James Carder, Chief Security Officer & Vice President of LogRhythm, expanded on why attacks on exactly this sort of voter registry information are part of a dangerous trend:
“It is worrisome that an app developed specifically for elections did not have advanced security measures in place – especially when millions of voter records were contained within it. Unfortunately, in this Elector incident, personally identifiable information including names, addresses and phone numbers for over six million voters was left exposed. This data can now be weaponized in future attacks, and it leaves those impacted vulnerable to future fraud.
“On top of that, these types of incidents can have real geopolitical ramifications. Exposed voter information could easily lead to fraudulent voting, allowing cyber criminals to manipulate the voting system and potentially elect individuals or pass laws that the population wasn’t going to support. And given how connected our world is – with nuanced diplomatic relations and economic unions – those fraudulently approved officials and laws could then have international ripple effects.
“This incident should serve as a wake-up call for other developers of election technology. Just last week, the U.S. had an issue with an app for the Iowa caucuses. While the situation in that case was less about security and more about general functionality of the app, the incident with Elector demonstrates the potential damage of hastily built election applications. And either way, these breaches and malfunctions can infringe upon the trust and confidence citizens have in their government; it could make them wonder how long these types of malfunctions and vulnerabilities have existed and if they’ve managed to compromise past elections.
“Cybersecurity around all elections should be a hyper-focus. Given the sensitive nature of the data needed to execute an election and the national and global impacts of the results, developers of election technology – whether it’s an app or something else – need to take the necessary precautions to protect voter data. First and foremost, anyone creating these technologies should employ secure software development and application security best practices. This will help identify and remediate any code-based vulnerabilities before the technology is made available to the public, and it will also assist with maintaining the security of the application as maintenance is performed. And then anyone collecting or storing this information should have real-time monitoring and clear visibility into their operations. This will allow them to rapidly detect and neutralize security threats.”