Hackers hit Arizona, Illinois voter databases

SAN FRANCISCO – A suspected Russian hacker probed a voter registration database in Arizona and another unidentified attacker gained entry to one in Illinois this summer, election officials said, prompting the FBI to warn states their election boards should conduct vulnerability scans.

The systems that count votes in elections were not compromised, officials said, and the hacks don't appear to be politically motivated.

Still, the breaches add to concerns such attacks could exploit the personal data of millions of voters for monetary or political gain. Those worries have been running high after July reports that the Democratic National Committee's email system had been hacked, a breach U.S. intelligence officials believe was perpetrated by the Russian government.

“We're all very aware that it’s less than 80 days before an important election,” said Pamela Smith with Verified Voting, a non-partisan, non-profit organization that advocates for election transparency.

Systems taken offline

Election officials in Illinois and Arizona told USA TODAY they took their voter registration databases offline briefly last month as they became aware of attempted breaches to their systems.

Matt Roberts, a spokesman for the Arizona Secretary of State’s Office, said state authorities were notified last month by the FBI of the suspected hack, when it was discovered the username and password of a county election official were being circulated online.

The Arizona system was shut down for several days, Roberts said, but there was no evidence that any information related to the 3.4 million voters in the database was compromised.

Roberts said authorities believe the source of the attempted intrusion was a Russian hacker.

Yahoo News earlier reported on the hacks.

DHS may increase protections for voting systems to thwart hackers

Ken Menzel, general counsel for the Illinois Board of Elections, said a “small percentage’’ of its data was accessed during last month’s attack. He said internal security systems detected the intrusion as the data was being moved, prompting the system shutdown.

Menzel said the system has been under “constant’’ attack since its creation about a decade ago, similar to drivers’ license data.The type of attack was not something that could have helped influence the outcome of an election, he said.

In a FBI cyber division flash alert earlier this month, the agency asked states to contact their Board of Elections and ask if similar attempts had been made elsewhere.

The FBI declined to elaborate on the alert, except to say in a statement that the bureau “routinely advises private industry of various cyber threat indicators observed during the course of our investigations. This data is provided in order to help systems administrators guard against the actions of persistent cyber criminals.’’

Motive unknown

Expert said there's no way to know if the attacks were attempts to compromise the voting system or simply part of the ongoing efforts of hackers worldwide to  harvest information about individuals that can be sold online to criminals looking for identity theft victims.

“The voter registration databases are completely separate from the system that vote counting system, so they wouldn't impact one and other. Counting systems typically are not online, whereas the registration system is designed to be online in many states,” said Verified Voting's Smith.

U.S. intelligence: Hackers tried to spy on 2016 candidates

While the systems are separate, it might be possible, though highly labor intensive, to use the voter names and addresses to interfere with an election, said Princeton's Appel.

Hackers could change voters’ addresses, so their registrations would be invalid or at least confused.

The danger there would be that “on election day people wouldn’t be allowed to vote who should legitimately be allowed to,” he said.

Anyone with concerns about the integrity of their voting registration can check it through their local Board of Elections. It’s also possible to visit Google’s How Do I Vote page to see what options are available in a given state or jurisdiction.

Elizabeth Weise covers technology from San Francisco, and Kevin Johnson covers national law enforcement and the Justice Department from Washington, D.C. Follow them on twitter at @eweise and @bykevinj