America’s Election Infrastructure Has Become a National Security Concern

We’re nearly 3 months into the new Administration, and what we know about the impact of the 2016 election is still dwarfed by what we don’t. We do know the Kremlin successfully made cybersecurity a partisan issue in the U.S. Its now settled the Kremlin interfered in our electoral process. Through my work at the OSET Institute, I know this meddling spanned the electoral ecosystem from campaign management to election administration. Yet, there are details we will never understand. The motivation for meddling is only now being seriously investigated.

But here is one thing we can say for sure: our electoral infrastructure has become a matter of national security.

Media coverage has been uneven and slanted to the digital break-in of the DNC. Mention of other types of intrusions was brief and soon forgotten. The problem is, we’ve grown numb to digital break-ins — personal data theft and other hacks — because they are frequent, virtual, and out of sight. There was no broken glass, jimmied locks, or overturned file cabinets. So, it’s hard to comprehend a digital burglary as the equivalent of a physical one. Make no mistake; the digital break-in of the DNC virtual headquarters was no different than another physical break-in 43 years ago — Watergate.

On top of digital intrusions before the election, concerns of compromise arose during and after as well. Many emphasized that there is no evidence that ballot-casting machinery in polling places was compromised. However, administering an election includes other systems outside of polling places, and tucked away in back offices — out of sight, and out of mind for most. When some computer scientists speaking with us in the early hours of November 9th realized there could be counting anomalies, days of analysis followed before they were sufficiently convinced to present their technical case. As a result, Green Party candidate Jill Stein mounted an effort to file for recounts in three States to little result. I was against this as an effort to overturn an election, but supportive of it to perform a thorough audit to resolve technical concerns.

Due to missteps and legal wrangling, there was no deep digital forensic analysis we had hoped for. We’re unlikely to ever know what, if anything actually happened. However, we do know there was reason to believe that efforts to penetrate the infrastructure were made (through no fault of any domestic political party). We also know that some two-dozen voter registration systems were poked, prodded, and in at least two cases penetrated. And recently, there was another such incident in Georgia, this time involving as many as 7.5 million voter records.

While no ballot casting machinery in the U.S. was connected to the Internet, those of us embedded in election technology security know its possible that other types of machinery may have been inadvertently connected and may have been included in that probing. Moreover, in my volunteer work with DHS on election security this past Fall, I learned the extent to which Russian-sanctioned (and funded) operatives not only infiltrated many aspects of our electoral infrastructure, but of other Nation’s as well. We are confident digital fingerprints of Russian cyber-intelligence groups including Fancy Bear, Cozy Bear and others are all over this activity. And these efforts overlap with other tracked strange Russian digital activity.

Adding to this, there is the President’s charge of massive voter fraud. While voter fraud is constantly alleged, so is ballot fraud. Is either type of electoral compromise possible? Yes. Has it happened on a wide scale? That’s unlikely, and so far there is no evidence to support such allegations. But here is an important caution: a compromise need not be widespread to be devastatingly effective. A national election could be derailed by targeting only a swing states’ tabulation results based on antique vulnerable equipment, and where there is no paper audit trail.

Between wild claims and real possibilities, the words “tampered,” “rigged,” “illegitimate,” and “hacked” are now part of the vernacular of American elections. This is a threat to trust in our democratic processes and simply unacceptable. Yet, these allegations could become more than theories (if they haven’t already) because of a disturbing backdrop: an aged-out, vulnerable, and slowly failing voting infrastructure that ultimately will affect 43 States by 2020.

Most are unaware that the majority of States need to replace their voting systems, but this reality is gaining attention. This machinery is woefully out of date. Most of the hardware certified and deployed is no longer manufactured. Jurisdictions rely on spare parts and software patches for operating systems no longer supported. In 2015 the Brennan Center produced an important report on our aging voting equipment. And the bipartisan Presidential Commission on Election Administration raised this caution in 2014.

Today’s voting machinery design is based on 90’s era PC technology. It’s inherently vulnerable. Those back office machines now running election administration Apps are old PCs that can be inadvertently connected to the Internet, because they often serve functions other than managing elections. The bottom line is no one expects a desktop computer to last more than 10-years. Yet that’s exactly what 84% of States did in the last election cycle.

Finally, the prior Administration designated election systems as “critical infrastructure,” and the new Administration’s Secretary of Homeland Security suggests the designation will remain. In absence of clarifications on what this means in terms of resources, support, and potential federal intervention in the event of a “security event,” there has been a backlash from States. Regardless of how we address it, vulnerability of our electoral systems is real. Setting aside the issue of designation, our U.S. electoral infrastructure is a matter of national security. The good news is this is not a political issue but an American issue, right? Not exactly.

Apparently, Congress doesn’t agree. Recently, in a (so far) sparsely reported legislative development, the House Administration Committee approved the Election Assistance Commission (EAC) Termination Act, a bill to terminate the only federal agency tasked with assisting States in protecting the integrity of election administration systems.

Discussing this with family, friends, and complete strangers I’ve come to realize that to most Americans, the EAC is an obscure small agency. The EAC functions with a modest budget for a Federal commission, but has enormous responsibility to help ensure election integrity. This commission collaborates with the National Institute of Standards & Technology (“NIST”) and technology security experts from the academic and private sectors to:

1. Develop national standards for open election data;

2. Establish guidelines for design and certification of new voting machines; and

3. Help define best practices and processes for audit.

These guidelines and standards are available to States for voluntary adoption (and the fact is nearly every State does). The EAC also compiles and analyzes data on problems with deployed systems and serves as an important repository of research. Finally, the EAC directs the work of certifying voting machinery and testing laboratories. 47 states’ laws rely on EAC standards, testing, and certification programs.

The termination of this commission further undermines U.S. election infrastructure integrity and leaves most States helpless to figure out how to replace obsolete equipment and ensure integrity of new systems. Yet, new technology will provide improved security to meet an increasing threat.

From all we’ve learned in recent months, a non-partisan lesson is clear: electoral infrastructure is a national security issue, and America needs to place a higher priority on preserving and protecting this vital aspect of our democracy. Making wild claims; castigating the system and process as “rigged,” “tampered,” “hacked,” or “illegitimate;” and terminating the EAC, is not protecting our democracy or our sovereignty.

We must ensure our voting systems cannot be compromised going forward. The longer we wait, the worse it will become. Based on 10-years of work in this arena, I cannot confidently say next year’s mid-terms or the general election in 2020 will be any more trustworthy than 2016, and if nothing changes probably less so.

America’s voting technology throughout our nation has deteriorated like much of our overlooked physical infrastructure. It now impacts our national security. We believe this infrastructure is too important to completely privatize and remain as a backwater of government I.T.. Initiatives like the TrustTheVote™ Project (and others) offer a way to increase confidence in our elections and their outcomes. Election officials’ have a fiduciary mandate to deliver elections that are verifiable, accurate, secure, and transparent (in process and systems). America needs to make this a priority as a matter of our civic duty and our civil right.

The 2020 election will be here sooner than we think. A foreign colleague with a good understanding of the Kremlin agenda and activities to date makes a disturbing observation: “There upper echelons of the Russian government and oligarchy hope the status quo of American electoral infrastructure remains; it is Swiss cheese metaphorically — highly penetrable; so much so, the 2016 election cycle amounted to a “dry run” of things to come.”

Thus, re-prioritizing this infrastructure; sustaining not terminating the EAC; and supporting the work of the TrustTheVote Project and other efforts to innovate U.S. election administration — all of this, is imperative. The operational continuity and preservation of our democracy depends on it.