- With the midterms days away, voter registration websites in a fifth of states are at a greater risk from hackers because they lack a top-level .gov domain1
- The states are: Arizona, Arkansas, Colorado, Florida, Kansas, Massachusetts, Michigan, Minnesota, Mississippi, New Mexico and Oklahoma – the Washington DC site is also unprotected1
- US Cybersecurity agency CISA describes sites with the .gov domain as more secure than other domains, with two-factor authentication and closer monitoring
Ridgewood NJ, As America prepares for next week’s midterm elections, one in five of the websites millions of voters use to confirm their registration details lack the cybersecurity protection called for by the White House, research by NordVPN can reveal2.
20% off all web services with Spark Driven https://1.sparkdriven.com/aff.php?aff=3
NordVPN has found that sites in 11 states, where voters were directed to check their details and eligibility for the 8 November ballot, didn’t carry the official .gov domain name recommended by the Cybersecurity and Infrastructure Security Agency (CISA).
CISA describes the .gov domain as “critical infrastructure” that increases “trust that government communications are authentic”. Sites with the domain benefit from extra security protection like two-factor authentication and — because they can be only used by parts of the US and federal government — are more regularly monitored than other domains like .org and .com.
Voter registration sites in Arizona, Arkansas, Colorado, Florida, Kansas, Massachusetts, Michigan, Minnesota, Mississippi, New Mexico and Oklahoma are all missing the .gov suffix, while the site for the District of Columbia — which does not vote on congress but will be deciding its mayor — also lacks the official domain1.
The findings come amid growing concern that hackers may try to disrupt the midterms, which will be used to determine the 118th United States Congress.
Last year it was reported in a US intelligence report that Vladimir Putin had tried to swing the 2020 presidential election to Donald Trump by spreading allegations about the then Democratic nominee Joe Biden3.
Colorado was targeted by Russian hackers twice last month, including an attempt to take over the airport’s website, according to national security investigators. The state’s Weld County has recently moved to a .gov account, with Chief Information Officer Ryan Rose saying it was in response to “more sophisticated” methods of online fraud4.
A joint FBI and CISA warning on 6th October about information manipulation in the run-up to the midterms advised the public to “be cautious with websites not affiliated with local or state government that solicit voting information, like voter registration information”.
It continued: “Websites that end in “.gov” or websites you know are affiliated with your state or local election office are usually trustworthy.”
Although the majority of deadlines for voter registration have passed, some states will still allow people to register in person – or online – right up to polling day.
Marijus Briedis, Chief Technology Officer at NordVPN, said: “The eyes of the world will be on the midterms in a few days’ time. As well as the result being seen as a verdict on President Biden’s time in office, the administration of the election itself will be under scrutiny
“Any suspicion that bad actors, particularly state-sponsored ones, have had an undue influence over the vote will undermine the President’s push to strengthen national cybersecurity and erode confidence in democracy.
“While all websites can be compromised by a determined hacker, the extra safeguards and authority behind .gov domains helps to reassure the public that information they hold is secure. Hopefully these domains will be rolled out to all voter registration by the time of the next election in 2024.
“In the meantime, make sure you exercise caution when visiting a website and do not double-click any embedded links without first checking its properties to ensure that the preview matches its destination.
“Look at the URL address carefully and you are still suspicious of the site, look for any contact details and check them on a search engine to make sure they’re legitimate.”
WHAT’S IN A DOMAIN NAME?
Marijus Briedis from NordVPN gives the lowdown on the history of webpage naming.
- The Domain Name System (DNS) was introduced in 1983 as a way of naming and structuring pages on the internet. The first TLDs, top-level domain names, were introduced the following year.
- Computer manufacturer Symbolics registered the first .com domain website, Symbolics.com, in 1985.
- There are six main TLDs, .org (for non-profitable organizations or charities), .com (for commercial organizations and the most popular domain), .gov (for US government agencies or state-connected bodies), .net (for networks and infrastructure), .edu (for US educational bodies), .int (for international organizations or partnerships). There is also a .mil domain used exclusively by the US military. In the years that followed the domain industry has expanded to include hundreds of new generic TLDs.
- The White House got its first official website Whitehouse.gov in 1994.
- In September 1995 the NSF (National Science Foundation), involved in organizing the DNS, allowed Network Solutions to charge $50 to register a domain name.
- Internet search giant Google launched with Google.com in 1998.
- The Voice.com domain was sold for a reported $30 million in 2019, making it the most expensive domain name of all time.
- At the end of June this year an estimated 351 million domain names were registered.
Notes to Editors
1 State site links: Arizona, Arkansas, Colorado, Florida, Kansas, Massachusetts, Michigan, Minnesota, Mississippi, New Mexico, Oklahoma, District of Columbia
2 State sites sourced from National Association of Secretaries of State Voter Registration Status page
3 Reuters: Putin likely directed 2020 U.S. election meddling, U.S. intelligence finds
4 Government Technology: Why a Colorado Government Shifted Its Website to .Gov Domain
For more information and media enquiries:
Chris Beckett | chris@rhizomemediagroup.com | T: +44 (0)7967 392 908
Neil Millard | neil@rhizomemediagroup.com | T: +44 (0)7803 560 331
Brigita Kavaliauskaite | brigita@nordsec.com