Where’s the evidence midterms weren’t hacked?

With help from Eric Geller, Jordyn Hermani and Martin Matishak

Editor’s Note: This edition of Morning Cybersecurity is published weekdays at 10 a.m. POLITICO Pro Cybersecurity subscribers hold exclusive early access to the newsletter each morning at 6 a.m. To learn more about POLITICO Pro’s comprehensive policy intelligence coverage, policy tools and services, click here.

— Sen. Ron Wyden wants to know how Trump administration officials can say there is no evidence of hackers affecting midterm election results, since they can’t force states to submit to forensic examinations of their voting machines.

— Industries holding trillions in debt are at high risk of cyberattack, according to a report out today. Moody’s is still contemplating the credit ramifications of cyber risk.

— Ticket scalper bots are growing both more sophisticated and widespread, new research found. In particular, bots comprise nearly all secondary market traffic.

HAPPY THURSDAY and welcome to Morning Cybersecurity! Well, that took a turn. Send your thoughts, feedback and especially tips to [email protected], and be sure to follow@POLITICOPro and@MorningCybersec. Full team info below.

FIRST IN MC: NO EVIDENCE FOR ‘NO EVIDENCE CLAIM — Trump administration officials often say there’s no evidence that hackers infiltrated election equipment to change votes, but Sen. Wyden today challenged the claim in a letter to DHS. Wyden recently requested that DHS conduct forensic examinations of voting machines in states without a paper ballot backup, and the head of the department’s Cybersecurity and Infrastructure Security Agency, Chris Krebs, answered that it couldn’t mandate such searches.

“If the Trump Administration has not forensically analyzed voting machines across the U.S. it will have to be considered the height of irresponsibility and duplicity to suggest ‘no evidence’ of foreign hacking exists,” Wyden wrote in his letter to DHS Secretary Kirstjen Nielsen. “On what basis can the Administration make its claims regarding lack of evidence of foreign interference if it has not looked for it?”

Wyden also asked DHS a series of questions about how it assessed the likelihood of no election machine hacking and how many voting machines used in 2018 had known vulnerabilities. Krebs recently told POLITICO that states have proven willing to cooperate when DHS says, “There’s something we need to share with you; we need to go look at this.”

RISKY BUSINESSES — The banking, securities, financial system infrastructure and hospital sectors are at high risk from cyber threats, a significant problem given that they collectively hold nearly $12 trillion in rated debt, according to a report out today from the credit rating service Moody’s. Nine of the other 31 sectors that the firm evaluated were found to be at medium-to-high risk, including electric utilities, health insurance, telecommunications and media. Moody’s described cyber risk as “a rising tide” due to increasing supply chain complexity and attacker sophistication. “Our approach to quantifying the credit implications of cyber risk exposure is still evolving at the issuer level,” the company said.

Thursday’s report is the first Moody’s publication to examine cyber risk across various sectors since November 2015, a practically prehistoric time in the evolution of cybersecurity. Since then, Moody’s said, cyber incidents have yielded several key lessons: Attacks can spread rapidly and affect unexpected entities, as was the case with NotPetya; the duration of an event is important; “high-profile leaks of nation-state cyber weapons” have unexpectedly empowered criminal hackers and activists; and current regulations are inadequate because they mostly focus on the exposure of confidential personal data.

I’M NOT A ROBOT…? — Research out today from Distil Networks shows the presence of sophisticated scalper bots has jumped on ticket websites from 19 percent in 2017 to 31 percent in 2018. The advanced bots, which display more human-like characteristics that make them difficult to detect, are on the rise at the same time moderately sophisticated bots are on the decline because they’re easier to notice. This issue seems to be largely North American, with more than 67 percent of bad bot activity coming from the U.S. and another 18 percent from Canada.

Many of these bots scrape ticket information and mass-purchase tickets to sell them for a higher price, while some companies employ bots to provide tickets as incentives for consumers or employees. Overall, nearly 40 percent of the traffic at the 180 websites Distil examined was malicious. The worst bot activity was on secondary market sites, Distil Networks concluded, with bot traffic comprising 99 percent of activity of sites studied. While there isn’t a one-size-fits-all solution for the problem, Distil Networks recommends investing in CAPTCHA technology, keeping an eye on traffic spikes from routine sources and blocking known proxy services.

POLITICO PLAYBOOK: Wake Up. Read Playbook. Eat Lunch. Read Playbook PM. Repeat. Be in the Know. Sign up todayhere.

VEHEMENT VOTING VIEWS — Georgia lawmakers on Wednesday moved forward with a bill authorizing the state to deploy ballot-marking devices to replace the state’s paperless voting machines, as an activist group blasted the state’s chief election official for misleading comments about paper ballots.

The watchdog group Common Cause criticized Secretary of State Brad Raffensperger for a memo his office released Monday showing that the estimated cost of adopting paper ballots would be as high as $225 million over 10 years, or $75 million more than with BMDs. That estimate was based on a “highly inflated” estimate of the cost of each paper ballot, according to Common Cause. In addition, it included the cost of buying e-poll books, which Georgia is doing either way. Common Cause’s top Georgia staffer said the group had “grave concerns that the Secretary of State has not been honest with the public” about the true cost of BMDs.

At practically the same time, the Georgia House of Representatives passed a bill to prepare for the implementation of BMDs and sent it to the state Senate. Raffensperger’s office, which cheered the bill’s progress, did not respond to a request for comment on Common Cause’s criticism.

RECENTLY ON PRO CYBERSECURITY — Voters believe the eventual report from special counsel Robert Mueller should be made public. … The CBC reported that the International Civil Aviation Organization may have botched its response to historic cyberattack, though the group denied it. … A senior Republican appropriator argued against more federal money for election security. … An Illinois man who helped launch millions of DDoS attacks pleaded guilty in federal court. … California’s secretary of state set a deadline for counties to deploy secure, modern voting machines. … A suspected Chinese hacker group has updated some of its tools. … Hackers increasingly launch phishing attacks through websites encrypted with SSL certificates.

— The U.S. is the leading contributor of malicious URLs at 63 percent, Webroot concluded in a threat report released today. The company found 40 percent of malicious URLs on good domains, meaning legitimate sites are often being compromised.

— One in 10 spearphishing emails are blackmail or sextortion attacks, according to research out today from Barracuda Networks. More than half use the phrase “Security Alert” to get targets’ attention, and a similar number focus on employees in the education industry, the company found.

— The most prominent malware threats in 2018 were LokiBot, Pony and TrickBot, Gigamon revealed in a report out today. LokiBot and TrickBot were still top threats in the second half of 2018 but Emotet overtook them, the company concluded.

TWEET OF THE DAY — Ding ding ding!

— President Donald Trump’s former lawyer and fixer Michael Cohen said Trump had knowledge in advance that WikiLeaks would dump Democratic emails. POLITICO

— George Washington University’s National Security Archive obtained the operations order for Cyber Command’s support to the military’s battle against ISIL.

— Microsoft is collaborating with state-run Telecom Egypt to extend its cloud network in the country.

— “Nationwide lobbying push for contractor monitoring software alarms state CIOs.” StateScoop

— A researcher used the Vault 7 leak to build a hacking tool. CyberScoop

— Those Israeli spies are the gift that keep giving. The Associated Press

— “The Feds’ Favorite iPhone Hacking Tool Is Selling On eBay For $100—And It’s Leaking Data.” Forbes

— A Dow Jones watchlist of millions of people leaked. TechCrunch

— Some Pennsylvania counties are doing enhanced election audits. WKBN

That’s all for today.

Stay in touch with the whole team: Mike Farrell ([email protected], @mikebfarrell); Eric Geller ([email protected], @ericgeller); Martin Matishak ([email protected], @martinmatishak) and Tim Starks ([email protected], @timstarks).