Building a Vulnerability Disclosure Program that Works for Election Vendors and Hackers

Overview: Chris Wlaschin, CISO at Election Systems & Software (ES&S), and Mark Kuhr, CTO of Synack and former NSA operator, present the operational development of vulnerability disclosure programs (VDPs) within the election technology sector. Against the backdrop of Russian election interference in 2016 and 2018, the Department of Homeland Security (DHS) designated election infrastructure as critical infrastructure. The speakers discuss how election vendors, government bodies, and crowdsourced security researchers can overcome historical adversarial friction to establish structured, collaborative vulnerability reporting frameworks.

Key Topics: - The evolution of U.S. election infrastructure: from Florida 2000 hanging chads to DHS critical infrastructure designation - The spectrum of crowdsourced security: public VDPs, open bug bounties, private invite-only bounties, and managed crowdsourced pentesting - Government and industry initiatives: Hack the Pentagon, DARPA research, IT-ISAC coordination, and Microsoft ElectionGuard - Case studies in successful researcher collaboration, including remediating Citrix NetScaler vulnerabilities with researcher Jack Cable

Technical Details: The speakers chart the technological trajectory of modern election systems, tracing the transition from physical punch-card ballots following the 2000 Florida election to electronic tabulators, optical scanners, and centralized online voter registration databases overseen by the Election Assistance Commission (EAC). Following Russian cyber operations targeting state election systems during the 2016 and 2018 election cycles, DHS officially classified election infrastructure as national critical infrastructure. This designation accelerated collaboration between election equipment vendors and external researchers, modeled on defense sector crowdsourcing initiatives like the Department of Defense's Hack the Pentagon program.

Kuhr outlines the architectural hierarchy of crowdsourced security models available to critical infrastructure vendors. At the baseline is the standard Vulnerability Disclosure Program (VDP), functioning as a structured "see something, say something" framework that provides safe harbor guidelines for unsolicited external reporting without monetary incentives. The model matures into open public bug bounties offering financial payouts, followed by private, invite-only bounties where vetted researchers with specialized technical proficiencies test sensitive, non-public assets based on threat models. At the apex is managed crowdsourced penetration testing, which combines continuous open vulnerability discovery, automated scanning, and structured compliance testing (against frameworks like NIST SP 800-53 and PCI) with strict rules of engagement, analytics, and auditability.

Wlaschin provides operational examples of active researcher collaboration at ES&S and across state governments. In Colorado, Secretary of State CIO Trevor Timmons partnered with Synack to embed crowdsourced penetration testing directly into the state's election cybersecurity architecture. Wlaschin highlights real-world remediation workflows, citing an engagement with security researcher Jack Cable (known for work on Hack the Pentagon) during the December 2019 and January 2020 disclosure of critical Citrix NetScaler VPN vulnerabilities. Cable proactively alerted ES&S to exposed perimeter VPN infrastructure vulnerable to remote exploitation. ES&S collaborated directly with Cable to verify the affected appliances, validate patches and workarounds, and confirm remediation before malicious actors could compromise election environments.

Key Takeaways: Election technology providers and government agencies must establish clear Vulnerability Disclosure Programs with explicit safe harbor protections to facilitate legal, responsible vulnerability reporting. Managed crowdsourced penetration testing bridges the gap between static compliance checklists and active adversary emulation by utilizing vetted researcher communities under strict rules of engagement. Proactive collaboration between critical infrastructure vendors and independent researchers provides vital early warning for perimeter vulnerabilities such as enterprise VPN flaws.

(AI summary — Gemini Flash)