Even as the Justice Department stays busy with those suspected of election meddling in the run-up to the midterms, there’s growing reason for optimism about the ability of the US electoral infrastructure to withstand attacks.
While it’s still technically possible for a foreign state to affect the vote – vulnerabilities remain – the plausible prospects have become more remote thanks to significant strides at the federal, state, and local government authorities the last couple of years in hardening the nation’s election infrastructure.
At the same time, federal and state efforts seem to be deterring the state-sponsored hackers so active during the last election cycle. Indeed, for the past several weeks, state after state has gone public to assure the public that its voting systems are safe.
Perhaps the biggest vote of confidence arrived in the form of a rare joint statement from the Director of National Intelligence, FBI, Justice Dept. and Homeland Security.
“Currently, we do not have any evidence of a compromise or disruption of infrastructure that would enable adversaries to prevent voting, change vote counts or disrupt our ability to tally votes in the midterm elections,” according to the joint statement.
The assurances applied to five main areas:
- Improved communications and cooperation
In 2016, if federal intelligence operatives found anything amiss, they literally couldn’t talk to state and local officials. The reason: The locals lacked proper security clearances. By consensus, that’s changed. What’s more, under the auspices of the Election Infrastructure Sharing and Analysis Council, formed a year ago, the feds have been working closely with nearly every state and some 1,100 counties. Homeland Security, for example, has launched a “Last Mile Project” to produce posters that detail best cyber security practices for jurisdictions, no matter how small. The posters reflect cyber crime’s biggest deterrent -- awareness.
- Better cyber security
And it’s occurring where it matters most — at the roots of the election system. It’s not the feds that manage elections. Nor really is it the states. Elections are managed by counties.
According to StateTech magazine, local jurisdictions have embraced a mounting list of defenses, including multi-factor authentication, email filtering and monitoring, threat scanning, network segmentation or “air-gapping,” and advanced firewalls. Thirty-one states and 61 counties have also installed network Albert sensors to detect intrusions.
- Paper ballots
It’s a decidedly no-tech solution to a high-tech problem. Yet, all but 13 states will roll into the mid-terms with a verifiable paper trail to review and confirm election results. Paper doesn’t crash. Most of all it can’t be changed – and at scale.
- Risk Limiting Audits
One of the best practices being adopted by states is a selective post-election sampling of the vote count. Colorado, considered to be an elections practices exemplar, became the first state to use RLAs, a measure that was also touted by a presidential commission that spent two years post-2016 investigating voting practices
- The courts
The nation’s system of checks and balances are at work. While Congressional efforts to improve election security floundered in time for the midterms, that hasn’t kept the courts from keeping an eye out for voters.
In perhaps the most significant ruling, a federal judge opened the door for test of election security on constitutional grounds -- that a vulnerable system could violate voting rights. This progress has had another effect: It is shifting the public dialogue about election security, as Brookings Fellow Susan Hennessey recently noted. She contends the ultimate threat to U.S. elections doesn’t come in the form of changing a vote outcome, if only because it’s too hard to change votes. Instead, the continuing danger resides in the ongoing disinformation efforts being mounted by America’s foes. "We need to be careful about how we talk about this threat," she warns. "If we convince the American people that their elections do not have integrity essentially what we're doing is accomplishing the bad guys' goal for them."