Investigation Finds ‘Little Oversight’ Over Crucial Supply Chain for US Election Software

Politico reports U.S. states have no uniform way of policing the use of overseas subcontractors in election technology, “let alone to understand which individual software components make up a piece of code.”

For example, to replace New Hampshire’s old voter registration database, state election officials “turned to one of the best — and only — choices on the market,” Politico: “a small, Connecticut-based IT firm that was just getting into election software.”

But last fall, as the new company, WSD Digital, raced to complete the project, New Hampshire officials made an unsettling discovery: The firm had offshored part of the work. That meant unknown coders outside the U.S. had access to the software that would determine which New Hampshirites would be welcome at the polls this November.

The revelation prompted the state to take a precaution that is rare among election officials: It hired a forensic firm to scour the technology for signs that hackers had hidden malware deep inside the coding supply chain. The probe unearthed some unwelcome surprises: software misconfigured to connect to servers in Russia [“probably by accident,” they write later] and the use of open-source code — which is freely available online — overseen by a Russian computer engineer convicted of manslaughter, according to a person familiar with the examination and granted anonymity because they were not authorized to speak about it… New Hampshire officials say the scan revealed another issue: A programmer had hard-coded the Ukrainian national anthem into the database, in an apparent gesture of solidarity with Kyiv.

None of the findings amounted to evidence of wrongdoing, the officials said, and the company resolved the issues before the new database came into use ahead of the presidential vote this spring. This was “a disaster averted,” said the person familiar with the probe, citing the risk that hackers could have exploited the first two issues to surreptitiously edit the state’s voter rolls, or use them and the presence of the Ukrainian national anthem to stoke election conspiracies. [Though WSD only maintains one other state’s voter registration database — Vermont] the supply-chain scare in New Hampshire — which has not been reported before — underscores a broader vulnerability in the U.S. election system, POLITICO found during a six-month-long investigation: There is little oversight of the supply chain that produces crucial election software, leaving financially strapped state and county offices to do the best they can with scant resources and expertise.

The technology vendors who build software used on Election Day face razor-thin profit margins in a market that is unforgiving commercially and toxic politically. That provides little room for needed investments in security, POLITICO found. It also leaves states with minimal leverage over underperforming vendors, who provide them with everything from software to check in Americans at their polling stations to voting machines and election night reporting systems. Many states lack a uniform or rigorous system to verify what goes into software used on Election Day and whether it is secure.
The article also points out that many state and federal election officials “insist there has been significant progress” since 2016, with more regular state-federal communication. “The Cybersecurity and Infrastructure Security Agency, now the lead federal agency on election security, didn’t even exist back then.

“Perhaps most importantly, more than 95% of U.S. voters now vote by hand or on machines that leave some type of paper trail, which officials can audit after Election Day.”

Read more of this story at Slashdot.

New York Bans ‘Addictive Feeds’ For Teens

New York Governor Kathy Hochul (D) signed two bills into law on Thursday that aim to protect kids and teens from social media harms, making it the latest state to take action as federal proposals still await votes. From a report: One of the bills, the Stop Addictive Feeds Exploitation (SAFE) for Kids Act, will require parental consent for social media companies to use “addictive feeds” powered by recommendation algorithms on kids and teens under 18. The other, the New York Child Data Protection Act, would limit data collection on minors without consent and restrict the sale of such information but does not require age verification. That law will take effect in a year.

States across the country have taken the lead on enacting legislation to protect kids on the internet — and it’s one area where both Republicans and Democrats seem to agree. While the approaches differ somewhat by party, policymakers on both sides have signaled urgent interest in similar regulations to protect kids on the internet. Florida Governor Ron DeSantis (R), for example, signed into law in March a bill requiring parents’ consent for kids under 16 to hold social media accounts. And in May, Maryland Governor Wes Moore (D) signed a broad privacy bill into law, as well as the Maryland Kids Code banning the use of features meant to keep minors on social media for extended periods, like autoplay or spammy notifications.

Read more of this story at Slashdot.

New York Launches Mobile Driver’s Licenses

New York has launched its mobile ID program, “giving residents the option to digitize their driver’s license or non-driver ID,” reports The Verge. From the report: Beginning today, the New York Mobile ID app is available from Apple’s App Store and Google Play. The app can be used for identity verification at airports. A physical license, permit, or non-driver ID is required to activate a mobile ID; you’ll need to take a photo of the front and back with your phone during the enrollment process. The news was announced during a media briefing at LaGuardia Airport on Tuesday that included New York’s and Transportation Security Administration federal security director Robert Duffy, among other speakers. Their pitch is that mobile IDs “will revolutionize the way New Yorkers protect their identities and will significantly enhance the way they get through security at airports across the nation.” State officials are also emphasizing that it’s a voluntary option meant for convenience.

“When you offer your mobile ID to TSA or anyone else who accepts it, you are in full control of sharing that information. They can only see the information they request to see,” Schroeder said. “If you only need to prove your age, you can withhold other information that a verifier doesn’t need to see.” The app is designed so that your phone remains in your possession at all times — you should never freely hand a device over to law enforcement — and shows a QR code that can be scanned to verify your identity. Any changes to your license status such as renewals or suspensions are automatically pushed to the mobile version, and the digital ID also mirrors data like whether you’re an organ donor.

For now, acceptance of mobile IDs by businesses (and the police) is completely voluntary — and there’s no deadline in place for compliance — so it’s definitely too soon to start leaving your physical one at home. But bars and other small businesses can start accepting them immediately if they install the state’s verifier app. The New York Mobile ID app can be used “at nearly 30 participating airports across the country including all terminals at LaGuardia and John F. Kennedy airports,” according to a press release from Governor Kathy Hochul. New York joins a small list of states that have rolled out mobile driver’s licenses, including Arizona, Colorado, Delaware, Georgia, Florida, Iowa, Louisiana, Maryland, Mississippi, Missouri, and Utah.

Read more of this story at Slashdot.

Is Nuclear Power in America Reviving – or Flailing?

Last week America’s energy secretary cheered the startup of a fourth nuclear reactor at a Georgia power plant, calling it “the largest producer of clean energy, and the largest producer of electricity in the United States” after a third reactor was started up there in December.
From the U.S. Energy Department’s transcript of the speech:

Each year, Units 3 and 4 are going to produce enough clean power to power 1 million homes and businesses, enough energy to power roughly 1 in 4 homes in Georgia. Preventing 10 million metric tons of carbon dioxide pollution annually. That, by the way, is like planting more than 165 million trees every year!

And that’s not to mention the historic investments that [electric utility] Southern has made on the safety front, to ensure this facility meets — and exceeds — the highest operating standards in the world….

To reach our goal of net zero by 2050, we have to at least triple our current nuclear capacity in this country. That means we’ve got to add 200 more gigawatts by 2050. Okay, two down, 198 to go! In building [Unit] 4, we’ve solved our greatest design challenges. We’ve stood up entire supply chains…. And so it’s time to cash in on our investments by building more. More of these facilities. The Department of Energy’s Loan Programs Office stands ready to help, with hundreds of billions of dollars in what we call Title 17 loans… Since the President signed the Inflation Reduction Act and the Bipartisan Infrastructure Law, companies across the nation have announced 29 new or expanded nuclear facilities — across 16 states — representing about 1,600 potential new jobs. And the majority of those projects will expand the domestic uranium production and fuel fabrication, strengthening these critical supply chains…
Bottom line is, in short, we are determined to build a world-class nuclear industry in the United States, and we’re putting our money where our mouth is.

America’s Energy Secretary told the Washington Post that “Whether it happens through small modular reactors, or AP1000s, or maybe another design out there worthy of consideration, we want to see nuclear built.” The Post notes the Energy department gave a $1.5 billion loan to restart a Michigan power plant which was decommissioned in 2022. “It would mark the first time a shuttered U.S. nuclear plant has been reactivated.”

“But in this country with 54 nuclear plants across 28 states, restarting existing reactors and delaying their closure is a lot less complicated than building new ones.”

When the final [Georgia] reactor went online at the end of April, the expansion was seven years behind schedule and nearly $20 billion over budget. It ultimately cost more than twice as much as promised, with ratepayers footing much of the bill through surcharges and rate hikes…

Administration officials say the country has no choice but to make nuclear power a workable option again. The country is fast running short on electricity, demand for power is surging amid a boom in construction of data centers and manufacturing plants, and a neglected power grid is struggling to accommodate enough new wind and solar power to meet the nation’s needs…

As the administration frames the narrative of the plant as one of perseverance and innovation that clears a path for restoring U.S. nuclear energy dominance, even some longtime boosters of the industry question whether this country will ever again have a vibrant nuclear energy sector. “It is hard for me to envision state energy regulators signing off on another one of these, given how badly the last ones went,” said Matt Bowen, a nuclear scholar at the Center on Global Energy Policy at Columbia University, who was an adviser on nuclear energy issues in the Obama administration.
The article notes there are 19 AP1000 reactors (the design used at the Georgia plant) in development around the world. “None of them are being built in the United States.”

Read more of this story at Slashdot.

US Passes Bill Reauthorizing ‘FISA’ Surveillance for Two More Years

Late Friday night the U.S. Senate “reauthorized the Foreign Intelligence Surveillance Act, a key. U.S. surveillance authority,” reports Axios, “shortly after it expired in the early hours Saturday morning.”

The reauthorization came despite bipartisan concerns about Section 702, which allows the government to collect communications from non-U.S. citizens overseas without a warrant.
The legislation passed the Senate 60 to 34, with 17 Democrats, Sen. Bernie Sanders (I-Vt.) and 16 Republicans voting “nay.” It extends the controversial Section 702 for two more years.

The bill had already passed last week in the U.S. House of Representatives,
explains CNN:

Under FISA’s Section 702, the government hoovers up massive amounts of internet and cell phone data on foreign targets. Hundreds of thousands of Americans’ information is incidentally collected during that process and then accessed each year without a warrant — down from millions of such queries the US government ran in past years. Critics refer to these queries as “backdoor” searches…

According to one assessment, it forms the basis of most of the intelligence the president views each morning and it has helped the U.S. keep tabs on Russia’s intentions in Ukraine, identify foreign efforts to access US infrastructure, uncover foreign terror networks and thwart terror attacks in the U.S.

An interesting detail from The Verge:

Sens. Ron Wyden (D-OR) and Josh Hawley (R-MO) introduced an amendment that would have struck language in the House bill that expanded the definition of “electronic communications service provider.” Under the House’s new provision, anyone “who has access to equipment that is being or may be used to transmit or store wire or electronic communications.” The expansion, Wyden has claimed, would force “ordinary Americans and small businesses to conduct secret, warrantless spying.” The Wyden-Hawley amendment failed 34-58, meaning that the next iteration of the FISA surveillance program will be more expansive than before.

Saturday morning the U.S. House of Representatives passed a bill banning TikTok if its Chinese owner doesn’t sell the app.

Read more of this story at Slashdot.

Data Collected by the US Justice Department Exposed in Consultant’s Breach

DOJ-Collected Information Exposed In Data Breach Affecting 340,000
Information Collected

An anonymous reader shared this report from Security Week:

Economic analysis and litigation support firm Greylock McKinnon Associates, Inc. (GMA) is notifying over 340,000 individuals that their personal and medical information was compromised in a year-old data breach. The incident was detected on May 30, 2023, but it took the firm roughly eight months to investigate and determine what type of information was compromised and to identify the impacted individuals.

According to GMA’s notification letter to the affected individuals, a copy of which was submitted to the Maine Attorney General’s Office, both personal and Medicare information was compromised in the data breach… “This information may have included your name, date of birth, address, Medicare Health Insurance Claim Number (which contains a Social Security number associated with a member) and some medical information and/or health insurance information,” the notification letter reads.

The compromised data, GMA says, was obtained by the US Department of Justice “as part of a civil litigation matter”. More than 340,000 individuals were affected by the data breach, the company told the Maine Attorney General’s Office. The impacted individuals, however, are “not the subject of this investigation or the associated litigation matters”, the company tells the affected individuals.

Read more of this story at Slashdot.

US Energy Department Announces ‘Blueprint’ for Slashing Emissions From Buildings and Reducing Energy Use

This week America’s Department of Energy announced “a comprehensive plan to reduce greenhouse-gas emissions from buildings by 65% by 2035 and 90% by 2050.”

The U.S. Department of Energy (DOE) led the Blueprint’s development in collaboration with the Department of Housing and Urban Development, the Environmental Protection Agency, and other federal agencies. The Blueprint is the first sector-wide strategy for building decarbonization developed by the federal government… “America’s building sector accounts for more than a third of the harmful emissions jeopardizing our air and health…” said U.S. Secretary of Energy Jennifer M. Granholm. “As part of a whole-of-government approach, the Department of Energy is outlining for the first time ever a comprehensive federal plan to reduce energy in our homes, schools, and workplaces — lowering utility bills and creating healthier communities while combating the climate crisis.”

Buildings account for more than one third of domestic climate pollution and $370 billion in annual energy costs… The Blueprint projects reductions of 90% of total greenhouse gas emissions from the buildings sector, which will save consumers more than $100 billion in annual energy costs and avoid $17 billion in annual health costs.
Just for example, the Department of Energy’s Affordable Home Energy Shot program “aims to reduce the upfront cost of upgrading a home by at least 50% and reduce energy bills by 20% within a decade.” (Meanwhile, the federal government’s role in making more change happen faster includes financing, funding R&D on lower-cost technologies, expanding markets, and “supporting the development and implementation of emissions-reducing building codes and appliance standards.”)

Besides the national blueprint, the Department also announced an expansion of its Better Buildings Commercial Building Heat Pump Accelerator initiative. In this program, “manufacturers will produce higher efficiency and life cycle cost-effective heat pump rooftop units and commercial organizations will evaluate and adopt next-generation heat pump technology.”
U.S. Secretary of Energy Jennifer M. Granholm said the program “builds on more than a decade of public-private partnerships to get cutting edge clean technologies from lab to market, helping to slash harmful carbon emissions throughout our economy.”

On average, between 20% and 30% of the nation’s energy is wasted, presenting a significant opportunity to increase energy efficiency. Through the Better Buildings Initiative, DOE partners with public and private sector stakeholders to pursue ambitious portfolio-wide energy, waste, water, and/or emissions reduction goals and publicly share solutions. By improving building design, materials, equipment, and operations, energy efficiency gains can be achieved across broad segments of the nation’s economy.

The Accelerator initiative was developed with commercial end users like Amazon, IKEA, and Target, and already includes manufacturers AAON, Carrier Global Corp., Lennox International, Rheem Manufacturing Co., Trane Technologies, and York International Corp. The Accelerator aims to bring more efficient, affordable next-generation heat pump rooftop units to market as soon as 2027 — which will slash both emissions and energy costs in half compared to natural gas-fueled heat pumps. If deployed at scale, they could save American businesses and commercial entities $5 billion on utility bills every year.

Read more of this story at Slashdot.

US Invests $20 Billion More to Finance Clean-Energy Projects

Thursday America’s Environmental Protection Agency “awarded $20 billion to help finance clean-energy projects across the country,” reports the Washington Post.

The money comes from the Greenhouse Gas Reduction Fund established by President Biden’s signature climate law, the Inflation Reduction Act. The fund seeks to leverage public and private dollars to invest in clean-energy technologies such as solar panels, heat pumps and more.

The program is potentially one of the most consequential — yet least understood — parts of the climate law…

Simply put, the program allows people to access low-interest loans for clean-energy projects that they might not otherwise have received. Imagine a community group that wants to install electric vehicle charging stations at its neighborhood recreation center but can’t get a loan from a bank or a lender. As is often the case, potential lenders say they’re hesitant to support a novel green technology or a business without a track record of success. Low-income and minority communities have long encountered such obstacles in trying to attract private capital. The program aims to overcome this problem by providing a huge influx of federal cash — $27 billion in total — for nonprofit organizations to dole out to clean-energy projects nationwide. Each nonprofit will serve as a “green bank” that offers more favorable lending rates than commercial banks. “It’s just really hard to get banks to bring capital into low-income communities, especially for these new projects that they’re not used to financing,” said Adrian Deveny, the founder of the firm Climate Vision and the former director of energy and environmental policy for Senate Majority Leader Charles E. Schumer (D-N.Y.), a key architect of the Inflation Reduction Act….

The EPA is awarding money to eight nonprofits, which have committed to leverage nearly $7 in private capital for every $1 of federal investment. The nonprofits have also pledged to ensure that at least 70 percent of the funds will benefit disadvantaged communities, and that the financed projects will reduce up to 40 million metric tons of carbon dioxide a year — equivalent to the annual emissions of nearly 9 million gasoline-powered cars… [The nonprofit] Coalition for Green Capital, will use a $5 billion award to establish a “national green bank,” co-founder and CEO Reed Hundt said. “We’re going to be able to cause about $100 billion of total additional investment over a seven-year time period with that number, because we can leverage it,” Hundt said.

Read more of this story at Slashdot.