COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
- 2. (U) Cyber Activity in State 4
(U ) State 4 officials, DHS, and FBI in the spring and summer of 2016, struggled to understand who was responsible for two rounds of cyber activity related to election infrastructure. Eventually, one set of cyber activity was attributed to Russia and one was not.
(U ) First, in April of 2016, a cyber actor successfully targeted State 4 with a phishing scam. After a county employee opened an infected email attachment, the cyber actor stole credentials, which were later posted online.[1] Those stolen credentials were used in June 2016 to penetrate State 4's voter registration database.[2] A CTIIC product reported the incident as follows: "An unknown actor viewed a statewide voter registration database after obtaining a state employee's credentials through phishing and keystroke logging malware, according to a private-sector DHS partner claiming secondhand access. The actor used the credentials to access the database and was in a position to modify county, but not statewide, data."[3]
(U ) DHS analysis of forensic data provided by a private sector partner discovered malware on the system, and State 4 shut down the voter registration system for about eight days to contain the attack.[4] State 4 officials later told the Committee that that while the cyber actor was able to successfully log in to a workstation connected to election related infrastructure, additional credentials would have been needed for the cyber actor to access the voter registration database on that system.[5]
(U) At first, FBI told State 4 officials that the attack may have originated from Russia, but the ties to the Russian government were unclear. "The Bureau described the threat as 'credible' and significant, a spokesman for State 4 Secretary of State said."[6] State 4 officials also told press that the hacker had used a server In Russia, but that the FBI could not confirm the
- ↑ (U)
- ↑ (U) SSCI interview with DHS and CTIIC, February 27, 2018, p. 38.
- ↑ Cyber Threat intelligence Integration Center (CTIIC), Compromised State Election Networks, November 2, 2016, p. 1.
- ↑ (U ) DHS IIR 4 005 0829 16, A U.S. State Government's Election System Targeted by Malicious Activity, September 9, 2016; Memorandum for the Record, SSCI Staff, Conference Call with [State 4], December 1, 2017.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [Slate 4], December 1, 2017.
- ↑ (U)
34
COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
