Writing for Ars Technica, Dan Goodin notes that Russian GRU officers were involved in multiple, simultaneous efforts to determine the outcome of the 2016 elections:
One of the 12 individuals charged allegedly hacked into an unnamed state's board of elections and stole information related to approximately 500,000 voters. The same individual, prosecutors said, also broke into computers belonging to an unnamed supplier of software for verifying voter registration information for the 2016 elections.
As we had previously learned, GRU was seeking to breach the security of voting systems across the nation, right up to election day:
According to the indictment, GRU officers Aleksandr Vladimirovich Osadchuk and Anatoliy Sergeyevich Kovalev began probing election infrastructure in the United States in June 2016. In July 2016, they allegedly identified a vulnerability in SBOE 1’s website and began to siphon off voter information…
According to the indictment, the hackers scrambled to cover their tracks after an FBI alert in August 2016 revealed that the FBI was aware of efforts to compromise election systems. The hackers nonetheless continued to look for vulnerabilities in other parts of the country, according to the indictment, looking at websites in counties in Georgia, Iowa, and Florida as late as October of 2016. (emphasis added)
Let’s not make the mistake of thinking this was a haphazard, throw it against the wall to see what sticks operation— they were targeting voting systems at the county level, in states across the country. These were precise, methodical attacks:
Russian hackers tried to break into the computer systems of at least five Florida county elections offices days before the 2016 presidential election, according to five county officials who say they received malicious emails described in a leaked intelligence report.
Election supervisors in Hillsborough, Pasco, Citrus and Clay counties separately told the Times/Herald their offices got the emails, which contained attachments that could have taken over their computers…
The first attempt, in August, targeted VR Systems, a Tallahassee-based vendor that sells voter registration software to all but three of Florida's 67 counties, according to the report. The second attempt was aimed at 122 election management officials across the country, just days before the election, and was disguised as a routine message from VR Systems, the report said.
VR Systems' software helps check in voters at the polls and doesn't tabulate ballots. Still, the attack could have infected election workers' computers, VR Systems warned in a Nov. 1 email… (emphasis added)
Was this simply a ‘political influence campaign’?
Not according to our government:
Hackers affiliated with the Russian government conducted an "unprecedented, coordinated" campaign against the U.S. voting system, including successfully penetrating a few voter-registration databases in 2016, a Senate committee has concluded…
"In a small number of states, these cyber-actors were in a position to, at a minimum, alter or delete voter-registration data; however, they did not appear to be in a position to manipulate individual votes or aggregate vote totals," the report said.
And it was nationwide:
DHS confirmed last summer that Russia targeted the voter registration databases of 21 states, but Undersecretary Christopher Krebs told the House Committee on Homeland Security that he thinks they tried to target every state and territory in 2016.
"I would suspect that the Russians scanned all 50 states," Krebs said, adding, "21 was the number we were able to see."
The full extent of the Russian efforts has consistently been low-balled in reports, only to be revised upward repeatedly:
Russian hackers likely probed election systems in all 50 states during to the 2016 U.S. presidential race, the Obama administration’s former cyber czar said Wednesday — more the double the number previously given by the Department of Homeland Security.
Michael Daniel, the White House cybersecurity coordinator from 2012 to 2017, made the remark while appearing on Capitol Hill during a Senate Intelligence Committee hearing involving Russian interference in the race.
“We have received from the Department of Homeland Security inconsistent and varying numbers on the number of states whose systems were scanned by the Russians,” said Sen. Susan Collins, Maine Republican. “How likely do you think it is that Russian cyber actors at least scanned all 50 states?”
“I think it is highly likely,” responded Mr. Daniel, who was the Obama administration’s top cyber policy official at the time of the election.
Mr. Daniel said he believed that “there was no reason why they wouldn’t have at least attempted recognizance against all 50,” adding: “It was more likely that we hadn’t detected it than it didn’t occur.” (emphasis added)
What has also been repeatedly ‘revised’ is just how far GRU officers got with their efforts:
Two years after Russia's wave of cyberattacks against American democracy, a Senate committee investigating election interference says those hackers hit harder than previously thought in several states…
Some of the report's other findings also are familiar: Russian cyberattackers targeted or scanned the elections systems in at least 21 states, and the Department of Homeland Security was slow in reaching out to the correct officials in those states to let them know.
But the report also says that in at least six of those states, the Russian-affiliated cyber operatives "went beyond scanning and conducted malicious attempts on voting-related websites" — a detail that had not been previously reported.
In most of those cases, the Russian cyberattackers attempted to use a "SQL" injection, which involves using special characters on a public-facing website to gain access and to either read or manipulate data.
The report says that in "a small number of states," the Russian operatives were in a position to alter or delete voter registration data. DHS has previously said that Russian hackers broke into the voter registration system only in Illinois…
And there is every reason to believe that the attacks we know about, and what they accomplished, represent only as fraction of what actually occurred:
"Unfortunately, throughout the last 15 years at DHS, when it comes to this situation, the victims stop reporting," Nielsen said. "When they stop reporting, we're just not aware of the attacks."
The Senate report also spotlighted this reporting issue.
Although it says "the diversity of our voting infrastructure is a strength," because it makes a large coordinated attack on vote tallies almost impossible, it also means neither Congress nor the Department of Homeland Security get an unimpeded look at the security of state voting systems.
"[They] are required to notify no one" about attacks, said Joseph Lorenzo Hall, a cybersecurity expert with the Center for Democracy and Technology.
Because of that, the Senate committee says that "it is possible that additional activity occurred and has not yet been uncovered."
"In light of the technical challenges associated with cyber forensic analysis, it is also possible that states may have overlooked some indicators of compromise."
For example, an attack on Alaska's election website in 2016 just became public this week because theAnchorage Daily News made a public records request that revealed emails about the event. A website called Cyberwar News had also previously reported the incident, but Alaska only acknowledged it this week.
The hacker, who Alaska officials told the Daily News was unrelated to the Russian scans of the 21 states, posted a photo on Nov. 8, 2016, of an administrator's view of the Alaska elections website on Twitter.
Of course, as the sage Charlie Pierce predicted a year ago, no matter how many ‘revisions’ of the historical record are made, public officials will downplay any possibility that votes and vote totals were affected by these Russian efforts:
The last outpost of moderate opinion on the subject of the Russian ratfcking during the 2016 presidential election seems to be that, yes, there was mischief done and steps should be taken both to reveal its extent and to prevent it from happening again in the future, but that the ratfcking, thank baby Jesus, did not materially affect the vote totals anywhere in the country. This is a calm, measured, evidence-based judgment. It is also a kind of prayer. If the Russian cyber-assault managed to change the vote totals anywhere, then the 2016 presidential election is wholly illegitimate. That rocks too many comfort zones in too many places.
As I noted in a previous diary, one former public official, uniquely qualified to speak about Russian intelligence operations, cybersecurity, and US voting systems, is willing to ‘rock comfort zones’:
For all the efforts Russia engaged in over the course of years to attempt to determine the outcome of the 2016 election, and install their preferred candidate, and all that is publicly known of their multifaceted operations to penetrate our voting systems, there are still many here and elsewhere who hold onto the contention there is no direct evidence that any votes, or vote totals, were changed.
That contention relies on the notion that Russia did everything in its capability to capture the election, from hijacking social media platforms to recruiting Americansto assist them, and they breached various voting systems in dozens of states, but the one the one thing they held back from doing, was change votes themselves (even though, as the work of Dr. Simons and other experts show, they could do so ‘invisibly’). Why would Putin hold back in this one instance, when he has shown no such restraint in any other way?
The answer is, in all likelihood: he didn’t hold back. Claims that votes were not changedto ensure the election of Putin’s tool, are looking less plausible by the day.
An article by Dr. Eric Haseltine (in, of all places, Psychology Today) from last month, explicates why this is the case.
First, who is Dr. Haseltine? From his website:
Eric joined the National Security Agency to run its Research Directorate. Three years later, he was promoted to associate of director of National Intelligence, where he oversaw all science and technology efforts within the United States Intelligence Community as well as fostering development innovative new technologies for countering cyber threats and terrorism. For his work on counter-terrorism technologies, he received the National Intelligence Distinguished Service Medal in 2007...
As much as we’d all like to believe such confident pronouncements, my experience in the intelligence world, where I served as Associate Director of National Intelligence, has lead me to one inescapable conclusion—the optimistic “experts” are probably wrong, and all of us should acknowledge that our unconscious (or not-so-unconscious) need to believe that our democracy can’t be subverted by foreigners, blinds us to powerful evidence to the contrary. And, after embracing this scary possibility, we should do a lot more to secure our voting systems than we are doing now…
One of the Russian Intelligence’s scariest accomplishments was to break into voter databases in 21 states (up to 50 states if you believe some sources). This success alone could have influenced the election by dictating who could and could not vote. In one target of Russian hacking, North Carolina for instance, some legitimate voters (in a “blue” precinct, as it turns out,) could not vote because the e-poll registration system used to allow voters to vote erroneously asserted that some legitimate voters weren’t registered…
One more thing. You might be wondering whether, despite their motivation to subvert our national elections, Russian leadership might still hesitate to alter vote tallies out of fear of getting caught. Whereas the U.S. Congress responded to voter registration hacks and email leaks from the Clinton campaign with sanctions—a mere slap on the wrist—the U.S. just might view outright alteration of vote counts an act of war and respond accordingly…
Sadly, I think the Kremlin views getting caught as more of a good thing, than a bad thing, because the net result would be favorable to Russia…
In other words, if Russia were caught changing vote counts, America would be even more divided than today: exactly what the Kremlin wants. And the national will to respond to Russia’s provocation as an act of war simply wouldn’t be there.
Russia wins if they don’t get caught and Russia wins if they do get caught; what’s not to like? (emphasis added)
What did we witness from the beneficiaries of Russia’s attack on our voting systems— Putin’s tool in the oval office and the GOP— after Mueller handed down indictments against a dozen GRU officers?
Well, certainly no suggestion that Putin’s tool shouldn’t meet with his patron in Moscow.
In fact, the news of the week from the GOP was whether a dentist can read body language better than an FBI counterintelligence agent:
If he could see me, Republican Rep. Paul Gosar would know that I am about to refer to him as one of the most harebrained screwballs ever sent to Congress by Arizona voters.
(And that’s saying something.)
Gosar would know what I am about to say next as well, because he has special powers. Kind of a self-described combination of oracle, psychic, and … dentist?
Dr. Haseltine and Charlie Pierce seem to have read our adversaries correctly.
Not the Russians, the Americans in league with them.