Expired Domains Leave Election Systems Exposed

With the U.S. Presidential election less than two weeks away, cybersecurity concerns remain elevated. Recent incidents and domain registration data show that basic infrastructure hygiene is still a weak point for election-related organizations.

On Monday, October 19, 2020, the website for Orange County, Florida’s Supervisor of Elections went down. The cause: the county failed to properly re-register its domain. The issue was resolved without further incident, but it highlights a broader problem.

Area 1 Security’s analysis of election-sensitive domains found four set to expire before Election Day on November 3, 2020:

  • albanywi.org — 2020-10-22
  • bcn.net — 2020-10-27
  • chesternh.org — 2020-11-01
  • bethlehemnh.org — 2020-11-02

Another 20 are scheduled to expire before the end of the year. That window matters: if election outcomes are contested or unresolved, those domains could be critical through the inauguration on January 20, 2021. The affected domains include:

  • arwhlaw.com — 2020-11-10
  • cityofcumberland.net — 2020-11-13
  • burnetcountytexas.org — 2020-11-14
  • antwerptownship.com — 2020-11-14
  • bessemermi.org — 2020-11-15
  • carsoncitymi.com — 2020-11-16
  • carrollcountyga.com — 2020-11-17
  • buttscounty.org — 2020-11-21
  • bridgeportmi.org — 2020-11-21
  • ci.superior.wi.us — 2020-11-27
  • bentcounty.net — 2020-12-04
  • cityofbr.org — 2020-12-06
  • birchruntwp.com — 2020-12-16
  • ci.emporia.va.us — 2020-12-18
  • hardeecountyelections.com — 2020-12-20
  • barrecity.org — 2020-12-23
  • alphacomm.net — 2020-12-24
  • andersoncountyks.org — 2020-12-26
  • broomecounty.us — 2020-12-27
  • hcnj.us — 2020-12-29

A full list of election-sensitive domain registrations is available on GitHub.

What Happens When a Domain Lapses

An unregistered domain creates two concrete risks for election integrity:

  1. An attacker who registers an expired election-sensitive domain can impersonate election officials and launch phishing campaigns from a legitimate-looking address.
  2. Critical voter information already published on the site can be altered or removed entirely.

Area 1 Security offers the following guidance:

  • Vote.
  • Domain owners should verify expiration dates immediately and renew domains for the maximum allowable registration period.
  • Review the earlier “Phishing Election Administrators” report for email security recommendations specific to election officials and administrators.