members to volunteer their time to elections offices, Blaze said time was of the essence. 

"The optimistic note is that we can do this," Blaze said, "but we need to engage now."

Digital election threats remain

The US is still at risk from digital threats in addition to the challenges of voting in a pandemic, Krebs emphasized. His agency's biggest concerns are ransomware attacks on systems that are exposed and visible on the internet, including voter registration databases and electronic voter rolls. As a result, CISA launched a program to help state and local election officials make sure they're securing those systems.

Election agencies will need to keep analog records of these databases where hackers can't tamper with them. Election experts say that will involve making copies several times as the election approaches, so that a ransomware attack won't cause catastrophic losses in the middle of the voting process.

Disinformation is also a major concern, and Krebs said.

When it comes to campaigns to spread false or divisive narratives in state-run news outlets or through social media channels, he said, "Russia has never taken a foot off the gas."

Observers are concerned efforts to confuse or misinform voters might target take advantage of how long it could take to count all mail-in ballots and certify an election result. That's another reason Krebs urged voters to be patient and not believe everything you see on the internet.

"Think before you share," he said. "There's plenty of additional research you can do to validate those claims."