Yuri Samoilov, Flickr
New Vulnerabilities: The Increasing Importance of Cybersecurity
Amid recent hacks of financial information, breaches of personal accounts, and attacks on voting software, cyberattacks prey on the lack of understanding of the importance of cybersecurity. It is time to reexamine current standards and precautions regarding technology like election software, nuclear sites, and voter databases in the wake of recent cyberattacks on the 2016 Presidential Election, critical industry, and personal information.
The 2016 US Presidential Election served as a defining point for recognizing the importance of cyber security. Confirmed Russian cyber-activity to influence the election permeated both public and private resources. According to the Department of Homeland Security, 21 states experienced attempted hacking into election-related computer systems. The Intercept reported that industries were also under threat as “Russian military intelligence ‘executed a cyberattack on at least one U.S. voting software supplier.’” Further, the Democratic National Committee and the Clinton Campaign faced email leaks executed by Russian hackers, per U.S. intelligence reports. This should be a wakeup call for the importance of cybersecurity.
Improved technology enables efficiency and complacency. The United States has been a target and victim of cyber-intrusions for years. With increasing information at risk, and consequent cyber-attacks, the modernization of technology and information databases demands a parallel buildup of cyber security. Because “technology is static and the threat is not,” there will always be new ways to get around predictable systems. Thus, our security systems must be as flexible and quick as the evolving threats.
The Department of Homeland Security manages cybersecurity in many ways, including implementation of an early warning system, improvement of security for federal organizations, and operation of emergency teams for response to malicious activity. Beyond addressing Russia’s influence in democratic elections, the Trump Administration has introduced plans to assist domestic cybersecurity. New mandates include the use of the National Institute of Standards and Technology Cybersecurity (NIST) Framework to establish a standard of security, partnership with industry to protect critical infrastructure, and establishment of the White House’s American Technology Council to modernize Federal IT services.
These preparations are in the right direction, but they focus on federal technology systems without addressing issues including state-level cyber-security, international cooperation, and cultural attitude towards the importance of cyber-security at the state, business, and personal levels.
The federal government does not directly control state election systems, and thus state-IT strategic plans vary. While some states outline multifaceted plans with increased system monitoring and personnel training, others mention cybersecurity in passing, do not lay out plans of action after mentioning cybersecurity threats, or are “virtually silent on the topic” of cybersecurity. States with lacking cybersecurity plans, and their respective industry and election systems, make easier targets to access voter registration, collect personal information, and manipulate records. Recently, an unofficial, private security test conducted on election systems in Georgia before the 2017 special election showed easy access – “without logging in” – to over 6.7 million voter records, instructions and passwords for the system, and software for verifying voter registration.
States should collaborate with DHS, the American Technology Council, and other organizations to address the growing need for cybersecurity and set standard, federally-recognized benchmarks for security. The U.S. Election Assistance Commission should also expand the current role from providing general security suggestions and publishing election security protocols to assisting with implementation of local security plans and enforcing state accountability. States can then develop individual plans for securing voter technology and infrastructure with a standard of protection and a starting point for securing private information.
Conflicting agendas in international relations make cooperation in cybersecurity a difficult goal. Total cyber-security will require federal intelligence-gathering agencies to work alongside companies like Microsoft to share with one another secrets that could be turned over to create patches for faulty systems rather than be weaponized against other nations. The disarmament of cyber-weapons requires trust, coordination, and accountability. A first step would be working with other nations to target seemingly-independent groups like the Shadow Brokers who “exposed major vulnerabilities in Cisco routers, Microsoft Windows, and Linux mail servers” and assisted with the Wannacry attack in May.
The most successful cyberattacks quietly exploit information, code, and complacent computer users to infiltrate computer systems. Large corporations and private users both struggle with security. Bureaucratic organizations are often slow to push software updates and each system update must endure “a battery of tests,” while individual users exhibit “straightforward laziness” installing new updates and patches. Whether reminding users to be wary clicking links in unusual emails or simplifying update processes, cyber security efforts must educate and engage citizens on cyber threats as business and industry, governments, and civil society increasingly encourage consumers to digitize daily life.
