Vulnerabilities in US 2020 Election Infrastructure
A 15 January 2020 National Intelligence Council memorandum assesses the potential impact of cyber operations against U.S. election infrastructure while expressly not assessing adversary intent or specific plans.
The memorandum assesses that at least Russia, China, Iran, and North Korea could access and potentially manipulate data in U.S. election-related systems. It preserves the key qualifier that the authors did not know whether those states had specific plans to interfere with system operation.
“We assess that at least Russia, China, Iran, and North Korea have the capability to access and potentially manipulate data in US election-related computer systems”
Central data repositories were assessed as most exposed
The memorandum judges centralized election-data repositories comparatively easy to exploit because they are regularly accessible and have weaker security. It says altered registration data could prevent or delay voting and that registration data could also be used to tailor interference or influence activity.
“adversaries could most easily exploit centralized election-related data repositories because of their ease of access and comparative lack of security.”
“Adversaries could alter data to potentially prevent individual voters or groups of voters from voting, causing delays on election day or forcing voters to use provisional ballots.”
The memorandum assesses that manipulating tabulation across enough jurisdictions to change a presidential result would be difficult because systems are decentralized and many attack methods require physical proximity. It judges that paper trails and post-election audits would very likely reveal such a campaign.
“We assess that vote tabulation systems would be difficult to manipulate on a wide enough scale to compromise election results.”
Results-reporting attacks could create uncertainty without changing certified counts
The memorandum assesses that attacks on the electronic reporting of results could delay public reporting and create uncertainty, but probably would not affect certified-result integrity because tabulated results are stored separately. It notes that denial-of-service attacks or manipulation of copies in transit could create the appearance of changed results.
“could delay results reporting from affected jurisdictions, potentially creating public uncertainty but probably not affecting the integrity of certified results.”
“Denial of service (DOS) attacks or manipulation of copies of the results in transit would delay public access to the results or make them difficult to access, creating the appearance of modified results.”
The analysts warn that adversaries could pair exaggerated or fabricated manipulation claims with real but limited cyber operations to undermine confidence. Proposed mitigations include stronger physical and cyber hygiene, vendor screening, prompt public education, and private deterrent messaging, while noting that basic controls probably would not deter the most capable nation-state actors.
“Adversaries could also link an exaggerated claim—for example, about their ability to affect the election outcome—to actual operations”
“Basic security measures―replacing obsolete equipment, strengthening password policy and audit processes, and implementing network segmentation―might prevent less sophisticated adversaries from disrupting election processes but probably would be insufficient to deter the most advanced and determined nation-state actors.”