Coordinated Vulnerability Disclosure (CVD) or Vulnerability Disclosure Policies (VDP) for technology are key components of a security strategy that builds trust with users and stakeholders. A VDP is a “see something say something” policy that allows third parties to report potential vulnerabilities and security gaps directly to the affected organizations. Election technology manufacturers are the latest industry to recognize the benefits of identifying and fixing software vulnerabilities before they can be exploited. In August 2018, the Information Technology – Information Sharing and Analysis Center (IT-ISAC) approved the formation of an Election Security Special Interest Group (EI-SIG) to provide a dedicated and trusted forum within the IT-ISAC for election industry stakeholders to help guard their networks and assets against physical and cyber threats. The five-year journey since the inception of the EI-SIG has delivered a number of initiatives for overall election technology security; one of those being to help establish wide acceptance of VDPs. While most election technologists’ VDPs have been in place for some time now, a recent event brought together the practice of vulnerability disclosure with hands-on security testing by some of the most experienced and innovative ethical hackers in the country.
As a member of the Election Security Research Forum (ESRF), HackerOne has been part of the journey and continues to contribute insight and talent to coordinate events and advise in security initiatives. In this blog we share the background of the event, why it took place, and the highlights from the sessions.
Ethical Hackers Help Secure Election Technology
The Election Security Research Forum (ESRF) event took place in September 2023 at the MITRE facility in McLean, VA and was spearheaded by the IT-ISAC, with the cooperation from the EI-SIG. To complement the participation from the EI-SIG, a Security Advisory Board, made up of industry professionals in the election security space, from former election officials to representatives of the security researcher community, was created to help foster relationships between election technology manufacturers and the security researcher community. Three election technology manufacturers and 15 independent security researchers, or ethical hackers, took part. The ethical hackers are all U.S. nationals who were fully security vetted before the event. Over a two-day period, the ethical hackers met with election technology providers to explore potential security issues within their devices. In addition to the testing, panels and talks from the various expert stakeholders built an additional understanding of the common goal. Security was tested, products and processes were improved, and, most importantly, mutual trust was earned.
Hardware hacker, Brandon Reynolds, attended the event and commented, “ [The election security event] was a once-in-a-lifetime chance to see inside the machine that is our electoral process and the hardware used. I am absolutely enamored with hardware security, and the different paths organizations will take to secure their hardware. Election technology makes up maybe 20% of the entire election ecosystem, but it is highly critical. The opportunity to review the hardware used to cast votes in our country was something I’ve always wanted a chance to look at, simply out of curiosity’s sake.” Brandon also commented on the importance of transparency to build trust. “There continues to be fear and misinformation around voter fraud. The greatest cybersecurity engineers spent multiple days, on their own dime, reviewing these critical machines, and I’d love to see the general public be made aware of the outcome(s). Whether positive or negative, sharing the findings with legislators, citizens, and other VIPs of the electoral process is a crucial aspect to restoring trust in the free and open electoral process in our country.”
Transparency in the Electoral Process Builds Trust
The risks posed to elections by disinformation, foreign interference, and mistrust are very credible. And the reality is that while technology exists, vulnerabilities will be present. However, if security happens behind a veil, any potential vulnerability in election technology could create the perception of a much greater risk. That’s why it’s so crucial to ensure thorough security testing is conducted by those who can adopt an outsider’s mindset and why it’s so critical to ensure transparency of that testing for the public through vulnerability disclosure.
For advice on setting up a vulnerability disclosure program, speak to one of our experts today.