N Korean Hackers’ Heist from Taiwan Bank

Posted on October 18, 2017October 18, 2017 by Denise Simon

Taiwan Bank Heist Linked to North Korean Hackers

A recent cyber-heist that targeted a bank in Taiwan has been linked by security researchers to an infamous threat group believed to be operating out of North Korea.

Hackers exploited the SWIFT global financial network to steal roughly $60 million from Taiwan’s Far Eastern International Bank. The money was transferred to several countries, but bank officials claimed they had managed to recover most of it. Two individuals were arrested earlier this month in Sri Lanka for their role in the operation.

Researchers at BAE Systems have identified some of the tools used in the attack and found connections to the North Korean threat actor known as Lazarus. This group is also believed to be behind the 2014 attack on Sony Pictures and campaigns targeting several banks, including Bangladesh’s central bank.

The attack on the Bangladesh bank, which resulted in the theft of $81 million, also involved the SWIFT system. Similar methods were also used to target several other banks, but SWIFT said some of the operations failed due to the new security measures implemented by the company.

While it’s still unclear how attackers gained access to the systems of Far Eastern International Bank, an analysis of various malware samples apparently involved in the attack suggests that the hackers may have used a piece of ransomware as a distraction.

The ransomware involved in the attack is known as Hermes. According to Bleeping Computer, the threat surfaced in February and its latest version has an encryption mechanism that makes it impossible to recover files without paying the ransom.

However, researchers at McAfee discovered that the Hermes variant used in the attack on the Taiwanese bank did not display a ransom note, which led them to believe it may have been only a distraction.

“Was the ransomware used to distract the real purpose of this attack? We strongly believe so,” McAfee researchers said. “Based on our sources, the ransomware attack started in the network when the unauthorized payments were being sent.”

BAE Systems has seen samples that drop a ransom note in each encrypted folder, but even they believe Hermes may have been used to distract the bank’s security team.

Another malware sample linked by BAE Systems to this attack is a loader named Bitsran, which spreads a malicious payload on the targeted network. This threat contained what appeared to be hardcoded credentials for Far Eastern International’s network, which suggests the threat group may have conducted previous reconnaissance.

Some pieces of malware discovered by BAE Systems are known to have been used by the Lazarus group, including in attacks aimed at financial organizations in Poland and Mexico. The malware includes commands and other messages written in Russia, which experts believe is likely a false flag designed to throw off investigators.

It’s worth noting that the Hermes ransomware samples checked the infected machine’s language settings and stopped running if Russian, Ukrainian or Belarusian was detected. This is common for malware created by Russian and Ukrainian hackers who often avoid targeting their own country’s citizens. However, this could also be a false flag.

Another piece of evidence linking the Taiwan bank attacks to Lazarus is the fact that money was transferred to accounts in Sri Lanka and Cambodia, similar to other operations attributed to the group.

Some experts believe that these bank heists and the WannaCry attack, which has also been linked by some to Lazarus, are campaigns launched by North Korea for financial gain. However, many of these operations don’t appear to have been very successful on this front.

“Despite their continued success in getting onto payment systems in banks, the Lazarus group still struggle getting the cash in the end, with payments being reversed soon after the attacks are uncovered,” BAE Systems researchers explained.

“The group may be trying new tricks to disrupt victims and delay their ability to respond – such as different message formats, and the deployment of ransomware across the victim’s network as a smokescreen for their other activity. It’s likely they’ll continue their heist attempts against banks in the coming months and we expect they will evolve their modus operandi to incorporate new ways of disrupting victims (and possibly the wider community) from responding,” they added.

photo

*** Related reading: The Lazarus (aka DarkSeoul group) is allegedly controlled by Bureau 121, a division of the Reconnaissance General Bureau, a North Korean intelligence agency. Bureau 121 is responsible for conducting military cyber campaigns.

*** By the way, some of the North Korean hackers not only operate in China but many of those hackers are from India….

6,000 is the number of hackers working for North Korea, traced by American and British security officials.

Once scoffed at, North Korea’s cyber technology has now developed to a brink where it can create a havoc in the world’s cybersecurity. From theft to political agenda, North Korea now launches attacks in the form of ransomware, digital bank heists, online video game cracks and Bitcoin exchanges.

In the first week of October, India’s Ministry of External Affairs issued a strongly-worded statement condemning North Korea for conducting a powerful nuclear test. Few weeks down the line, a stunning report from the New York Times claims that India serves as a base for North Korea’s cyber warfare.

Citing a report by the Recorded Future, the American publication said nearly a fifth of the Pyongang’s attacks originate from India.

The report claims that most of North Korean cyber operations are carried out from foreign countries like India, Malaysia, New Zealand, Nepal, Kenya, Mozambique, and Indonesia. While in some cases, the North Korean hackers route their attacks through their computers from abroad, in cases like that in India, hackers are physically stationed to carry out attacks.

The cyber mission as envisaged by Kim Jong-il in the 1990s was expanded by his dictator son Kim Jong-Un after he took power in 2011.

On of the most successful cyber attacks carried out by North Korea dates back to 2014 on Sony pictures to prevent them from releasing a comedy film that was based on the assassination of Kim Jong Un.

Last May, a widespread global ransomware attack caused panic and briefly stalled the Britain’s National Health Services.

The digital bank heists in Philippines in 2015 and in Vietnam in the same year also earned them some hard cash from cyber attacks.

The report by Recorded Future also indicates that India, despite serving as a base for North Korea’s cyberwar, also remains at a potential threat from similar attacks. While the world lives under the fear of North Korea emerging as a nuclear superpower, the country is silently building a strong brigade of hackers.

Scope of Russian Troll Operation Explained

Posted on October 17, 2017October 17, 2017 by Denise Simon

Information warfare = Troll warfare

Russian journalists publish massive investigation into St. Petersburg troll factory’s U.S. operations

A day after Dozhd television published an interview with a former member of Russia’s infamous Internet Research Agency, the magazine RBC released a new detailed report on the same organization’s efforts to meddle in U.S. domestic politics. Meduza summarizes RBC’s new report here.

photo

The Internet Research Agency, Russia’s infamous “troll farm,” reportedly devoted up to a third of its entire staff to meddling in U.S. politics during the 2016 presidential election. At the peak of the campaign, as many as 90 people were working for the IRA’s U.S. desk, sources told RBC, revealing that the entire agency employs upwards of 250 people. Salaries for staff working in the U.S. department apparently range from 80,000 to 120,000 rubles ($1,400 to $2,100) per month.

The head of the IRA’s U.S. desk is apparently a man originally from Azerbaijan named Dzheikhun Aslanov (though he denies any involvement with the troll factory).

In August and September this year, Facebook, Instagram, and Twitter suspended 118 communities and accounts run by the St. Petersburg “troll factory,” disabling a network capable of reaching 6 million subscribers. In 2016, at the height of the U.S. presidential campaign, this network reportedly produced content that reached 30 million people each week.

A source also told RBC that the Internet Research Agency spent almost $80,000 over two years, hiring roughly 100 local American activists to stage about 40 rallies in different cities across the United States. The activists were hired over the Internet, communicating in English, without their knowledge that they were accepting money or organizing support from a Russian organization. According to RBC, internal records from the IRA verify its role in these activities.

The main activity in the troll factory’s U.S. desk was to incite racial animosity (playing both sides of the issue), and promoting the secession of Texas, objections to illegal immigration, and gun rights.

RBC estimates that the Internet Research Agency’s total salary expenses approach $1 million per year, with another $200,000 allocated to buying ads on social media and hiring local activists in the U.S.

According to RBC, the IRA still has a U.S. desk, though its staff has apparently dropped to 50 employees.

Note: Formally, the Internet Research Agency ceased to exist roughly two years ago, rebranding itself under different names, but sources say the organization continues to operate as before.

***

One part of the factory had a particularly intriguing name and mission: a “Department of Provocations” dedicated to sowing fake news and social divisions in the West, according to internal company documents obtained by CNN.

Prigozhin is one of the Kremlin’s inner circle. His company is believed to be a main backer of the St. Petersburg-based “Internet Research Agency” (IRA), a secretive technology firm, according to US officials and the documents reviewed by CNN. Prigozhin was sanctioned by the US Treasury Department in December of 2016 for providing financial support for Russia’s military occupation of Ukraine. Two of his companies, including his catering business, were also sanctioned by Treasury this year.

CNN has examined scores of documents leaked from Prigozhin’s companies that show further evidence of his links to the troll factory.

One contract provided IRA with ways to monitor social media and a “system of automized promotion in search engines.”

Prigozhin has a colorful past. He spent nine years in prison in the 1980s for fraud and robbery, according to Russian media reports. After his release, he went into the catering business — renovating a boat and opening New Island, one of a half-dozen upscale restaurants he owns in St. Petersburg. Putin turned to him to cater his birthday parties as well as dinners with visiting leaders, including President Bush and Jacques Chirac of France. A headline in The Moscow Times referred to Prigozhin as Putin’s “Personal Chef.”

Prigozhin subsequently won lucrative catering contracts for schools and Russia’s armed forces. He escorted Putin around his new food-processing factory in 2010. By then he was very much a Kremlin insider with a growing commercial empire. More here.

***

Trolling NATO? Yuppers

Seventy percent of Russian-language tweets targeting NATO military activities in Eastern Europe are generated by automated Russian trolls, according to a survey done by the military alliance.

“Two in three Twitter users who write in Russian about the NATO presence in Eastern Europe are robotic or ‘bot’ accounts,” the NATO Strategic Communications Centre of Excellence stated in a report made public this week.

The Russian bots sent 84 percent of all Russian language messages. English language tweets against the alliance also were found to be automated, with some 46 percent generated by automated Twitter accounts.

The report criticized the global social media platform for not doing enough to counter Russian bot activities on Twitter. “Our impression is that Twitter in Russian is policed less effectively than it is in English,” the report said.

A Twitter spokesman could not be reached for comment. Colin Crowell, Twitter’s vice president for public policy, stated in a recent post on the company website that “we strictly prohibit the use of bots and other networks of manipulation to undermine the core functionality of our service.” Read more here.

Trump not Taking Sides, Took a Side Against Kurds

Posted on October 17, 2017October 17, 2017 by Denise Simon

Hey President Trump, fire Brett McGurk. Qassem Suleimani has been declared a terrorist and has countless sanctions, why is he allowed to travel including 3 trips to Moscow?

Why is the United States neutral?

Kirkuk, home to some 1 million Arabs, Kurds, Turkmen and Christians, has been at the heart of a long-running dispute between the autonomous Kurdish region and the central government in Baghdad. Both are close allies of the U.S. There are 35 million Kurds in 4 countries, they are essentially stateless….McMaster, you out there? What say you?

photo

On Sunday, Qassem Suleimani, Iran’s chief spymaster, travelled to the Iraqi city of Sulaimaniya to meet with the leaders of the Patriotic Union of Kurdistan, or P.U.K., one of the two main Kurdish political parties. For years, the P.U.K. and its sister party, the Kurdish Democratic Party, or K.D.P., have been struggling to break away from the rest of Iraq and form an independent state. A Kurdish republic is opposed by all the region’s countries—the governments in Baghdad, Turkey, and Iran—which fear that sizable Kurdish minorities in all three nations will begin to act autonomously.

It is not known what Suleimani—the Middle East’s most cunning operative—told the P.U.K.’s leaders. But, within hours, their fighters began abandoning their posts, making way for Iraqi military units just across the front lines. Not long after, Iraqi forces took over the former Kurdish positions and a stretch of oil fields near the city of Kirkuk. With the Iraqi Kurds now split in two—the P.U.K. on one side and the K.D.P. on the other—hopes for an independent Kurdish state appear to be fading fast. “It was a horrible, horrible betrayal,” a senior official in the Kurdish Regional Government told me.

“Everyone is calling it the P.U.K. drug deal,” a former senior American official who works in the region told me. Notably, many P.U.K. units refused the order to stand down and fought the oncoming Iraqi units.

Last week, Iraqi military units began massing near the Kurdish-Iraqi border. The Iraqi units are dominated by “popular mobilization forces,” which is another way of saying Iranian-trained militias that operate inside Iraq. Those militias—controlled by Suleimani—are staunch backers of the Shiite-led government of Prime Minister Haider al-Abadi, in Baghdad. Most of these groups have dark pasts; the main militia that moved into Kurdish territory this morning was Asa’ib Ahl al-Haq, which battled American soldiers in Iraq during the war there. Its leader, Qais Khazali, is believed to be the principal planner of the kidnapping and execution of four American soldiers in Karbala in 2007. The military operation in the Kurdish region is very much a joint Iraq-Iran project; the flag of Asa’ib Ahl al-Haq was planted at one of the Kurdish bases that was taken over. Also accompanying Iraqi forces in Kirkuk was Abu Mahdi al-Muhandis, an Iraqi militia commander convicted of bombing the American Embassy in Kuwait in 1983; he has been designated a terrorist by the United States government. More here from NYT’s.

photo

*** Iraq Shiite Hashd al-Shaabi enters Yezidi town of Sinjar following Peshmerga withdrawal. Hashd al-Shaabi group cuts electricity in Kirkuk city as it seeks to take control of Kurdish Peshmerga positions. Iraqi military says it has seized large oil fields near Kirkuk from Kurdish forces.

***

How bad was it and where does this go for the Kurds?

The game of brinkmanship blew up in the faces of Baghdad and Irbil on October 16 as talks gave way to fighting in south Kirkuk and Tuz Kharmato in Salahaddin.

At the start of October 15, the central and Kurdish regional governments were in the middle of heavy talks to resolve the crisis in Kirkuk. The problem started when Prime Minister Haidar Abadi mobilized the joint forces and demanded that the Kurds withdraw from areas they occupied in 2014 including several military bases, an airport and the Bai Hassan and Avana oil fields in southern Kirkuk. Baghdad demanded that the Kurds abide by the constitution and cancel the results of the September independence referendum. It also accused the Kurds of moving in fighters from the Turkey’s Kurdistan Workers’ Party (PKK) into Kirkuk in a bald attempt to get Ankara more involved in the dispute. The Kurdistan Regional Government (KRG) rejected those calls as the Kurdistan Democratic Party (KDP) and Patriotic Union of Kurdistan (PUK) met in Dokan. Talks were held there because the KDP and PUK were so far apart on this crisis. The KDP has been steadfast in rejecting any terms set by Baghdad. It has also been beating the war drum accusing the Abadi government of acting like the Baath and constantly warning that the federal government was going to attack Kirkuk. The PUK on the other hand is divided. Many in the party’s leadership are open to making compromises, but others such as Kirkuk Governor Najmaldin Karim and Vice President Kosrat Rasul are siding with the KDP and calling for a defense of Kirkuk. Iranian General Qasim Suleimani of the Quds Force was also in Kurdistan, while America’s Brett McGurk arrived in Baghdad, both trying to mediate. There were reports on social media that the PUK had made a local deal to allow the federal forces into certain areas of the province, but that broke down and fighting ensued.

There were clashes in both southern Kirkuk and Tuz Kharmato in Salahaddin. First, the government had given the Peshmerga until October 15 to withdraw from several positions in Kirkuk. That expired, and talks were still going on between both sides. On October 16, the Golden Division, the army’s 9^th Division, and Federal Police began advancing along two axes from Dibis in the west and Hawija in the south towards the K1 military base and the Bai Hassan and Avana oil fields. When the Golden Division entered an industrial district fighting broke out that included mortars and artillery. There were also clashes in Tuz Kharmato, and the Hashd were said to be moving to cut the road from there to Kirkuk.

There are various factors leading to this huge breakdown in Iraq, but there’s also a good chance that the conflagration won’t last. First, Kurdish President Massoud Barzani pushed through the independence referendum on his own without consulting with other Kurdish parties, but rather assuming they would all come on board, which they didn’t. There was also no preparation for Baghdad’s response, and the KDP constantly attacked the federal government for not following the constitution and being a reincarnation of the Saddam regime. Second, Prime Minister Haidar Abadi was put under intense pressure by parliamentarians demanding the Kurds be punished for the election. Abadi had to respond to the KRG as a result imposing a flight ban, talked about shutting down border points, etc. Third, he took it from those measures that were largely symbolic to demanding that the Kurds withdraw from southern Kirkuk to their pre-2014 positions, which was a huge escalation and threatened a military confrontation. That blew up in his face. All the while, Baghdad and Irbil offered talks, but on terms that neither would agree upon. The Americans started off telling the Kurds not to hold the referendum, to offering to defuse the situation, but came in too late. With fighting underway Washington is likely to pressure the two sides to halt. However, getting the two sides to come together and achieve anything substantial will be hard at best as the political repercussions of this clash will run deep.

U.S. ready for Chinese and Iranian Drone Program?

Posted on October 16, 2017October 16, 2017 by Denise Simon

Can the U.S. and allies counter the Chinese program of armed drones or Iran’s?

Beijing has developed an arsenal of unmanned aerial systems ranging from stealthy combat drones to networked-drone swarms. While the U.S. military still remains superior in technology and in number of drones – with the U.S. military reportedly operating some 7,000 and Chinese military operating at least 1,300 – China is quickly gaining traction.

China’s CH-3 and Ch-4 are broadly modeled off variations of the U.S. Predator and Reaper drones. The next iteration, the CH-5, with a 4400-mile flight range over 60 hours – soon to be 12,000 miles over 120 hours – and payload of over one ton of weapons and sensors, including modules designed for electronic warfare and early warning radar to detect enemy aircraft, is the country’s most advanced drone to date. It can even communicate with other combat drones such as earlier CH-3 and CH-4 models to conduct joint missions. Similarly, the smaller CH-805 Stealth Target Drone, which can fly at near supersonic speeds to mimic Chinese fighters on air defense systems, would likely be used operationally as a wingman for manned aircraft.

Notably, however, China must tailor its military doctrine to engage a conventionally superior foe in the United States, who has prioritized expensive and highly advanced drone hardware such as the Global Hawk. For this reason China has sought to foster drones that will enable it an asymmetric capability – an inexpensive attack force operating together and capable of quick yet not decisive attacks. For this reason, Beijing has sought swarms of small, low-tech, possibly 3-D printable drones linked together through high-tech artificial intelligence to create a cognitive hive mind, or swarm.

For example, China’s SW-6 is a small “marsupial” drone with folding wings that can be dropped en mass from cargo chutes or helicopters to conduct persistent surveillance, jam enemy communications, or even relay friendly communications in contested airspace. While the drone is unarmed, it could network with other SW-6s to hunt, swarm, and even dive-bomb enemy targets. This would allow Beijing to project power within its sphere of influence with a lower probability of outright military confrontation – the presence of unarmed drones do not trigger escalation in the same way that fighter jets or aircraft carriers do.

“Should a U.S. warship all of sudden get swarmed by hundreds if not a thousand small unarmed drones, it could have disruptive and distracting effects – impacting electronics and target acquisition for U.S. weapons systems by blinding them,” says Doug Wise, former Deputy Director of the U.S. Defense Intelligence Agency. “By having the nonlethal drone military capability, it also gives the Chinese a non-kinetic way to conduct military operations in the prosecution of the sovereign Chinese seas – expedite control of a disputed island or interdict maritime traffic to control the waters.”

Part of the reason the Chinese military has likely kept its drones near the mainland could be a lack of space-based communications for over-the-horizon flight control where there is not a direct line of sight between the Chinese-based ground control and the drone. But China has already displayed an ability to do conduct such operations in a limited fashion, and as Beijing’s constellation of satellites grows, so will its ability to conduct remote operations in far off places where it has national interests, such as Africa and the Middle East, where drones could be launched from its new military base strategically positioned in Djibouti.

While drones might play a narrow asymmetric roll in Chinese military doctrine at the moment, the prominence of Chinese drone technology in defense trade shows suggests Beijing is also seeking to incorporate the technology into its broader foreign policy. Besides the United States, who has sold armed drones to the British and Italian militaries, China is the only other exporter of lethal drones, providing them to governments with questionable human rights records, such as Pakistan, Iraq, Nigeria, Saudi Arabia, Egypt, the United Arab Emirates, and possibly even the Somali military. China is even building factories for its drones outside of its borders, in places like Saudi Arabia, Pakistan, and Myanmar, essentially bypassing plausible export restrictions all together.

But while China is becoming a true competitor of the U.S. in the provision of key weapons systems such as drones, it is also replacing Russia as the cheaper and less restricted alternative supplier. For example, a Chinese CH-4 drone costs a mere $4 million on the global market, while the MQ-1 Predator and ground station costs a reported $20 million. More here.

***

On Oct. 5, 2017, Maghreb Confidentiel — a professional journal covering Africa’s intelligence services — revealed that the Libyan National Army has obtained Iranian-made Mohajer-2 drones.

War Is Boring’s own sources in Libya confirmed the claim. A photo provided by LNA militants shows one of the Iranian UAVs at an unspecified air base.

The Libyan engineer in the picture – his face obscured for security reasons – works with the LNA. But the provenance of the drone is unclear.

There are two sources plausible sources. Iran and Sudan.

The Mohajer-2 is powered by a 25-horsepower WAE-342 twin-cylinder piston engine. Generally unarmed, the Mohajer-2 is optimized for reconnaissance missions. It boasts a 50-kilometer range and a maximum speed of 200 kilometers per hour. Its ceiling around 3,350 meter. Its endurance — 90 minutes or so.

Iran, Sudan and Venezuela all use the Mohajer-2.

The first possibility is that Iran itself supplied the drones to the Tobruk-based Libyan regime, possibly via an intermediary such as Russia, which has also transferred MiG-23s and spare parts to the LNA.

The transfer could have occurred via the air cargo companies that regularly visit LNA bases, including Moldovan firms Sky Prim Air and Oscar Jet.

All that said, some of the LNA’s strongest backers are Sunnia-Arab countries — major opponents of Iran. In accepting drones from Tehran, even indirectly, Tobruk could risk alienating its most important backers.

That leaves Sudan. Khartoum has, in general, supported militants in Misrata and the Libyan Government of National Accord — a rival of the LNA. Sudan has provided ammunition, spare parts and technical maintenance and Sudanese crews for the pro-GNA Libya Dawn Air Force.

** photo

But there are indications that Khartoum has occasionally aided the LNA.

The Justice and Equality Movement and the Sudan Liberation Movement are Sudanese Islamist opposition groups, most of whose members are Darfuris. They are part of the Sudanese Revolutionary Front, an alliance of Sudanese factions opposed to the government of Pres. Omar Al Bashir.

Rebels from these two armed groups regularly enter Libyan territory, notably the Kufra region. In February 2016, JEM and SLM fighters attacked the city of Kufra, which was then under the control of the Tobruk-based House of Representative.

Since October 2015, the main armed group in the area has been the Subol Al Salam brigade – a Salafist militia – which is said to be operating in alliance with the LNA’s leader Khalifa Haftar.

In October 2016, this militia reportedly killed 13 JEM militants and destroyed two vehicles near the oasis town of Jaghboub. Despite this, Sudan regularly complains that Libya — that is to say, the Tobruk government — does nothing to prevent the various Darfuri rebel groups from crossing into Libya.

Lacking infrastructure in the south of Libya, the LNA can only use light armed-reconnaissance aircraft – SIAI Marchetti SF.260s – to monitor the Sudanese-Libyan border. One of these Italian-made small planes crashed south of Kufra in May 2017, killing the two crew members.

Khartoum has operated Iranian-made UAVs since 2008, as Africa Confidential reported. That year, the Sudan Liberation Movement-Unity Commanda shot down a Ghods Ababil-3 over Darfur. According to Africa Confidential editor Patrick Smith, the drone was probably controlled by Iranian technicians in Sudan.

The Sudanese air force has used many types of UAVs and lost at least six in combat – most of them shot down by rebels.

Despite past tensions between Tobruk and Khartoum due to Sudan’s support of the regime in Tripoli, an agreement between the Libyans and Sudanese may have facilitated Sudan’s supply of Mohajer-2s to Tobruk and the training of operators, all in order to monitor and prevent the crossing of the Libyan border by JEM and SLM militants.

Of course, it’s also possible that the LNA captured the drones from the GNA when the former seized Al Jufra air base in June 2017. The LNA could have grabbed Mohajer-2s along with the ex-Libya Dawn MiG-23UB fighter that LNA fighters found at the base.

Should Voting Machines be Part of Critical Infrastructure?

Posted on October 16, 2017October 16, 2017 by Denise Simon

At present, there are sixteen critical infrastructure sectors, including twenty subsectors that are eligible to receive prioritized cybersecurity assistance from the Department of Homeland Security. The existing critical infrastructure sectors are:

Chemical
Commercial Facilities
Communications
Critical Manufacturing
Dams
Defense Industrial Base
Emergency Services
Energy
Financial Services
Food and Agriculture
Government Facilities
Healthcare and Public Health
Information Technology
Nuclear Reactors, Material, and Waste
Transportation Systems
Water and Wastewater Systems

***

WE: op election officials from around the country met this weekend to create the formal organization to hash out what powers and lines of communications the Department of Homeland Security should have after the department designated voting systems in the states and territories as “critical infrastructure” earlier this year.

By voting to adopt a charter for a “Government Coordinating Council,” the secretaries of state now have a group that has an official channel and a single “voice” to communicate with DHS.

The move marks the first major step in the coming together between the nonpartisan National Association of Secretaries of State, or NASS, and DHS, amidst a contentious and sometimes mistrusting year.

“The other importance of the coordinating council actually being formed, is that there is so much activity on the federal level regarding legislation, I think this will give us, hopefully, a venue to help us inform members of the U.S. Senate and House of Representatives that states are taking an active role and we are doing a lot to prepare ourselves for the 2018 elections and beyond,” said NASS President and Indiana Secretary of State Connie Lawson.

Lawson and six other secretaries of state were in Atlanta this weekend for the first real efforts at coordinating between the states and DHS.

Although DHS has insisted from the start their “critical infrastructure” designation doesn’t give them any actual powers or authority over state and local voting systems, local officials have been wary. They say they can’t be sure DHS wasn’t encroaching on authority reserved explicitly to the states until DHS had clearly delineated their mission and what they hoped to accomplish with the critical infrastructure tag.

NASS and even U.S. senators and representatives expressed serious concern that although DHS knew for months about attempted “hacks” around the time of the 2016 elections, the affected states weren’t notified by DHS until this past September.

When the local election officials were finally notified, it immediately generated headlines around the country that “21 states” were the victims of some kind of hacking attempts on their voting systems, or on computer systems that may have been linked to the same offices as the voting systems.

However, in the intervening weeks, at least four states have come forward – California, Texas, Wisconsin, and Arizona – and disputed to some degree the DHS finding that they were the victims of a hack attempt.

Elected officials on Capitol Hill were upset as well when the “21 states” news broke.

“It’s unacceptable that it took almost a year after the election to notify states that their elections systems were targeted, but I’m relieved that DHS has acted upon our numerous requests and is finally informing the top elections officials in all 21 affected states that Russian hackers tried to breach their systems in the run up to the 2016 election,” said Sen. Mark Warner, D-Va., who serves on the Senate Intelligence Committee, which has taken an active role in trying to look at election vulnerabilities from 2016 in order to create more voting security in the future.

Lawson said NASS officials were still concerned about the lack of communication, but were also not trying to harp on the topic at this weekend’s meeting in Atlanta.

“I can’t say we’ve set it [communications issues] aside, but I can say we are just trying to make sure that things like this don’t happen again, that we all use the same terminology, that there’s a chain of communication that needs to take place,” Lawson told the WashingtonExaminer.

“We’re cautiously optimistic that things are going to get better,” she said.

Besides discussing the communications issues and communications chains in the event of problems in the future, Lawson said the coordinating council also discussed goals and deliverables.

“Those are just big, high-level pictures,” Lawson said.

“And then, who’s going to do the work, and how are we going to make sure that DHS has the support they need to stand up this coordinating council.”

“It was a logistical issue just being able to get everybody here because there wasn’t an official council at the time,” Lawson added later.

Secretary of Homeland Security Jeh Johnson originally made the critical infrastructure designation in the last days of the Obama administration. However, not long after, then-DHS Secretary John Kelly said the Trump administration had no plans to rescind the designation.

Apart from DHS, representatives from Election Assistance Commission were in attendance as well.

“State and local officials have already taken a number of steps to improve the security of the nation’s elections, and under the Government Coordinating Council we will be able to further leverage resources and our collective expertise,” said Bob Kolasky, the acting deputy under secretary of the DHS National Protections and Programs Directorate in a statement.

“The security of the nation’s elections are critical to our democracy, and DHS stands ready to support this important mission through exercises, information sharing, and technical cyber analysis and expertise.”