CARVER Vuln Analysis & US Voting System

CARVER Vuln Analysis & US Voting System

Speakers: Mike Moore, CISO, Arizona Secretary of State; Nate Young, CISO, Maricopa County Elections Department; Will Baggett, Hacker

Conference: Voting Village

YouTube: https://www.youtube.com/watch?v=rqMNllTo6wc

Overview

This talk, presented at Defcon's Voting Village, delves into a comprehensive vulnerability analysis of the United States voting system using the CARVER framework. Delivered by Mike Moore, Nate Young, and Will Baggett, the session applies a structured approach, originally developed for military intelligence, to identify critical weaknesses in election infrastructure and processes. The speakers, all deeply involved in election security, aim to highlight the most impactful areas for both offensive exploitation and defensive investment. This analysis is crucial because it moves beyond traditional technical vulnerabilities to encompass logistical, physical, and, most importantly, reputational threats, underscoring the complex, multi-faceted nature of safeguarding democratic processes. The talk ultimately reveals that despite robust technical and physical defenses, public trust and system credibility stand as the most vulnerable and critical components of the entire election ecosystem.

The conversation is particularly relevant in an era marked by escalating cyber threats, misinformation campaigns, and increased scrutiny of election integrity. By systematically evaluating various components—from voting machines and cyber support systems to audits, logistics, and public perception—the speakers provide a pragmatic roadmap for defenders. They stress the importance of understanding an adversary's potential targets and prioritizing limited resources to protect the "crown jewels" of election administration. The CARVER framework offers a standardized method for assessing Criticality, Accessibility, Recoverability, Vulnerability, Effect, and Recognizability, enabling election officials to identify weaknesses that could lead to significant disruption or erosion of public confidence, thereby impacting the very foundation of democracy.

Background

▶ Watch: Introduction to CARVER analysis of US voting system (0:00)

The CARVER analytical system originated during World War II, developed by the US Office of Strategic Services (OSS), the predecessor to the CIA. Its initial purpose was to assist the French resistance in identifying and assessing Nazi targets in occupied territories. Instead of large-scale, brute-force attacks, CARVER enabled the resistance to pinpoint critical vulnerabilities that, if exploited, would yield maximum effect with minimal resources and footprint. A classic example cited is targeting a single, undefended bridge 13 miles away that supplies a heavily defended ball bearing plant, rather than bombing the factory itself. This approach prioritizes strategic impact over direct confrontation.

Over the years, CARVER has evolved from a tool for offensive targeting into a versatile framework for both offensive red-teaming and defensive vulnerability assessment. Its acronym defines its core components:

• Criticality: How important is the target to the overall function of the system?
• Accessibility: How easy is it to reach and interact with the target?
• Recoverability: What effort is required for the adversary to rebuild or restore the target if it's taken out?
• Vulnerability: How easy is it to exploit a weakness in the target?
• Effect: What would be the overall impact if the target were compromised or destroyed?
• Recognizability: Would the adversary recognize this as a key functional target?

The speakers illustrate CARVER's application with several examples. A past banking software bug, where clicking "debit" and "credit" on the same field caused a system-wide lockup, demonstrates a high-criticality, high-vulnerability point known to insiders. The 2015 OPM database breach, where sensitive clearance records were outsourced and compromised, highlights how seemingly cost-cutting measures can lead to catastrophic data loss and a need to revet thousands of cleared personnel. Another compelling example is the Conti ransomware group in 2022. A disgruntled Ukrainian insider leaked Conti's entire operational playbook, including source code, C2 infrastructure, compromised email lists, and specific CVEs for target companies. This single act, leveraging a high-criticality vulnerability (the source code and core designers), effectively dismantled a group generating $180 million annually. In the context of the US voting system, the problem exists due to its distributed, complex nature, political sensitivity, and the inherent need for public trust, making it a prime target for various adversaries, from nation-states to domestic actors.

Key Findings

▶ Watch: Breaking down the CARVER acronym and its components (2:20)

The central, overarching finding of the CARVER analysis presented is that public trust and the reputation of the voting system itself constitute the highest-ranked vulnerability. While technical and physical security measures are critical and continually being enhanced, the perceived integrity of the election process is paramount. If voters lose confidence, regardless of the factual accuracy or security, the entire system's legitimacy collapses, leading to voter depression and undermining democracy.

The speakers applied the CARVER framework to several consolidated categories within the US voting system:

1. Voting (Voter Registration, Early Voting, Election Day Voting):

• Criticality: Very High. The credibility of elections is foundational; without it, the entire system collapses.
• Accessibility: Multi-factored. Tabulation systems are highly regulated, secure, and under surveillance. Polling locations, often in public venues like churches or libraries, are inherently less secure.
• Recoverability: Semi-Low (for Maricopa County). Due to multi-layer security, checks and balances, and various options (e.g., if the internet dies or a tabulation building burns down), there are robust recovery mechanisms.
• Vulnerability: Semi-Low (for tabulation). Requires physical access to secure buildings for nefarious acts without detection.
• Effect: High. Any incident, no matter how minor, becomes headline news, causing significant public problems.
• Recognizability: Very High. Maricopa County, in particular, has been a focus of intense media scrutiny and various audits, making it a highly recognizable target.

2. Cyber Elements (Tabulators, E-poll Books, Support Systems like Websites/Email):

• Criticality: Varies. Core election equipment is critical. A website going down might not be the "end of the world," but a defaced website on Election Day can severely erode confidence.
• Accessibility: Depends. Core tabulation equipment is air-gapped and requires in-person access, making insider threat a primary concern. Websites, by nature, must be highly available and accessible remotely.
• Recoverability: Varies. A website can be restored from a known good backup quickly (e.g., the Arizona Secretary of State's website was restored within 12 hours after a defacement). Physical damage to critical systems (e.g., election centers without fire suppression) on Election Day would be far more challenging to recover from.
• Vulnerability: Depends. Hard to attack air-gapped systems remotely. Websites are inherently more vulnerable due to their public-facing nature.
• Effectiveness: High. Targeting tabulation equipment severely disrupts the process. Bomb threats, a form of denial-of-service, can temporarily halt vote counting, though often anticipated.
• Recognizability: High. Adversaries recognize websites as primary communication mechanisms and election equipment as "tasty targets."

3. Audits:

• Accessibility (external): Not highly accessible from an outside attacker's perspective.
• Recoverability: Voting systems are backed up with multiple on-site and off-site backups, though the vulnerability of off-site backups is a consideration.
• Effect: Impactful. Removing or compromising the audit system would undermine trust but perhaps not be "devastating."
• Recognizability: Not traditionally a high-value target for foreign adversaries, though this perception might change after such analyses.

4. Physical Security and Logistics:

• Significant improvements have been made since 2016, with enhanced chain-of-custody protocols, GPS tracking on ballot transport vehicles, and law enforcement escorts (e.g., Maricopa County Sheriff's Office with two unmarked cars). Ballots are brought into secure facilities behind locked fences with roaming patrols. The understanding of elections as a "juicy target" has elevated the importance of these measures.

5. Reputation:

• Accessibility: Easiest to attack. Adversaries can leverage misinformation, disinformation, synthetic content, and deep fakes (e.g., using large language models like ChatGPT) to erode confidence.
• Effect: Devastating. Loss of confidence leads to voter depression. Once damage is done (e.g., doxxing poll workers, spreading fake claims), it's extremely difficult to reel back public trust, with real-life consequences for individuals.
• Recoverability: Extremely difficult to recover lost public confidence.

The speakers concluded that while they initially sought to disprove the notion that public trust was the ultimate vulnerability, their extensive analysis confirmed it. Even if every technical aspect is perfect, a widespread belief in bias or corruption can be just as damaging as an actual system compromise.

Technical Deep Dive

▶ Watch: Star Wars example: exploiting a key system weakness (4:27)

The CARVER framework provides a structured approach to identifying and prioritizing vulnerabilities within the complex ecosystem of the US voting system. The technical deep dive focuses on how different components are secured and how they might be targeted.

Core to the defense of election integrity is the distinction between air-gapped systems and accessible ones. The actual tabulators and e-poll books used for counting votes and checking in voters are generally isolated from the public internet. As Nate Young, CISO for Maricopa County, explains, these systems are typically housed in secure buildings, under surveillance, and require physical presence to interact with them. This significantly raises the bar for an attacker, making insider threat a primary concern for these critical components. To mitigate this, measures like two-person rules (buddy systems) for accessing critical spaces, robust locks, badging systems, and cameras are implemented. This forces collusion for any malicious physical act, making it less likely.

In contrast, support systems like election websites and email are by their very nature public-facing and must be highly available. This makes them significantly more accessible and vulnerable to remote attacks. Mike Moore, CISO for the Arizona Secretary of State's office, cited a recent incident where their website was defaced, likely by a nation-state actor (Iran, based on moderate confidence attribution due to timing and content). While concerning and disruptive, such an attack on a website is distinct from a compromise of the core voting mechanics, which are isolated. The rapid recovery of the website (within 12 hours from backup) demonstrates the importance of robust disaster recovery and continuity of operations plans (COOP) for these public-facing assets.

The foundational defense for many US election systems, particularly in states like Arizona, is the paper ballot. Paper provides an auditable trail that persists even if machines fail or are compromised. Nate Young highlighted that Arizona is a "paper voting state," where every vote is recorded on paper. This enables hand-count audits after every election, where batches of ballots are manually counted by bipartisan teams and compared against machine counts. Discrepancies, often due to adjudication of ambiguously marked ballots, are investigated. This physical artifact serves as a crucial backstop, ensuring that even if the machines are compromised, the true intent of the voters can still be verified.

Logistical security has also seen significant enhancements. The transport of ballots, especially in large counties like Maricopa, involves sophisticated chains of custody. Vehicles transporting hundreds of thousands of ballots are equipped with GPS tracking and escorted by law enforcement (e.g., two unmarked sheriff's cars in front and behind). Upon arrival, ballots enter secure facilities with locked fences and roaming patrols. These measures address the physical accessibility and vulnerability of ballots during transit.

The talk also touched upon the challenge of resource allocation. As Mike Moore explained, CISOs must constantly prioritize where to spend limited time and money. The CARVER model helps in this by identifying the highest-impact vulnerabilities. Collaboration is key; the Arizona Secretary of State's office works closely with the Arizona Department of Homeland Security and the National Guard to provide resources like next-generation antivirus and web application firewalls to smaller counties that may lack the budget or expertise to procure them independently. They also conduct monthly statewide election security meetings and tabletop exercises to share intelligence, best practices, and prepare for various scenarios, including bomb threats (which are effectively denial-of-service attacks).

While specific CVEs or tool names (other than DTEX as an example of user-based analytics, not explicitly used in their election systems) were not extensively detailed, the technical discussion revolved around architectural choices (air-gaps), procedural controls (two-person rules, chain of custody), and recovery mechanisms (backups, paper audits) that collectively strengthen the system against a wide array of threats.

Demo / Proof of Concept

▶ Watch: Kanti ransomware: A real-world CARVER application example (6:00)

The talk did not feature a live demonstration or proof of concept of a hack. Instead, the presentation itself was an analytical exercise, applying the CARVER framework to various components of the US voting system. The speakers used the framework to methodically assess hypothetical attack scenarios and existing vulnerabilities, rather than showcasing an exploit.

An illustrative example mentioned was the common perception at Defcon that "hacking a voting machine" simply involves uploading a picture of Rick Astley. The speakers explicitly clarified that such an act, while visually impactful and easily shareable on social media, is not a true "hack" in the sense of altering votes or compromising core system integrity. It is merely a "control C, control V" operation that exploits public perception rather than deep technical vulnerabilities, reinforcing their ultimate finding about the centrality of reputation.

Defensive Implications

▶ Watch: Kanti's critical vulnerabilities ranked: source code, designers, infrastructure (7:44)

The detailed CARVER analysis provides critical insights for election defenders, guiding them on where to focus their finite resources and efforts.

1. Prioritize Reputation and Public Trust: The most significant defensive implication is the need to actively build, maintain, and protect public trust. This requires proactive and transparent communication about election processes, security measures, and incident responses. Election officials must combat misinformation and disinformation vigorously, educating the public about common falsehoods and providing verifiable facts. This includes investing in public relations, media engagement, and community outreach to make "the truth as sexy as the lies."

2. Strategic Resource Allocation: Election officials, often operating with limited budgets (as highlighted by Mike Moore's plea for more legislative funding), must use frameworks like CARVER to identify and prioritize investments. This means understanding which vulnerabilities, if exploited, would have the highest effect and lowest recoverability, and directing resources there. For example, ensuring the integrity of air-gapped tabulation systems through physical security and insider threat mitigation is paramount, as is bolstering the resilience of auditable paper ballot systems.

3. Enhance Layered Physical and Cyber Security: While reputation is key, robust technical and physical defenses remain non-negotiable.

• Physical Security: Continuously improve chain-of-custody protocols, secure transportation of ballots (e.g., GPS tracking, law enforcement escorts), and secure storage facilities with access controls, surveillance, and two-person rules for critical areas.
• Cyber Security: Strengthen defenses for public-facing systems (websites, email) with Web Application Firewalls (WAFs) and next-generation antivirus. Implement strong disaster recovery (DR) and continuity of operations (COOP) plans for all systems, regularly testing their effectiveness (e.g., the CrowdStrike incident during an election cycle).
• Insider Threat: Implement rigorous access controls, monitoring, and two-person policies for critical election infrastructure.

4. Strengthen Auditing and Verification: Emphasize the importance of paper ballots as an auditable record. Conduct regular, independent hand-count audits that involve bipartisan teams to verify machine counts. Transparency in these audit processes can significantly bolster public confidence. The ability to reproduce vote counts and identify anomalies is crucial for contested elections.

5. Foster Collaboration and Information Sharing: The distributed nature of US elections necessitates strong collaboration. State-level offices (like the Arizona Secretary of State) should actively support smaller counties with fewer resources, providing equipment, training, and expertise. Regular statewide meetings for IT, communications, and leadership foster intelligence sharing regarding Indicators of Compromise (IOCs), tactics, techniques, and procedures (TTPs) used by adversaries. Working with federal agencies like the FBI and DHS for attribution and advanced threat intelligence is also vital.

6. Educate and Empower the Public: A crucial defensive strategy is to equip citizens with the ability to discern factual information from misinformation. Encouraging critical thinking about online content, especially during election cycles, and directing people to official, verified sources is essential. The speakers noted that the damage from false claims, such as the doxxing of poll workers based on nonsense, can be long-lasting and severe.

By adopting a holistic defense strategy informed by CARVER, election officials can better protect the integrity of the voting process, not just from technical exploits, but from the more insidious threat of eroded public faith.

Key Takeaways

• The CARVER framework provides a powerful, structured methodology for assessing vulnerabilities and prioritizing defensive actions in complex systems like US elections.
• Public trust and the reputation of the voting system are identified as the single most critical and vulnerable components, often outweighing purely technical vulnerabilities.
• Layered defenses encompassing physical security, robust cyber protections (especially for air-gapped systems), and auditable paper trails are essential for overall system integrity and resilience.
• Resource limitations necessitate strategic threat modeling to ensure that finite investments in security are directed towards the most impactful and critical areas.
• Collaboration and proactive information sharing across local, state, and federal agencies are vital for a collective defense against evolving threats, including sharing IOCs and best practices.
• Combating misinformation and disinformation is a core defensive responsibility, requiring transparent communication, public education, and rapid response to false claims to prevent voter depression and preserve democratic legitimacy.

About the Speaker(s)

Mike Moore serves as the Chief Information Security Officer (CISO) for the Arizona Secretary of State's office. His role involves overseeing the cybersecurity posture for election systems across the state, including dealing with incidents like the website defacement by suspected nation-state actors. He is a strong advocate for increased resources for election security and for collaborative efforts among counties.

Nate Young is the Chief Information Security Officer (CISO) for the Maricopa County Elections Department in Arizona. Maricopa County, being a large population center, faces significant scrutiny and has implemented extensive multi-layer security measures. Young emphasizes the importance of checks and balances, disaster recovery planning, and the foundational role of paper ballots in ensuring election integrity.

Will Baggett is introduced as a "hacker" on the panel. While his specific organizational affiliation or title is not detailed in the transcript, his participation underscores the importance of red-team perspectives in identifying and understanding vulnerabilities within election systems.