Email Domains Vulnerable to Election Infrastructure Cyber Attack

Email is being “significantly overlooked” as threat vector in securing election infrastructure, a recent report said.

While voting officials such as county auditors, clerks, or boards of elections regularly communicate with the public via email and real-time election results are sent to the media by email, in many states and counties in the U.S. it is highly vulnerable to cyber attacks, according to a study by the San Franciso-based Valimail. The software company makes an automated cybersecurity solution that blocks phishing emails and protects against business email compromise.

Valimail's research linchpins on DMARC technology (Domain-based Message Authentication, Reporting & Conformance) status for each of 187 domains used by election officials in the three largest counties or parishes for all 50 states. A correctly configured DMARC record with a policy of enforcement determines the authenticity of an email, wrote Seth Blank, Valimail’s industry initiatives director, in a blog post. Hackers are less likely to go after a brand with a DMARC record, he said.

“A DMARC enforcement policy prevents unauthorized senders from using the domain in the “From” field of their messages, cutting off one of the most devious impersonation vectors used by attackers,” Blank wrote.

Here’s what Valimail found:

The 10 domains protected from exact-domain impersonation attacks:

The data showed that six so-called swing states have a complete lack of protection among their three largest counties:

While the absence of DMARC enforcement at the state and local levels is but one vulnerability in U.S. election infrastructure, it’s still a significant opening for hackers, Blank said. A spoofed email impersonating an election official could spread voter disinformation, misdirect voters, suppress the vote or infect government networks with malware, according to Blank. “While there are other types of impersonation, exact-domain impersonation (putting the exact domain of a spoofed organization into the “From” field of a phishing email) is particularly difficult for email recipients to detect and often go uncaught even by many email security solutions,” he wrote.

Valimail is urging all state and local election officials to configure their domains with DMARC at enforcement, Blank said, calling the move “both feasible and effective.” A notable barrier is a lack of government funding to underwrite improving email security. For example, while the federal government under the Help America Vote Act (HAVA) disbursed nearly $400 million in 2018, none of it has been used to improve email security. According to Valimail, the email domains evaluated in the four states receiving the largest grants under HAVA -- California, Texas, Florida, and New York, each of which has received more than $20 million -- are not protected.

“The low rates of state and local deployment of this open standard is a clear warning sign that best practices to protect democracy are missing in many key places,” Blank wrote. “It is time to direct funding toward implementing such best practices, with DMARC at the top of the list, across state and local infrastructure,” he said.