The Washington PostDemocracy Dies in Darkness

The Cybersecurity 202: Chaos in primary elections offers troubling signs for November

with Tonya Riley

Sometimes-chaotic primary elections across eight states and the District of Columbia foreshadowed challenges that could undermine the security and legitimacy of the general election in November. 

There were signs of dangerous shortcuts and workarounds, especially in the District where officials couldn't get mail-in ballots out to everyone who requested them and resorted to accepting emailed ballots. Security experts warn such ballots are highly vulnerable to hacking because voters can't verify they were recorded accurately. 

That was the biggest security concern on a night that was also marked by hours-long lines for in-person voting, last-minute extensions for absentee voting, and anxiety about going to the polls during the coronavirus pandemic and nationwide protests against police violence, which prompted curfews in some places including Washington and Philadelphia. 

The good news was that Department of Homeland Security officials said they hadn’t seen any signs of cyberattacks or significant disinformation campaigns from Russia or elsewhere as of a midday briefing. But they warned that disinformation attacks in particular might take more time to identify. 

Overall, the day produced a middling report card for election officials, with one big note: Needs improvement before November. 

“We’re looking at administering elections when there’s an ongoing threat from foreign adversaries coupled with a pandemic and now civil unrest,” Elizabeth Howard, counsel for the Brennan Center’s Democracy Program and a former Virginia election official, told me. “This is a terrible situation, but we’re going to be learning a lot of lessons we’ll be able to use in November.” 

Getting mail-in ballots to people who requested them proved the greatest challenge of the night. 

Voters in the District, Maryland and Rhode Island all reported not receiving mail-in ballots or struggling to request them, Amy Gardner, Elise Viebeck and Natalie Pompilio report. The states were all dealing with huge increases in voting by mail, which experts say is the safest way to vote during a pandemic considering the public health risks of going to the polls.

In one Pennsylvania county, a judge ordered the mail-in deadline extended for as many as 500 people who had requested but not received mailed ballots. The state’s top election official Kathy Boockvar said she expected an even greater crush of absentee voting in the general election. 

This surge is one thing, but I think we can expect a lot more than this in November, even without covid-19,” she said. 

In Indiana, meanwhile, the clerk of the state’s most populous county warned last week that thousands of ballots might not be counted because they would not be returned by the Election Day deadline.

Elections were also held in Iowa, Montana, New Mexico, South Dakota, Rhode Island and Indiana. 

Problems were especially severe in the District.

In addition to allowing emailed ballots, officials there resorted to driving across the city to hand-deliver ballots to people who had requested but not received them, Julie Zauzmer and Fenit Nirappil report. Nevertheless, numerous voters said they had not received ballots by Election Day and so headed to the polls. 

It’s unclear how many ballots did not reach D.C. voters, but the city mailed 92,000 ballots and had only received 37,000 back as of Sunday. 

Voters who showed up in person had to wait in blocks-long lines at numerous polling locations, and waits stretched for several hours — well past the 7 p.m. curfew D.C. Mayor Muriel E. Bowser (D) set to reduce property destruction and violence during the protests. 

The curfew included an exception for people voting because polls closed at 8 p.m., but there were reports about voters and police confused by the exception. 

To diminish the chance of spreading the coronavirus, the city opened only 20 voting centers, compared with the more than 140 polling sites that normally operate during elections, and only allowed 10 people inside at a time. 

Here’s a look at the line in one Northwest Washington neighborhood from Slate staff writer Mark Joseph Stern: 

Those problems could be just a taste of what will happen if officials aren’t prepared for a surge in mail voting in November.

And yet many states are only beginning to prepare for how they’ll run the general election if the novel coronavirus is still making in-person voting difficult or dangerous. That’s particularly perilous for states that are used to just 10 percent of voters or fewer casting ballots by mail. 

Many states that typically require an excuse for people to vote by mail, such as illness or travel, have removed those restrictions for the primaries but not yet for the general election. 

These decisions need to be happening now. It’s a June kind of thing, and July is even pushing it,” Amber McReynolds, a former top election official in Denver and chief executive of the National Vote at Home Institute, told me.

The elections also took place against the backdrop of a partisan clash at the federal level over mail-in voting. 

President Trump has assailed the process, claiming it leads to widespread fraud without providing evidence, despite voting by mail himself in Florida this year. 

Now his campaign is partnering with the Republican National Committee to search for places to launch legal challenges to limit its expansion. The most prominent lawsuit so far is in California, where the RNC and the state Republican Party are challenging an order by Gov. Gavin Newsom (D) that would require counties to send absentee ballots to all voters. 

On the state level, however, Republicans and Democrats have clashed far less about mail-in voting — at least so far. In fact, numerous states with Republican governors or top election officials are in the process of expanding it. 

Attorney General William P. Barr recently upped the ante by claiming foreign countries could produce phony absentee ballots without being detected. 

But current and former election officials say that’s highly improbable, Amy Gardner reports

Colorado elections chief Judd Choate told Amy that there’s “zero chance” that could happen in his state, which votes almost entirely by mail because of a slew of security precautions. 

“It is absolutely not the case that someone could create a multitude of ballots and in some way infuse them or inject them into the system without detection, said Tammy Patrick, a former election official with Maricopa County, Ariz., and currently a senior adviser to the bipartisan foundation Democracy Fund.

There’s also a big question about whether states will have enough money to handle expanded voting by mail. 

Congress appropriated $400 million for elections in its $2 trillion coronavirus stimulus bill, but experts say the real cost of running safe elections during the pandemic could be up to $2 billion

Congressional Democrats have pushed for another $3.6 billion in election funding in a future stimulus bill, but it’s far from clear whether Senate Majority Leader Mitch McConnell (R-Ky.), who’s historically been wary of spending on election security, will agree. 

Those funding difficulties and general confusion could also be a road map for U.S. adversaries looking to interfere in the election or to spread disinformation that undermines confidence in it. 

“The struggles election officials are facing are public. Our enemies know about them, and it sure seems as if it’s going to be another opportunity for them,” said Howard of the Brennan Center.

The keys

China and Huawei are driving a ‘high-tech wedge’ between the United States and the United Kingdom, Sen. Tom Cotton warned Parliament.

The Republican from Arkansas, who’s a longtime Huawei critic, urged the British Parliament’s defense committee to follow the U.S. lead in banning the Chinese telecom giant from all of its next-generation 5G networks. 

Last week, British officials announced that they would review Huawei’s role in 5G after U.S. officials moved to ban the company from accessing sophisticated chip-making technology. Prime Minister Boris Johnson has also asked officials to end China’s involvement in its 5G infrastructure by 2023 a timeline Cotton urged lawmakers to speed up.

Cotton claimed that the United Kingdom using Huawei could give Chinese hackers a window into U.S. military operations in England, Gordon Corera at BBC News reports. The United States has repeatedly raised security concerns that Beijing could use Huawei to eavesdrop on Western intelligence, a claim Huawei has vehemently denied. 

Meanwhile, the U.S. pressure campaign against Huawei is helping the company’s Swedish rival, Ericsson, the Wall Street Journal reports. The company has seen a growing market share, but it still hasn’t caught up with Huawei, the Journal said.

France released its coronavirus contact-tracing app, marking a key test for such systems.

France is one of the few European nations that opted not to use contact-tracing software developed by Apple and Google after clashing with the companies over privacy concerns and their refusal to allow Bluetooth to run in the background. France argued that the companies' approach withheld information governments could use to better track the disease, while Apple and Google argued that access to location data was too invasive.

The French app, called StopCovid, will use Bluetooth technology to alert users if they spend more than 15 minutes within a yard of someone who has been identified as infected, Bloomberg News reports.

It is unclear how many users downloaded the voluntary app on its first day. The Android version of the app currently has more than 1,600 reviews, which isn't necessarily reflective of downloads. Still, the French government argues that even low levels of downloads can help speed up the tracing process and prevent the virus from spreading.

From the first downloads, the app helps avoid contamination, illness and thus deaths,” Digital Minister Cedric O said in an interview on French radio on Monday. Of course, the more people have the app, the better, but there is no threshold to make it efficient.” 

False rumors about antifa organizing protests to loot suburban areas spread on social media and via text messages.

The misinformation went viral in neighborhood groups on Facebook and on the neighborhood-based social media app Nextdoor, as well as in group texts in multiple states, Brandy Zadrozny and Ben Collins at NBC News report. The rumors hit several states, including South Dakota, which held its primary Tuesday. Local law enforcement disputed the rumors. 

The rumors often featured an image of a fake antifa Twitter account created by the white-nationalist group Identity Evropa. They appeared to target white residential areas and rural areas, experts say.

Privacy patch

Google is being sued for up to $5 billion over allegations that it secretly collected user data.

The suit, brought by the law firm Boies Schiller Flexner, alleges that the company collects information, including IP addresses and browsing histories through other Google tools, even after users have turned off data collection on the Chrome browser.

The firm is seeking at least $5,000 in damages per violation of federal wiretapping and California privacy laws. Google maintains that its policies around data collection are clear.

“As we clearly state each time you open a new incognito tab, websites might be able to collect information about your browsing activity, Jose Castaneda, a Google spokesman, told Bloomberg News.

More privacy news:

Your Phone Is a Goldmine of Hidden Data for Cops. Here’s How to Fight Back (Gizmodo)

To Build Its COVID-19 Task Force, Las Vegas Partnered With A Company Linked To UAE Intelligence (BuzzFeed News)

Industry report

The cybersecurity firm CrowdStrike reported an 85 percent jump in revenue.

The spike may have been boosted by companies’ shift to telework during the pandemic, CyberScoop’s Jeff Stone reports

More news from the cybersecurity community:

Hackers and hucksters reinvigorate 'Anonymous' brand amid protests (Reuters)

Chat room

Russia is using clashes between police and protesters for anti-U.S. propaganda. Foreign Policy’s Robbie Gramer:


  • The House Judiciary Committee will host a hearing on protecting the right to vote during the coronavirus pandemic at 10 a.m. today.
  • The RSA Conference will host a webcast on nation-state cyberthreats and the 2020 election on Thursday at 4 p.m.
  • The Brennan Center for Justice and Microsoft’s Defending Democracy Program will host a workshop, “Building Election Resilience,” at noon on Friday.
  • The Senate Judiciary Committee has scheduled a hearing, titled “COVID-19 Fraud: Law Enforcement’s Response to Those Exploiting the Pandemic,” for June 9 at 10 a.m.

Secure log off

D.C. resident Rahul Dubey gave refuge to about 60 protesters inside his home after law enforcement pushed them down his street, firing chemicals at them.

D.C. resident Rahul Dubey gave refuge to around 60 protesters inside his home after law enforcement had pushed them down his street. (Video: The Washington Post, Photo: Bonnie Jo Mount/The Washington Post)