Securing Our Elections
Last week, NBC News reported that U.S. intelligence had uncovered substantial evidence that websites or voter registration systems in seven states were compromised by Russian-backed covert operatives before the 2016 election—but never told the states involved, according to multiple U.S. officials. The report said that three senior intelligence officials told NBC that the states were Alaska, Arizona, California, Florida, Illinois, Texas and Wisconsin.
The report also stated officials asserted election systems in the seven states were compromised in a variety of ways, from entry into state websites to penetration of actual voter registration databases.
The morning after the report, County Supervisor of Elections David Stafford, told Inweekly that the news story was completely contrary to everything he knows about the situation.
“To the best that I can tell from the information that I’ve seen, and from official channels on the record, is whatever the information that NBC was talking about is either wrong or outdated,” said Stafford.
The supervisor of elections serves on the Government Coordinating Council for the Critical Infrastructure Sector for Elections. He explained that in January 2017 the Department of Homeland Security deemed the election systems critical infrastructure, meaning the system is so vital to the United States that the incapacity or destruction of such system would have a debilitating impact on national security.
The Government Coordinating Council (GCC) was established in October 2017 to enable interagency and intergovernmental coordination. Representatives across various levels of government comprise the GCC. Stafford is one of six election supervisors on the council.
“My point in saying all that is we’ve been at the table with folks from Department of Homeland Security, FBI, Department of Justice, people across the spectrum, both from intelligence and law enforcement,” he said of the NBC News report. “It was completely inconsistent with anything we’ve ever heard.”
The Department of Homeland Security (DHS) responded to the news report, stating that it was inaccurate and undermined the agency’s close partnerships with state and local governments.
“DHS has shared information with affected states in a timely manner, and we will continue to do so,” said DHS officials. “We have no intelligence-new or old-that corroborates NBC’s reporting that state systems in seven states were compromised by Russian government actors.”
The officials added, “The department has been clear and consistent that we are aware of 21 states targeted by Russian government cyber actors leading up to the 2016 election. In nearly all states, only preparatory activity like scanning was observed. We have said it before and will say it again: in no case is there any evidence that votes were changed or that Russian actors gained access to systems involved in vote tallying.”
Stafford said the federal government has offered state election commissions, his office and other election supervisors a tremendous amount of resources, at no cost, to help with “cyber hygiene,” which includes in-depth risk and vulnerability assessments on networks and public-facing websites.
Higher education has also offered assistance. The Belfer Center for Science and International Affairs, a research center located within the John F. Kennedy School of Government at Harvard University, has the Defending Digital Democracy Project.
“We hosted them here because they wanted to come in and see our systems,” said Stafford. “The thing about election systems is they’re so diverse, even within a state from one county to another and then you can imagine from one state to another.”
He added, “Trying to come up with a playbook, an overall way to try to improve our postures that relates to cybersecurity, is difficult because a ‘one size fits all’ approach isn’t going to work. They had to try to get a better understanding of the interplay within the states, between the states, and then some of the uniqueness within a state itself.”
Around the time the Belfer Center released its playbook, the Government Coordination Council and DHS agreed to establish an Information Sharing and Analysis Center solely for elections to gather, analyze and disseminate intelligence and information related to their systems.
“This would be things like thread indicators or certain IP addresses, or we’re seeing this particular malware, or somebody over here was a victim of a ransomware attack and here’s the indicators to look for, and all of that,” explained Stafford. “We’re in the process of acquiring what’s called an Albert sensor, which is a network sensor that monitors information and it’s a way of sharing information back and forth.”
He said one of the most significant challenges has been sharing information in an accurate, timely fashion and analyzing the level of threat. Stafford said, “Of course, election officials should share threat information with each other. It should go up the chain, then back down the chain. Okay, well that sounds good on paper but how do you actually do it?”
He shared that the Cloudflare and Google have also stepped up to help. Google’s project is called “Project Shield,” and Cloudflare’s is “Project Athenian.”
“Basically, these are enterprise-level services that these companies provide to gigantic companies, and they are now offering to us,” said Stafford. Project Shield helps protect the public website. Project Athenian prevents DDoS (Directed Denial of Services) attacks where hackers flood a website to take it down.
He also praised Florida’s Secretary of State, Ken Detzner, who he said has been aggressive on cybersecurity long before the 2016 election. Detzner enhanced protections of the Florida registration system. In the FY 2019 budget, he has money for Albert sensors for each county and to improve the state-level cybersecurity office.
Stafford has been working Dr. Eman El-Sheikh, Director of the University of West Florida Center for Cybersecurity, to develop an in-depth, two-day training program for supervisors of elections and their IT staff. He said, “If the pilot program works out, if we find that it’s valuable, then I think that there’s going to be a commitment from the state to move forward on a statewide level.”
For years the emphasis on the supervisors of elections was on improving voting equipment, but the focus has changed.
“Now when you look at a voting system, you look at the broader election system and how everything else is interconnecting, you’ve got electronic voter databases, you’ve got electronic poll books, you’ve got your public facing website, you’ve got an email,” said Stafford. “It’s challenging because we have to be open and the more we get aggressive in offering services, particularly in the technology realm, then you’re increasing your exposure, so it’s finding that balance.”
The risks to the election process heightened awareness on the federal, state and local levels. Stafford believes his fellow supervisors are up to the challenge.
He said, “There’s just a new sense of purpose about this issue overall.”