Connecticut’s online voter registration system was among election-related systems in 21 states targeted by Russian agents before the 2016 presidential election, state officials learned Friday.
“Today, the federal Department of Homeland Security (DHS) informed my office that Connecticut was one of the 21 states targeted by Russian agents in the lead-up to the 2016 presidential election,” said Secretary of the State Denise Merrill, Connecticut’s top election official, in a statement.
Merrill said the DHS confirmed Russian agents didn’t manage to get past the state’s network security.
Back in June, the Department of Homeland Security said that 21 states had been targeted, but not which states. No vote-counting machines were targeted in these attacks, but a system in at least one state — Illinois — was successfully breached, according to the Associated Press.
“[Last] September, the federal government notified the state’s IT team of activity from a suspicious IP address,” but not that it was linked to Russia, Rosenberg said.
The incident hadn’t garnered a lot of attention. Attempts to profile or penetrate networks are commonplace.
Any large network “is scanned all the time by a million other sources,” Rosenberg said. “They don’t stand out until you get a call from DHS that it’s Russian hackers.”
Rosenberg emphasized that the vote-counting machines were not targeted.
“What they were targeting is basically our public-facing IP — the website, the online voter registration, the voter lookup — not the voting machines or the vote tabulators, which in Connecticut are never online; they are completely air-gapped,” Rosenberg said.
Even a successful breach that let an attacker register people fraudulently online would have had limited impact, thanks to keeping humans in the system, according to Rosenberg.
He said that while online registration makes it easier for voters to submit their registrations, names don’t go from the web form a user fills out straight into the official voter rolls. When a voter registers online rather than in-person, the local registrar’s office would still get “a physical notice” and have to finalize the registration.
“Before they got added, the registrar would have to actually do it. It wouldn’t happen automatically,” Rosenberg said.
Merrill, who has served as president of national group of secretaries of state, said officials in Washington need to take these incidents as a warning.
“This successful defense of the integrity of our online voter registration system is good news for Connecticut, but it underlines the threat posed by foreign agents seeking to disrupt U.S. elections and sow the seeds of doubt in the integrity of our electoral process,” Merrill said. “It is clear that Congress needs to act swiftly, both to investigate and publicize Russian interference in the 2016 presidential election, and to appropriate the necessary funds so that our state and local governments have the resources they need to adequately protect our election infrastructure.”
News of which states were targeted came the same day President Donald J. Trump wrote on Twitter, “The Russia hoax continues, now it’s ads on Facebook. What about the totally biased and dishonest Media coverage in favor of Crooked Hillary?”