A Department of Homeland Security official on Wednesday compared the behavior of Kremlin-linked hackers seeking to disrupt the 2016 election to that of burglars casing a neighborhood, with a few “rattled” doorknobs and a few successful entries.
DHS officials told the Senate Intelligence committee that the hackers potentially targeted 21 state election-related systems, but that the systems were not used in vote tallying.
“As of right now, we have evidence of election-related systems in 21 states that were targeted,” Jeanette Manfra, DHS acting deputy undersecretary for cybersecurity, told the Senate Intelligence Committee.
Samuel Liles, acting director of the cyber division within the office of intelligence and analysis at DHS, said the “vast majority” of this activity seemed to be hackers “scanning for vulnerabilities.”
“Analogous to somebody walking down the street and looking to see if you are home,” Liles said. The largest chunk of states experienced only this “preparatory activity,” according to written testimony.
“A small number of the networks were unsuccessfully exploited, as though somebody had rattled the doorknob but was unable to get in,” Liles said. “A small number of the networks were successfully exploited, they made it through the door.”
Officials have resisted disclosing the quantity and names of states that were targeted. Arizona and Illinois have confirmed that their systems were among those breached.
Manfra and Liles confirmed independently that no votes in the 2016 election were changed.
Across the Capitol, Obama DHS secretary Jeh Johnson told lawmakers on the House Intelligence Committee that Russian meddling in the 2016 election was “unprecedented” in scope and scale, but reiterated that the Kremlin did not successfully change ballots or reporting of 2016 election results.
“To my current knowledge, the Russian government did not through any cyber intrusion alter ballots, ballot counts or reporting of election results,” Johnson told lawmakers in prepared testimony.
Johnson said that officials discovered “scanning and probing” of state voter registration databases, which could serve as a “preamble” for a cyber intrusion, in August. He compared “scanning” to “looking into a locked box to see what’s inside.”
“As fall progressed, we saw a progression of scanning and probing activities around voter registration databases,” he said. The former DHS secretary could not confirm a report that 39 states were affected by Russian intrusions, a count much higher than previously realized.
Johnson in written testimony could not say whether the Kremlin swayed the election through cyber espionage. But he told lawmakers that the intelligence showed, “perhaps beyond a reasonable doubt,” that the Kremlin was behind the DNC hacks.
“I am not in a position to know whether the successful Russian government-directed hacks of the DNC and elsewhere did in fact alter public opinion and thereby alter the outcome of the presidential election,” Johnson said in prepared testimony.
The intelligence community concluded in January that Russian president Vladimir Putin ordered a “multi-faceted” campaign to “undermine public faith in the US democratic process.” The effort included the DNC hack and ensuing leaks, cyber intrusions into electoral boards, and propaganda.
