2020 Election Cybersecurity Concerns and Recommendations

As Election Day approaches, threat actors continue to intensify attempts to engage in malicious activity that could sow distrust, create unrest, render services unavailable, or gain access to systems and data. Threat actors have historically targeted the elections process by conducting distributed denial-of-service (DDoS) attacks, SQL injections attacks, phishing/spear-phishing campaigns, website defacement, and disinformation campaigns. These activities may slow, but not impede, voting or the reporting of election results.

The NJCCIC has observed several election-related phishing campaigns, including those purporting to be from a known political organization, attempting to deliver malicious emails to NJ state employees in order to steal credentials or install malware such as Emotet. Phishing campaign may attempt to steal user credentials or install malware and include themes such as voter registration errors, campaign platforms, and election donations. After publicly identifying a campaign linked to the Iranian Government, the US Director of National Intelligence urged recipients to refrain from forwarding these emails, as doing so only perpetuates the intended effects. CISA and the FBI released alerts detailing the threats to election-related systems by Iranian advanced persistent threat (APT) actors (AA20-296B), as well as the targeting of US SLTT governments by Russian APTs (AA20-296A).

Successful website-based attacks, such as SQL injection, may provide a threat actor access to sensitive data that can be used in subsequent attacks, such as spear-phishing emails. Unauthorized access to official websites and social media accounts may result in website defacement in order to spread disinformation, subsequently leading to mistrust and loss of confidence for that source, or in the election system itself. These threats also include DDoS attacks, which could slow or render election-related public-facing websites inaccessible. This would not prevent voting or the reporting of election results; however, it may limit access to resources such as voting information or non-official voting results.

In addition to the above cyber threats, disinformation and misinformation have played a key role in attempted disruption of the election process. Disinformation and misinformation are cyber-centric threats, in which threat actors, both foreign and domestic, have capitalized on the use of internet-based platforms to cause confusion and distrust. Many news sources and social media platforms are facilitating the spread of disinformation and misinformation regarding the 2020 General Election, including the election process, furthering nation state influences. Some examples of disseminated disinformation and misinformation include rigged, stolen, or compromised state and county voting systems and voter registration databases. In addition, both disinformation and misinformation have been observed circulating regarding the handling and delivery of mail-in ballots in attempt to sow distrust in the United States Postal Service (USPS). These include false claims surrounding the capabilities of the USPS, as well as fictitious voter fraud stories of manipulated, discarded, or misplaced ballots.

Recommendations

The NJCCIC recommends users maintain awareness of current tactics used by threat actors, exercise caution with communications from unknown senders that request information or an action be taken, particularly those that convey a sense of urgency. Additionally, users are advised to implement multi-factor authentication where available, avoid reusing passwords across multiple accounts, and ensure both hardware and software are up to date. We recommend voters seek out accurate and reliable sources of information provided by official government entities, such as New Jersey’s vote.nj.gov, official state and local election websites and social media pages, Elections Assistance Commission (EAC), and the Cybersecurity and Infrastructure Security Agency (CISA). The NJ Office of Homeland Security and Preparedness (NJOHSP) provides a webpage to help the public distinguish between facts and misinformation/disinformation. CISA also provides an Election Disinformation Toolkit to reduce the impacts of disinformation campaigns. Cyber-related incidents may be reported to the NJCCIC via the Cyber Incident Reporting Form.