The Secretary of the State said Connecticut’s voter list gets a million pings a day from illicit IP addresses mining for data.
“They want the data that’s in these lists but you can’t tell which ones are bad actors and which ones are just doing it for commercial purposes. It’s really a needle in a haystack,” explained Connecticut Secretary of the State Denise Merrill.
Merrill said the system is the most vulnerable at the local level.
“Threats against municipal systems in particular have gone through the roof in the last two and a half years,” explained Tim Weber, the head of Security Services for ADNET Technologies.
He said ransomware is the biggest threat to our election security. Cybercriminals have already attacked cities and school districts in the state with this technology.
“They’re threatening to either not release the data or not unencrypt it so you can’t get access to it unless you pay the ransom,” Weber explained.
While both Weber and Merrill said threats to our election system are greater than 2016, they also believe the government is more prepared than ever before to keep your vote secure.
“The good news is that there’s been a lot of attention and time, money, and effort on protecting the election systems,” Weber pointed out. " I’m not terribly worried about a cyber security threat.”
Since 2016, millions of dollars have been spent on upgrades to local computer systems and training the people who run them.
“Our election system has a drop point in every one of the 169 towns and we had no idea whether they were running secure software, whether they were changing their passwords, all those kinds of things that we all now know that we need to do,” said Merrill.
The National Guard performed a high-level assessment of local election infrastructure, upgrades were made to network connections at the municipal level, and cybersecurity analysts now keep the Secretary of the State’s office informed of cyber intelligence.
However, there is a contingency in case the voter list, considered the backbone of the system, goes down.
“We have lots of paper backup lists. We have backed that list up every single night,” said Merrill.
"If somebody wants to get in with enough time, money, and computing power they'll always be able to get in,” Weber pointed out.
During the 2016 election, federal agents detected efforts to infiltrate Connecticut's voter list, considered the backbone of our system. Merrill said the threats came from Russian IP addresses.
"I think part of what they're trying to do is create distrust. If everyone knows that the Russians are trying to get into our election systems that creates a lot of panic and distrust in the public and sometimes I think that may have been all they wanted to do, because they didn't get in," she said.
Weber agreed that the end goal is more likely to create chaos but said the hackers also have a financial incentive.
“In the end, the ransomware purveyors are actually real criminals. Their goal is to disrupt systems and get whoever the unwitting victims are to pay a ransom. So, really it’s about a monetary goal for those folks,” he explained.
Merrill said municipalities could resort to counting paper ballots by hand should a disruption occur.
“Some sort of electrical grid failure, for example, that could compromise our scanners," she said.
The Connecticut National Guard was called in to perform high-level assessments on the state's municipal election infrastructure, but Merrill’s office said only a third of cities and towns took advantage of the program.
"We've still got some work to do because we don't know what every little town is doing and that's part of the problem," she explained. "A lot of our towns are very small and they don't have IT staff."
With so many people voting by absentee, ballot boxes are also under scrutiny. In addition to the two places in front of City Hall, ballot boxes are also located in other places within the Capital City.
"We go out almost every day with the police officer to secure the ballots and bring them back in,” said the city’s town clerk, Noel McGregor, Junior.
Merrill is calling for upgrades to the system in the years to come, including a way to download absentee ballot request forms, sorting machines for absentee ballots, and a more advanced and secure voter registry.
When it comes to counting your vote this election, the state's antiquated system may thwart those highly sophisticated cyber criminals. Our 20-year-old tabulators are not even connected to the internet.
"I know that people think that their ballot is at risk somehow. It is not. We vote on paper. These tabulators are basically scanners,” she said.
Merrill said she’s most concerned about a campaign of disinformation that’s raising suspicion about our election.
“Oh I think it’s a bigger threat, by far because we can deal with systems, we can deal with hardware, we can put in more protections and try to stay ahead of it,” she explained. “Billions and billions of dollars are going into that campaign and it’s very sophisticated. It's really hard in a free society where we have free speech to be able to do anything about any of this."