[Image via dconc]

The U.S. Department of Homeland Security has ruled out a cyberattack as the cause of Durham County, NC’s particularly bad Election Day 2016, where serious issues with the county’s e-pollbooks led to long lines, extended polling hours and intense scrutiny. The News-Observer has more:

There’s no evidence that the 2016 Election Day problems in Durham were the result of cyber hackers, according to the federal government.

Special Counsel Robert Mueller’s report on Russian election interference said a company — whose description closely matched the company that provided voter check-in software for Durham and other North Carolina counties in 2016 — was targeted by hackers. And Durham experienced widely reported issues with that check-in software during the 2016 elections.

State officials have long said they believed the problems were just due to human error, however, and not anything malicious like foreign hackers. But after the Mueller report’s findings on election interference became public earlier this year, officials at the Department of Homeland Security agreed to look into the Durham situation.

On Monday, putting an end to their months-long investigation, they announced they had found nothing to indicate a cyber attack.

The County welcomed the findings and highlighted the steps it has taken to prevent a re-occurrence of 2016’s problems in subsequent elections:

Phillip Lehman, chairman of the Durham County Board of Elections, called the report “compelling evidence that there were no cyberattacks impacting the 2016 election in Durham.”

“As we have acknowledged, there was human error in the preparation of electronic poll books,” Lehman said in a news release announcing the investigation’s findings. “Since that time, the Durham County Board of Elections has implemented additional training, security measures and staffing changes. Elections in 2017, 2018 and 2019 were conducted efficiently and accurately with no significant incidents.”

DHS’ report did find some evidence of lax cyberhygeine but didn’t identify any evidence of outside interference:

The unclassified, heavily redacted version of the Homeland Security election hacking investigation report available to the public says the investigators were “unable to identify any artifacts suggesting the presence of malware or unauthorized remote access.”

The investigators did find a new user account that was created on Election Day, which they flagged in the report. They also said one account — it’s unclear if it’s the same one, since any account names are redacted — was used to upload a file to a desktop computer in the Durham election office.

Homeland Security officials deemed that computer “a high value target.” However, they said, they couldn’t determine what was in that file.

They also said someone used that desktop computer to access a personal email account on Election Day and then visit at least two websites, whose names were also redacted. But the investigators didn’t raise alarm over that, saying the outside websites didn’t appear malicious based on several testing methods.

For its part, the state election office is working (with assistance from DHS) to ensure that similar issues don’t emerge in 2020 or beyond:

Karen Brinson Bell, executive director of the N.C. State Board of Elections, said Monday that state and county officials will continue working to improve poll workers’ training before the 2020 elections.

“This issue highlights the importance of poll worker training by elections officials and the vendors whose products are used in North Carolina,” she said in the news release. “Election security is an ongoing process, and the State Board will continue to work with the 100 county boards of elections and our state and federal government partners to improve security at every step in the voting process.”

Homeland Security gave tips to state and local officials — which were redacted from public view for security reasons — and Bell said that Durham has already implemented “many” of them and is working on others.

The DHS report puts to rest the lingering concerns about the source of Durham County’s terrible, horrible, no good very bad Election Day 2016 – but is a vivid reminder of the kinds of problems that can arise when the technology on which election offices rely goes sideways. Here’s hoping the lessons learned in Durham County can help it and other Tobacco State counties going forward – and that DHS can use this case study/cautionary tale as a guide for other jurisdictions across the nation as the big 2020 election cranks into gear. Stay tuned …

Posted in Uncategorized and tagged