Incident: Russian Hackers Breach Florida Voter Databases During 2016 Election

Published Date: 2017-06-09

Postmortem Analysis
Timeline 1. The software failure incident of Russian hackers hitting Florida voter databases during the 2016 US presidential election happened in 2016. [84832] 2. The software failure incident of Russian hackers attempting to hack a voting-tech firm in Florida occurred before the article was published on June 9, 2017. [60320]
System 1. VR Systems voting-tech firm's equipment and software used in voting registration [60320] 2. Florida's election databases [84832]
Responsible Organization 1. Russian hackers, specifically believed to be part of the country's GRU military agency, were responsible for causing the software failure incident by attempting to hack a voting-tech firm in Florida [60320]. 2. The hackers gained access to Florida's election databases through spearphishing emails, similar to the method used to infiltrate the Democratic National Committee's servers [84832].
Impacted Organization 1. Florida voter databases [84832] 2. VR Systems, a Florida-based tech firm that sells equipment and software used in voting registration [60320]
Software Causes 1. The software cause of the failure incident was the successful phishing attack on VR Systems, a Florida-based tech firm that sells equipment and software used in voting registration, by Russian hackers [Article 60320]. 2. Another software cause was the hackers gaining access to Florida's election databases through spearphishing emails, similar to the method used to infiltrate the Democratic National Committee's servers [Article 84832].
Non-software Causes 1. Spearphishing emails used by hackers to gain access to Florida's election databases [84832]. 2. Phishing attempts targeting employees at VR Systems, a Florida-based tech firm that sells equipment and software used in voting registration [60320].
Impacts 1. Voter registration data was accessed by Russian hackers in two Florida counties during the 2016 US presidential election, leading to potential alterations in voter registration data and the possibility of eligible voters not showing up in the system at polling places [84832]. 2. The breach of Florida's election databases through spearphishing emails allowed the attackers to alter voter registration data, although no votes were manipulated, and election results were not altered [84832]. 3. The incident raised concerns about the vulnerability of local counties in the electoral process due to limited expertise and resources, highlighting the need for improved cybersecurity measures for election officials, especially at the local level [84832]. 4. The software failure incident involving Russian hackers attempting to hack a voting-tech firm in Florida escalated beyond political leaks and disinformation to threaten the core systems of America's voting apparatus, indicating a shift towards more technically focused attacks on democracy [60320]. 5. The incident demonstrated a progression in Russian election-hacking tactics towards more direct tampering with election machinery, moving from information and propaganda attacks to techniques designed to potentially tamper with election results, although there was no evidence that the 2016 attacks changed actual vote counts [60320].
Preventions 1. Implementing robust cybersecurity measures such as multi-factor authentication and regular security audits could have prevented the software failure incident [84832]. 2. Enhancing employee training on recognizing and avoiding phishing emails could have helped prevent the breach [60320]. 3. Strengthening network security protocols and monitoring systems for unusual activities could have detected and prevented the intrusion [84832]. 4. Regularly updating and patching software vulnerabilities could have mitigated the risk of exploitation by hackers [60320]. 5. Collaborating with cybersecurity experts and agencies to stay informed about evolving threats and best practices in election security could have provided additional layers of defense [84832].
Fixes 1. Implementing stronger cybersecurity measures to prevent future hacking incidents, such as enhancing email security protocols to prevent spearphishing attacks like the one that allowed access to Florida's election databases [84832]. 2. Conducting regular security audits and assessments of voting registration systems to identify and address vulnerabilities that could be exploited by hackers [60320]. 3. Enhancing collaboration and information sharing between election officials, law enforcement agencies, and cybersecurity experts to quickly detect and respond to any potential breaches in election systems [84832]. 4. Investing in cybersecurity training and resources for local counties responsible for managing election processes to improve their expertise and ability to defend against cyber threats [84832]. 5. Implementing multi-factor authentication and other advanced security measures to protect sensitive voter data and prevent unauthorized access to election databases [84832].
References 1. Gov. Ron DeSantis 2. Special counsel Robert Mueller's report 3. Department of Homeland Security 4. FBI 5. The Intercept 6. Kenneth Geers 7. VR Systems 8. NATO's Cyber Center 9. University of Toronto group Citizen Lab 10. Eric Rosenbach 11. WikiLeaks 12. Security firm Trend Micro 13. Senate Intelligence committee vice chairman Mark Warner 14. USA Today 15. University of Pennsylvania computer science professor Matt Blaze 16. Center for Strategic and International Studies

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization (a) The software failure incident having happened again at one_organization: - The incident of Russian hackers targeting voter databases in Florida during the 2016 US presidential election is an example of a software failure incident that happened again within the same organization (Florida voter databases) [84832]. - The article mentions that Russian hackers had previously targeted the Democratic National Committee's servers using spearphishing emails, and now they targeted a Florida-based tech firm, VR Systems, that sells equipment and software used in voting registration [60320]. (b) The software failure incident having happened again at multiple_organization: - The articles do not provide specific information about the same incident happening at multiple organizations.
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the incident where Russian hackers gained access to Florida's election databases through spearphishing emails [84832]. This incident highlights a failure due to contributing factors introduced by system development, specifically the vulnerability in the design of the system that allowed unauthorized access through phishing emails. (b) The software failure incident related to the operation phase is evident in the attack on VR Systems, a Florida-based tech firm that sells equipment and software used in voting registration. The leaked NSA document pointed to Russian attempts to hack this voting-tech firm, indicating a failure due to contributing factors introduced by the operation or misuse of the system [60320].
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the Russian hackers infiltrating Florida's voter databases during the 2016 US presidential election can be categorized as a within_system failure. The hackers gained access to Florida's election databases through spearphishing emails, indicating that the breach originated from within the system itself [84832]. (b) outside_system: The software failure incident can also be categorized as an outside_system failure as the breach was caused by external factors, specifically Russian hackers who were attempting to meddle in the US democratic process. The attack was part of a larger trend of Russian hacking campaigns targeting democratic processes in various countries, indicating an external threat to the system [60320].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The software failure incident in Article 84832 was caused by Russian hackers infiltrating Florida's voter databases during the 2016 US presidential election. The hackers gained access through spearphishing emails, a method used to infiltrate the systems [84832]. - The incident involved a breach of the VR Systems, a Florida-based tech firm that sells equipment and software used in voting registration. This breach was part of the escalation of Russian election hacking beyond political leaks and disinformation to threaten the core systems of America’s voting apparatus [60320]. (b) The software failure incident occurring due to human actions: - The incident in Article 84832 was a result of human actions, specifically the actions of Russian hackers who actively targeted and infiltrated Florida's voter databases during the 2016 US presidential election. - The breach of the VR Systems, as reported in Article 60320, was also a result of human actions, with Russian hackers attempting to phish the credentials of employees at the tech firm, indicating a deliberate and targeted effort by the hackers.
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The incident involving Russian hackers gaining access to Florida's election databases through spearphishing emails [84832]. - Hackers believed to be working for Russia's GRU military agency sent phishing emails to VR Systems, a Florida-based tech firm that sells equipment and software used in voting registration [60320]. (b) The software failure incident related to software: - The incident where Russian hackers hit Florida voter databases during the 2016 US presidential election [84832]. - The leaked NSA document pointing to Russian attempts to hack a voting-tech firm, VR Systems, which sells equipment and software used in voting registration [60320].
Objective (Malicious/Non-malicious) malicious (a) The software failure incident described in the articles is malicious in nature. Russian hackers targeted Florida voter databases during the 2016 US presidential election with the intent to infiltrate and access voter data [84832]. The hackers gained access through spearphishing emails and attempted to alter voter registration data, which could have potentially affected the voting process by causing eligible voters to not show up in the system at polling places [84832]. The incident was part of a larger trend of Russian hacking campaigns aimed at disrupting democratic processes and undermining trust in voting systems [60320]. (b) The incident was not non-malicious as it involved deliberate actions by the hackers to breach the election databases and potentially manipulate voter data, rather than being accidental or unintentional.
Intent (Poor/Accidental Decisions) poor_decisions (a) The intent of the software failure incident related to poor decisions can be seen in the incident where Russian hackers targeted Florida voter databases during the 2016 US presidential election. The hackers gained access to Florida's election databases through spearphishing emails, a method previously used by Russian hackers to infiltrate the Democratic National Committee's servers [84832]. This incident highlights the poor decision-making in terms of cybersecurity measures and vulnerabilities that allowed the hackers to breach the voter databases. (b) The intent of the software failure incident related to accidental decisions can be observed in the incident where Russian hackers attempted to hack a voting-tech firm, VR Systems, by phishing the credentials of its employees. This incident represents a shift from mere political leaks and disinformation to threatening the core systems of America’s voting apparatus, indicating an unintended consequence of escalating election hacking tactics [60320].
Capability (Incompetence/Accidental) development_incompetence (a) The software failure incident related to development incompetence is evident in the articles. The incident involving Russian hackers infiltrating Florida's voter databases during the 2016 US presidential election highlights a failure in the development and maintenance of secure systems by the election officials and tech firms involved. The breach occurred due to the hackers gaining access through spearphishing emails, indicating a lack of professional competence in implementing robust cybersecurity measures [84832, 60320]. (b) The software failure incident related to accidental factors is not explicitly mentioned in the articles. The focus of the incidents described is on deliberate hacking attempts by Russian actors rather than accidental failures. Therefore, there is no information provided in the articles about software failures occurring accidentally.
Duration permanent, temporary The software failure incident described in the articles can be categorized as both permanent and temporary: (a) Permanent: The incident can be considered permanent in the sense that the breach of the Florida voter databases by Russian hackers during the 2016 US presidential election resulted in the alteration of voter registration data. This alteration could have lasting effects on the voter registration system, potentially leading to issues with voter eligibility in the future [84832]. (b) Temporary: On the other hand, the incident can also be seen as temporary since the breach did not directly affect the votes on Election Day, and there was no manipulation of actual votes or election results. The immediate impact of the breach was on voter registration data, which could be rectified or mitigated in the short term [84832]. Therefore, the software failure incident involving the breach of the Florida voter databases by Russian hackers during the 2016 US presidential election can be viewed from both the perspectives of permanent and temporary consequences.
Behaviour omission, value, other (a) crash: The articles do not mention a software failure incident related to a crash where the system loses state and does not perform any of its intended functions. (b) omission: The incident mentioned in the articles is related to a failure due to the system omitting to perform its intended functions at an instance(s). Specifically, the attackers were able to alter voter registration data, potentially leading to eligible voters not showing up in the system when they arrived at their polling place [84832]. (c) timing: The articles do not mention a software failure incident related to a timing issue where the system performs its intended functions correctly but too late or too early. (d) value: The incident mentioned in the articles is related to a failure due to the system performing its intended functions incorrectly. In this case, the attackers were able to alter voter registration data, impacting the accuracy of voter information [84832]. (e) byzantine: The articles do not mention a software failure incident related to a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior observed in the incident described in the articles is unauthorized access and intrusion into the election databases by hackers, leading to potential data breaches and manipulation attempts [84832, 60320].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) unknown (b) unknown (c) unknown (d) [60320] The software failure incident related to the Russian hackers targeting a Florida-based tech firm that sells equipment and software used in voting registration had the potential consequence of impacting people's data and the core systems of America’s voting apparatus. (e) unknown (f) [84832] The software failure incident involving Russian hackers infiltrating Florida's voter databases impacted non-human entities, specifically voter registration data being altered. (g) unknown (h) [84832] The potential consequence discussed was that people who were eligible to vote might not have shown up in the system when they arrived at their polling place due to the altered voter registration data. (i) unknown
Domain information, government (a) The failed system was related to the information industry as it involved voter databases being breached during the 2016 US presidential election [84832]. (l) The failed system was also related to the government industry as it impacted the electoral process and voter registration databases in Florida during the election [84832, 60320].

Sources

Back to List