Many state election systems await DHS security checks
With the midterm congressional primaries about to go into full swing, the Department of Homeland Security is playing catchup in helping to ensure that state election systems are secure against cybertampering by Russia or others bent on mischief.
The department said it has completed on-site risk assessments of election systems in just nine of 17 states that have formally requested them so far. It has pledged to do so by November for every state that asks.
The security reviews are designed to identify any weaknesses that could be exploited by hackers. Such examinations are routinely conducted in the private sector.
Homeland Security officials attribute the backlog to increased demand for such reviews since the 2016 presidential election and say they are devoting more money and shifting resources to reduce wait times. The reviews typically take two weeks each.
“Elections remain a top priority,” said Matt Masterson, the department’s senior adviser for cybersecurity.
Among those still waiting for Homeland Security to conduct a risk assessment is Indiana, one of four states with primaries on Tuesday. Its ballot includes several hotly contested races, including a Republican primary for U.S. Senate.
But Indiana, like other states, is not without any defense against hackers. It has used a private vendor to conduct a risk assessment, and is also one of 33 states and 32 local election offices that are receiving remote cyber-scanning services from Homeland Security to identify vulnerabilities in their networks.
Indiana Secretary of State Connie Lawson said Voters prepare their ballots last month during early voting in Indiana, one of four states with primaries on Tuesday. she is confident state officials have done what they can to safeguard Tuesday’s voting but acknowledged: “I’ll probably be chewing my fingernails during the entire day on Election Day.”
The concerns aren’t just theoretical.
The nation’s intelligence chiefs warned earlier this year that Russia remains interested in disrupting U.S. elections after a multipronged effort to interfere in 2016. That included attempts to hack into the election systems of 21 states.
There is no indication Russian hackers succeeded in manipulating any votes, but U.S. security agencies say they did manage to breach voter rolls in Illinois. That state and Texas are the only two to hold statewide primaries so far this year, and neither reported any intrusions into their election systems.
But a local election in Tennessee last week highlights the concern: Knox County has hired a cybersecurity firm to investigate why a website that reports election results crashed after the polls closed.
The county’s technology director said some of the unusually heavy traffic came from overseas servers. DHS spokesman Scott McConnell said there is no indication that the outage was caused by a “malicious actor.”
Homeland Security designated elections systems critical infrastructure just months after the 2016 White House election, adding them to a list that includes chemical plants, dams and nuclear reactors.
The vast majority of primaries around the U.S. are in May and June. At least 28 states said they want Homeland Security to conduct the risk assessments, according to a 50-state survey of state election officials by The Associated Press.
Some states prefer to do the security checks on their own, with some, such as New Hampshire, expressing concern about federal overreach in a country where elections are run by state and local governments.
The delays have caught the attention of Congress, including the Senate Intelligence Committee, which recommended in March that Homeland Security expand capacity to reduce wait times.
Of the other states holding primaries Tuesday, North Carolina and Ohio said they had received onsite reviews by Homeland Security. The fourth state, West Virginia, declined to say when asked by the AP.
Other states that told the AP they had received the DHS reviews are Colorado, Maryland, Nebraska, New Mexico and Oregon.