'You're it,' Pa. told of Russian election hacking attempt

HARRISBURG — Pennsylvania's top election official said Monday that he believes Russian hackers were targeting the state's voter registration data before last year's presidential election, an action which, if successful, could have enabled them to cause chaos at the polls.

Secretary of State Pedro Cortes said that based on limited information last week from the U.S. Department of Homeland Security, the hackers tried to "scan" the state's election computer system to see whether there was a way into it. He said voting machines were not a likely target because they are not connected to the internet and are not "penetrable."

The state was not told when precisely the attempts were made, or how many times the hackers probed the system for points of access, but federal officials told Cortes they had no evidence of a breach. In theory, altering registration information could sow confusion among voters and election officials, potentially depressing the number of ballots cast.

"We were told, 'You're it;' Russia tried to scan our system looking for vulnerabilities; there was no evidence of intrusion," Cortes said in an interview with the Inquirer and Daily News and the Pittsburgh Post-Gazette. He said the telephone briefing lasted from three to four minutes.

During last week's call, Pennsylvania was told it was one of 21 states targeted by Russians. The disclosure came as a special counsel is probing whether there was any coordination between Russia and associates of President Trump during the 2016 presidential election.

It was not clear why federal authorities, who have known about the attempted hacks for months, waited so long to share the information with individual states.

Cortes said that the news came as a surprise to Pennsylvania, and that federal officials did not give any guidance on whether additional safety measures were needed. As it learns more, the state will decide on what steps to take to reinforce security in its election systems, he said.

J.J. Abbott, spokesman for Gov. Wolf, said that to his knowledge no one from the federal government had previously contacted state officials about the problem, and no one working for the commonwealth had independently stumbled upon evidence of Russian hacking.

Though Cortes appeared confident there was no data breach, he acknowledged that he could not say with certainty that there was none.

Hacking attempts are more common than people think, Cortes said. Indeed, state officials believe that in 2016 there were some 90 billion attempts to probe computer systems across all departments and agencies.

Finding evidence of an attack by another nation can be extremely difficult, in part because their hackers often are persistent and might break into a system months or years in advance of their actual goal, said Dan Wallach, a professor at Rice University in Texas who has examined voting systems.

"It's exceptionally difficult to prove a negative," he said. "The apt hacker people who know what they're doing make it their business not to be seen."

Wallach also said that assuming voting equipment wasn't targeted solely because it's not connected to the internet could be a dangerous mistake. Experts say the code that controls voting machines could be poorly written or manipulated by wrongdoers with tech skills, for example.

"It's just a bogus argument," Wallach said. "You might as well argue the Earth is flat."