How Election Security Has Become a Top Issue
Back in the spring of 2016, this blog asked the rhetorical question, “Could the election be hacked?”
The response: most people, including industry experts at the time, either ignored, mocked or laughed at the suggestion. But after the events of the past few years, no one is laughing now at the potential for voting irregularities, either online or offline.
On the contrary, as we head closer to the November, election security is quickly rising to the very top of the domestic priority list and is set to be a top issue this Fall. Some of the recent headlines underline a growing sense of urgency, if not panic, regarding the topic and what’s at stake. For example:
- Security Magazine: Cybersecurity Concerns with Online Voting for 2020 Presidential Election
- Roll Call: Congress must act now to help states with vote-by-mail in November, experts say
- The American Interest: The Danger of Electoral Violence in the United States – “The 2020 election could result in widespread civil unrest unless immediate action is taken.”
- Delaware Public Radio: Delaware drops internet-based voting system used by some absentee voters amid security concerns
- Wall Street Journal: It’s Not Too Late to Save the 2020 Election
- NY Times: Georgia’s Election Mess: Many Problems, Plenty of Blame, Few Solutions for November – “Before Georgia’s embattled election officials can fix a voting system that suffered a spectacular collapse, leading to absentee ballots that never got delivered and hours long waits at polling sites on Tuesday, they must first figure out who is responsible. …”
- Atlantic Magazine: Why Americans Might Not Trust the Election Results – “Nearly three in five Americans don’t have confidence in the honesty of our elections, a February Gallup poll found. Republicans, Democrats, state officials, grandmothers, first-time voters, the politically engaged, the anti-institutionalists—pretty much the only thing they could agree on was their doubts about the integrity of our democracy. …”
Explain This New Election Context?
So why now? What makes our current situation different than in the past? According to Andris Ozols, the former chief research analyst for Michigan government and an expert who has commented nationally on several past election cycles, the USA is in uncharted waters. “The pandemic is helping shift the election discourse from processes, operations and IT cybersecurity to also emphasizing public policies and values. For example, eligibility, access, openness, transparency, trust and truthfulness and equity are core issues.
This is in partly accomplished from (1) lessons from the 2020 primaries, (2) the police and justice actions being seen in the larger context of pandemic, economic status, employment and election framework, and through (3) collaboration among states, governors and state interest groups and (4) increased engagement by the private sector.”
State collaboration on technology plays a significant role with internal, US generated threats while the private sector strongly assists with US based as well as external threats. Here are more specific details on unique aspects to this election cycle:
- Direct and Indirect Pandemic Effects: Unique to 2020, with potential for continuation. Affects registration and voting, fear of crowds, risk of infection, long waits, difficulty in recruiting workers, many previous locations not available, elderly – a high voting group – particularly affected.
- Greater range of issues involved in election, including public policy values: state / federal authority, powers; executive/ legislative branch powers; judicial and regulatory agendas; federalism framework; driving and connected socioeconomic issues such as income, employment, health, race become more visible.These have created divisions as well as has potential for unification, higher election turnout either way.
- Pre 2016, 2016, 2018, early 2020 lesson not fully assessed, implemented. Backlog on implementing solutions, e.g. U.S. intel: Russia compromised seven states prior to 2016
- Two of the absentee voting approaches – e-voting and mail both face challenges, including systematic attacks on mail voting as well as postal service infrastructure.
- More and more incentivized and practiced US based and external hackers, increased by the range of public policy and economics and revenue oriented issues.
- Divisiveness, with some recent shared values. May or may not be temporary.
- Increase collaboration among states, state interest groups and the private sector offers opportunities. Potential for greater engagement on election infrastructure than in 2016 and 2018.
Top Election Cybersecurity Issues
Registration: See June 15, 2020 NYT on “Pandemic is Choking off the Quadrennial Surge in Voter Registration” and WSJ, Keep Voters from having to Wait in Line”, June 12, 2020.
Voter Turnout: Fast Company: These behavioral science tweaks could boost voter turnout during a pandemic election (even if it’s voting by mail)
Voter Data Bases: Increased external inquiries and allegations of ineligible or deceased registrants. Targeted sweeps of registered voters, changes in eligibility, often affecting minority or other groups that tend to vote blue.
Mail Voting: Addresses many aspects of Pandemic issues, but there are claims of potential for fraud. See June 12 WSJ “Bolster confidence in voting by mail” and “Encourage Election and Postal Officials to coordinate their efforts as soon as possible”.
E voting: Multiple issues on vulnerability raised by many entities and experts. Recent studies by MIT and others.
Accelerated Vote Suppression: Multiple techniques: disenfranchisement including removal from rolls, targeted site placement and consolidation, reduction in days or hours, etc. Vote suppression accelerates during census cycle decision and data utilization phases.
Insist that big-tech companies do their part: See WSJ, June 12, 2020. The WSJ has done a good job on covering this issue.
Collaboration Among States, State Association and Security Entities
Cybersecurity and Democracy Collide: Locking Down Elections
“The EI-ISAC (Elections Infrastructure Information Sharing and Analysis Center) handles information for election officials and provides no-cost cybersecurity services. …”
Government Technology Challenges:
- Government Cyber Focus: Planning for 2020 Election Security
- What Will We Learn from the Iowa Caucus App Fiasco?
- DHS Publishes 2020 Strategic Plan for Election Security
- U.S. Could Learn How to Improve Election Protection from Other Nations
- NGA to Help States Work on Cybersecurity Ahead of 2020 –
- Six States Tapped by NGA for Election Security Policy Academy – “Six states will have tougher cybersecurity measures in place when the 2020 election begins to heat up.
- The National Governors Association (NGA) selected Arizona, Hawaii, Idaho, Minnesota, Nevada and Virginia to participate in the NGA Policy Academy on Election Cybersecurity after a “highly competitive” application process, according to a release.
Addressing New Cyberthreats
Yes, we’ve been discussing election cybersecurity threats for the past four years, but new cyberthreats keep surfacing. Consider these recent examples:
NY Times: Amid Pandemic and Upheaval, New Cyberthreats to the Presidential Election
“With the general election less than 150 days away, there are rising concerns that the push for remote voting prompted by the pandemic could open new opportunities to hack the vote — for President Vladimir V. Putin of Russia, but also others hoping to disrupt, influence or profit from the election. …
Homeland Security officials have been focusing “intensely on hardening registration systems,” said Christopher C. Krebs, who leads the department’s Cybersecurity and Infrastructure Security Agency. He said his teams had been working to make sure that towns, counties and states patch software vulnerabilities, back up their systems and also have paper printouts of poll books — the registration lists used on Election Day — should criminals or adversary nations render the digital versions inaccessible. …”
Vanity Fair: Hackers Are Already Screwing With the 2020 Election
“Expanding access to the ballot will be necessary this cycle, as officials scramble to hold an election against the backdrop of a pandemic. But the security vulnerabilities they present are almost certain to be exploited by the president and his allies.
Solutions Please: Organizational Election Resources and References
Over the past few years there has been many ways that election security topics were addressed by lawmakers and other government leaders and organizations. From states getting classified briefings in 2018 elections to the Senate Intelligence Committee writing a report on election vulnerabilities ahead of the midterms to the US Election Assistance Commission providing $380 million to states in election security funds, the response to the 2016 election was broad-based.
Many other groups across the country have focused on these issues. Some of the available resources for the 2020 elections include these organizations and important documents listed below.
State Interest Groups, Associations Addressing Election Security
National Governors Association (NGA)
- May 20, 2020: With Millions of Jobs at Stake, State and Local Government Associations Call on Congress to Approve Aid
- May 13, 2020: Governors Call on Congress to Act on State Fiscal Relief
- April 11, 2020: National Governors Association Outlines Need for ‘Additional and Immediate’ Fiscal Assistance to States
National Association of State Budget Officers
April 28, 2020: A Budget Shortfall Estimate for States Grows Even Worse
National Association of State Chief Information Officers (NASCIO)
Stronger Together: State and Local Cybersecurity Collaboration
The National Governors Association (NGA) and the National Association of State Chief Information Officers (NASCIO) released Stronger Together: State and Local Cybersecurity Collaboration. With a dramatic uptick in ransomware attacks across the country, governors, state CIOs and state government executives are designing and implementing programs to strengthen local partnerships in cybersecurity. The publication outlines promising programs that states have initiated to enhance collaboration with their local government counterparts for cyber resilience. It also provides high-level recommendations for state officials looking to strengthen partnerships with local government officials on cybersecurity.
National Conference of State Legislatures
Election Security – National Conference of State Legislatures
https://www.ncsl.org/research/elections-and
Ensuring the integrity and security of the election process is essential for the functioning of democracy in the U.S., and is a shared responsibility among many officials. Local election administrators are in charge of the nuts and bolts of election administration, and play a key role in elections security.
Data Security Laws | State Government
https://www.ncsl.org/research/telecommunications
Feb 14, 2020 · Requires executive branch agency heads to ensure that information security programs are in place, implement security policies, standards and cost-effective safeguards to reduce, eliminate or recover from identified threats to data and information technology resources; include cybersecurity …
Council of State Governments (CSG)
Project Overview: Election Cybersecurity
https://www.csg.org/CSG_Election_Cybersecurity_Overview.pdf
Observations and lessons learned from these facilitated sessions will be distilled into a toolkit that any state can use to map a communications plan for an election cybersecurity breach. The toolkit was be made available on the CSG website in November 2018.
Election Cybersecurity Initiative Guide by The Council
issuu.com/csg.publications/docs/cybersecurity_guide_online
National Association of Counties (NACO)
Counties plan for election changes amid COVID-19 outbreak
https://www.naco.org/articles/counties-plan-election-changes-amid-covid-19-outbreak
Mar 23, 2020 · Administering an election during a global pandemic is likely a first for most county officials. With the uncertainty of COVID-19’s long-term impact throughout the country, counties are grappling with election-related challenges ranging from shortages of poll workers to providing additional voting options and keeping polling locations clean.
National League of Cities (NLC)
Cybersecurity | National League of Cities | Cybersecurity
https://www.nlc.org/topics/technology/cybersecurity
This guide outlines some of the most impactful ways that local governments can work with their state governments to prepare and defend again cyberattacks.
International City/County Management Association (ICMA)
International City/County Management Association – icma.org
ICMA, which was formed in 1914, is the leading association of local government professionals dedicated to creating and sustaining thriving communities throughout the world. With over 10,000 members, the organization advances professional local government through leadership, management, innovation, and ethics.
National Association of Attorneys General
NAAG | Cybersecurity: A Multinational Group’s Collaborative Approach
National Association of Election Officials
Election Center – Home – National Association of Election Officials
National Association of Secretaries of State (NASS)
https://www.nass.org/initiatives/securing-elections
THE ROLE OF CHIEF STATE ELECTION OFFICIALS IN ELECTION SECURITY: 40 members of the National Association of Secretaries of State (NASS) serve as their state’s designated chief election official, overseeing the conduct of elections according to law.
- Securing Elections as Critical Infrastructure | NASS
- Securing Future Elections Against Cyber Threats
- Facts and Findings on Cybersecurity and Foreign Targeting of the 2016 U.S. Elections (March 2017)
Election Processes and Security (Various Sources) That Are Addressing Election Security
National Institute of Standards & Technology (NIST)
Election Security Preparations: Federal and Vendor
https://www.nist.gov/speech-testimony/election
Jul 11, 2018 · The Guidelines are used by accredited testing laboratories as part of both state and national certification processes; by state and local election officials who are evaluating voting systems for potential use in their jurisdictions; and by manufacturers who need to ensure that their products fulfill the requirements, so they can be certified.
Department of Homeland Security (DHS)
Election Security – Department of Homeland Security
https://www.dhs.gov/topic/election-security
Jun 09, 2020 · Election Security is a Partnership. Securing election infrastructure is a partnership between federal, state and local government and private sector entities. DHS collaborates with federal departments and agencies, state and local government, election officials and other valued partners such as the National Association of Secretaries of State …
Cybersecurity Infrastructure Security Agency (CISA)
Election Security Library | CISA
https://www.cisa.gov/election-security-library
Securing election infrastructure from new and evolving threats is a vital national interest that requires a whole-of-society approach. This library provides State and local governments, election officials, campaigns, the vendor community, and voters with voluntary tools to secure election-related assets, facilities, networks and systems from cyber and physical risks.
US Election Assistance Commission
https://www.eac.gov/election-officials/elections-critical-infrastructure
The Department of Homeland Security has designated elections systems as part of our nation’s critical infrastructure. At the time of designation, then-DHS Secretary Jeh Johnson observed, “Given the vital role elections play in this country, it is clear that certain systems and assets of election infrastructure meet the definition of critical infrastructure, in fact and in law.”
https://www.eac.gov/election-officials/election-security-preparedness
Election Security . Election Security Preparedness; Election Management Guidelines; Quick Start Guides; Election Worker Best Practices; Voting Accessibility; Designing Polling Place Materials; Voter Registration Cancellations; Language Access; Glossaries of Election Terminology; Press Releases; Elections as Critical Infrastructure; Procurement
https://www.eac.gov/voting-equipment/managing-election-technology
Managing Election Technology The Election Official of today is an Information Technology (IT) Manager – whether they think they are, whether they want to be, or whether they were trained to be. IT management requires a unique set of attitudes, knowledge, and skills in order to plan, direct, and control contemporary election administration.
State-Specific Resources – Election Assistance Commission
Center for Election Innovation
https://electioninnovation.org/
Congressional Task Force on Election Security
https://homeland.house.gov/imo/media/doc/TFESReport.pdf
Ongoing support to state and local governments. Election Technology Vendors Must Secure Their Voting Systems Many states purchase their voting systems from third-party vendors who have little financial incentive to prioritize election security…
Brookings
https://www.brookings.edu/topic/campaigns-elections
May 13, 2020 · Guidance for the Brookings community and the public on our response to the coronavirus (COVID-19)
https://www.brookings.edu/blog/fixgov/2019/08/23/
Aug 23, 2019 · The lack of information flow in 2016 is largely due to the fact that at that time almost no state election officials had security clearances and were thus not privy to understanding the full …
https://www.brookings.edu/blog/fixgov/2019/08/20/
Aug 20, 2019 · This post is part of ” Cybersecurity and Election Interference,” a Brookings series that explores digital threats to American democracy, cybersecurity risks in elections, and ways to mitigate…
https://www.brookings.edu/series/cybersecurity-and-election-interference
About Cybersecurity and Election Interference. As we head into the 2020 elections, the United States faces extraordinary threats from the weaponization of cyberspace, foreign interference…
Pew Charitable Trusts
A Voter’s Guide to Election Security | The Pew Charitable …
https://www.pewtrusts.org/en/research-and-analysis/
Nov 01, 2018 · In March, Congress allocated $380 million for state and local election security. While counties used the funds for cybersecurity training and new election equipment, many local officials complained it was not enough money. Some states, such as Arkansas, were able to improve their voting
GAO
ELECTION SECURITY: DHS Plans Are Urgently Needed to Address Identified Challenges Before the 2020 Elections
GAO-20-267: Published: Feb 6, 2020. Publicly Released: Feb 6, 2020.
https://www.gao.gov/products/GAO-20-267#summary
Center for American Progress
Election Security in All 50 States – Center for American …
https://www.americanprogress.org/issues/democracy/
Election Security in All 50 States … this report does not address specific information technology (IT) requirements for voting machine hardware, software, or the design of pre-election testing …
https://www.heritage.org/election-integrity
Aug 19, 2019 · The right to vote in a free and fair election is the most basic civil right, one on which many of the other rights of the American people depend. View the Election Fraud Database.
Alliance for Securing Democracy
The Election Official’s Handbook – Alliance for Securing
https://securingdemocracy.gmfus.org/wp-content/
David Levine, Elections Integrity Fellow February 13, 2020 … well as experts in cybersecurity and information technology, to complement efforts by federal and/or state officials … many of its local election officials are part-time employees,15 the state’s election cybersecurity.
Atlantic Council
Atlantic Council – Shaping the global future together
Democracy Rebooted: The Future of Technology in Elections
https://publications.atlanticcouncil.org/election-tech
International voting system standards would provide valuable guidance for governments in the process of procuring election technology. Establishing comprehensive international guidelines is vital. Some companies, in particular those with a track record of managing and implementing new election technology in a variety of countries, self-regulate …
Harvard Kennedy School – Belfer Center for Science and International Affairs, Cyber Security Project
State and Local Election Cybersecurity Playbook (2017):
- The Campaign Cybersecurity Playbook
- The Election Cyber Incident Communications Coordination Guide
- The Election Incident Communications Plan Template
Center for Internet Security (CIS)
Elections Infrastructure Security Handbook (February, 2018)
Multi-State Information Sharing and Analysis Center (MS-ISAC)
MS-ISAC – Center for Internet Security
Final Thought From Dan Lohrmann
No doubt, the sum of these election challenges and resources seems daunting – and not just for cybersecurity reasons. Indeed, if the vote count is close, some believe that voters won’t accept the 2020 election results no matter who wins.
But regardless of your political persuasions or perspectives regarding the events of the past few years, there can be little doubt that all eyes are now on November. Election security is the elephant in the room for the next five months – and likely beyond.