Iranian hackers broke into to a system used by a U.S. municipal government to publish election results in 2020 but were discovered by cyber soldiers operating abroad and kicked out before an attack could be launched, according to U.S. military and cybersecurity officials.
The system involved in the previously undisclosed breach was not for casting or counting ballots, but rather was used to report unofficial election results on a public website. The breach was revealed during a presentation this week at the RSA Conference in San Francisco, which is focused on cybersecurity. Officials did not identify the local government that was targeted.
“This was not a system used in the conduct of the election, but we are of course also concerned with systems that could weigh on the perception of a potential compromise,” said Eric Goldstein, who leads the cybersecurity division at the U.S. Cybersecurity and Infrastructure Security Agency.
If not expelled from the site, the hackers could have altered or otherwise disrupted the public-facing results page — though without affecting ballot-counting.
“Our concern is always that some type of website defacement, some type of (denial of service) attack, something that took the website down or defaced the website say on the night of the election, could make it look like the vote had been tampered with when that’s absolutely not true,” Major Gen. William J. Hartman, commander of U.S. Cyber Command’s Cyber National Mission Force, told conference attendees Monday.
Hartman said his team identified the intrusion as part of what he termed a “hunt-forward” mission, which gathers intelligence on and surveils adversaries and criminals. The team quickly alerted officials at the U.S. cybersecurity agency, who then worked with the municipality to respond to the intrusion.
Hartman said his team then acted “to ensure the malicious cyber actor no longer had access to the network and was unable to come back into the network in direct support of the elections.”
No details were released on how or from what country the Iranian intrusion was detected.
Its successful thwarting highlights the stealthy, largely classified, efforts of U.S. military cyberwarriors to prevent a repeat of 2016, when a Russian hack-and-leak operation targeting Hillary Clinton’s campaign favored former President Donald Trump’s election.
Asked in a recent interview about his accomplishments since he was promoted to U.S. Cybercom and National Security Agency chief in 2018, Gen. Paul Nakasone pointed to election security.
“We said if you are going to come and try to influence or interfere in our elections, we’re going to take you on, and we did,” he said.
Election and national security officials have been increasingly focused on cybersecurity threats since the 2016 election. Locally, they have been trying to heighten protections for voting machines, vote tabulators, voter registration databases and electronic pollbooks, which are used to check in voters at polling locations.
Some of the non-voting systems present security challenges because they have internet connections. As the use of electronic systems has grown, they have proved an attractive target for those seeking to meddle in elections.
In 2016, Russian hackers scanned state voter registration systems looking for vulnerabilities and accessed the voter registration database in Illinois, although an investigation later determined no voter data was manipulated. In 2020, Iranian hackers obtained confidential voter data and used it to send misleading emails, seeking to spread misinformation and influence the election.
Beginning in 2018, the National Defense Authorization Act let the U.S. “take down infrastructure” and “take on adversaries” outside the country, Nakasone said. So by 2020, when Russian and Iranian actors attempted to interfere with the U.S. election, U.S. cyber operators were able to thwart them, he added.
Under Nakasone, Cybercom has sent small teams to 22 countries to help hunt on their networks — “to identify malware, tradecraft, techniques that adversaries are using and then broadly publicize that,” he said. That includes Ukraine, where he said a team arrived on Dec. 3, 2021, more than two months ahead of the Russian invasion.
In a March statement ahead of a congressional hearing, Nakasone said Cybercom had deployed its teams 40 times to work on 59 networks, generating insights and “imposing costs on common adversaries.” He said the missions “exposed malicious cyber activity by China, Russia, Iran and cyber criminals,” helped make other nation’s networks more secure and “led to the public release of more than 90 malware samples for analysis by the cybersecurity community.”
