Cyberattacks last month took systems offline at a town in New Hampshire, a county government in Georgia, and more than 30 water and wastewater utilities in Minnesota. A fourth attack hit an internet provider in Maine and cut service to 23 towns, including one town’s government offices. The attackers and the targets varied, but staff in all four places had to keep working without the tools they rely on every day.
In Milford, NH, the outage took down phones, internet, online payments, and the town clerk’s connection to state systems. Because New Hampshire town clerks serve as election officials, the disruption may have impacted election operations. The town is working with forensic specialists to investigate what it describes as a “cybersecurity incident involving unauthorized activity.” In May, a cybersecurity professional pointed out a vulnerability to town leadership, noting a storage device was exposed directly to the internet and urged the town to take it offline. It’s unknown whether that device had anything to do with the outage.
In Greene County, GA, initial reports suggested the county detected an intrusion but had not determined how their network was breached. County networks were taken down “out of caution” while the network was rebuilt and restored. On July 28, SOCRadar discovered that Greene County was listed as a victim of a ransomware group that had claimed 33 other victims in the previous 60 days.
Early reports about the Minnesota water system attacks didn’t yield a clear motive. The attack disrupted water and wastewater operations, but water service continued, and the public impact was limited, though the attack disabled some automated controls and cut off data from sensors. The state is working with its security partners to “contain, investigate, and remediate damages.” One city, Braham, impacted by the attack was able to restore a backup to restart their plant.
Nearing press time, new reports from The New York Times and The Washington Post say that US intelligence agencies have preliminarily assessed that Iran-linked hackers were likely behind the coordinated cyberattack in Minnesota. Investigators caution that the assessment could change. The FBI has since tied similar activity to water systems in several other states.
Damariscotta, ME, lost municipal services after a cyberattack on a telecommunications service provider. Due to “spotty to no internet service,” the town’s government office could not carry out some essential functions. The attack flooded the service provider’s network with malicious traffic, which in turn slowed internet service and caused delays. In all, the attack lasted nearly two days.
At least one of these incidents touched an election office directly, and that is the point. Election work rides on the same county networks, phone lines, and shared IT services as most other functions in the building. With Week E-13 on the calendar, an outage an office could absorb in early August would cost far more during ballot programming or logic and accuracy testing. Election officials shouldn’t wait for risks to become reality before taking action. The defenses that limit this kind of damage aren’t complicated or hard to implement, but too often they are overlooked.
Six Things Worth Checking This Week:
- Is multifactor authentication (MFA) turned on? Email, remote access, and anything touching voter data should use MFA. With it on, a stolen password isn’t enough to get in.
- Have you changed all default passwords? Some technology arrives from the factory with a common default password. Automated hacking tools scan for those passwords, so change them on every device as soon as it arrives.
- What is exposed to the internet? Systems exposed to the internet invite constant automated attacks, data theft, and network takeovers. Make a list of what is exposed, then shorten it.
- What needs patching? Review workstations, servers, phones, routers, printers, and anything else connected to your network. Turn on automatic updates where you can so no one has to remember to apply them. Attackers scan for unpatched systems constantly, and they are not picky about whose office they find.
- Have you tried restoring from a backup? If you have never tested it, you don’t know if your backup will work. Pick one system, restore it, and time it. That number is what you will need to know on a bad day.
- Is your plan on paper? If power is down or your network is inaccessible, the contact list and incident response plan on your computer will not help you. Print your key contacts and phone numbers before you need them.
For easy-to-implement steps to help prevent cyber intrusions, review the resources highlighted in the Resource Library section of this newsletter.
The Situation Room focuses on real security incidents and threats in the news relevant to election security. To review previous issues, see the newsletter archive.