How the Twitter Hack Revealed a Risky 2020 Election System – The New York Times

But the Twitter hacking suggested yet another vector for attack. And it was a reminder of three particular challenges facing those trying to secure the election. The first is assessing possible vulnerabilities so the country is not playing catch-up once again, long after Election Day, to outside interference with the election system or on social media. (The extent of Russia’s manipulation of Facebook posts in 2016, for example, became clear only after President Trump had been elected.)

The second is how well the country can lock down these systems in the 100-plus days left before the election, beyond the obvious “critical infrastructure” that will enable the Nov. 3 vote. And the third is whether it is possible to build some national resilience to respond quickly, as Twitter tried, if something goes wrong.

Since 2016, thousands of pages of federal investigative reports have been published on what went wrong in the presidential election that year, and a congressional Cyberspace Solarium Commission has produced long lists of recommendations of how private enterprise and the government can work together.

But then there are days like Wednesday, when it seems as if all the studies were insufficient.

“We have seen disconcerting incidents of account takeovers before,” said John Hultquist, the senior director of intelligence analysis at FireEye, one of the leading cybersecurity firms, “but we are very concerned about the possibility of real foreign actors hijacking legitimate sources of information — key media accounts for instance — and using that to push out disinformation” close to Election Day.

“By the time we unwind everything to figure out what happened, it could be too late,” he added. “That’s a very real scenario.”

Or, as Laura Rosenberger, a former State Department official who now directs the Alliance for Securing Democracy project at the German Marshall Fund, noted, “What hasn’t changed is our failure to think ahead. Our adversaries have an ability to turn this infrastructure, which we have created, against us, and we need to be better at anticipating the threat vectors.”

Similar thoughts haunt state election officials on both sides of the aisle, who say they are alarmed about what could happen if the mega-microphones of accounts belonging to the likes of Mr. Biden or Mr. Obama broadcast a bit of electoral disinformation.

Alex Padilla, the secretary of state in California, home to Twitter headquarters, said that while state officials had run simulations of a social media disinformation campaign disrupting an election day, they hadn’t imagined a situation in which Twitter itself was hacked. Still, he said, threats posed by disinformation motivated him to set up VoteSure, a statewide voting information effort sparked by the special counsel’s investigation of Russian interference in the 2016 election.

“I wouldn’t say it was a new concern, but I would say it’s a big reminder given what we’ve all been through over the last four years,” Mr. Padilla said.

In Ohio, Frank LaRose, the secretary of state, has been conducting seminars to inform local officials about disinformation tactics and how to respond, and directing much of Ohio’s federal election funds to shoring up election security. But the attack on Twitter opened a new front, he said.

“From my time in the Army, I learned that the enemy is always going to be innovating to try to find our vulnerabilities,” Mr. LaRose said in a statement. “We’re doing everything we can to stay ahead of the curve, including going straight into targeted communities and arming them with the tools they need to fight back against disinformation.”

Of course, no one should be shocked at high-profile account takeovers: The account of Jack Dorsey, Twitter’s chief executive, was compromised last year. Last year, two Twitter employees were accused of abusing their access to aid Saudi Arabia’s efforts to spy on dissidents abroad.

And as far back as 2013, the Syrian Electronic Army hacked The Associated Press’s Twitter account, issuing false warnings that an explosion at the White House had injured Mr. Obama. By the time the tweet could be corrected, and the hackers exposed, the stock market had plunged.

Seven years later, fears are heightened by the uncertainty over how to deal with life in a so-called dirty network, where data and information are coursing through Americans’ phones on apps of questionable security — Twitter is now in that category — or under foreign control.

That is why companies ranging from PayPal and Wells Fargo, and political organizations like the Democratic National Committee, have told employees to delete the Chinese social media app TikTok from their corporate devices. On Wednesday, as the Twitter drama was unfolding, Mr. Trump’s chief of staff, Mark Meadows, said the government was considering banning TikTok entirely.

“There are a number of administration officials who are looking at the national security risk as it relates to TikTok, WeChat and other apps that have the potential for national security exposure,” Mr. Meadows said on Air Force One, “specifically as it relates to the gathering of information on American citizens by a foreign adversary.”

But Twitter is an American company — no one is going to ban it — and it’s the way that Mr. Meadows’s boss communicates with his constituents and, often, with his own government. The question is whether its security flaws can be fixed in the next 16 weeks.