Threats remain to US voting system – and voters’ perceptions of reality

Richard Forno, University of Maryland, Baltimore County

As the 2018 midterms proceed, there are still significant risks to the integrity of the voting system – and information warfare continues to try to influence the American public’s choices when they cast their ballots.

On the day of the election, there were a number of early hitches in voting at individual polling places, such as polling places opening late and vote-counting machines not plugged in. But there seem not – at least not yet – to be major problems across the country.

However, not all the election-related news and information voters have been encountering in recent days and weeks is accurate, and some of it is deliberately misleading. As this election’s results come back, they will reveal whether the misinformation and propaganda campaigns conducted alongside the political ones were effective.

Securing election systems

America’s electoral process remains highly fragmented, because of the country’s cherished tradition of decentralized government and local control. While this may leave some individual communities’ voting equipment potentially vulnerable to attack, the nation’s voting process overall may be more trustworthy as a result of this fragmentation. With no unified government agency or office to provide, administer and protect election technologies, there’s not one central national element that could fail or be attacked.

Across the country, though, many districts’ voters will cast ballots with the help of machines that have long-standing security concerns. Fortunately, 45 states keep a paper record of each vote cast – whether for fear of threats to voting integrity or just budget constraints preventing purchase of newer gear. But that means five states – Louisiana, Georgia, South Carolina, New Jersey and Delaware – don’t keep paper records of their voters’ choices.

Voting machine vendors have been reluctant to appear before Congress to explain their systems’ security practices – and shortcomings. However, federal agencies have helped some states reduce the likelihood of voting machines being hacked or physically tampered with.

Beyond voting machines

Election security is about much more than voting machines and vote-counting systems, though they are the most visible technologies at work on Election Day. State systems that track voter registrations, or allow users to register online, are enticing targets for hackers, too. Security firm Carbon Black reported that 81 million voter records from 20 states are available in online forums. This data, obtained by hacking various official and corporate databases, could be used to facilitate voter fraud or sow confusion at polling places on Election Day: How would you feel if you were told that someone using your name and address had already voted?

There are security concerns even in states like Oregon, where everyone votes on paper and mails in their ballots in advance of Election Day. That state’s election officials were targeted by hackers seeking to gain access to state email and database systems. With that access, attackers might be able to digitally impersonate a government official to send false or confusing emails, press releases or other notifications to citizens, journalists or poll workers.

Also at risk are public-facing official websites that carry election information. Merely changing the reported location of polling places or voting hours could prevent some people from voting. Also vulnerable are states’ methods of announcing preliminary election results. At a major internet security conference in August, children were able to compromise replicas of several states’ election-reporting systems. The most remarkable was that in just 10 minutes, an 11-year-old boy cracked the security on a copy of the Florida secretary of state’s website and was able to change the publicly announced vote totals for candidates. That could be enough to cast doubt on whatever was later reported as the official results – and the integrity of the system itself.

Managing information on social media

A more difficult threat to defend against is information warfare, which doesn’t attack voting machines or election officials’ computers. Rather, it targets voters’ perceptions and decisions, seeking to influence how they vote.

Long before the 2016 U.S. presidential election, information warfare was influencing elections around the world, including in Ukraine, Myanmar and Egypt. But after 2016, Facebook and Twitter came under intense scrutiny for their role in providing digital environments that facilitated the spread of misinformation to sow discontent, and special counsel Robert Mueller began investigating Russians’ influence efforts.

In the run-up to the 2018 midterms, Russians and others were still hard at work trying to influence Americans to vote in ways that help foreign interests. In October, the U.S. Department of Justice charged a Russian woman with creating thousands of fake social media accounts allegedly representing American citizens to “create and amplify divisive social media and political content” before the election.

This year, though, unlike two years ago, social media companies are taking action. Twitter and Facebook have both deleted thousands of accounts they identified as engaging in propaganda and influence-peddling. And they have made other efforts to identify and fight falsehoods on their platforms, too.

Nevertheless, online misinformation continues to thrive. More than 80 percent of the Twitter accounts that often shared links to false and misleading information in 2016 are still active today. And the amount of online misinformation is higher than it was two years ago.

Investigating alleged wrongdoing

U.S. intelligence and police agencies are concerned about the potential effects of misinformation on the American electorate. But large proportions of the country don’t trust those organizations to be politically independent. It doesn’t help that the White House continues to claim, without evidence, that voter fraud is a significant problem.

Mainstream news organizations can find themselves under scrutiny too, either for reporting falsehoods that appear to gain traction online or for failing to filter out or properly identify inaccurate information for their readers.

Looking ahead

Protecting democracy is a huge challenge. I’ve written before that it involves more than technical solutions to computer problems. The U.S. government, and the people it serves, must find the desire and the drive to establish secure and trustworthy procedures for running elections across the country. Education is also key, teaching people from an early age how to recognize propaganda and misinformation, and think critically about the information they encounter. Facts are not subject to alternative views; without widespread agreement on common objective realities, society and government cannot function well.

Technology continues to evolve, presenting challenges to individuals and society alike. Emerging “deepfake” technology is already helping create convincing videos of people appearing to say and do things they never said or did. In addition, intelligent social media bots are becoming more human-like, making identifying and blocking them much more difficult. That’s just some of the challenges that democracies will face in the future.

Many of these problems will not have a clearly defined fix, because they involve a nuanced balancing of individual rights and social necessities. Real and lasting solutions must come from civil discourse by rational and objectively informed people who have, above all, the actual honest desire to do it right.Richard Forno, Senior Lecturer, Cybersecurity & Internet Researcher, University of Maryland, Baltimore County

This article is republished from The Conversation under a Creative Commons license. Read the original article.

The post Richard Forno: Threats remain to US voting system – and voters’ perceptions of reality appeared first on Department of Computer Science and Electrical Engineering.

The UMBC Cyber Defense Lab presents

Legal Aspects of Privacy and Data Protection

Razvan Miutescu
Privacy Counsel, Whiteford, Taylor & Preston

12:00–1:00pm Friday, 9 November 2018, ITE 227, UMBC

Privacy and data security continue to be topics of interest for organizations of all sizes. In addition to being concerned about cyber crimes and data breaches occurring more frequently and with higher operational impact, consumers and regulators around the world are focusing on privacy. Individuals are becoming increasingly aware of the value and the use of the information that identifies them or analyzes their conduct and behavior. Privacy laws around the world are becoming stricter. The European Union’s General Data Protection Regulation (GDPR) is viewed as a flagship law that imposes data protection requirements well beyond the borders of the European Economic Area. California recently passed its Consumer Privacy Act, which borrows concepts from the GDPR, leaving no doubt that privacy laws in the United States are also on track to become more complex. In this context, we will discuss practical legal approaches to an organization’s privacy and data security program.

Razvan Miutescu is a technology and information governance attorney with Whiteford, Taylor & Preston. His practice focuses on privacy and data security, information technology transactions and licensing, intellectual property, and data management, including data broker transactions, cloud services, distributed ledgers/blockchain, and related regulatory and compliance matters. Email: *protected email*

Host: Alan T. Sherman, *protected email*

The UMBC Cyber Defense Lab meets biweekly Fridays. All meetings are open to the public.

The post talk: Legal Aspects of Privacy and Data Protection, 12-1 Fri 11/9 appeared first on Department of Computer Science and Electrical Engineering.

Professional Graduate Programs Open House, Sat. 10/20

The Fall Open House for UMBC’s Professional Programs (Main Campus offerings) takes place on Saturday, October 20 in the first floor of PAHB from 9:30-11:30am. Students interested in exploring and/or pursuing these graduate programs (degrees and/or certificates) or just want to learn more about these fields are encouraged to register and attend. CSEE students interested in pursuing a BS/MPS option for selected programs (such as CYBR or Data Science) are especially welcome.

Programs represented include

• • Cybersecurity
  • Data Science
  • Health Information Technology
  • Engineering Management
  • Systems Engineering
  • Instructional Systems Development
  • Integrated Product Development & Manufacturing
  • Technical Management

Faculty program directors will be presenting in individual breakout sessions and relevant support staff will be on-hand to provide administrative overviews, answer questions, and mingle. Refreshments will be provided.

If you are interested, please RSVP at https://openhouse.umbc.edu/. If you have questions contact: *protected email*

The post Professional Graduate Programs Open House, Sat. 10/20 (CYBR, DATA, …) appeared first on Department of Computer Science and Electrical Engineering.

Busy teams of students clustered around laptops in a room overlooking Baltimore’s Inner Harbor on Tuesday, focused on solving as many challenges as possible during a “capture-the-flag” style competition. After hours of intense competition in cyberspace, UMBC’s team emerged victorious, named champions of the college division of the 2018 Maryland Cyber Challenge.

Started in 2011, the competition is part of the annual CyberMaryland Conference. UMBC’s team included Niara Richards ‘22, computer science; Nithya Prakash ‘22, information systems; Josh Mpere ‘19, computer science; Seamus Burke ‘20 computer science; and Swathi Krithivasan ‘22, computer science. They worked together to test their skills in a series of real-world cybersecurity challenges over the course of two virtual qualifying rounds and then the final competition, beating talented teams from the U.S. Air Force Academy and University of Maryland, University College.

“It was my first time competing in the Maryland Cyber Challenge, although I have a pretty extensive competition background,” said Burke. “I am especially proud of my freshman teammates who put in a ton of effort, solved challenges, and didn’t get discouraged when the challenges got more difficult.”

Burke is a Center for Women in Technology (CWIT) Scholar and Mpere is a Cyber affiliate. Richards, Prakash, and Krithivasan all participate in UMBC’s Cyber Scholars Program, which works to prepare the next generation of cybersecurity professionals.

All five members of the winning team will receive a monetary award and an offer to complete a summer internship to continue growing their experience and skills. Additionally, the university will receive new technologies (including software) to support more UMBC students in developing their cybersecurity skills.

“The competition was a fantastic experience and gave me a lot of exposure into topics that I otherwise would not have gained, especially as a freshman,” said Krithivasan. “We had a mix of both upper and underclassmen on our team, which really enabled us to learn and grow from working with each other.”

Adapted from a UMBC News article by Megan Hanks. Banner image: Nithya Prakash, Swathi Krithivasan, and Josh Mpere being recognized at the award ceremony. Photo by Mike Lackner, computer science and informatics, and technology instructor at Loyola Blakefield High School.

The post UMBC students win top prize at Maryland Cyber Challenge appeared first on Department of Computer Science and Electrical Engineering.

The UMBC Cyber Defense Lab presents

Results from the January 2018 SFS Research Study at UMBC

Enis Golaszewski, CSEE, UMBC

12:00-1:00pm Friday, 12 October 2018, ITE 227

January 22-26, 2018, UMBC SFS scholars worked collaboratively to analyze the security of a targeted aspect of the UMBC computer system. The focus of this year’s study was the WebAdmin module that enables users to perform various functions on their accounts, including changing the password. Students identified vulnerabilities involving failure to sanitize user input properly and suggested mitigations. Participants comprised BS, MS, MPS, and PhD students studying computer science, computer engineering, information systems, and cybersecurity, including SFS scholars who transferred from Montgomery College (MC) and Prince George’s Community College (PGCC) to complete their four-year degrees at UMBC. We hope that other universities can benefit from our motivational and educational strategy of cooperating with the university’s IT staff to engage students in active project-based learning centering on focused questions about the university computer system.

Enis Golaszewski is a PhD student and SFS scholar in computer science working with Dr. Sherman on blockchain, protocol analysis, and the security of software-defined networks.

This project was supported in part by the National Science Foundation under SFS grant 1241576.

Host: Alan T. Sherman, *protected email*

The UMBC Cyber Defense Lab meets biweekly Fridays. All meetings are open to the public.

The post talk: Results of a student study of UMBC computer systems security appeared first on Department of Computer Science and Electrical Engineering.

MD-AI Meetup holds 1st event at UMBC
6-8pm Wed 10/3, 7th floor library

A new Maryland-based meetup interest group has been established for Artificial Intelligence (MD-AI Meetup) and will have its first meeting at UMBC this coming Wednesday (Oct 3) from 6:00-8:00pm in the 7th floor of the library.  The first meeting will feature a talk by UMCP Professor Phil Resnik on the state of NLP and an AI research agenda.  Refreshments will be provided.  The meetup is organized by Seth Grimes and supported by TEDCO, local AI startup RedShred, and the Maryland Tech Council.

If you are interested in attending this and possibly future meetings (which will probably be monthly), go to the Meetup site and join (it’s free) and RSVP to attend this meeting (if there’s still room).  If you join the meetup and RSVP, you can see who’s registered to attend.

These meetups are good opportunities to meet and network with people in the area who share interests. It’s a great opportunity for students who are will be looking for internships or jobs in the coming year.

The post MD-AI Meetup holds 1st event at UMBC 6-8pm Wed 10/3, 7th floor library appeared first on Department of Computer Science and Electrical Engineering.

The UMBC Cyber Defense Lab

Machine Learning and Artificial Intelligence: A Technical Chat with the Defense Information Systems Agency

James Curry
Lead Engineer–DoD Cyber Security Range
Defense Information Systems Agency (DISA)

12:00–1:00pm Friday, 28 September 2018, ITE 227, UMBC

A broad reaching brief on the scope and scale of the DISA Mission, followed by a dive into DISA’s efforts to develop Machine Learning and Artificial Intelligence to help defend the nation’s cyber infrastructure. Attendees are highly encouraged to ask questions.

James Curry is the Lead Engineer of the DoD Cyber Security Range (CSR). The CSR’s mission is to replicate the DoD Information Network (DODIN) environment at lab scale, while maintaining high-fidelity realism. As Lead Engineer, Mr. Curry led the design, acquisition, and implementation of two first-of-its-kind technologies: a Virtual Internet Access Point (vIAP) and a Virtual Joint Regional Security Stack (vJRSS). These technologies enable the DoD Workforce to train in an IaaS-on-demand environment that realistically matches DISA’s core infrastructure. Mr. Curry is a Scholarship for Service (SFS) recipient (2008-2009) and received his masters and bachelors of science in computer science from New Mexico Tech. Email: *protected email*

Host: Alan T. Sherman, *protected email*

The UMBC Cyber Defense Lab meets biweekly Fridays. All meetings are open to the public. Upcoming meetings for Fall 2018 include the following.

• Oct 12 Enis Golaszewski, The 2018 UMBC SFS study
• Oct 26 Enis Golaszewski, Using tools in the formal analysis of cryptographic protocols
• Nov 9 Razvan Mintesu, Legal aspects privacy
• Dec 7 Tim Finin, A knowledge graph for cyber threat intelligence

The post Machine learning and AI for cybersecurity: a technical chat with DISA appeared first on Department of Computer Science and Electrical Engineering.

Get hands-on cybersecurity and blockchain skills in NSA’s Codebreaker Challenge

NSA’s sixth annual Codebreaker Challenge is a hands-on, cybersecurity engineering challenge in which students work to complete mission-focused objectives and push their university to the top of the competition leaderboard.

The 2018 scenario involves ransomware and blockchain. A new strain of ransomware has managed to penetrate several critical government networks and NSA has been called upon to assist in remediating the infection to prevent massive data losses. For each infected machine, an encrypted copy of the key needed to decrypt the ransomed files has been stored in a smart contract on the Ethereum blockchain and is set to only be unlocked upon receipt of the ransom payment. Your mission is to ultimately (1) find a way to unlock the ransomware without giving in to the attacker’s demands and (2) figure out a way to recover all of the funds already paid by other victims. Are YOU up to the challenge?

UMBC students did well, both individually and as a group, in previous challenges.  Let’s make it to the top of the leaderboard this year.

• The challenge is hosted at https://codebreaker.Ltsnet.net
• The challenge end on December 31st
• Students register for the challenge at2017 Codebreaker Challenge using their umbc.edu email addresses
• The challenge website has nine lectures on reverse engineering, so students with little coding or cybersecurity experience can participate

Feedback from previous iterations of the challenge showed that students were able to learn a great deal from participating. Each student receives a slightly different set of challenge binaries and associated files, so that one student’s solution won’t work for someone else. The binaries are similar enough so that students can work together to understand the problems and develop approaches to solutions and hen implement them independently and register their results.

The 2018 challenge consists of a series of tasks that are worth a varying amount of points based upon their difficulty. In previous years, tasks had to be solved in order to unlock the next task and rankings were based upon the quantity of solvers that progressed the furthest from each school. This way of ranking heavily weighted progression above participation and did not allow for skipping ahead if a particular task became a stumbling block. So to address these issues, all tasks will be available immediately upon registration and can be solved in any order. The point value associated with each task is based on relative difficulty and schools will be ranked according to total number of points accumulated by their students. It is still recommended to solve tasks in order since the tasks flow with the storyline, but that is no longer a requirement.

The post Learn cybersecurity skills in NSA’s Codebreaker Challenge appeared first on Department of Computer Science and Electrical Engineering.

The UMBC Cyber Defense Lab

Phishing in an Academic Community:
a Study of User Susceptibility and Behavior

Alejandra Diaz
University of Maryland, Baltimore County

12:00–1:00pm, Friday, 14 September 2018, ITE 227

(joint work with Alan T. Sherman Anupam Joshi)

We present an observational study on the relationship between demographic factors and phishing susceptibility at the University of Maryland, Baltimore County (UMBC). From March through May 2018, we performed three experiments that delivered phishing attacks to 450 randomly-selected students on three different days (1,350 students total) to examine user click rates and demographics within UMBC’s undergraduate student population. The participants were initially unaware of the study. We deployed the Billing Problem, Contest Winner, and Expiration Date phishing tactics. Experiment 1 impersonated banking authorities; Experiment 2 enticed users with monetary rewards; and Experiment 3 threatened users with account cancellation.

We found correlations resulting in lowered susceptibility based on college affiliation, academic year progression, cyber training, involvement in cyber clubs or cyber scholarship programs, amount of time spent on the computer, and age demographics. We found no significant correlation between gender and susceptibility. Contrary to our expectations, we observed an inverse correlation between phishing awareness and student resistance to clicking a phishing link. Students who identified themselves as understanding the definition of phishing had a higher susceptibility rate than did their peers who were merely aware of phishing attacks, with both groups of students having a higher susceptibility rate than those with no knowledge whatsoever. Overall, approximately 70% of the students who opened a phishing email clicked on it.

Alejandra Diaz (*protected email*) is a cyber software engineer at Northrop Grumman. She earned her BS in computer science from UMBC with a concentration in cybersecurity in May 2017, and her MS in computer science in August 2018. As a Cyber Scholar and a Society of Women Studying Information Security Scholar, she has a special interest in the human aspects of cybersecurity.

Host: Alan T. Sherman, *protected email*

Support for this research was provided in part by the National Science Foundation under SFS grant 1241576, the U.S. Department of Defense under CAE grant H988230-17-1-0349, and IBM.

The post talk: Phishing in an Academic Community, a Study of User Susceptibility and Behavior appeared first on Department of Computer Science and Electrical Engineering.

NSA highlights strong partnership with UMBC in Featured School campaign

Over the past two decades, UMBC and the National Security Agency (NSA) have developed a strong relationship, which has led to research, internship, and career opportunities for faculty, students, and alumni. UMBC is the first institution to be highlighted in NSA’s Featured School Series, which launched on September 4.

“UMBC’s long-standing partnership with NSA has provided valuable experiences for our students, faculty, and alumni to pursue internships, careers, and collaborative research opportunities,” said President Freeman Hrabowski. “Through this work we are helping to address the need for well-trained cyber professionals by creating a network of talented people to protect the state, nation, and world.”

More than 1100 NSA employees are UMBC alumni, including Darniet Jennings ‘98, M.S. ‘99, Ph.D. ‘03, information systems management. Jennings continued his dissertation research when he took a job at NSA, where he developed a system to manage big data effectively, which was patented in 2010.

The opportunities at NSA include careers in a broad range of disciplines including cybersecurity, engineering, computer science, language, and biological and chemical sciences. Regina Hambleton ‘87, mathematics, has held a number of positions at NSA and is currently the Agency’s deputy director of Engagement and Policy. She began working at NSA while she was a student at UMBC, and participated in a program that allowed her to spend a semester at UMBC taking courses followed by a semester working at NSA.

The partnership between NSA and UMBC also helps prepare an increasing number of graduates for careers in cybersecurity-related fields, to protect the nation from cyber threats.

Charles Nicholas, professor of computer science and electrical engineering, is also highlighted in the Featured School Series campaign. He has spent two sabbaticals at NSA during his time at UMBC, and has mentored students who completed NSA internships, in addition to students who went on to pursue careers at NSA. Nicholas is interested in the intersection of cybersecurity and data science, and the tools that are used to compare malware specimens.

“There are so many opportunities in the intelligence community, including at NSA,” Nicholas says. “It is important for students interested in those careers to develop technical ability, as well as critical and creative thinking, and I enjoy the chance to help them grow those skills.”

For more information about the partnership, and a few UMBC alumni who work at NSA, visit the UMBC page on the NSA website.

Adapted from a UMBC News article by Megan Hanks. Banner image by Marlayna Demond for UMBC.

The post NSA highlights strong partnership with UMBC through Featured School campaign appeared first on Department of Computer Science and Electrical Engineering.