How Ethical Hackers Are Securing Elections

Coordinated Vulnerability Disclosure (CVD) or Vulnerability Disclosure Policies (VDP) for technology are key components of a security strategy that builds trust with users and stakeholders. A VDP is a “see something say something” policy that allows third parties to report potential vulnerabilities and security gaps directly to the affected organizations. Election technology manufacturers are the latest industry to recognize the benefits of identifying and fixing software vulnerabilities before they can be exploited. In August 2018, the Information Technology - Information Sharing and Analysis Center (IT-ISAC) approved the formation of an Election Security Special Interest Group (EI-SIG) to provide a dedicated and trusted forum within the IT-ISAC for election industry stakeholders to help guard their networks and assets against physical and cyber threats. The five-year journey since the inception of the EI-SIG has delivered a number of initiatives for overall election technology security; one of those being to help establish wide acceptance of VDPs. While most election technologists’ VDPs have been in place for some time now, a recent event brought together the practice of vulnerability disclosure with hands-on security testing by some of the most experienced and innovative ethical hackers in the country. 

As a member of the Election Security Research Forum (ESRF), HackerOne has been part of the journey and continues to contribute insight and talent to coordinate events and advise in security initiatives. In this blog, we share the background of the event, why it took place, and the results and lessons learned. 

Ethical Hackers Help Secure Election Technology

The Election Security Research Forum (ESRF) event took place in September 2023 at the MITRE facility in McLean, VA and was spearheaded by the IT-ISAC, with the cooperation from the EI-SIG. To complement the participation from the EI-SIG, a Security Advisory Board, made up of industry professionals in the election security space, from former election officials to representatives of the security researcher community, was created to help foster relationships between election technology manufacturers and the security researcher community. Three election technology manufacturers and 15 independent security researchers, or ethical hackers, took part. The ethical hackers are all U.S. nationals who were fully security vetted before the event. Over a two-day period, the ethical hackers met with election technology providers to explore potential security issues within their devices. In addition to the testing, panels and talks from the various expert stakeholders built an additional understanding of the common goal. Security was tested, products and processes were improved, and, most importantly, mutual trust was earned.

Hardware hacker, Brandon Reynolds, attended the event and commented, “ [The election security event] was a once-in-a-lifetime chance to see inside the machine that is our electoral process and the hardware used. I am absolutely enamored with hardware security, and the different paths organizations will take to secure their hardware. Election technology makes up maybe 20% of the entire election ecosystem, but it is highly critical. The opportunity to review the hardware used to cast votes in our country was something I've always wanted a chance to look at, simply out of curiosity's sake.” Brandon also commented on the importance of transparency to build trust. “There continues to be fear and misinformation around voter fraud. The greatest cybersecurity engineers spent multiple days, on their own dime, reviewing these critical machines, and I'd love to see the general public be made aware of the outcome(s). Whether positive or negative, sharing the findings with legislators, citizens, and other VIPs of the electoral process is a crucial aspect to restoring trust in the free and open electoral process in our country.”

Transparency in the Electoral Process Builds Trust

The risks posed to elections by disinformation, foreign interference, and mistrust are very credible. And the reality is, that while technology exists, vulnerabilities will be present. However, if security happens behind a veil, any potential vulnerability in election technology could create the perception of a much greater risk. That’s why it’s so crucial to ensure thorough security testing is conducted by those who can adopt an outsider’s mindset, and why it’s so critical to ensure transparency of that testing for the public through vulnerability disclosure. Cooperative and transparent testing was the goal and purpose of this event, and as the participants who participated proved, it is achievable and it is valuable, and this is only the beginning. 

The Results: Low-Risk

The final report, released by the IT-ISAC’s EI-SIG and ESRF, is a collection of the three independent findings reports published by the election technology manufacturers and put together collaboratively with the researchers. These reports were the result of the 48-hour testing period during the event and post-event triage and remediation window. The tested attack vectors addressed a range of election security threats, including ballot box stuffing, scanner denial of service, website URL squatting, and front panel workstation access. Of the 21 reports across three election technology manufacturers, 19 were categorized as “low-risk,” while the remaining two are still being explored. 

Learnings for the Future

In an effort to build upon the success of this collaboration, manufacturers and researchers alike agree that there are opportunities to learn and improve. For future events, it would be ideal to pull in and test more of the ecosystem to include local and state jurisdictions. This not only expands the attack surface security researchers can test, but it also empowers them to focus on even more attack vectors in the election security space.

The journey to securing elections will likely never be a complete one, there will always be new technologies, new people and processes, and new threats to tackle. With this practice of collaborative and transparent security testing of election systems becoming the norm, there is a path forward to improving the foundation for a more resilient election process overall. 

For advice on setting up a vulnerability disclosure program, speak to one of our experts today.