- REUTERS/Carlo Allegri
- Lawmakers in Washington have been criticized for failing to enact any major legislation since Russia targeted state election systems in 2016.
- But inaction at the federal level hasn’t deterred state officials.
- From Virginia to Illinois to Colorado, states across the US have made significant strides in safeguarding their elections.
- Despite concerns that hackers will return this year to undermine the midterm elections, security experts are confident states will be able to thwart serious attacks.
On June 23, 2016, unidentified hackers made their way into the statewide voter-registration system in Illinois.
They remained undetected in the system for three weeks until they appeared to intentionally overload the voter-registration website with a massive amount of traffic. It was only then that IT staff at the Illinois State Board of Elections (SBE) noticed that something was wrong.
On July 13, state technicians took the website offline to investigate the attack. For about a week, people in Illinois weren’t able to register online to vote, although they could still do so by contacting their local election officials directly.
The IT experts doggedly scoured their online system for any trace of who might have been behind the breach. They changed the system’s code to eliminate the technical vulnerabilities that opened the door to the hackers in the first place.
Having kicked out the hackers from their election system, Illinois officials were back in control.
But the attacks on the voter-registration website continued unabated. Monitoring of hacker activity revealed that IP addresses linked to the SBE were being targeted five times per second, 24 hours a day.
Then, on August 12, seven weeks after the initial breach, the attacks abruptly stopped.
The Illinois SBE was no longer under assault.
‘How do we not let it happen again?’
Illinois SBE officials didn’t learn who was behind the attack until about a year later, when officials from the Department of Homeland Security testified before the Senate Intelligence Committee that Russia was behind the targeting of election systems in 21 states, including Illinois.
That hackers linked to the Kremlin were responsible for the breach didn’t come as a surprise.
Matt Dietrich, an SBE spokesman, told Business Insider that the Board assumed Russia was the culprit because Moscow had also been implicated in the hacking of the Democratic National Committee, which occurred around the same time in June and July 2016.
“But that was more or less immaterial to us,” Dietrich recalled. “Our concern was just that it happened. How do we not let it happen again?”
After the attack, the SBE strengthened its relationship with DHS, implementing weekly cyber-hygiene tests in October 2016 to scan for vulnerabilities in the state’s election infrastructure.
Those weekly tests still take place today along with continuous monitoring of network activity on state computers, as well as regular cybersecurity awareness training for state employees provided by the Illinois Department of Innovation and Technology.
Illinois is one of 32 states that have requested and received ongoing cyber hygiene scans, according to an official from the National Protection and Programs Directorate at DHS.
The state is also scheduled to undergo a full-scale risk and vulnerability assessment from DHS to make sure the state’s election systems are prepared for the 2018 midterms.
“It was just human error and some programming that allowed our breach to happen,” Dietrich said. “But we fixed that, and now we think that we’ve enhanced our system to guard against something like that from ever happening again. But you just don’t know.”
Russia ‘rattled doorknobs’
After the US intelligence community’s assessment found that the Russian government tried to interfere in the 2016 US presidential election – representing “Moscow’s longstanding desire to undermine the US-led liberal democratic order” – panic set in around the country.
Election officials complained they lacked the resources to adequately address cyber threats. Lawmakers warned of an impending breakdown in American democracy. And President Donald Trump hardly made things better by wavering, on more than one occasion, when asked whether he believed claims of Russian interference.
Americans also started questioning their own election-day votes.
When DHS announced in September 2017 that it had contacted officials in 21 states targeted by Russian government hackers, many voters misinterpreted that assessment to mean that the Russians had changed actual votes.
That never happened, as Brent Davis, the director of operations at the Illinois SBE, explained last year during a panel discussion about his state’s 2016 voter-registration breach.
“I’m not trying to say it’s not a big deal because it is a big deal for a lot of reasons,” Davis said. “But it is completely unrelated to voting on election day or voting early or by mail or the tabulation of those ballots.”
Election officials have described Russia’s cyberattacks against state voting databases as a “rattling of doorknobs.”
“It’s really reconnaissance by a bad guy to try and figure out how they could break into your computer,” Trevor Timmons, a spokesman for the Colorado secretary of state’s office, told The Associated Press last year after Colorado was informed it was one of the states targeted by the Russians. “It’s not an attack. I wouldn’t call it a probe. It’s not a breach. It’s not a penetration.”
In fact, the Illinois breach appears to have been Russia’s only successful attack against a state’s election system in 2016.
DHS officials previously confirmed in testimony to Congress that “a small number of networks were successfully compromised.” But when Business Insider followed up on the admission, DHS officials would not provide details about any other potential successful breaches.
Nevertheless, US officials have said repeatedly that Russia’s interference affected no votes during the 2016 election, despite the Senate Intelligence Committee’s finding that Russia-linked hackers had access to “alter or delete voter registration data” in a small number of states before the election.
But state and local election officials aren’t necessarily worried about foreign hackers changing votes.
In many cases, hackers don’t even have the capabilities to probe actual voting machines on election day, and the highly decentralized nature of the US election system – where counties and states are the ones running elections – would make it difficult for hackers to alter votes on a massive scale.
“Our systems are better defended than other places are, and it gives us strength,” said Bob Kolasky, the deputy assistant secretary for Infrastructure Protection at DHS. “It’s extremely difficult to have a massive impact on the voting process without that being observed. And we do feel like with voting machines, there is perhaps a lower vulnerability.”
The fear, therefore, lies in a bad actor’s ability to undermine faith in the legitimacy of the election process itself.
Election officials say this can be done by the mere appearance that election systems are vulnerable to hackers. Russia, or anyone else seeking to sow discord, doesn’t actually have to change any votes to upend an election.
Planting that seed of doubt was part of Russia’s goal, US intelligence officials have concluded – hacking was just one part of their campaign to scare Americans into thinking their elections could be compromised. Using social media to influence spread partisan bias and fake news were part of their tactics, too.
“I don’t believe hackers can get to the heart of the matter – to the votes,” said Noah Praetz, the director of elections in Cook County, Illinois, the US’s third-most-populous county. “But they can sow enough distrust” that people could lose faith in the democratic process.
David Becker, the founder of the Center for Election Innovation and Research, told Business Insider he thinks this is what Russia was trying to do in Illinois.
“If you look at how the Illinois data breach occurred, the hackers very slowly accessed a very small number of records for a couple weeks and they weren’t noticed,” Becker said. “Then all of a sudden they started accessing a massive amount of records and that was noticed since it sucked up all the bandwidth.”
“If the hackers were sitting inside a system and not being noticed, why would you do something to get noticed?” he added. “The answer’s obvious: Because you want to get noticed. You want Americans to doubt their own functioning democracy. That’s the goal of the Russians and others who are seeking to interfere. And we have to be careful not to help them.”
‘After 2020, we still have to be vigilant’
In rare bipartisan fashion, Congress approved $380 million in election-security funding in March, the largest distribution of such funds since the passing of the Help America Vote Act in 2002, which provided $4 billion to the Election Assistance Commission to divvy up among states.
The funding will help states replace outdated voting machines, implement postelection audits, and provide election officials with cybersecurity-awareness training, among other improvements in election security.
“In this challenging political time, this has to be seen as a win and a recognition that [election security] is an important responsibility,” Adam Ambrogi, the director of the Elections Program at the Democracy Fund, previously told Business Insider.
But Congress has yet to pass any singular legislation in response to Russia’s 2016 election meddling.
This has created the false perception that nothing has been done to shore up weaknesses in state election infrastructures and that state officials are balking at the notion that election security is an urgent matter, Becker told Business Insider.
“That is absolutely not the case,” he said. “It can be both true that the threat is real and we have to be extremely vigilant and that the actors charged with that vigilance are acting responsibly. And I think both of those things are true.”
There is a lot of evidence supporting Becker’s claim.
Before Virginia’s gubernatorial election last November, election officials there ordered all towns, cities, and counties to use paper ballots. In February, Pennsylvania Gov. Tom Wolf said all new voting machines purchased in the state must include a paper trail. And in the Georgia House, lawmakers were considering a bill that would replace electronic touchscreen voting with a paper-based system.
After the 2017 elections in Colorado, state officials conducted a first-in-the-nation election audit – or what’s sometimes called a “risk-limiting audit” – to verify the results, which they plan to use for future elections.
Rhode Island, Virginia, Iowa, Washington, and Mississippi have also passed legislation requiring some variation of risk-limiting audits or an enhanced recording of votes, according to data collected by the National Conference of State Legislatures. Other states, including Nevada, Minnesota, and Utah, have appropriated funds for updating voting equipment.
Federal officials have made some gains as well.
- Aaron P. Bernstein/Reuters
In January 2017, then DHS Secretary Jeh Johnson announced that election infrastructure would be considered “critical,” a seemingly inconsequential but significant move that enables the federal government to devote resources more easily to protect US elections. It also allows more streamlined communication between state officials and Washington.
The relationship between DHS and state election officials has “improved tremendously,” said Connie Lawson, the president of the National Association of Secretaries of State and Indiana’s top election official.
“As long as DHS says they’re here to provide services and their mission is not to take over elections at all, then I think states will learn to trust them even more,” Lawson said, referring to concerns some state election officials have about the federal government getting too involved in how states run elections.
At least 15 states have also requested a risk and vulnerability assessment from DHS, and eight of them have been completed so far. One DHS official told Business Insider the remaining assessments were scheduled and would take place before the midterm elections in November.
The DHS official described the risk and vulnerability assessment as the department’s “most extensive” election security related service.
The assessment involves an on-site evaluation of a state’s election infrastructure by three to five DHS officials who make up what’s called a Hunt and Incident Response Team. The team typically spends a couple weeks conducting the assessment, testing technical controls and offering customized advice to election officials on how to improve their systems.
But while a risk and vulnerability assessment could help states safeguard their election systems, it won’t guarantee foolproof election security.
“As states and counties get better and have more secure systems, the bad guys are going to get better as well,” Becker said. “We need state legislatures and Congress to think of elections as more of a 365, seven-days-a-week, 24-hours-a-day thing.”
“We’re not going to cross a finish line and say, ‘We’re secure,'” he added. “Even after 2020, we’re still going to have to be vigilant.”