Tag: Electronic Voting

Secure the Voting System from Election Hacking

Cook County Deputy Clerk John Murkovic has worked hard to secure the electronic voting system. He’s made it hard for cyber hackers to throw a wrench in our election process. Learn what measures he has implemented against election hacking.

Cook County Deputy Clerk John Mirkovic focuses on securing the electronic voting systems from election hacking

Enigma Forensics, CEO Lee Neubecker and Cook County Deputy Clerk John Mirkovic discuss election hacking and measures that have been taken to help secure Cook County for the upcoming 2020 Election scheduled for November 3rd, 2020. The two discuss past hacking attempts during to 2016 election cycle on the Democratic National Committee, including phishing attacks that compromised numerous campaign workers.

Protecting the Vote From Cyber Attacks and Election Hacking

Lee Neubecker (LN): Hello, today I have John Mirkovic from the Cook County Clerk’s Office. He’s the deputy clerk and he oversees all the technology and communications working with Karen Yarbrough, and today I’m going to be talking to him about protecting the vote from cyber attacks. First, I wanted to start off by recapping what happened in 2016. Hillary Clinton’s Campaign Chairman, John Podesta, was phished with an email on March 19, 2016. And what had happened is he forwarded an email to a staffer that had replied with a typo. The staffer said this is a legitimate email versus what the staffer should have said is this is an illegitimate email. So he did the right thing by checking first, but he probably should have picked up the phone and not relied on email. So then he went and he clicked through and reset his password. And the type of attacks that are happening right now is such that when you click a link, sometimes it will pretend to be Office365 or Google, and it will want you to put your username and password in so that you can see the document. Well, in fact, those sites are getting your credentials for later cyber attacks, or they’re trying to put malware on your computing device. So what happened after that? In April 2016, hackers created a fake email account and spearfished 30 Clinton staffers. They sent a spreadsheet that had the name Hillary-Clinton-favorable-rating.xlsx and that attachment was designed to make the staffer want to click. So these are social engineering attacks on campaign staff. And then later DCLeaks was registered, and all these emails were published and put out there, which was very damaging and probably changed the outcome of the election in 2016. So I have John here, and John, I want to ask you, what steps has the Cook County Clerk taken to prevent similar attacks here in Cook County?

Securing Electronic Voting

John Mirkovic (JM): Well, I think one is that we don’t make it so easy that you can change credentials via one email that way. So, what happened to Mr. Podesta, it would have required a few more steps in our agency, which is usually good, I guess, but it was such a clever attack. There’s almost no way to stop something that clever, and that relies on someone’s sense of urgency and emotion. So we, in our office, we work with Cook County on our email servers, so we would reach out to a different office to work with that. So the ability to make it hard to change emails, for example, you know, it can be frustrating sometimes but you know, you realize when you build those layers up if they frustrate you that means they’re going to frustrate an attacker as well so that’s one way.

LN: So deployment of frustration, a government staple, right?

JM: Yeah, the old help desk.

LN: Well, having these processes in place though, by design they help protect people and make it more difficult for hackers to get in. So that’s great. There’s been a lot of talks about potential hacks coming on election day, should voters be concerned that their vote’s going to be hacked on election day?

JM: I think they should be more concerned about the disinformation campaign that is going on about hacking voting machines in Illinois, and that we have the misinformation from nebulous foreign state actors, but they’re actually people in this country who are being paid. You know, they think they’re working for a news agency, but it’s some shell and all they’re doing is spreading misinformation, especially in Illinois. You know, we’ve had to refute notions that our ballot marking devices are connected to the internet and that anybody can get in there. So to answer your question, we use a lot of layers of security and some of them, and the main one is we don’t even give ourselves the ability to update these machines on election day or in the field, which again that frustrates us, but we also know that if there’s no way to communicate with those machines by us even, then no one else can, so.

LN: Isn’t there also a simultaneous paper audit trail for the voting machines?

JM: Yeah, so voters in suburban Cook County should be really happy with the system we have in Illinois, which requires a paper backup of every vote. So voters in the suburbs may remember, I don’t know if they had them in the city, but they may remember the sort of receipt paper printers that were built into the machines and they would kind of scroll really quick and show you what you voted for, but it really wasn’t user-friendly, so.

LN: John, just finally, should voters be concerned about election equipment being hacked on election day?

JM: Well, you know, depends where they live. If they live in a state that isn’t as committed to security, I think that people should ask questions and these are the right types of questions to ask, and if you live in a state and you find out your ballot marking device or voting machine is connected to the internet, you should be worried about that. In Illinois, that is not the case and we don’t even use the open internet for any transmission of data, we use secure cellular networks that can work one-way communications and send encrypted data that cannot be tampered with in transit. So voters should ask questions and, but they should also be mindful of who’s causing them to ask questions, and if that person is playing on their emotions.

LN: Great. Do you think that early voting and vote by mail will help reduce the potential impact of election day hacking?

JM: Yeah, I believe so. If you think about centralized versus decentralized targets. You know, an election where you have ballots being cast in 400,000 different locations, as opposed to 1,000, that’s a bigger attack vector and harder to, you know, for a foreign adversary to manipulate really. So it’s really, a mail election sort of really makes it hard for a hacker to find a way to get in there, so I think that vote by mail does make election safer.

LN: Great. Well, thanks a bunch for being on the show, I really appreciate you taking the time to come on.

JM: Thank you, Lee.

Cook County Security
Securing Electronic Voting
Cook County Clerk on Election Security

Check out Cook County’s website!

https://cookcountyclerk.com/

Cook County Security

This is Part 2 in the Cook County Election Security Interview

Last week, I sat down with Cook County Clerk Karen Yarbrough and her Deputy, John Mirkovic to discuss the many cyber security changes. Clerk Yarbrough gave an excellent interview discussing changes she has helped bring about during her tenure to protect the ballot box. As a followup to that interview, I sat down with her Deputy who provided more technical details regarding the current state of cyber security readiness and efforts to adopt leading technologies to streamline and secure government from cyber attacks. To view, Part 1 Please watch this followup to the previous interview with Clerk Yarbrough by clicking the image below.

The transcript of the interview follows:

Election Cyber Security Safeguards

Lee Neubecker: Hi, I’m here today with Karen Yarbrough, the Cook County Clerk and Recorder, her deputy, John Mirkovic is her data wizard. He’s come on my show to talk a little bit about Election Cyber Security and some other interesting topics. John, thanks for coming on today.

John Mirkovic: Thanks for having us, Lee.

Lee Neubecker: So, the Clerk and I were talking a little bit about Microsoft’s open ElectionGuard and I wanted to get your take on what’s happening with that. If you could tell everyone what the platform’s about and what brought this about in terms of Microsoft’s involvement.

John Mirkovic: Yeah, we’re pretty excited about this and one reason, our vendor is participating. So, generally, this is an idea to build really the best voting machine out there or kind of establish the software and hardware standards that the government would like jurisdictions across the country to adopt to really open-source standards. So, what this is about is, as you know open-source, it’s about doing all the work on the front end, publishing your code and your set-ups and inviting the world to attack it and try and penetrate it. So, our vendor is working with this system. We are monitoring the progress. It’s moving a little slow but we’re excited that there are finally people talking about open-source in government because it’s really the most important.

Lee Neubecker: Oh yeah, and it’s good too because essentially you’re putting the spotlight on the system. So, if there’s a bug, everyone’s talking about it online and it gets fixed, it’s transparent and what I like the best about this is it creates a potential for all these Clerks and other parties responsible for voting to be able to capture and preserve those votes and introduce technology to allow people to verify that their vote was cast as intended.

John Mirkovic: Yeah, exactly, and a lot of offices across the country don’t have enough resources to get the equipment they want. There are a lot of states that vote only on electronic machines which is frightening, really, and it’s kind of the worst system to have, so, any kind of sharing of resources is vital for the government to be able to quickly get the entire country up to the same standard.

Lee Neubecker: So, John has the federal government been helping get Cook County ready for the next election cycle? And if so, what has the federal government’s role been with assisting you?

John Mirkovic: Yeah, they’ve been a great partner both Department of Homeland Security and the FBI. It is a true partnership because we have adequate resources here, so we’re able to implement a lot of the cutting edge stuff that they would like to see across the country.

John Mirkovic: So, we are almost like a pilot or a laboratory really. They’re in our office on Election Day, monitoring the systems, checking how all the CyberSecurity systems work, and real-time threat sharing. So, yeah, we in Cook County are considered to be amongst the top 1% of performers in the country and we’re happy to help spread that information to other jurisdictions.

Lee Neubecker: Last time when you and I had lunch, you were telling me a little bit about some of your work in the blockchain space and some of your ideas for how you thought blockchain might be able to help Recorder officers everywhere with using blockchain technology to record deeds. Can you tell a little bit about what the premise is behind that and explain to people how that can revolutionize the recording of deeds?

John Mirkovic: Yeah, yeah, it sort of ties into elections too. You know the most famous blockchain out there is Bitcoin. And Bitcoin works so well because it’s only designed to do one thing which is transfer numbers from one ledger to another. So, really being inspired, you know, not only by the technological ability to protect that using hashing algorithms and digital signatures, just the general idea on architecture software in the same manner.

John Mirkovic: And, you know, Clerk Yarbrough said before, “It’s like …Back to the Future.”

John Mirkovic: Technology doesn’t always have to be about adding more features. And generally, when you build products in committees or groups, no one’s happy and the compromise is never what anyone wants. So, in election security there can be no compromises, we have to have the best.

John Mirkovic: So, blockchain, you know, is a way to digitally guarantee certain outcomes. So, you know, it’s not quite ready for elections yet though there have been some experiments with it. It’s a great technology for Land records and preferably only if it is applied on a large scale to protect the entire transaction. So, blockchain is a way to wrap an expensive, important transaction in CyberSecurity and ensure that it works out.

Lee Neubecker: So, right now, I know it’s common if people are trying to research property records. They’ll come down to the Recorder’s office, go into the basement, sometimes look through microfiche or something. Is there a likelihood that if this technology gets adopted, universally.. that all those old records will be retroactively kind of put back out onto the blockchain so that they exist in cyberspace?

John Mirkovic: Yeah, that’s a great question, one that we get a lot. It some smaller counties you would probably be able to do that. Cook County, unfortunately, has way too many records in various states of microfilm. And, to get those on, they would actually require the same types of effort that creates bad data in the first place which is re-keying data entry. So, really the best approach, if we were to switch to such a system would be… like the County used to insure title for certain transactions. So, in those cases we could, look at the transaction, insure over any risks from the 1950s and 60s. We know what else is out there, you know, the 50s in kind of electronic format. So, it’s too tough to get it all into the same system but when you think about how these systems work, you know, if you have a legacy database and a distributed database, it’s all feeding to one website, right. So, the public, you know, when they go and do their research, they’re not really going to see the background whether it’s a distributed database or a centralized database. So, it’s all about how you deliver the information to the people.

Lee Neubecker: Well, thanks a bunch for being on the show. I really appreciate it. Thank you.