DDOS Attacks and Election Day: What to Do? [HINT: Don't Wait.]

[Image via tekk3y]

Last Friday, Internet users across America were affected by an apparent worldwide distributed denial of service (DDOS) attack using an army of household appliances to barrage the network with data requests. The New York Times has more:

Major websites were inaccessible to people across wide swaths of the United States on Friday after a company that manages crucial parts of the internet’s infrastructure said it was under attack.

Users reported sporadic problems reaching several websites, including Twitter, Netflix, Spotify, Airbnb, Reddit, Etsy, SoundCloud and The New York Times.

The company, Dyn, whose servers monitor and reroute internet traffic, said it began experiencing what security experts called a distributed denial-of-service attack just after 7 a.m. Reports that many sites were inaccessible started on the East Coast, but spread westward in three waves as the day wore on and into the evening.

And in a troubling development, the attack appears to have relied on hundreds of thousands of internet-connected devices like cameras, baby monitors and home routers that have been infected — without their owners’ knowledge — with software that allows hackers to command them to flood a target with overwhelming traffic.

A spokeswoman said the Federal Bureau of Investigation and the Department of Homeland Security were looking into the incident and all potential causes, including criminal activity and a nation-state attack.

In the wake of the attack, many observers speculated on what would happen if a DDOS attack were to happen in the United States on Election Day. Rick Hasen had a good example on his Election Law Blog:

Here’s the kind of stuff that could potentially be disrupted on Election Day:

1. Emails, messages, and telephone calls (over VOIP, at least) to and from election officials and volunteers dealing with problems at polling places that inevitably pop up (ballot problems, polling place problems)
2. Voters obtaining correct information on where and when to vote, and polling place problems
3. Accurate journalistic reports of voting, vote totals, problems at the polls
4. Law enforcement activities that may be necessary if there are acts of voter intimidation or other problems
5. Lots of everyday other features of daily life, from electricity, to traffic control, to emergency services, and to the rest of what is connected to the internet grid

If there are significant problems with people being able to vote on Election Day, this could lead to court lawsuits to keep polls open late, or even to extend voting to a different day, potentially throwing the results of not just the presidential election but numerous elections into question.

Further, a wide internet outage on any day could create a situation for uncertainty and the spread of misinformation. This is especially dangerous on an election day … between [some] campaign charges of rigging and Russian and other interference with our process.

If this did happen, this would be an incredibly challenging day for election officials and voters alike. And while there’s no guarantee it won’t, I think the good news is that – thanks to the routinized nature of the election process – most if not all of the information voters need to get and cast their ballots is already available. States that offer voting before Election Day (whether you call it absentee voting, vote by mail, early voting or something else) have those plans in place and information is already available. In states that don’t offer such options – or for voters that prefer to cast their ballots on November 8 – information is already available on where and when to do so.

In some ways, Friday’s DDOS attack is just another development feeding the “belt and suspenders” nature of this year’s vote, providing incentive to use the information at hand to learn, before Election Day, about casting a ballot if not actually doing so. To be honest, that’s good advice regardless of external threats to the election process.

As for the rest of Rick’s list, it’s a useful reminder that online communication – email, VOIP, messaging and social media – can’t be the sole method of getting and sharing information on Election Day. I’d be surprised if most election officials don’t already have “Internet outage” on their list of contingencies to for Election Day – but if not there’s still time.

In short, a DDOS attack could indeed have significant impacts on Election Day. But the trick is to think of it like any other disruption – like a really bad weather event – and plan (ahead!) accordingly.

If you’re worried about problems on Election Day, the solution is simple: don’t wait until Election Day to learn about when, where and how to cast your ballot – or, if you’re willing and able to do so, go ahead and vote. A well-informed and prepared voter is always the best defense against problems – whether it’s weather, traffic or a rogue army of baby monitors.

15 days until Election Day – stay tuned …