Incident: Russian Hackers Lock Up Voter Signature Verification Database in Georgia

Published Date: 2020-10-28

Postmortem Analysis
Timeline 1. The software failure incident of the ransomware attack that locked up the voter signature verification systems in Gainesville, Georgia, occurred last week [106008]. 2. The article was published on 2020-10-28. 3. Therefore, the software failure incident likely occurred in October 2020.
System 1. Voter signature verification systems in Gainesville, Georgia [106008] 2. Election software in Georgia [106008]
Responsible Organization 1. Russian hackers [106008] 2. Hackers behind TrickBot ransomware [106008]
Impacted Organization 1. Voter signature verification database in Georgia 2. Trump campaign website 3. Election systems in California and Indiana 4. Small government offices in Louisiana 5. Secretaries of state websites 6. Voting infrastructure across multiple counties and states 7. Voter signature verification systems in Gainesville, Georgia [Cited Articles: 106008]
Software Causes 1. The failure incident was caused by Russian hackers who locked up the voter signature verification systems in Georgia in a ransomware attack, leading to the dumping of voters' registration data online [106008]. 2. The attack on the Trump campaign's website, where hackers defaced it with a threatening message, was another software cause of the failure incident [106008]. 3. Ransomware attacks, such as the one in Gainesville, Georgia, that locked up the voter signature verification systems, were identified as software causes of the failure incident [106008].
Non-software Causes 1. Lack of two-factor authentication due to disabling it by the Georgia secretary of state's office [106008] 2. Ransomware attack targeting the voter signature verification systems in Gainesville, Georgia [106008]
Impacts 1. The software failure incident involving Russian hackers locking up the voter signature verification systems in Gainesville, Georgia, resulted in poll workers having to resort to manual verification methods, impacting the efficiency and speed of the election process [106008]. 2. The incident exposed weak spots in Georgia's election systems, a key battleground state, highlighting vulnerabilities that could potentially be exploited in future attacks [106008].
Preventions 1. Implementing and maintaining strong cybersecurity measures, such as two-factor authentication, to prevent unauthorized access and attacks [106008]. 2. Regularly updating and patching software systems to address vulnerabilities and prevent exploitation by hackers [106008]. 3. Conducting thorough security assessments and audits of election systems to identify and mitigate potential weaknesses [106008]. 4. Enhancing training and awareness programs for election officials and staff to recognize and respond to cybersecurity threats effectively [106008].
Fixes 1. Implementing robust cybersecurity measures to prevent ransomware attacks, such as maintaining two-factor authentication and ensuring systems are secure [106008]. 2. Enhancing backup systems, particularly for voter registration data, to mitigate the impact of potential cyberattacks [106008]. 3. Continuously monitoring and updating voting machines to address vulnerabilities and prevent potential attacks that could compromise election outcomes [106008].
References 1. United States Cyber Command 2. Facebook 3. Twitter 4. Google 5. Microsoft 6. Department of Homeland Security 7. American intelligence agencies 8. University of Michigan 9. J. Alex Halderman 10. Harri Hursti 11. National Security Agency 12. VR Systems 13. Homeland Security Department’s Cybersecurity and Infrastructure Security Agency 14. Cybersecurity firm Mandiant 15. Microsoft executive Tom Burt 16. Kimberly Goody, cybercrime analyst at Mandiant 17. Georgia secretary of state’s office 18. Cybersecurity and Infrastructure Security Agency [106008]

Software Taxonomy of Faults

Category Option Rationale
Recurring one_organization, multiple_organization (a) The software failure incident having happened again at one_organization: - The article mentions a ransomware attack in Gainesville, Georgia, that locked up the voter signature verification systems, forcing poll workers to resort to manual verification [106008]. - Internal emails revealed that the Georgia secretary of state's office disabled two-factor authentication after facing issues with the election software, which is a security measure recommended by the Homeland Security Department [106008]. (b) The software failure incident having happened again at multiple_organization: - The article discusses various cyberattacks targeting election systems in different states, including Georgia, California, Indiana, and Louisiana, indicating a pattern of attacks across multiple organizations [106008].
Phase (Design/Operation) design (a) The article mentions a software failure incident related to the design phase when a ransomware attack in Gainesville, Georgia, locked up the voter signature verification systems, forcing poll workers to resort to manual methods [106008]. This incident was a result of weak spots in Georgia's election systems, including the disabling of two-factor authentication by the Georgia secretary of state's office after the election software faced challenges with early voters' volume. (b) The article does not provide specific information about a software failure incident related to the operation phase caused by factors introduced by the operation or misuse of the system.
Boundary (Internal/External) within_system, outside_system (a) within_system: The software failure incident related to the ransomware attack in Gainesville, Georgia, which locked up the voter signature verification systems, was a result of factors originating from within the system. The attack, although not directed at the election, took down election systems as collateral damage, exposing weak spots in Georgia's election infrastructure [106008]. (b) outside_system: The article mentions that Russian hackers targeted various election systems in different states, such as Georgia, California, Indiana, and Louisiana. These attacks were initiated by external factors, specifically Russian hackers, who breached local networks and election systems [106008].
Nature (Human/Non-human) non-human_actions, human_actions (a) The software failure incident occurring due to non-human actions: - The incident in Georgia involved a ransomware attack that locked up the voter signature verification systems, leading to poll workers having to resort to manual verification methods [106008]. - The ransomware attack in Gainesville, Ga., that affected the voter signature verification systems was not specifically directed at the election but caused collateral damage by taking down election systems [106008]. (b) The software failure incident occurring due to human actions: - Internal emails revealed that the Georgia secretary of state's office disabled two-factor authentication in recent weeks after facing issues with the election software, which was struggling under the volume of early voters. This action of turning off two-factor authentication introduced a vulnerability that could have contributed to the software failure incident [106008].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions a ransomware attack in Gainesville, Georgia, that locked up the voter signature verification systems, forcing poll workers to resort to manual methods [106008]. - It is highlighted that the attack in Gainesville, Georgia, was not directed at the election but affected election systems as collateral damage, indicating a hardware-related failure [106008]. (b) The software failure incident related to software: - The article discusses how the Georgia secretary of state's office disabled two-factor authentication in recent weeks after facing issues with election software, which could be considered a software-related failure [106008].
Objective (Malicious/Non-malicious) malicious, non-malicious (a) The objective of the software failure incident was malicious, as it involved Russian hackers conducting ransomware attacks on various systems related to the election process, including voter signature verification databases and Trump campaign websites [106008]. (b) The software failure incident was also non-malicious in nature, as it highlighted vulnerabilities in the election systems that could be exploited by attackers to sow doubt about the legitimacy of the election results, without necessarily intending direct harm to the systems themselves [106008].
Intent (Poor/Accidental Decisions) poor_decisions, accidental_decisions (a) The intent of the software failure incident related to poor decisions can be seen in the case of the ransomware attack in Gainesville, Georgia, where the voter signature verification systems were locked up. Internal emails revealed that the Georgia secretary of state's office disabled two-factor authentication after the election software was struggling with the influx of early voters, which was a poor decision that left the system vulnerable to attacks [106008]. (b) The accidental decisions contributing to the software failure incident are evident in the case of the ransomware attack in Gainesville, Georgia. The attack, which locked up the voter signature verification systems, was not directed at the election but caused collateral damage by taking down election systems. This unintended consequence exposed weak spots in Georgia's election infrastructure, highlighting the accidental nature of the failure [106008].
Capability (Incompetence/Accidental) accidental (a) The articles do not provide information about a software failure incident occurring due to development incompetence. (b) The software failure incident related to accidental factors is the ransomware attack in Gainesville, Georgia, which locked up the voter signature verification systems, forcing poll workers to resort to manual methods [106008]. This incident was not directed at the election but affected election systems as collateral damage, highlighting continued weak spots in Georgia's election infrastructure. Additionally, internal emails revealed that the Georgia secretary of state's office disabled two-factor authentication after facing issues with the election software, which was a critical security measure [106008].
Duration temporary The software failure incident mentioned in the articles is temporary. The incident involved a ransomware attack in Gainesville, Georgia, which locked up the voter signature verification systems, forcing poll workers to resort to manual processes [106008]. This indicates that the failure was due to specific circumstances, such as the ransomware attack, rather than being a permanent failure introduced by all circumstances.
Behaviour crash, byzantine (a) crash: The article mentions a ransomware attack in Gainesville, Georgia, that "locked up the voter signature verification systems" last week, forcing poll workers to resort to manual methods [106008]. (b) omission: The article discusses concerns about potential attacks on voter registration, verification, and vote reporting systems, which could sow doubt about the legitimacy of the election by delaying results or affecting the reporting of results [106008]. (c) timing: The article does not specifically mention any failures related to timing. (d) value: The article does not provide information about failures due to the system performing its intended functions incorrectly. (e) byzantine: The article mentions the behavior of a Russian group called Energetic Bear, which has breached various systems including a nuclear power plant in Kansas and web systems at San Francisco International Airport, indicating inconsistent responses and interactions [106008]. (f) other: The article does not describe any other specific behavior of the software failure incident.

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, delay, theoretical_consequence (d) property: People's material goods, money, or data was impacted due to the software failure - A ransomware attack in Gainesville, Ga., locked up the voter signature verification systems last week, forcing poll workers to do things the old-fashioned way, pulling registration cards manually and eyeballing the signatures. The attack, which does not appear to have been directed at the election but took election systems down as collateral damage, exposed continued weak spots in Georgia, a key battleground state. Internal emails showed that the Georgia secretary of state’s office disabled two-factor authentication in recent weeks, after its election software was buckling under the deluge of early voters. Two-factor authentication, which keeps hackers from breaking into systems with one stolen password, has been key to the Homeland Security Department’s election security strategy, and in this case emails show that the secretary of state simply turned it off. [106008]
Domain information, government (a) The failed system was related to the information industry as it involved a database that verifies voter signatures being locked up by Russian hackers in a ransomware attack, which also dumped voters' registration data online [106008]. (l) The failed system also had implications for the government industry as the incident involved cyberattacks aimed at small government offices in Louisiana, with the National Guard being called in to stop these attacks [106008].

Sources

Back to List