Ethical Hacking News
Election Website Security: A Persistent Threat to Democracy
A recent study by Mysterium VPN has revealed that 42% of US county sites still lack the .gov domain, leaving voters vulnerable to security threats. The study found that larger counties had made more progress in securing their websites, but many still lack basic security measures. This article provides an in-depth look at the study's findings and recommendations for counties and voters to prioritize election website security.
42% of US county election websites lack the .gov domain, leaving voters vulnerable to security threats. 28% of residents in counties with non-.gov domains are living in areas with unsecured election websites. 23% of county election pages lack DMARC records, making them vulnerable to domain spoofing. 84% of county election websites contact at least one tracking company, raising concerns about data collection. Counties must prioritize election website security, including moving to .gov domains and enforcing email authentication policies.
The November 3rd US election is fast approaching, and millions of Americans will rely on county election websites to check their registration, find polling places, or track ballots. However, a recent study by Mysterium VPN has revealed that 42% of US county sites still lack the .gov domain, leaving voters vulnerable to security threats.
The study, which examined 2,081 county election websites across the United States, found that larger counties had made more progress in securing their websites, with only 28% of residents living in counties whose election pages used non-.gov domains. Texas, in particular, accounted for 169 non-.gov sites, including 134 using the older co..tx.us structure.
The use of non-.gov domains can make it difficult for voters to distinguish between official government websites and malicious imitations. This is particularly concerning, given the FBI and CISA's previous warnings about the use of fake election websites to spread false information and collect personal data.
The study also found that 23% of county election pages lacked DMARC records, while 28% used a monitoring-only policy that does not request quarantine or rejection of unauthenticated messages. This means that up to 51% of domains without an enforced DMARC policy may still be vulnerable to domain spoofing.
Furthermore, the researchers identified 28 websites with consistent HTTPS failures, 15 of which lacked a working HTTPS service altogether. This highlights the need for counties to ensure that their websites use secure connections to protect voter data.
Another concerning finding was the presence of third-party connections on many county election websites. 84% of the measured pages contacted at least one company identified as a tracker by Disconnect or DuckDuckGo, with 60% of websites using Google Analytics or Tag Manager.
While some tracking results may come from default settings in website platforms, the researchers suggest that counties should review whether these connections are necessary on pages designed to provide basic voting information.
The study's findings are a reminder that election website security is a persistent threat to democracy. Counties must take steps to secure their websites, including moving to .gov domains, enforcing email authentication policies, and configuring HTTP-to-HTTPS redirects and HSTS.
For voters, the report recommends starting with the state election office listed on USA.gov and following its link to the relevant county website. They should also avoid trusting unsolicited messages or plausible-looking search results without checking the destination.
In conclusion, the study's findings highlight the need for counties to prioritize election website security. By taking steps to secure their websites, counties can protect voter data and prevent potential security threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Election-Website-Security-A-Persistent-Threat-to-Democracy-ehn.shtml
https://securityaffairs.com/201967/security/election-website-security-42-of-us-county-sites-still-lack-gov-domains.html
Published: Thu Oct 29 05:17:19 2026 by llama3.2 3B Q4_K_M
