{"id":98431,"date":"2020-02-03T21:00:57","date_gmt":"2020-02-04T05:00:57","guid":{"rendered":"\/blogs\/?p=98431"},"modified":"2025-06-08T18:07:43","modified_gmt":"2025-06-09T01:07:43","slug":"u-s-battleground-county-website-security-survey","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/u-s-battleground-county-website-security-survey\/","title":{"rendered":"U.S. Battleground County Website Security Survey"},"content":{"rendered":"

Today McAfee released the results of a survey of county websites and county election administration websites in the 13 states projected as battleground states in the 2020 U.S. presidential elections. We found that significant majorities of these websites lacked the official government .GOV<\/strong> website validation and HTTPS <\/strong>website security measures to prevent malicious actors from launching copycat web domains posing as legitimate county government sites.<\/p>\n

These shortcomings could make it possible for malicious actors to spread false and misleading election information through mass bulk email and website promotion campaigns that could suppress, misdirect, or otherwise disrupt Election Day proceedings in such a way that they could impact the number of votes cast and, ultimately, perhaps impact the results of the 2020 U.S. elections.<\/p>\n

Why .GOV & HTTPS?<\/u><\/strong><\/h2>\n

Whereas websites using .COM, .NET, .ORG, <\/strong>and .US<\/strong> in their names are easily accessible to anyone with a credit card from website domain vendors such as GoDaddy.com, acquiring a .GOV<\/strong> website name requires that buyers submit evidence to the U.S. government that they truly are buying these names on behalf of legitimate local, county, or state government entities.<\/p>\n

The lack of .gov in a website name means that no controlling government authority has validated that the website in question is legitimate.<\/p>\n

When website visitors see the HTTPS<\/strong> and a lock icon<\/strong> in the address of a website they are visiting, this means that their browser has made a secure connection with that website through a technology called Secure Sockets Layer (SSL). While SSL sounds technical, the security it delivers is easy to understand. These signifiers simply tell visitors that any personal voter registration information that they share with those websites is encrypted and cannot be intercepted and stolen by hackers while they are visiting the site.<\/p>\n

Additionally, and more importantly to the election disinformation issue, they also tell visitors that they cannot be re-routed against their will from legitimate government websites to other websites pretending to be government websites.<\/p>\n

What McAfee\u2019s survey found<\/u><\/strong><\/h2>\n

McAfee\u2019s January 2020 survey researched states projected by U.S. election prognosticators to be pivotal in determining the victor in the 2020 Presidential Elections. States surveyed include Arizona, Florida, Georgia, Iowa, Michigan, Minnesota, Nevada, New Hampshire, North Carolina, Ohio, Pennsylvania, Texas, and Wisconsin. Together, these states account for 201 of the 270 electoral votes required to win the U.S. presidential election.<\/p>\n

State counties lacking .GOV validation<\/strong><\/p>\n

Of the 1,117 counties in the survey group, 83.3% of their websites lack .GOV validation. Minnesota ranked the lowest among the surveyed states in terms of .GOV website validation with 95.4% of counties lacking U.S. government certification. Other states severely lacking in .GOV coverage included Texas (94.9%), New Hampshire (90.0%), Michigan (89.2%), Iowa (88.9%), Nevada (87.5%), and Pennsylvania (83.6%).<\/p>\n

Arizona had the highest percentage of main county websites validated by .GOV with 66.7% coverage, but even this percentage suggests that a third of the Grand Canyon State\u2019s county websites are unvalidated and that hundreds of thousands of voters could still be subjected to disinformation schemes.<\/p>\n

State counties lacking HTTPS protection<\/strong><\/p>\n

McAfee\u2019s survey found that 46.6% of county websites lack HTTPS encryption. Texas ranked the lowest in terms of encryption with 77.2% of its county websites failing to protect citizens visiting these web properties. Other states with counties lacking in encryption included Pennsylvania (46.3%), Minnesota (42.5%), and Georgia (38.4%).<\/p>\n

Assessment of Iowa and New Hampshire<\/strong><\/p>\n

In Iowa, 88.9% of county websites lack .GOV validation, and as many as 29.3% lack HTTPS encryption. Ninety percent of New Hampshire\u2019s county websites lack .GOV validation, and as many as 30% of the Granite State\u2019s counties lack encryption.<\/p>\n

Inconsistent naming standards<\/strong><\/p>\n

McAfee\u2019s research found that some states attempted to establish standard naming standards, such as www.co.[county name].[two-letter state abbreviation].us<\/strong>. Unfortunately, these formats were followed so inconsistently that a voter seeking election information from her county website cannot be confident that a web domain following such a standard is indeed a legitimate site.<\/p>\n

Easy-to-remember naming formats<\/strong><\/p>\n

McAfee found 103 cases in which counties set up easy-to-remember, user-friendly domain names to make their election information easier to remember and access for the broadest possible audience of citizens. Examples include www.votedenton.com<\/a>, www.votestanlycounty.com<\/a>, www.carrollcountyohioelections.gov<\/a>, www.voteseminole.org<\/a>, and www.worthelections.com<\/a>. While 93 of these counties (90.2%) protected voters visiting these sites with encryption, only two validated these special domains and websites with .GOV. This suggests that malicious parties could easily set up numerous websites with similarly named domains to spoof these legitimate sites.<\/p>\n

.GOV and elections<\/u><\/strong><\/h2>\n

The lack of .gov matters because, without an official government body validating whether websites truly belong to the government entities they claim, it\u2019s possible for malicious actors to spoof legitimate government sites with fraudulent websites.<\/p>\n

If a malicious foreign actor can spoof government websites, he can send hundreds of thousands of emails to voters and use both those emails and the websites to which they are tied to send voters information on the wrong polling places, phony voter registration processes or requirements (barriers), or other incorrect voting instructions that could suppress, misdirect, or otherwise disrupt a key county\u2019s electorate from voting.<\/p>\n

If the malicious actor can launch such a digital disinformation campaign close enough to election day, he could reach a critical mass of voters. If he does so before county and state officials become aware of the campaign, it could be very difficult for the officials to counter the disinformation before voter behavior is impacted.<\/p>\n

If the actor can successfully disrupt the voting behavior of just tens of thousands of citizens in these key states, their votes may not be counted or their confidence in the validity of election results and even legitimacy of the democratic process overall could be badly shaken.<\/p>\n

Ultimately, if a malicious actor seeks to undermine confidence in America\u2019s system of government, such a digital disinformation campaign can succeed in damaging confidence in the electoral process, even if he cannot succeed in impacting actual votes.<\/p>\n

Ohio\u2019s Strategy for transitioning to .GOV<\/strong><\/p>\n

While only 19.3% of Ohio\u2019s 88 county main websites have .GOV validation, the state leads McAfee\u2019s survey with 76.1% of county election websites and webpages validated by .GOV certification.<\/p>\n

This leadership position appears to be the result of a state-led initiative to transition county election-related content to .GOV validated web properties. A majority of counties have subsequently transitioned their main county websites to .GOV domains, their election-specific websites to .GOV domains, or their election-specific webpages to Ohio\u2019s own .GOV-validated https:\/\/ohio.gov\/<\/a> domain (i.e. https:\/\/www.boe.ohio.gov\/vanwert\/<\/a>)<\/u>. See here<\/a> for a complete list of Ohio county election websites.<\/p>\n

Such a .GOV transition strategy constitutes an interim solution until more comprehensive efforts are made at the state and federal government level through initiatives such as The DOTGOV Act of 2020<\/a>. This legislation would require the Department of Homeland Security (DHS) to support .GOV adoption for local governments with technical guidance and financial support.<\/p>\n

Please see the following for more information on this subject:<\/p>\n