Elections chiefs tackle cyber threats

Cybersecurity has rocketed to the top of the issues on the minds of county elections officials in Florida as they prepare for the August primary and November general elections.

The specter of malicious actors doing something that could interfere with voting — or make people think there’s something wrong to undermine public confidence in the results — has elections administrators on high alert.

None wants to be the weak link that allows something to go wrong in 2018.

As a result, supervisors of elections from metropolitan Broward and Palm Beach counties in the south to small Gadsden and Putnam counties in the north are tightening their controls, going through security reviews and, in many cases, upgrading their software and equipment.

“Florida is one of the most, if not the most, proactive state in getting prepared for the cybersecurity threats that we’re going to be facing in 2018 and

2020,” said Paul Lux, supervisor of elections in Okaloosa County and the new president of the Florida State Association of Supervisors of Elections.

One reason the stakes are so high: Florida has two of the nation’s most important elections in 2018, for U.S. Senate and governor.

And Florida has a history of exceedingly close elections, with the last four big statewide races decided by about 1 percentage point and the infamous 2000 presidential race decided by just 537 votes out of almost 6 million ballots cast.

Political strategists predict 2018 could be just as close. And a security breach, the threat of one, or the belief that one happened could cause turmoil if it cast doubt on the results of a close race.

High priority

In the hallway conversations, key speeches, and seminar topics, the issue dominated the four-day spring conference of the election supervisors’ association last week at the Harbor Beach Marriott hotel.

Asked, without prompting, the top issue on the minds of elections supervisors midway through the first day, Broward’s Brenda Snipes said “cybersecurity.” Snipes’ office runs elections in a county with more than 1.1 million registered voters. Charles L. Overturf III, supervisor of elections in Putnam County, which has 47,000 registered voters, had the same oneword answer.

Cybersecurity related topics were on each day’s agenda. Sessions one afternoon were moved to a larger room because there was so much interest.

The U.S. Department of Homeland Security dispatched six people to the conference. One of the agency’s sessions for supervisors and their staffs lasted three hours.

It’s a big change for the association. Agendas for the previous two May conferences, in the 2014 and 2016 election years, dealt extensively with early voting, voting by mail, online voter registration, campaign finance, election lines and civic engagement.

The environment is different in 2018, said Joyce Griffin, the Monroe County supervisor of elections. “I’ve never seen anything happen so quickly,” she said.

Public reassurance

Secretary of State Ken Detzner, Florida’s top elections official, and elections supervisors from large and small counties said the public should feel confident that people will be able to vote and the votes will be counted accurately.

“State and local elected officials are taking the potential threat of cyber activity very, very seriously, and we are taking the critical steps to ensure that the security of our elections [is] safe,” Detzner said.

Susan Bucher, the supervisor of elections in Palm Beach County, has been a Detzner critic, but agrees with his assessment.

“We need to convey to the public that there is a large amount of emphasis [on cybersecurity] and that we continue to harden our systems,” Bucher said. “We are extremely confident that we’re very tight and that nobody is going to come in and hack anything.”

Skepticism

Not everyone is convinced. In speeches, interviews and posts on Twitter, U.S. Sen. Marco Rubio, RFla., has repeatedly voiced concerns about what he sees as overconfidence on the part of elections officials.

“Our elections officials in #Florida are very good. But many are underestimating the threat we face from #Putin interference,” he wrote in a recent Twitter post about concerns over possible mischief sponsored by the Russian president.

Matt Masterson, senior cybersecurity adviser at the U.S. Department of Homeland Security, declined to comment on Rubio’s assessment or exactly how Florida ranks compared with other states. But, he said, “Florida has been an incredible partner, one of the most engaged states, if not the most engaged state” in working with his agency on election security.

Lux said he would be part of a delegation meeting soon with Rubio.

“We’re going to lay out for the senator exactly what steps Florida has been taking in order to show him that we have been taking a proactive stance and we’re not just sitting by twiddling our thumbs saying nothing is going to happen,” Lux said.

Safeguards, threats

Elections officials are confident that the most alarming kind of threat — someone getting into the system and altering votes — won’t happen.

Jorge Nunez, information technology director at the Broward Supervisor of Elections Office, said vote counting isn’t connected to the internet. “That whole tabulation system is a separate network that is not connected to the Internet in any way,” he said.

Also, Nunez said, the ability to use USB drives is disabled and employees can’t charge their phones on their computer USB ports. The tabulation room at election headquarters is under the watch of security cameras, and employees aren’t allowed to enter the room by themselves; the presence of a second person is required.

The state has appropriated $1.9 million to pay for a network monitoring security system that identifies and shares information about potential threats and provides around-the-clock monitoring. The Division of Elections is also hiring five cybersecurity specialists.

And the U.S. Department of Homeland Security is providing risk assessments for county elections offices, probing for potential vulnerabilities.

“We get paid to think deviously,” said Matthew Frost, the DHS protective security adviser for South Florida.

Still, elections officials were told to prepare for a range of threats and how they’d resume operations, just the way they plan for hurricanes.

They were warned that the same kind of security threats that plague anyone using the internet could affect elections office networks, particularly phishing emails that trick people into clicking on links that expose their systems to attack.

One presenter showed the slide of an Islamic State message that hackers put on the homepage of the North Carolina elections agency.

Even if the real results weren’t altered, something like that on election night could create confusion and distrust, especially if it displayed results showing the wrong winner.

Lux, who became his county’s elections supervisor in 2009 after working in the office for 10 years, said state and county officials are making extensive preparations to deal with cyber threats, which he regards as inevitable.

“That isn’t to say that if an incident occurs someone won’t be able to Monday morning quarterback and say you should have done more,” he said. “But when did Noah build the ark? He built it before the flood, not after, and Florida, I’m confident, is working to make sure everybody has an ark for when the flood comes.”