All posts by Jocelyn Woolbright

Celebrating 7 Years of Project Galileo

Post Syndicated from Jocelyn Woolbright original

Celebrating 7 Years of Project Galileo

Celebrating 7 Years of Project Galileo

Every June, we celebrate the anniversary of Project Galileo. This year, we are proud to celebrate seven years of protecting the most vulnerable groups on the Internet from cyber attacks. June is a busy month for us at Cloudflare, with the anniversary of Project Galileo and Access Now’s RightsCon, one of the largest events on human rights in the digital age. As we collaborate with civil society on topics from technology, privacy, digital security and public policy, we learn how to better protect critical voices on the Internet but also how to use the Cloudflare network to make positive changes to the Internet ecosystem.

We started Project Galileo in 2014 with the idea that we need to protect voices that are targeted for working in sensitive areas. As such, we give these voices the resources to protect themselves online against powerful opponents. Whether their opponent’s aim is to intimidate, silence, or steal sensitive information, cyber attacks can cause significant damage to organizations that work in areas such as human rights, independent media, education, and social justice. As the world moves online — a factor accelerated by COVID-19 — access to powerful cybersecurity tools is critical for organizations around the world. Our goal at Cloudflare is to help build a better Internet. Part of that goal is helping those who are disproportionately targeted by cyber attacks due to their critical work. We do this by providing the tools they need to stay online to continue their mission in serving the public good.

For the 7th anniversary of Project Galileo, we want to provide a glimpse of what we work on every day when it comes to protecting vulnerable groups on the Internet. Below are some of these stories with information on threats against these groups, highlights from the past year as well as new tools organizations utilize to protect against cyber threats.

Highlights from the past year

  • In the past year, we have seen a 50% increase in organizations that receive protection under Project Galileo. There are now more than 1,500 in 111 countries.
  • We partner with 40 civil society organizations that review and approve websites for protection under Project Galileo.
  • There are 5x as many cyberattacks against all Project Galileo sites compared to our update last year, with 13 billion attacks between August 2020 and March 2021. This is an average of 53 million cyber attacks per day in the past eight months.
  • Project Galileo was recognized as a Spotlight Recipient by The Tech Spotlight at Harvard Kennedy School’s Belfer Center for its commitment to serve the public good in areas of digital technologies.
Celebrating 7 Years of Project Galileo

Project Galileo Radar dashboard

In September 2020, we launched Radar, a platform that provides insight into Internet trends to help anyone understand security, performance and usage of the Internet. For Project Galileo, we wanted to identify the types of attacks these groups face to better equip researchers, civil society and organizations that are targeted with best practices for safeguarding their website and internal data.

In the last year, as many organizations moved to online operations, this opened the floodgates to malicious cyber activity. To learn more about the cyber attacks those protected under the project suffer, visit our Project Galileo 7th Anniversary Radar Dashboard.

Celebrating 7 Years of Project Galileo

Project Galileo and Harvard Tech Spotlight

This year, we were thrilled for Project Galileo to be recognized as a Spotlight Recipient by The Tech Spotlight at Harvard Kennedy School’s Belfer Center. The Tech Spotlight recognizes projects and initiatives that demonstrate a commitment to public purpose in the areas of digital technologies. Nominations are evaluated based on their proven ability to reduce societal harms and protect public purpose values including privacy, safety and security, transparency and accountability, and inclusion. In the past year, we have seen how people interact and utilize the Internet, the increase in malicious cyber attacks as well as sophisticated attacks against social justice groups, and an increase in application to the project from COVID-19 relief efforts. This has shown us new ways in which Project Galileo can help during times of crisis for a wide range of groups on the Internet.

Protecting internal applications for community-building nonprofits with Cloudflare Access

In the past year, we learned how organizations had to quickly implement a work-from-home solution and many of the risks associated with this shift to remote working. Due to the increased need for secure remote access while also maintaining a strong security posture, we started offering Cloudflare Access under Project Galileo. At a high level, Access gives organizations the ability to secure internal applications — such as internal knowledge resources of help desk platforms. In the case of Project Galileo, when volunteers connect to these applications they must authenticate with their identity provider — such as Google or Okta. Then Cloudflare checks their login against rules the IT administrator has deployed and, if permitted, allow them to access the application. This provides a secure remote work environment by not allowing unauthorized access to sensitive internal applications.

Learn more about how Project Galileo participants, World University Service Canada and Unbound use Access to secure their remote workforce.

World University Service of Canada, Canada

Celebrating 7 Years of Project Galileo

World University Service of Canada is a Canadian non-profit organization that works in international development with a diverse network of students, volunteers, schools, governments, and businesses. “Through this program, we work with the Canadian post-secondary community to provide access to resettlement and higher education for young refugees. Since 1978, our network has resettled more than 2,000 refugee youth to Canada where they are able to build a better future for themselves and their families,” says Ken Fraser, the Deputy Director of IT and Digital Transformation at the organization. Ken wears many hats at WUSC with a team of five providing IT services and support for staff around the world.

“A big challenge we had previously was that our security tools only protected internally hosted applications. For any sites we hosted with an external provider there were no monitoring or security tools available, aside from whatever the service provided,” says Ken. “This has all changed now with Cloudflare. Any site that we proxy through the Cloudflare network has the same reporting, performance and security features such as the web application firewall available whether internally or externally hosted.”

For internal applications, WUSC uses Cloudflare Access to keep their team in Canada and abroad secure when accessing the organization’s internal applications. Ken explains, “Cloudflare Access has been an integral part of securing our sites, and even more so now that we’re all working from home. For example, all of our sites using WordPress are protected with a Cloudflare Access policy in order to prevent anyone on the Internet from getting to the login page, and only specific email addresses added to the policy can get through. It was very simple to set up within Cloudflare and had an immediate benefit to the security posture of our sites.” With Access, Ken and the team can monitor and enforce rules to ensure that unauthorized attempts to access their WordPress login pages stop at Cloudflare’s network first.

You can read the World University Service of Canada’s case on the Project Galileo website.

Unbound, United States

Celebrating 7 Years of Project Galileo

Unbound is an international nonprofit based in Kansas City, with an ambitious goal of bringing people together to challenge poverty in new and innovative ways in 19 countries around the world. The organization differs from the typical child sponsorship charity, as they sponsor a range of people from children to elders — they are actually one of the few organizations that offers sponsorships to the elderly. “At Unbound, our mission is to walk with the poor and marginalized of the world, and we do that by providing personal attention and direct benefits to children, youth, elders and their families, so they may live with dignity, achieve their inherent potential and participate fully in society,” explains John Dougherty, the Director of Technology Services for Unbound.

The organization applied for Project Galileo as a way to increase their security posture and secure their public-facing website, as well as some custom-built web-facing applications used by staff spread across the 19 countries the organization operates in. We first used Cloudflare Access to protect the admin side of the website for many of our staff members”, says Dougherty. In March 2020, due to the spread of COVID-19, Dougherty and the IT team had one week to implement a secure work-from-home solution for their staff. “We needed a way for our staff to access the organization’s internal ticketing system, help desk, and knowledge base in a simple and reliable manner. Now, more than 150 users can easily access the services they need to continue to provide support to those in need.”

With Project Galileo, the organization has the ability to focus on their mission of helping others while not having to worry about data breaches or being taken offline. Dougherty explains, Project Galileo has given us the ability to leverage technology to help us operate in a lean and efficient way. Anytime Unbound receives these types of services to secure our website and not have to worry as much about being taken offline due to a cyber attack or have sensitive information compromised, we can spend more time and money on providing direct support to families living in extreme poverty.”

You can read the Unbound case on the Project Galileo website.

Protecting journalists & LGBTQ+ organizations from malware and phishing attacks with Cloudflare Gateway

Beyond organizations using Cloudflare Access to protect access to their internal applications, we also had organizations reaching out and asking about the best way to protect their internal data due to a surge in malware and cyber attacks. We started to offer Cloudflare Gateway under Project Galileo as organizations shifted from office settings to home offices. Gateway uses DNS filtering to block malicious content, ransomware, and phishing before your browser has a chance to load it. It acts as a filter, and automatically blocks unsafe content from web traffic to stop cyber threats and data breaches. As many of these attacks are sophisticated and personalized to organizations, these attacks target human rights groups, journalists and civil society around the world every day. Gateway is a tool that can easily block these threats so workers do not accidentally click malicious links.

Learn about how a local journalism group in New Jersey and LGBT+ helpline in the UK uses Gateway to protect against these threats.

New Brunswick Today, United States

Celebrating 7 Years of Project Galileo

New Brunswick Today has been serving the city of New Brunswick, NJ (home to Rutgers University) since 2011. The paper covers community matters, corruption, culture, real estate development and more. Recently, the paper has been focused on the spike in gun violence since the COVID-19 pandemic. Justin Freid, head of digital strategy at New Brunswick Today, turned to Cloudflare to help mitigate repeated attacks on the site that started in late 2015. He is familiar with journalists being threatened and harassed due to the sensitive nature of their work. “Our journalists have been targeted with physical and online threats, so we have to be diligent and aware of the security tools and precautions we use,” says Freid.

New Brunswick Today appeared on an episode of Full Frontal with Samantha Bee focused on saving local news, highlighting the importance of local journalism and its role in the community after one of NBT’s stories caught nationwide attention for its coverage of public corruption at the city water utility.

During COVID-19, the organization started to use Cloudflare Gateway to filter and block malicious attacks and phishing attempts. They route their traffic through Gateway, with policies maintained and enforced via Cloudflare’s dashboard specifically for their editors’ devices. We use Gateway on our editors so that we can browse more confidently. As a local newspaper, we receive source material and are worried it may contain malware looking to thwart our systems and possibly steal sensitive information about pieces that are being written by the paper,” says Fried. “The idea that Cloudflare is able to filter malware before it reaches our device, increases confidence for our journalists that they need when they write, investigate and publish stories to keep citizens of New Brunswick informed on local issues.”

You can read the New Brunswick Today case on the Project Galileo website.

Switchboard LGBT+ Helpline, United Kingdom

Celebrating 7 Years of Project Galileo

Switchboard is one of the oldest telephone helplines in the United Kingdom founded back in 1974 to provide support and information to people of all kinds but especially those who identify as LGBT+. Fast-forward to 2021 and the organization is in high gear, with an average of 1,500 unique service users a month connecting with volunteers who are available seven days a week.

“Our goal at Switchboard is to provide a safe judgement free-space for those who need support. We have people that call in to talk about things such as seeking help in navigating their gender identity, looking for resources on mental health in the UK, or to discuss issues in their community when it comes to LGBT+ rights,” explains Pete Hannam. Switchboard is a volunteer-led charity so Hannam holds many responsibilities from answering phone calls and providing support to callers, to developing and securing the organization’s online platform.

Switchboard started as a phone helpline but with the growth of emerging technologies and new forms of communications over the years, they adapted by adding new channels such as email and real-time chat. Technology also helped the organization respond to COVID-19 quickly, and they transitioned their platform to be fully online quickly to handle the many calls, emails and chats that volunteers at Switchboard received related to the uncertainty of the pandemic on careers and social disengagement with people around the world. Hannam estimates the organization saw an increase in communication via email and chat grow from 30% to 55%.

Switchboard joined Project Galileo in May 2019 primarily to have more visibility into HTTP traffic including threats that targeted their site. “We had very basic web services with no idea what type of traffic or access people may have had to our backend systems. Unfortunately, our site was hacked because of a vulnerability in a WordPress plugin. We had no visibility into our traffic or threats before Cloudflare and due to this didn’t realise that our site had been compromised,” explains Hannam. “As an organization that provides a platform for those sharing sensitive information about things such as gender identity or abuse they suffered, trust is essential for us and presenting an insecure platform is a huge breach of respect and professionalism.” The organization was accepted to Project Galileo and immediately enabled Cloudflare SSL certificates to encrypt, authenticate and provide a sense of trust to users that use the organization’s support services. From there, they used the web application firewall to automatically block hackers’ attempts to exploit vulnerabilities in their website’s PHP code.

In the past year, Switchboard implemented Cloudflare Gateway. As the organization looks toward the future, which includes returning to the office in some form, they were looking for a solution to automatically block viruses and phishing attempts that spread over the Internet through malicious web pages. Gateway helps as a first layer of defence against most security threats and prevents the organization’s network and devices from getting infected by malicious software that their volunteers may accidentally download. Hannam explains, “We have the exact same issues as large companies, possibly even more targeted due to the sensitivity of our work, with significantly fewer resources. So it is important for organizations such as ours to have the opportunity to use advanced security tools, and Cloudflare’s Project Galileo allows us access to these tools to keep our site reliable, secure and trustworthy.”

You can read the Switchboard UK case on the Project Galileo website.

To the future…

As world events shape the ways in which organizations maintain their online platforms and workforce, Project Galileo has adapted to these situations. We look forward to continuously working with our civil society partners on the best way to support organizations and provide products that help them stay online, secure their internal teams, and focus on their mission of helping the greater good.

2020 U.S. Election: Cybersecurity Analysis

Post Syndicated from Jocelyn Woolbright original

2020 U.S. Election: Cybersecurity Analysis

As the election season has ramped down and the new Presidential Administration begins, we think it’s important to assess whether there are lessons we can draw from our experience helping to provide cybersecurity services for those involved in the 2020 U.S. elections.

Cloudflare built the Athenian Project – our project to provide free services to state and local election websites – around the idea that access to the authoritative voting information offered by state and local governments is key to a functioning democracy and that Cloudflare could play an important role in ensuring that election-related websites are protected from cyberattacks intended to disrupt that access. Although the most significant challenges in this election cycle fell outside the realm of cybersecurity, the 2020 election certainly validated the importance of having access to definitive sources of authoritative election information.

We were pleased that the robust cybersecurity preparations we saw for the 2020 U.S. election appeared to be successful. From the Cloudflare perspective, we had the opportunity to witness firsthand the benefits of having access to free cybersecurity services provided to organizations that promote accurate voting information and election results, state and local governments conducting elections, and federal U.S candidates running for office. As we protect many entities in the election space, we have the ability to identify, learn and analyze attack trends targeted at these sites that provide authoritative election information. We hope that we will continue to be able to assist researchers, policymakers and security experts looking to support best practices to protect the integrity of the electoral process.

Supporting free and fair elections

Many state and local governments bolstered their security postures ahead of the 2020 elections. There have been partnerships between governments, organizations, and private companies assisting election officials with the tools and expertise on best ways to secure the democratic process. Additionally, the spread of COVID-19 has prompted unprecedented challenges on how citizens can vote safely and securely.

Before the 2020 U.S. election, we detailed much of the activity targeting those in the election space to prepare for election day. To the relief of security experts, there were no significant publicly reported cybersecurity incidents as Chris Krebs, Director of the Cybersecurity and Infrastructure Security Agency during the 2020 election described it as “just another Tuesday on the Internet.” On November 12, 2020, a joint statement from the leading election security organizations stated “The November 3rd election was the most secure in American history . . . [T]here is no evidence that any voting system deleted or lost votes, changed votes, or was in any way compromised.”

At Cloudflare, we had a team of over 50 employees monitoring and addressing any issues to ensure we were providing our highest level of support to those working in the election space. It is important to note that our services do not protect electronic voting boxes or ballot counters; instead, Cloudflare services provide protection to websites, applications, and APIs. But we do protect many websites that provide pertinent information on the electoral process in the United States. This includes a wide range of players in the election space that facilitate voter registration, provide information on polling places, and publish election results. Since the 2016 election, state and local government websites that provide information such as voter registration, polling places, and election results, which have been increasingly targeted with cyberattacks.

Protecting organizations in the election space with Project Galileo

We launched Project Galileo in 2014 to provide a free set of security services to a range of vulnerable groups on the Internet such as human rights organizations, journalists and social justice organizations. Under the project, we currently protect more than 1,400 organizations working in regions all over the world with many organizations that work towards providing accurate voting information, tackling voter suppression, providing resources on voting rights and publishing election results. Cloudflare works with a variety of different types of non-governmental entities under Project Galileo, but we generally put them into two groups: participants, who are granted the benefits of Project Galileo, and partners, who work with us to identify other organizations who might be worth supporting. Our partners are typically larger civil society organizations and high profile NGOs, who work with entities who might benefit from our services and decide who should receive Cloudflare protections under the project.

Many of these organizations need cybersecurity protections well before election day. Belmont University is a private, four-year university located in Nashville, Tennessee. Shortly after the University was selected to be the site of the third and final 2020 U.S. Presidential Debate, the University reached out to Cloudflare asking for assistance. As part of the support for the debate, Belmont launched a new website to provide a centralized space for volunteers, media, and the community to prepare and organize the debate.

The project was quickly accepted to Project Galileo and we worked with Paul Chenoweth, Web Programming Service Manager for Belmont University to tackle concerns over server capacity, visitor traffic, site security, and analytics. Chenoweth explains, “We faced a number of web site challenges in 2008 when the university hosted the Town Hall Presidential Debate and with a totally new set of conditions in 2020, we did not know what to expect. We were worried about our site being taken down by malicious actors but also by unpredictable surges in traffic to the site. The Cloudflare team helped us create firewall rules, lock down our origin, and provided support during the Presidential debate.” Due to the spread of COVID-19, the debate website was the primary source of information for media registration, volunteer applications, and the event calendar for more than 40 themed virtual education events for the community. Overall, the university saw a 5x increase in traffic and blocked more than 80,000 malicious HTTP requests targeting their site.

Read stories from these organizations and Project Galileo here.

2020 U.S. Election: Cybersecurity Analysis

Under Project Galileo, we provide powerful cybersecurity tools to assist organizations such as Vote America, U.S. Vote Foundation, Decision Desk HQ, and many more working in the election space to identify and mitigate attacks targeting their web infrastructure. Along with protection from malicious DDoS attacks, our services also help with large influxes of unexpected traffic as organizations tend to see traffic spikes during voter registration deadlines. During the months leading up to elections, many of these organizations provided up to date information on the changing voting processes due to COVID-19. During the ballot count, many organizations posted election results online as state and local governments began reporting official numbers.

2020 U.S. Election: Cybersecurity Analysis

Many of the election-related organizations under Project Galileo allow you to register to vote, view the status of your voting ballot, and much more. States often hold their state and presidential primaries on different dates with the earliest primaries for 2020 held in March with 24 states and June with 23 states. When looking at cyberattacks against election organizations during the elections, the Cloudflare WAF blocked more than 10 million attacks in 2020. We can see that the WAF mitigated a majority of attacks during these two months, as many states held elections and voter registration deadlines.

2020 U.S. Election: Cybersecurity Analysis

Protecting election websites with the Athenian Project

In 2017, we launched the Athenian Project to provide our highest level of service to U.S. state and local governments running elections. This includes county board of election websites, Secretaries of State, and many smaller municipalities that register citizens to vote and publish election results. Under the Athenian Project, we protect more than 275 election entities in 30 states. In the past year, we onboarded more than 100 government election sites in preparation for the November 3rd election.

Read stories from state and local governments protected under the Athenian project here.

2020 U.S. Election: Cybersecurity Analysis

During the month leading up to elections, we had a team of engineers ready to assist state and local governments looking for help protecting their websites from cyberattacks. We onboarded Solano County in California, who engaged with our team on the best way to secure their election resources as we approached November 3rd.  The right to a free and fair election is one of the most basic civil rights we enjoy as Americans; it is a right upon which many of our foundational civil rights depend. Creating the conditions for transparent, clear, and truthful communications about the process and outcomes of elections is crucial to maintain the public trust in our electoral process, says Tim Flanagan, Chief Information Officer for Solano County. In a few hours, we onboarded the county to Cloudflare and implemented best-practices tailored for election entities that use our services under the Athenian Project. Cloudflare’s services added additional layers of security to our web presence that raised confidence in our ability to assure County’s residents that our election results were trustworthy.

Starting in November, we saw traffic to government election sites increase as many people looked for polling places or how to contact local election officials. We also saw those traffic spikes after election day, as many election websites post periodic updates as the counting of ballots ensues. We reported many of these traffic spikes in the Election Dashboard with Cloudflare Radar.

2020 U.S. Election: Cybersecurity Analysis

For cyberattacks targeting government election websites, we found a majority of attacks before election day and primarily in September with about 50 million HTTPS requests blocked by the web application firewall.

2020 U.S. Election: Cybersecurity Analysis

From November 4 to November 11, the WAF mitigated 16,304,656 malicious requests to sites under the Athenian Project. During this time, many state and local governments were counting ballots and posting election results to their websites. A majority of attacks were blocked by the managed ruleset in the WAF – a set of rules curated by Cloudflare engineers to block against common vulnerabilities – including SQLi, cross-site scripting and cross-site forgery requests. These are not sophisticated attacks that we see, but hackers looking for vulnerabilities to access or modify sensitive information. For example, file inclusion is an attack targeting web applications to upload malware to steal or modify the content of the site.

2020 U.S. Election: Cybersecurity Analysis

Protecting Political Campaigns in 2020

In January 2020, we launched Cloudflare for Campaigns, a suite of free security services to federal campaigns with our partnership with Defending Digital Campaigns. During the course of the year, we onboarded 75 campaigns ranging from House, Senate, and Presidential candidates running for election in 2020. At Cloudflare, we have a range of campaigns that use our services ranging from free up to our Enterprise level plan. Overall, we protected more than 450 candidate sites running for federal office in 2020.

In 2020, the average number of attacks on U.S. campaign websites on Cloudflare per month was about 13 million. When comparing attacks against political campaigns and government election sites, we saw more DDoS attacks rather than hackers trying to exploit website vulnerabilities. As depicted below, campaigns used Cloudflare’s layer 7 DDoS protection that automatically monitors and mitigates large DDoS attacks, alongside rate-limiting to mitigate malicious traffic. For election websites, it’s clear that hackers tried to exploit common website vulnerabilities that were blocked by the WAF and firewall rules, with the goal of gaining access to internal systems rather than make the site inaccessible like we see in DDoS attacks.

2020 U.S. Election: Cybersecurity Analysis
2020 U.S. Election: Cybersecurity Analysis

Lessons learned and how we move forward

We learned a lot from preparing for the 2020 U.S. election while engaging with those in the election space and learned to be flexible in the face of the unexpected. We learned that COVID-19 had impacted many of these groups at a disportionate rate.  For example, organizations that work in promoting online voter registration were well suited for the move to online that we found ourselves in during COVID-19. For political candidates, they had to adapt to moving campaign events and outreach to an online environment rather than the traditional campaign operations of door-knocking and large fundraising events. This move online meant that campaigns needed to pay more attention to digital risks.

We also learned as we approached the November election that the election space involves a range of players. Protecting elections requires not only working with governments to secure their websites for the unexpected, but also working with campaigns and non-profit organizations who work on election-related issues. We appreciated the fact that Cloudflare has many different projects that support a range of players working in promoting trust in the electoral process, giving us the flexibility to protect them. Many of these players need different levels of support and assistance with how to properly protect their web infrastructure from cyberattacks, and having a range of projects offering a different level of plans and support, helped us in finding the best way to protect them. We were able to provide a free set of services to a wide range of players each with separate goals but a common mission: providing authoritative information to build trust in the electoral process.

Both the awareness of the importance of election security and election security itself has improved since the 2016 election. We have seen the benefits of sharing information across many partners, organizations, and local players. To help prepare state and local governments for elections, we conducted webinars and security tunings sessions for many of these election players. In the case of state and local governments we protect under the Athenian Project, as we conducted more security training, we saw many participants recommend others in their state to ensure they were protected as well. For example, a week before the general election, the Wisconsin Election Commission sent an election security reminder with resources on how to mitigate a DDoS attack with Cloudflare to county and municipal clerks across Wisconsin.

At Cloudflare, we worked with a variety of government agencies to share threat information that we saw targeted against these participants. Days before the November 3rd election, we were invited to the last meeting conducted by the Cybersecurity and Infrastructure Security Agency to share threats data we had seen against government election websites and how they could be mitigated to more than 200 general election stakeholders, including counties across the United States.

Weeks after the election, I spoke with Stacy Mahaney, the Chief Information Officer at the Missouri Secretary of State, which is currently protected under the Athenian Project. His comment aptly summarized Cloudflare’s security practices. Security is like an onion. Every layer of security that you add protects against various layers of attack or exposure. We were able to add layers to our security defenses with Cloudflare. The more layers you add, the more difficult it is for attackers to succeed in making voters question the trust of the democratic process that we work to protect every day.”  Information security is about prevention and detection and is a continual process that involves monitoring, training, and threat analysis. By adding more layers including tools such as a web application firewall, 2FA, SSL encryption, authentication protocols, and security awareness training, it makes it more difficult for hackers to penetrate through the security layers.

Although cybersecurity experts concluded that the 2020 election was one of the safest in the history of elections, the work is not done yet. Not only will future U.S. election cycles begin again soon,  but election security is a global concern that benefits from the involvement of experienced players with appropriate expertise. The longer we engage with those working with those in the election space, the more we learn the best ways to protect their web infrastructure and internal teams. We look forward to continuing our work to protect resources in the voting process and help build trust in democratic institutions.

Election Cybersecurity: Preparing for the 2020 U.S. Elections.

Post Syndicated from Jocelyn Woolbright original

Election Cybersecurity: Preparing for the 2020 U.S. Elections.

At Cloudflare, our mission is to help build a better Internet. As we look to the upcoming 2020 U.S. elections, we are reminded that having the Internet be trusted, secure, reliable, and accessible for campaigns and citizens alike is critical to our democracy. We rely on the Internet to share and discover pertinent information such as how to register to vote, find polling locations, or learn more about candidates.

Due to the spread of COVID-19, we are seeing a number of election environments shift online, to varying degrees, with political parties conducting virtual fundraisers, campaigns moving town halls to online platforms and election officials using online forms to facilitate voting by mail. As the 2020 U.S. elections approach, we want to ensure that players in the election space have the tools they need to stay online to promote trust and confidence in the democratic system.

We’re keeping an eye on how this shift to online activities affect cyberattacks. From April to June 2020, for example, we saw a trend of increasing DDoS attacks, with double the amount of L3/4 attacks observed over our network compared to the first three months of 2020. In the election space, we are tracking trends and vulnerabilities to better understand the threats against these critical players. Our goal is to use the information to create best practices for election and campaign officials so they can be better prepared for the upcoming elections.

Key Takeaways:

  • When comparing types of attacks against campaigns and government election sites, we saw the exact inverse type of attacks with political campaigns experiencing more DDoS attacks while government sites experiencing more attempts to exploit security vulnerabilities.
  • On average, state and local government election sites experience 122,475 cyber threats per day with an average of 199 SQL injection attempts per day.
  • On average, political campaigns experience 4,949 cyber threats per day, although larger campaigns may see far more.

Project Athenian & Cloudflare for Campaigns Participants

Since 2020, the number of domains under Project Athenian has increased by 48 percent, to 229 state and local government election websites in 28 states receiving our security protections. Cloudflare also protects many political campaigns at all levels on a wide range of plans. Under Cloudflare for Campaigns, an initiative we launched in January 2020 to provide a free package of security protections to political campaigns with our partnership with Defending Digital Campaigns, we protect more than 50 political campaigns from candidates in 27 states.

Significant traffic spikes and probing for vulnerabilities to government election websites

For state and local governments, election night and the days leading up that day are typically the most important days of the year. With constituents accessing voter information such as voting and polling stations, election officials expect higher amounts of traffic to their website. Over the last few months, we’ve seen this shift at Cloudflare, with noticeable increases in traffic ranging from 2 to 3 times the volume of requests to many of these government election websites. We believe there are a wide range of factors for traffic spikes including, but not limited to, states expanding vote-by-mail initiatives and voter registration deadlines due to emergency orders by 53 states and territories throughout the United States. In March, more than 23 states conducted presidential primaries including 14 states on Super Tuesday, the most states on a single day to host primary elections.

At this year’s DEF CON Voting Village, experts from the Department of Homeland Security identified routine failure due to abnormally high demand as the largest risk to election systems because of the coronavirus pandemic. We have seen this in full effect, with traffic to election websites being unpredictable, and including unexplained spikes outside of election cycles, per the graph below.

Election Cybersecurity: Preparing for the 2020 U.S. Elections.

To help state and local governments under Project Athenian prepare for elections, we wanted to identify the types of threats that election websites face and how to better protect their website from malicious attacks. Since the beginning of this year, we’ve seen a large number of attempts to exploit security vulnerabilities that were mitigated by the web application firewall (WAF), with 90 million threats blocked in March 2020, for example. Cloudflare’s WAF uses managed rulesets to offer a wide range of protection against known vulnerabilities and suspicious behavior and custom firewall rules to allow users to rapidly identify and adapt to the evolving threat landscape. Of the threats we identified, managed rulesets helped mitigate 51% of threats and custom firewall rules mitigated an additional 35% of threats. Having both managed rulesets and custom firewall rules therefore helps safeguard election information.

In previous elections, attackers have used SQL injections against government election websites to attempt to extract information. We therefore did a deeper dive on those types of attacks, to understand if these threats are being conducted leading up to the 2020 election. We identified a number of SQL injection threats that were blocked by Cloudflare, with an average of 43,884 attempts per day across all domains under Project Athenian. SQL injection attacks are commonly attempted against government election sites, with the WAF blocking an average of 199 SQL injection threats per day.

Election Cybersecurity: Preparing for the 2020 U.S. Elections.

Political Campaigns have experienced more DDoS attacks

When looking at the ecosystem of election security, political campaigns can be soft targets for cyberattacks due to the inability to dedicate resources to sophisticated cybersecurity protections. Campaigns are typically short-term, cash strapped operations that do not have an IT staff or budget necessary to promote long term security strategies.

To gain a better understanding of the threats around political campaigns, we surveyed 80 U.S. federal political campaigns on a range of Cloudflare plans from Cloudflare for Campaigns to our self serve plans. Cloudflare has mitigated a total of 77,192,840 threats on these sites since January 2020. That means that, on average, these sites saw 4,949 threats per day from January 2020 to present.  In general, we see larger scale attacks against Senate candidate’s sites than those of House candidates.

Election Cybersecurity: Preparing for the 2020 U.S. Elections.

As the election season has progressed, we’ve also seen an increase in the average number of attacks against political campaigns, with a 187% increase from May to June 2020. As face to face campaigning is not an option, campaigns now rely on online platforms such as video conferencing software, online fundraising and social media to reach voters. This can present significant cybersecurity challenges to already vulnerable groups, such as political campaigns. Political campaigns are realizing the importance of cybersecurity services and have begun working with state parties and committees on training on the types of cyber threats and widely available resources for campaigns. With basic cybersecurity hygiene training on issues such as password security, two factor authentication, identifying phishing scams, network protection, internal application security and social media privacy, campaign staff are less likely to be the victims of a data breach.

Election Cybersecurity: Preparing for the 2020 U.S. Elections.

There has been a notable amount of DDoS activity against political campaign websites. DDoS attacks, which can be cheap, easy to organize and highly destructive, are often used for targeting political campaigns. A DDoS attack that takes down a campaign’s website during critical times can severely disadvantage a website. Campaigns used rate limiting to address 63% of the cyber threats they experienced, suggesting that DDoS attacks remain a significant concern.

Securing Elections in 2020

Democracies rely on access to information and trust in government institutions, especially during a crisis. Reflecting this reality, elections officials are more aware and focused on reliability and resilience than ever before. Likewise, political campaigns are increasingly aware of the potential risks of DDoS activity and other cyber threats.

As COVID-19 continues to spread, it puts further pressure on ensuring that the Internet can be used to access and share election information. At Cloudflare, we believe that expanding access to tools that election officials and political candidates need to combat a range of online threats both serves our mission to help build a better Internet and strengthens our democracy.

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

Post Syndicated from Jocelyn Woolbright original

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

Consistent with our mission to “help build a better Internet,” Cloudflare believes that one of the most important roles for the Internet is to empower marginalized voices that may not be heard, or bring together oppressed groups of people that may otherwise find themselves isolated and alone. Six years ago, Cloudflare started Project Galileo to provide free services to vulnerable nonprofits, journalism and independent media voices online who might otherwise be in danger of being silenced by cyberattacks. Much has changed in the past couple of months as the COVID-19 pandemic has transformed the world while the United States faces a wave of protests addressing racial violence and inequality. These events have put further strain on vulnerable groups working in these spaces, and we have seen many organizations step up to ensure that those who are most affected by these circumstances are protected. At Cloudflare, we believe that protecting these groups from attack is essential to helping build a better Internet.

We are excited to mark the 6th anniversary of the project this month, and it is a good time for us to reflect, talk to participants, and see how the Project has grown and changed over the course of the previous year. This year, the spread of COVID-19 and the global response to the pandemic has shown us new ways that Project Galileo can help. Our goal for the 6th anniversary of Project Galileo is to share updates and stories from the field from organizations that have stepped up in this time of uncertainty.

Earlier this week, we published a blog post on the increase in cyberattacks on advocacy organizations fighting racism. We believe that these stories of racial injustice in the United States need to be heard and we are committed to ensuring groups working in fighting racism, promoting inclusiveness and diversity get the protections they need. While we will continue to update on those ongoing events, we want to take the time to share additional stories from heroes in Project Galileo.

A year ago, we reported that we were protecting nearly 600 organizations and partnering with 28 civil society organizations to identify and provide services to politically and artistically vulnerable entities on the Internet. A single year has brought us more than a 60 percent increase in the total number of participants in the project, with more than 1,000 participants currently receiving Cloudflare’s security protections in every region of the world.

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

We’ve also added eight new civil society partners, working in areas from promoting the arts to aiding democratic movements to protecting human rights. Since we rely on our partners to identify and approve requests from important organizations working in these areas, expertise that we simply don’t have, one of our goals in the last year was to increase our partnerships with civil society organizations to expand our protections in new geographic regions. We are constantly looking for partners around the world to identify at-risk groups to ensure they have the tools they need to stay online. Our new partners on Project Galileo are:

  • Center for International Media Assistance & National Endowment of Democracy
  • DefendDefenders
  • Freedom House
  • International Republican Institute
  • Open Briefing
  • PEN America
  • The Carter Center
  • The Internet Society

One of our new partners, The Carter Center, joined the Project as a partner in September 2019. The Carter Center works in 80 countries in areas such as election monitoring, democratic institution-building, and supporting human rights defenders. With their expertise in promoting human rights, we knew they would be an important addition to help identify at-risk organizations in need of our security protections.

“Project Galileo plays a crucial role in helping to safeguard election observers, human rights activists, and independent media from malicious actors that aim to silence their voices.”

Michael Baldassario, the Sr Advisor on Digital Threats to Electoral Integrity for the Carter Center

On the anniversary, we’d like to share in this section the stories of our participants, to provide some insight of the variety and commitment of organizations trying to do good during a time of significant adversity, and how ongoing access to the power and scope of the Internet plays an essential role in doing that work.

Before we talk about the general groups of websites that participate in the Project, we think it’s worth taking a moment to highlight a couple of organizations that specifically work on COVID-19 relief efforts.

COVID-19 Relief Efforts

In the past couple months, we have seen an increase in applications for Project Galileo related to COVID-19 relief efforts from entities that have spearheaded initiatives such as symptom tracking sites, personal protective equipment donation, DIY mask creation and other related efforts. One of these groups is CoronaSafe. CoronaSafe is a guide and collection of tools built as an open-source public utility for the Kerala State government in India on how to stay safe during the pandemic. These projects include access to information available for tracking the spread of COVID-19, telemedicine options, food delivery networks, tracking hospital capacity, ambulance networks and maps of COVID-19 hotspots in the Kerala region. They joined Project Galileo in March 2020 and in two weeks they launched 20 projects in multiple languages.

“We’re seeing thousands of new visitors each week that are looking for information and resources about COVID-19 across our multiple domains. We’ve seen attacks trying to get to us and huge spikes in traffic since March when we launched, and Cloudflare has kept us up and running through it all.”

Bodhish Thomas, CoronaSafe

In Germany, we have seen initiatives such as Digital Waitingroom, a platform that simulates a doctor’s visit, providing information on symptoms associated with COVID-19. The platform implements interfaces to information services, health authorities, medical practices, hospitals, laboratories, databases, and other digital processes in order to handle the tasks with the least possible effort and the highest possible transparency for the patient.

In the education space, Freifunk Munich joined Project Galileo in March of 2020 as it started creating an online conference system specifically for families during COVID-19.

“When COVID-19 sprung up, we launched a video conferencing service for schools so that they could access online learning. Almost immediately we saw an increase in DDoS attacks that threatened to take down our whole operation.”

Annika Wickert, Freifunk Munich

Education and teaching have moved online as many schools and universities race to adopt e-learning alternatives. The FBI’s Internet Crime Complaint Center (IC3) warned that attackers could take advantage of COVID-19 by increasingly targeting virtual environments, including those utilized by school districts.

In Australia, #BeatCovid19Now was accepted into the project in March 2020. #BeatCovid19Now is a symptom tracker led by researchers at the Centre for Global Health and Equity with help from data scientists at the Swinburne University of Technology. The tracker provides daily symptom tracking while collecting information for research purposes to help future decision-makers, health authorities, and researchers to better understand pandemics.

“Our team was able to distribute our Covid-19 symptom tracker internationally and concentrate on predicting and preventing outbreaks without worrying about malicious attacks that might expose sensitive information to hackers. The integration was seamless and until I was receiving the reports I hadn’t appreciated just how important it was to employ such a service.”

Matthew Bailes, Professor and the Director of the ARC Centre of Excellence for Gravitational Wave Discovery.

The website handles sensitive information, and with SSL encryption and web application firewall, they are easily able to secure this information against cyberattacks with Cloudflare.

Social Welfare and Community Building Organizations

Approximately 35% of Project Galileo participants work in social welfare and community building, education, environment/disaster relief, and global health. Since the spread of COVID-19, many of our Project Galileo participants in this space have shifted their attention to relief efforts – delivering essential personal protective equipment, emergency food distributions, and assisting front line defenders in the regions hit hardest by the virus.

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

One of these organizations is The Water Project, which joined Project Galileo in 2017. The organization was founded in 2007 with the mission of providing reliable access to clean water and proper sanitation in communities in sub-Saharan Africa. Since April 2020, The Water Project has expanded its scope in health and hygiene work to include COVID-19 prevention training in more than 700 communities in the region.

Although it may defy logic based on the nature of their work, the project needs protection against cyberattacks that seek to disrupt their operations.

“Our website is where all of our donors, team members, partners, and communities come together to learn about our work, manage project data, track impact and performance, and offer support. If it doesn’t work, we don’t work and the communities we serve suffer.”

Peter Chasse, President and Founder of The Water Project

During the pandemic, we are also supporting many organizations that work in providing emotional support through hotlines and mental health services, such as The MIX UK, who has been a member of the project since 2017. In response to the pandemic, The Mix is extending its services to phone, chat, and online helplines while also providing a series of resources available to young people with information on how to cope during the pandemic.

Similarly, Samaritans, a charity working in the United Kingdom and Ireland with over 20,000 volunteers and 200 branches, recently joined Project Galileo. Samaritans provide round-the-clock emotional support and campaigns to make suicide prevention a national and local priority. In their application for Project Galileo, they requested an onboarding session for Cloudflare for Team products as all their volunteers are working from home due to the coronavirus outbreak.

“Cloudflare for Teams enables staff to continue to securely access and maintain our highly critical systems, and ensure that we can continue to provide emotional support to people in desperate need.”

Francis Bacon, Asst Director, Digital Services and Change of Samaritans

Due to the spread of COVID-19, many people have had to change their daily routine while managing the fear of contracting the virus. In the eight weeks since lockdown in the UK, Samaritans has provided emotional support to more than 400,000 people with 1 in 3 people mentioning COVID-19 related anxiety, as is the common theme among many of the calls. These types of emotional support services are essential to many people’s livelihood and working to ensure that people have the tools they need to alleviate their suffering is crucial.

Environmental Organizations

Approximately 5% of Project Galileo participants are nonprofit organizations with an environmental focus.

Citizens of the Great Barrier Reef, for example, has been protected under Galileo since the organization’s launch in 2017. Citizens of the Great Barrier Reef is an environmental conservation organization with an important mission, to conserve, protect, and restore the Great Barrier Reef through public engagement and service. With only four full-time employees based in Cairns, Australia, the organization utilizes the internet to extend reach and rally thousands of people to join their mission. Cloudflare’s caching features has allowed the organization to reduce bandwidth costs, which is incredibly important for organizations working on restricted budgets, and secure their origin server from large bursts of traffic or malicious actors attempting to access the website.

“Under Project Galileo, we can remain fully operational as a web-fronted organization with a small team and the budget of a local cafe.

Som Meaden, Technologist at the Citizens of the Great Barrier Reef

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

Independent media and journalism

Nearly a quarter – 23 percent – of the organizations participating in the Project are related to journalism and independent media.  At the beginning of the COVID-19 pandemic, we saw a significant increase in traffic to journalism and media sites under Project Galileo. National and local media sites have been crucial in providing authoritative information during the pandemic and providing efficient updates on virus mitigation efforts and community developments.

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

The importance of securing independent media and journalism sites from cyberattacks is crucial for organizations under Project Galileo, especially during a time where accurate information is critical.

“Amid the COVID-19 global health crisis, independent news outlets in many countries have reported an uptick in cyberattacks aimed at pulling them offline. These attacks are most likely coming from increasingly sophisticated authoritarian regimes that are targeting them for their factual reporting, which often exposes the government’s mishandling of the pandemic.”

Daniel O’Maley, Digital Policy Specialist at the Center of Intl Media Assistance at the National Endowment for Democracy

CIMA/NED recently joined Project Galileo as a partner and has helped identify and support these groups to ensure the free flow of information.

Civil Society and NGO

Civil society and non-governmental organizations make up 16% of organizations under Project Galileo.

For the International Policy Center for Inclusive Growth, a global forum that brings together economists, political scientists, and experts in the field of international relations to help fight global poverty and reduce inequality in the Global South, the security of their web infrastructure is a top priority. Since the beginning, they have had more than 7.6 million downloads of their policy publications in over 179 countries. When they launched their online, member-based knowledge sharing and capacity building platform in 2019, they suffered a DDoS attack. The site was dealing with extended bouts of downtime and unreliability in a particularly sensitive time — an online training on social policies was about to be offered to dozens of participants in sub-Saharan Africa. With a rising profile, IPC-IG contacted Cloudflare to prevent attacks on its website.

“In a matter of hours, IPC-IG’s website was not only protected from attacks but protected at no cost.”

Patricia Cavallari, Sr Knowledge Management Assistant at IPC-IG.

Currently, through their online platform, Social Protections, an inter-agency task-force to map social protection responses to the COVID-19 crisis, they are gathering resources and promoting webinars to discuss policy alternatives.

Cloudflare’s Commitment to Protect

Since 2014, we have promised to protect organizations working in these spaces to ensure they are not censored or taken offline by cyberattacks. Although the world has changed dramatically,  we continue to stand by our promise to protect these organizations and ensure they have the tools they need to stay online. If you are an organization looking for protection under Project Galileo, please visit our website:

Project Galileo’s 6th year Anniversary: The Impact of COVID-19 on the most vulnerable groups on the Internet

Offer of Assistance to Governments During COVID-19

Post Syndicated from Jocelyn Woolbright original

Offer of Assistance to Governments During COVID-19

Offer of Assistance to Governments During COVID-19

As the COVID-19 emergency continues to affect countries and territories around the world, the Internet has been a key factor in providing information to the public. As businesses, organizations and government agencies adjust to this new normal, we recognize the strain that this pandemic has put on the groups working to assist in virus mitigation and provide accurate information to the general public on the state of the pandemic.

At Cloudflare, this means ensuring that these entities have the necessary tools and resources available to them in these extenuating circumstances. On March 13, we announced our Cloudflare for Team products will be free until September 1, 2020, to ensure Cloudflare users and prospective users have the tools they need to support secure and efficient remote work. Additionally, we have removed usage caps for existing Cloudflare for Teams users and are also providing onboarding sessions so these groups can continue business in this new normal.

As a company, we believe we can do more and have been thinking about ways we can support organizations and businesses that are at the forefront of the pandemic such as health officials and those providing relief to the public. Many organizations have reached out to us with COVID-19 related initiatives including the creation of symptom tracking websites, medical resource donations, and websites focused on providing updates on COVID-19 cases in specific regions.

During this time, we have seen an increase in applications for Project Galileo, an initiative we started in 2014 to provide free services to organizations on the Internet including humanitarian organizations, media sites and voices of political dissent. Project Galileo was started to ensure these groups stay online, as they are repeatedly targeted due to the work they do. Since March 16, we have seen a 40% increase in applications for the project of organizations related to COVID-19 relief efforts and information. We are happy to assist other organizations that have started initiatives such as these with ensuring the accessibility and resilience of their web infrastructure and internal team.

Offer of Assistance to Governments During COVID-19

Risks faced to Government Agencies Web Infrastructure due to COVID-19 pandemic

As COVID-19 has disrupted our lives, the Internet has allowed many aspects of our life to adapt and carry on. From health care, to academia, to sales, a working Internet infrastructure is essential for business continuity and the dissemination of information. At Cloudflare, we’ve witnessed the effects of this transition to online interaction. In the last two months, we have seen both a massive increase in Internet traffic and a shift in the type of content users access online. Government agencies have seen a 100% increase in traffic to their websites during the pandemic.

Offer of Assistance to Governments During COVID-19

This unexpected shift in traffic patterns can come with a cost. Essential websites that provide crucial information and updates on this pandemic may not have configured their systems to handle the massive surges in traffic they are currently seeing. Government agencies providing essential health information to citizens on the COVID-19 pandemic have temporarily gone offline due to increased traffic. We’ve also seen examples of public service announcements and the sites of local governments providing unemployment resources unable to serve their traffic. In New Jersey, New York and Ohio, websites that provide unemployment benefits and health insurance options for people who have recently been laid off have crashed due to large amounts of traffic and unprecedented demand.

Offer of Assistance to Governments During COVID-19
To help process claims for unemployment benefits, New Jersey’s Department of Labor & Workforce Development has created a schedule for applicants.

During the spread of COVID-19, government agencies have also experienced cyberattacks.

The Australian government’s digital platform for providing welfare services for Australian citizens, known as Mygov, was slow and inaccessible for a short period of time. Although a DDoS attack was suspected, the problems were actually the result of 95,000 legitimate requests to access unemployment benefits, as the country recently doubled these benefits to help those impacted by the pandemic.

COVID-19 Government Package

Cloudflare has helped improve the security and performance of many vulnerable entities on the Internet with Project Galileo and ensured the security of government related election agencies with the Athenian Project. Our services are designed not only to prevent malicious actors from disrupting a website, but also to protect large influxes of legitimate traffic. In light of recent events, we want to help state and local government agencies stay online and provide essential information to the public without worrying their site can be taken down by malicious or unexpected spikes in traffic.

Therefore, we are excited to provide a free package of services to state and local governments worldwide until September 1, 2020, to ensure they have the tools needed to secure their web infrastructure and internal teams.

This package of free services includes the following features:

  • Cloudflare Business Level services: Includes unmetered mitigation of DDoS attacks, web application firewall (WAF) with up to 25 custom rulesets, and ability to upload custom SSL certificates.
  • Rate limiting: Rate Limiting allows users to rate limit, shape or block traffic based on the rate of requests per client IP address, cookie, authentication token, or other attributes of the request.
  • Cloudflare for Teams: A suite of tools to help ensure that those working from home can ensure continuity.
    • Access: To ensure the security of internal teams, Cloudflare Access, allows for organizations to secure, authenticate, and monitor user access to any domain, application, or path on Cloudflare, without using a VPN.
    • Gateway: Uses ​DNS filtering to help protect users from phishing scams or malware sites at multiple locations.​

To apply for our COVID-19 government assistance initiative, please visit our website at

We are also making this offer available for Cloudflare channel partners around the world to help support government agencies in their respective countries during this challenging time for the global community.  If you are a partner and would like information on how to provide Cloudflare for Teams, a Business Plan and Rate Limiting at no charge, please contact your Cloudflare Partner Representative or email [email protected].

What’s Next

The news of COVID-19 has transformed every part of our lives. During this difficult time, the Internet has allowed us to stay connected with friends, family, and provide resources to those in need. At Cloudflare, we are committed to helping businesses, organizations and government agencies stay online to ensure that everyone has access to authoritative information.

Why the 100th Anniversary of Women’s Right to Vote in the U.S. is Important to Celebrate on International Women’s Day

Post Syndicated from Jocelyn Woolbright original

Why the 100th Anniversary of Women’s Right to Vote in the U.S. is Important to Celebrate on International Women’s Day

Why the 100th Anniversary of Women’s Right to Vote in the U.S. is Important to Celebrate on International Women’s Day

Seven months ago, I joined Cloudflare to work on the Public Policy Team focusing on our democracy projects such as Project Galileo, Athenian Project and Cloudflare for Campaigns. Since I joined the team, I have learned a lot about how important cybersecurity protections are for organizations that are the target of sophisticated cyberattacks, while also learning about the complex election security environment in the United States and abroad.

It seems fitting that on International Women’s Day, a day people throughout the world are celebrating the achievements of women, we also celebrate the Centennial Anniversary of the Women’s Suffrage Movement which was the tipping point that gave many women voting rights in the United States.

Since I have been working on Cloudflare’s election security projects, this day means something extra special to me and many of my colleagues who believe that voting is the cornerstone of democracy and that having access to information regarding voting and elections is essential.

Why the 100th Anniversary of Women’s Right to Vote in the U.S. is Important to Celebrate on International Women’s Day

Here are five reflections that I want to share on International Women’s Day and the Centennial Anniversary of the Nineteenth Amendment which granted women the right to vote in the United States:

1. The Women’s Suffrage Movement in the United States was a decades-long battle

The Women’s Suffrage movement burst into view in the United States in 1848 at the Seneca Falls Convention, where participants introduced the notion that women deserved their own political identity and that a righteous government cannot exist without equal rights for all. These organizers passed the torch to the Congressional Union for Woman Suffrage, founded in 1913, which raised awareness through distributing pamphlets at street meetings, organizing parades, speaking tours, and petitioning Congress to pass legislation on the movement. In 1919, the Senate passed the Nineteenth Amendment and it was officially ratified on August 26, 1920.

2. Due to racial inequality, many women of color in the United States were not granted the right to vote until 1965

With the ratification of the Nineteenth Amendment in 1920, it technically granted women the right to vote. However, due to widespread inequality within the ranks of the women’s suffrage movement who primarily focused on white middle-class interests, many African Americans, Asian Americans, Hispanics, and American Indian women did not receive the right to vote until later in the century. African American women were not guaranteed the right to vote until the Voting Right Acts of 1965. During the height of the civil rights movement, The Act was signed into law by President Lyndon Johnson to prohibit racial discrimination in voting.

Why the 100th Anniversary of Women’s Right to Vote in the U.S. is Important to Celebrate on International Women’s Day

3. There has been a historical, global increase of women in political power

Much has changed since the ratification of the Nineteenth Amendment. The Center for American Women and Politics in the United States reports that in every presidential election since 1964, the number of female voters has exceeded the number of male voters.

There has also been a historical increase of women in elected offices around the world. This is evident with the highest number of women ever elected to the U.S. Congress in 2018, Slovakia electing the first female president, the United Kingdom electing 220 female MPs to the House of Commons, women making up 49% of Senate of the Republic of Mexico and female Prime Ministers in Denmark, Norway, and Finland. Foundationally, the right to vote is a nonpartisan issue that benefits the interest of the country, strengthens our democracy, and with more women in office, it promotes diversity of thought and experience.

4. The spread of voting and election information has changed

The way we share information has evolved dramatically from distributing pamphlets in 1913 to millions of people sharing information on the Internet across the world in 2020. State and local governments now use their election websites as the primary source to provide up to date announcements and information on how to register to vote, find designated polling stations, and access election results. Political campaigns use their digital infrastructure to release information about their policies, accept donations, recruit volunteers and give updates on the campaign to increase supporters’ engagement.

5. Access to election information is essential to voter turnout and democracy.

Voting is a crucial tenet of our democratic system and regardless of circumstance, individuals should have access to the information necessary to exercise their rights without outside interference. At Cloudflare, our mission is to build a better Internet and part of that is ensuring that users have access to accurate, trusted information, in a safe environment. With many upcoming elections in 2020, it is important that we have confidence in the democratic processes and that starts with ensuring their website infrastructure and internal teams are secure against malicious efforts to take them offline and shake voter’s faith in democracy.

Cloudflare has made election security a priority, investing our time in the Athenian Project and Cloudflare for Campaigns as political campaigns and state and local government election websites are the first line of defense in election security. In 2016, it was reported by the Department of Homeland Security that state and local government election infrastructure in all 50 states were targeted during the Presidential election. Fast forward to 2020, we are protecting more than 170 state and local government election websites and providing services to 18 of the 32 U.S. Presidential campaigns.

Therefore, it seems fitting that we celebrate the Centennial anniversary of the Nineteenth Amendment and International Women’s Day, highlighting the achievement of women throughout history and the importance of voter confidence in the democratic institutions that many fought to participate and have their voices heard.

Working at Cloudflare has allowed me to learn how important access to information is to Internet users, and voters across the world, and I am proud to work for a company that supports strengthening democracy.

If you are interested in learning more about our election project, please visit &

The Two-Year Anniversary of The Athenian Project: Preparing for the 2020 Elections.

Post Syndicated from Jocelyn Woolbright original

The Two-Year Anniversary of The Athenian Project: Preparing for the 2020 Elections.

The Two-Year Anniversary of The Athenian Project: Preparing for the 2020 Elections.

Two years ago, Cloudflare launched its Athenian Project, an effort to protect state and local government election websites from cyber attacks. With the two-year anniversary and many 2020 elections approaching, we are renewing our commitment to provide Cloudflare’s highest level of services for free to protect election websites and ensure the preservation of these critical infrastructure sites. We started the project at Cloudflare as it directly aligns with our mission: to help build a better Internet. We believe the Internet plays a helpful role in democracy and ensuring constituents’ right to information. By helping state and local government election websites, we ensure the protection of voters’ voices, preserve citizens’ confidence in the democratic process, and enhance voter participation.

We are currently helping 156 local or state websites in 26 states to combat DDoS attacks, SQL injections, and many other hostile attempts to threaten their operations. This is an additional 34 domains in states like Ohio, Florida, Kansas, South Carolina and Wisconsin since we reported statistics after last year’s election.

The need for security protection of critical election infrastructure is not new, but it is in the spotlight again as the 2020 U.S. elections approach, with the President, 435 seats in the U.S House of Representatives, 35 of the 100 seats in the U.S. Senate, and many state and local representatives on the ballot. According to the Department of Homeland Security and Federal Bureau of Investigations, election infrastructure in all 50 states was targeted during the 2016 presidential election. The risk is real. Florida counties suffered a spearfishing attack that gave hackers access to the voter registration rolls, and a Tennessee county website was knocked offline on election night and had to resort to handing out printed election vote counts.

Although the U.S government has sought to combat malicious actors that target election infrastructure, with Congress approving funding of $250 million for states in the administering and security of U.S elections in September 2019, there is always more to be done. As states rapidly prepare for the upcoming elections, the need for inexpensive, accessible solutions to protect election infrastructure are at an all-time high. As Micah Van Maanen, the Information Technology Director for Sioux County, Iowa, put it:

The Two-Year Anniversary of The Athenian Project: Preparing for the 2020 Elections.

At Cloudflare, we believe it is vital to the national interest that elections are secure and free from interference as these fundamentals are essential to United States democracy. In these two years, we have learned a great deal about government election offices all across the U.S, the spread of information and resources available to them, and the small number of people it takes to make an impact in the protection of election infrastructure.

We still have more to learn to ensure the protection of these critical sites and understanding how we can better prepare state and local election websites for the upcoming elections. As we look into the future of the project in upcoming years, it is important to also look at the past.

Stories from the Field:

The jurisdictions that are using Cloudflare to protect their election websites are diverse, with state and local governments representing a range of populations from over 1.2 million residents to fewer than 5,000 residents.

The Two-Year Anniversary of The Athenian Project: Preparing for the 2020 Elections.
I Voted Stickers- Element 5 Digital on Pexels

In Ohio, the Secretary of State released their yearly state directive in June 2018 and 2019, to all counties in Ohio Board of Elections on tools, resources and best cybersecurity practices to strengthen the security of their election system. The Athenian Project was recommended and encouraged in both directives for the DDoS protection, Web Application Firewall, Rate Limiting, Under Attack Mode and 24/7 support. During this past year- we have on-boarded 13 counties in Ohio with a total of 27 domains protected under Cloudflare. In the directive, Ohio plans to become the leader in best practices in the security of elections systems and we are happy to be aiding in this mission.

The Idaho Secretary of State joined the Athenian Project at the beginning of 2018 and Chad Houck, Idaho’s Chief Deputy Secretary of State, engaged with our team on how exactly the Secretary of State could benefit from Cloudflare services.

On May 11, 2018, two of Idaho’s state agency websites were defaced by an anti-government group that posted a manifesto in Italian. After receiving notifications from many different sources regarding the security breach and following several inquiries from the press regarding the matter, Chad decided to look at the Idaho Secretary of State Cloudflare account to see if there was any evidence of the same hackers trying to penetrate the IDSOS site. Using Cloudflare’s analytic tools, he was able to see 27,000 blocked requests, up from the normal 240 per day,  within the same 3.5-hour window that saw the other sites defaced. Cloudflare’s Web Application Firewall had automatically blocked the bad requests that attempted to penetrate the site.

Confident in the value of Cloudflare’s tools, Deputy Secretary Houck’s plan is to create policies of operation that assist Idaho’s 44 counties in protecting their election websites and statewide voter registration systems. “With the first two counties already on board for a pilot, our goal is to be the first state to reach 100% county adoption of the Athenian Project tools.”

Understanding the U.S. Electoral System & Athenian Project Expansion:

The United States election system is fragmented and varies greatly from state to state. In some states, the administration of elections is covered by the state government and, in others, by counties or local municipalities. This system is decentralized, meaning that each state and local government has control over how the various duties of elections are distributed. According to the National Conference of State Legislators, “there are more than 10,000 election administration jurisdictions in the U.S. The size of these jurisdictions varies dramatically.” This means the voting experience differs from county to county, and from state to state.

The Two-Year Anniversary of The Athenian Project: Preparing for the 2020 Elections.
Photo by Brandon Mowinkel on Unsplash

This system fragmentation has been a challenge for the Athenian project. In the process, we have learned that state and local government election offices range on technical abilities and funding. With this in mind, our teams at Cloudflare are looking into new ways to engage the community. Among our efforts, we aim to interact with election security information sharing centers that provide recommendations and resources for election infrastructure to strengthen cybersecurity practices. Doing this helps state and local entities prepare for the upcoming election.

What’s Next:

As we have a year until the 2020 election, we are thinking of how we engage with our current Athenian participants and expand access to Cloudflare services to new states and counties within the United States that might benefit from the Athenian Project. A key aspect that we have learned in this process is that the security of election websites sits with a small group of dedicated government officials that have found each other and built their own networks to share best cybersecurity practices.

In response to my question to Athenian participants in the onboarding process about how they discovered the project and Cloudflare, many of the answers I receive are similar: they heard about the project from another county, neighboring state, or information sharing centers that recommend using Cloudflare services as an extra layer of protection on their election infrastructure. Rodney Allen, the Executive Director for the Board of Voter Registration & Elections of Pickens County, South Carolina says that “the great thing about the Athenian Project is that Pickens County Board of Elections site has not experienced any downtime or outages thanks to Cloudflare, especially during South Carolina’s 2018 general election and special elections in 2019.”

As we set our sights for the 2020 election, we are happy to help provide these state and local governments with the tools they need to protect their election websites. If you run a state or local election website, feel free to reach out through our webform or read more about how our Athenian Project can help secure your online presence.