New audit highlights cybersecurity weaknesses in Utah elections

SALT LAKE CITY — A new report highlighted cybersecurity weaknesses in the state’s election system but found that Utah elections are overall secure.

The audit, which was discussed during Wednesday morning’s Government Operations Interim Committee meeting, found several areas of recommendations for county clerks to help strengthen security in Utah elections.

‘There’s a lot more going right with elections in Utah than wrong’

Speaking before the committee, Jake Dinsdale, senior audit supervisor, said Utahns should still be confident in the overall security of elections.

“I want to emphasize upfront here, there’s a lot more going right with elections in Utah than wrong. We’re proud to be part of an effort to strengthen our processes in our system. This is certainly part of that. We’ve released multiple reports, as you all well know, touching on opportunities to improve, and this is just one more in that lineup.”

The audit didn’t find any glaring errors or causes for concern, but did find a few areas where security could be strengthened.

Wireless networking capabilities

One of these dealt with wireless networking capabilities.

According to the audit, the election server in one country was built using an off-the-shelf laptop. That meant the laptop had wireless internet components installed.

This is a common practice, and the computer had been properly configured to prohibit internet connections.

However, the auditors were concerned that the parts were still in the computer, meaning someone could more easily modify it to access the internet, which is expressly prohibited for election equipment.

“As a result of our testing with the experts that we contracted with, we found some concerns … I will say that we are making a recommendation that (the) statute go beyond where it currently is, prohibiting connections. We believe it could strengthen our system to prohibit the capability for connection,” Dinsdale said.

Access to information

Another concern highlighted in the audit report dealt with election workers’ accounts and privileges to access information.

Auditors found that in some cases, users had been granted access to system settings and configuration options that weren’t necessary for their election duties.

The report says that in worst-case scenarios, “a malicious user could use such elevated privileges to make significant modifications to voting systems.”

However, the report does say that additional controls like system logs and security cameras could help prevent those kinds of changes.

Auditors also recommend that elections officials create stronger passwords and update them more often.

‘An objective way for folks to come in and take a look at the guts of the system’

Responding on behalf of Utah’s 29 county clerks, Weber County Clerk and Auditor Ricky Hatch said he and the other county clerks appreciate this kind of audit.

“One reason why we’re so glad to have this audit is because it was an objective way for folks to come in and take a look at the guts of the system, the guts of the process, and that they were people who were trained to do this examination. They were experts to examine in a way that we could trust to dig into the system. So we really appreciate that.”

The entire report is available online for the public. 

Related: Hundreds of new Utah laws took effect this month. Here’s what that means for you

Follow @AndyCMathis