Election Systems & Software Unveils Vulnerability Disclosure Policy; Chris Wlaschin Quoted

Election Systems & Software, an Omaha, Neb.-based voting equipment maker, announced a vulnerability disclosure policy that will allow security researchers to look for software bugs in the company’s corporate networks and public-facing websites, CyberScoop reported Wednesday.

The new policy announced at the virtual Black Hat conference will provide ES&S 90 days to address the cyber vulnerabilities before security researchers can publicly report those issues.

“Hackers are going to hack, researchers are going to research, whether or not there’s a policy in place,” Chris Wlaschin, vice president of systems security at ES&S, told the publication. “We think it’s important to have that safe harbor language out there to set expectations.”

The Wall Street Journal reported other voting machine vendors are becoming more open to scrutiny of their systems by security researchers. Denver-based Dominion Voting Systems intends to issue a vulnerability disclosure policy in the coming weeks. Austin, Texas-based Hart InterCivic said it has broadened its vulnerability reporting and testing efforts in the past year.