Iowa will be first test case for 2020 election security

DES MOINES, Iowa — Weeks before the Iowa caucuses and the start of the 2020 presidential election season, one of the few senior Democratic campaign staff members whose full-time job was guarding against hackers and stopping a repeat of 2016 quit in frustration.

The campaign — in this case, Pete Buttigieg’s — simply did not care enough about security, Mick Baccio, its former chief of information security, wrote in a five-page resignation letter this month, a portion of which was obtained by the New York Times.

“The campaign continues to mimic the relaxed behavior and poor security posture that led to the Russian intelligence compromises in 2016,” he wrote.

Buttigieg’s campaign says it has since retained a new security firm. But its shortcomings are hardly unique, according to experts and current and former Democratic campaign officials. Despite four years of American intelligence assessments and federal indictments laying out how the Russians sought to interfere in the last presidential election, the 2020 Democratic primaries are getting underway in Iowa on Monday with campaigns once again dangerously exposed to hackers and state election systems still plagued by many of the same vulnerabilities exploited by Moscow in 2016.

While security officials have not seen any credible threats to the Iowa caucuses, Iowa Democrats, aided by the Department of Homeland Security, are taking no chances with the first presidential nominating contest since the 2016 election, and party officials are actively preparing to combat any disinformation campaigns leading up to and during the caucuses.

The state’s role as the first in the nation to vote may be much debated inside the Democratic Party, but its system of caucuses is a blessing for security. The caucuses are far more transparent than typical elections, with groups of people gathering in rooms and openly choosing candidates. Any attempt to fiddle with results after the fact — a serious concern among officials and experts who are working to secure the 2020 election — would most likely be spotted by caucusgoers who know the outcome of an event in which they took part. And, of course, there are no voting machines to hack.

Still, Iowa is taking security a step further this year, and for the first time in the state’s history caucus attendees will have to fill out a “presidential preference card” to document their choice. These cards, which will be individually numbered and have other security features, are intended to offer the caucuses some form of a “paper trail” that election security experts say is vital to protecting results.

Additionally, while the caucuses have relied on mobile apps to record and tabulate results in the past, the Iowa Democratic Party is using a new app this year that has been tested and verified by both security experts and the Department of Homeland Security. Described as a “fancy calculator,” the app will help precinct chairs tabulate results during each phase of the caucus and then send results to the Iowa Democratic Party headquarters.

After the results from the app are immediately transmitted to the party’s headquarters, a team of officials there will review them to look for possible outlier results. Each official will have a set of historical results and models that will help identify any result that looks suspicious; if a precinct has traditionally had a turnout of roughly 50 percent and results come in showing 98 percent, the team will be able to investigate.

“We knew that technology gave us some opportunities in this process, but with those opportunities came different challenges,” said Troy Price, chairman of the Iowa Democratic Party. He said that the preference cards were a “clear way of double-checking and verifying results” and noted that the level of data preparation was more extensive than in recent years.

“We have been very diligent about doing our modeling and figuring out exactly what projected turnout could be at different levels,” Price said. “So we’ll be able to see if things look wildly incongruent from what we would expect.”

In November, Iowa’s Democratic and Republican parties teamed up with the Defending Digital Democracy Project at Harvard to run a drill of worstcase scenarios. The event, led by Robby Mook, campaign manager for Hillary Clinton in 2016, and Eric Rosenbach, a former chief of staff at the Pentagon, featured a fire drill of sorts, designed by future Defense Department officers.

“We ran them through the ringer and pushed them really hard,” Mook said. “Some were much better at managing technical issues, and some were better managing information operations and disinformation, misinformation and communicating with the public. So I think they really learned from each other, and they created some best practices for each other.”