Subj: This Email Could Wreak Havoc on the 2020 Election

As we lurch towards Voting Day in November, it’s only natural to cast a nervous glance back at 2016, when Russia phished the presidential campaigns in a bid to tilt the election. But lately, cybersecurity pros are looking beyond the campaigns to the grassroots. In some worst-case scenarios, the attacks once again start with phishing, the simplest and most effective cyber-weapon ever—but this time they target city or county election officials, using the COVID-19 crisis to trick the unwary and unprepared.

Let’s look at three alarming scenarios that are just a click away.

Scenario 1: Ransomware locks down back-end voting systems, preventing people from casting ballots or knowing the results. 

Security professionals note that election infrastructure—back-end systems for voter registration, voter verification, and vote tallying—are likely in the crosshairs. State and local officials are focused on voting machines, which Russia and others have penetrated in numerous states (more on this in a moment). But attacks on background systems could sow chaos, too. And because they’re getting less attention, these systems are potentially more vulnerable. 

It’s easier to phish a county clerk than to crack voting machines. Imagine a large swing-state county where an election official gets a COVID-related email, seemingly from the county board. “Subject: Urgent—review new protocols for in-person voting.” When the official clicks, on a malicious link or a PDF attachment, ransomware is activated and voting systems freeze. Who knows, the attacker might not even want a ransom. The real currency could be panic and loss of public trust.

Scenario 2: With compromised email accounts, attackers spoof election officials to spread false voter information or voting results.

As reported last year, a civil grand jury in California warned that hackers might hijack email or social media accounts belonging to election officials. The grand jury in San Mateo County said, “Imagine that a hacker hijacks one of the County’s official social media accounts and uses it to report false results on election night…” The grand jury also noted that hackers might take over the county’s elections website, enabling them to lie about where, when, and how to cast ballots.

It’s not purely theoretical. In 2010, hackers took over a San Mateo website to falsify the vote count. In 2016, a number of county employees’ email accounts were compromised by phishing. The grand jury noted last year that even if voting is secure, disinformation from “credible” sources could ruin the public’s trust.

A possible phishing lure: “Subject: State rules concerning mail-in ballots,” exploiting the nationwide push to vote remotely while the virus lurks. Sticking with that theme, once they’ve compromised a local system hackers could hijack the website, spreading misinformation about how to vote by mail—or whether it’s even allowed.

Scenario 3: Hackers plant malware to tamper with voting results.

Here’s the scenario everyone swiveled to after 2016’s debacle, the Nightmare Most Likely to Succeed in the 2020 contest. According to conventional wisdom, anyone driven to disrupt the next election—whether their name rhymes with Rasputin or not—would train their sights on voting machines. And while a successful attack is likely to be anything but conventional, voting machine attacks cannot be overlooked.

The New York Times reported that the most vulnerable machines are touch-screen devices, which also lack a paper trail in the event of a manual recount. Despite intense scrutiny, research at the University of Michigan revealed that the software can be manipulated to distort results. In the model used, Benedict Arnold (of course) stole the White House from George Washington. Two stats to bear in mind: come November, as many as seven states will still lack paper-ballot backup and 94% of all detected malware comes via email.

How would a phishing email be the spearpoint? Possibly like this: “From: The American Voting Machine Coalition. Subject: System Updates and Sanitary Precautions.” It’s a timely twist on the age-old lure of scary IT notifications. Failure to click and review the experts’ recommendations would lead to “security vulnerabilities” and “potential virus transmission.” Click. Click. Click.

Last but not least, a rerun is always possible.

Could a hacker reprise 2016? Sure. Without phishing-specific defenses, any target is vulnerable. Even if the usual suspects—Russia, China, Iran, and North Korea are the short list—weren’t to blame, they’d get the blame. Or the credit, leak by leak. 

With help from organizations like Defending Digital Campaigns, a non-profit group that points campaigns to vetted security vendors, the 2020 presidential candidates are in better shape than last time. By ensuring their staff is trained to be alert for phishy emails, they can lower their risks and rebuild public confidence in democracy. The same is true for local election offices. Let’s hope they’re ready to ensure safe and trusted voting.

Joshua Bartolomie is a director of Cofense Labs.