Election Defense Against Hacks

There was an interesting story in the Financial Times Weekend about the US election hacking and working on defenses for preventing the same kind of thing.  It was curious that when I went for the link to the story, I found several others (even Hacker News had one) that used the same examples and word-for-word descriptions of some of the events.  Whoever did the distribution of this story line tried to reach a number of different outlets with a canned story.  The reporters may have attended, but it is rare for them all to use the same examples and wording to describe an event like a training session.  The Times seems to have done more rewriting than some of the others.  The story is about education of representatives who manage election functions in state governments.  The Defending Digital Democracy Project seems to be leading this training.

 In general, state computer people are not the easiest people to work with because they focus on their own state and not the rest of the country.  Elections face international threats and states are not good at defending against that kind of thing.  Homeland Security is supposed to be training them on how to do that, but each state has to request help to get it.  I have seen nothing on the quality or focus of this type of training.  

This effort seems to be more awareness oriented, running table-top exercises with technical and non technical people who have been hacked, notably those from the Hillary Clinton camp.  People who have been hacked are usually good to have around because they failed to defend their systems.  Ones who did keep the hackers out are boring.

The leader of the group, Eric Rosenbach, emphasizes in the beginning of the exercises that this is in no way an indication that the elected President was not legitimately elected.  A curious statement to set the scene for an exercise like this, and relevant only if there was some tampering with voter tallies.  The official report on election concerns does not indicate any such thing.  If you really want to raise awareness about defense of computers, that is normally not the place to start.