City of Cambridge hack prompts questions about web voting

CAMBRIDGE — The return of internet voting to Cambridge in the October municipal election prompts some uneasy questions — especially after the city’s own website briefly got hacked by cryptocurrency miners two months ago.

“How will we know if something goes wrong?” Coun. Jan Liggett asked during Tuesday night’s city council meeting.

“We were told in the last election that they don’t think something happened. But how will we know positively, 100 per cent for sure, the day following the election, that nothing had happened, nothing had been hacked?”

George Georgiadis, the city’s chief information officer, said that Dominion Voting will be on top of the security question when electronic voting opens — perhaps two weeks before election day, as in 2014.

Dominion, hired by the city in 2013 to provide e-voting service, is under contract until 2022. It will closely monitor the election process.

“We will know on a day-by-day basis if there has been any compromise whatsoever,” Georgiadis said.

If a hack or violation of the service is discovered, “we will cancel online voting for the subsequent days,” he added.

“It’s very speculative right now.”

Twenty per cent of votes were cast online in Cambridge four years ago. This year, Dominion provided satisfactory responses to a new set of security questions, Georgiadis told council. City administration feels the e-voting service is “high-impact” with “low-probability risk.”

Georgiadis expressed confidence that the service provided by Dominion is secure.

“Have they ever had somebody or someone try to hack their system?” Coun. Frank Monteiro asked of the 16-year-old company.

“The answer is no,” Georgiadis replied.

Meanwhile, Georgiadis assured council that no information was stolen from any visitors to the city website during the

four-hour span when a vulnerable text-to-voice plug-in was hacked on Feb. 11.

As many as 474 visitors could have had the processing power of their computers hijacked by hackers in pursuit of cryptocurrency.

The computer owners likely would not have noticed.

Thousands of websites using the plug-in were affected.

The city’s service provider, eSolutions, detected the issue the Sunday morning of the security breach and removed the plug-in. Georgiadis said city staff found out on Monday morning.

Coun. Mike Mann wanted to know why councillors weren’t notified until Wednesday evening.

“It took us some time to actually investigate the incident and make sure we have the proper answers,” Georgiadis said.