Though not acted on, the request shows how the Trump administration has tried to use the Cybersecurity and Infrastructure Security Agency for its own ends while draining it of resources to help its mission of protecting the nation’s voting systems.
The “try to hack us to see if we’re vulnerable” part is 100% standard practice for security audits. It’s called penetration testing, and there is an entire industry set up around the idea of legally breaking into secure facilities, just to see if their security is working. It is healthy, because it can be a valuable tool for finding major security flaws.
The massive glaring issue is the fact that they asked the penetration testers to hide their results, and not alert the agencies involved. The entire point of a penetration test is to see if attackers can get in so that you can fix the issues they used to breach your facility. If the penetration testers aren’t sharing their results, it’s just fucking breaking and entering to tamper with voting machines. Asking the penetration testers to hide their results is like asking a surgeon to pull out a perfectly healthy organ.
At least the security company noticed this, and had the ethics to actually come forward about it.
The “try to hack us to see if we’re vulnerable” part is 100% standard practice for security audits. It’s called penetration testing, and there is an entire industry set up around the idea of legally breaking into secure facilities, just to see if their security is working. It is healthy, because it can be a valuable tool for finding major security flaws.
The massive glaring issue is the fact that they asked the penetration testers to hide their results, and not alert the agencies involved. The entire point of a penetration test is to see if attackers can get in so that you can fix the issues they used to breach your facility. If the penetration testers aren’t sharing their results, it’s just fucking breaking and entering to tamper with voting machines. Asking the penetration testers to hide their results is like asking a surgeon to pull out a perfectly healthy organ.
At least the security company noticed this, and had the ethics to actually come forward about it.