Editorial: Don't lose sight of impact of Russia's state election board hack
Two and half years after Russian intelligence hacked the Illinois State Board of Elections database and stole data on 500,000 voters, we don't know much more than we did then.
Except, thanks to the Mueller report, we now know that at least it wasn't any worse than we thought.
On page 58 in the redacted report a paragraph describes the hack by the GRU, Russia's largest foreign intelligence agency: "... in approximately June 2016, the GRU compromised the computer network of the Illinois State Board of Elections by exploiting a vulnerability in the SBOE's website ... gained access to a database containing information on millions of registered Illinois voters, and extracted data related to thousands ... before the malicious activity was identified."
Immediately after that paragraph is another sentence containing several redactions, blacked out because they purportedly reveal investigative techniques. If that information would be valuable to cybersecurity experts trying to protect Illinois' voting system before the 2020 election, we hope it can be forthcoming.
But reading between the lines of what we can see, what the Mueller report tells us is the hack was what we thought it was, the theft of information from thousands of people but, so far, no hack of the individuals themselves with no change in the state board's data. If it had been worse, Mueller would have said so.
"I'm reassured, because there was nothing new in the report about what happened in 2016," SBOE spokesman Matt Dietrich told the Capitol News Illinois network.
Even though no 2016 actual votes were affected (the SBOE doesn't tabulate votes, Illinois' counties do), it was still the worst hack of a state board of elections database in 2016 - and authorities believe 21 states were targeted.
The SBOE alerted 76,000 Illinois voters that some or all of their names, addresses, birth dates and the last four digits of their Social Security numbers were compromised. The other 400,000-plus voters were not alerted, as not enough of their data was taken to put them in danger.
There are things we still don't know, like what the Russians did with the information. Or what they intended to do. Or what they still intend to do. No cases of identity theft related to the hack have been reported. With a $13.2 million grant from the federal government last year, the state has taken numerous measures to protect voters and voting data, including hiring "cyber navigators" to assess the risk of county election offices.
This is good to know, because if the Russians were successful once, it's a good bet they'll try again. This state cannot let down its guard.