The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning on Oct. 2 to help the public recognize and avoid spoofed election-related internet domains and email accounts during the 2020 election year.
The warning says that foreign adversaries can use spoofed domains and email accounts to: disseminate false information; gather usernames, passwords, and email addresses; collect personally identifiable information; and spread malware.
The FBI and CISA said that cyber actors are setting up spoofed domains with slightly altered characteristics of legitimate domains, such as an alternate spelling of a word (“electon” instead of “election”), or using an alternative top-level domain, such as a “[.]com” version of a legitimate “[.] gov” website. The public may then mistakenly visit the spoofed domains when seeking accurate election information. Additionally, the warning says that cyber actors may use a seemingly legitimate email account to entice the public into clicking on malicious files or links.
The warning offered up a handful of recommendations for the general public:
- “Verify the spelling of web addresses, websites, and email addresses that look trustworthy but may be close imitations of legitimate election websites.
- Seek out information from trustworthy sources, verifying who produced the content and considering their intent. The Election Assistance Commission (https://www.eac.gov) provides a vast amount of verified information and resources.
- Ensure operating systems and applications are updated to the most current versions.
- Update anti-malware and anti-virus software and conduct regular network scans.
- Do not enable macros on documents downloaded from an email unless absolutely necessary, and only then, after ensuring the file is not malicious.
- Disable or remove unneeded software applications.
- Use strong two-factor authentication if possible, via biometrics, hardware tokens, or authentication apps.
- Do not open e-mails or attachments from unknown individuals. Do not communicate with unsolicited e-mail senders.
- Never provide personal information of any sort via e-mail. Be aware that many e-mails requesting your personal information appear to be legitimate.”
This warning follows a Sept. 22 public service announcement from the FBI and CISA. In the announcement, the FBI and CISA aimed to raise awareness about the potential for disinformation around the results of the elections, especially in the period after voting has occurred.
While the FBI and CISA have issued warnings about election security, earlier last month FBI Director Chris Wray tried to allay some of the public’s fears. He said his agency hasn’t seen any attempts thus far by foreign actors to attack U.S. voter registration databases in the run-up to the November elections, or any attempt to tamper with vote counts.
Recently, CISA and the Election Assistance Commission praised the Office of Personnel Management’s decision to allow Federal government employees serve as poll workers on election day.
“As election officials continue to adjust processes and procedures to keep everyone safe, it’s become clear the nation needs more poll workers, as many who typically volunteer tend to be older and are higher risk,” Christopher Krebs, director of CISA, said. “OPM’s decision will allow our Federal workers to step up and do their part. I encourage all Americans who are healthy and able to participate in the process and consider volunteering as a poll worker.”
