Posted: 3 Min ReadElection Security

Is the Electoral System Cyber Secure for 2020?

After spending hundreds of millions of dollars to bolster electoral cyber security, it’s still a mixed picture

The guessing game around the security of the 2020 elections continues. Will it go off without a hitch? Will it be a disaster? Or are we looking at something in between?

Place your bets.

If you listen to the federal government, steady progress is underway to bolster the security of a system that was in clear need of an overhaul.

States have spent hundreds of millions of dollars on security improvements since 2016 and the investments are paying off, according to the Department of Homeland Security's senior cyber security adviser, Matthew Masterson. Speaking recently before the House of Representatives, Masterson declared “that 2018 was more secure and resilient than 2016 and 2020 will certainly be more secure and resilient” than the last national election in 2016.

To be sure, sixteen states didn’t even have paper trails in 2016. However, by 2020, it’s expected that 42 states will have paper records of every vote.

If you listen to the federal government, steady progress is underway to bolster the security of a system that was in clear need of an overhaul.

Meanwhile, at least a dozen states are testing out what’s known as risk-limiting audits, an approach that promises a better way of verifying the accuracy of vote tallies. Currently, auditors rely on manual recounts in a predetermined number of precincts. But that doesn’t help them know whether a declared victor in an election really did win. In risk-limiting audits, state officials carry out hand-counts of a statistically meaningful sample of all votes cast – with the sample increasing as the margin of victory in the vote narrows.

In addition, the optimists say the decentralized nature of the US electoral system – where the voting apparatus gets done at the state and local levels – also offers extra protection against cyber interference in the 2020 elections. Not only are voting machines hard to tamper with but attackers would also need to gain physical access to the units, a feat that would prove exceedingly difficult even in normal times.

Further, the states have greater access to real-time threat information sharing than they did in 2016. Election officials can also tap into "instant response capabilities" that DHS has developed.

Changing Tactics

Still, critics question whether that’s enough. They say that the security of the overall electoral system remains vulnerable in many of ways, just as it was in 2016. And they criticize the $380 million that Congress allocated for election improvements in 2018 as insufficient. Although a proposed election security bill that would have earmarked another $1 billion for states to bolster their election infrastructure got derailed, Congress is still poised to spend another $250 million on election security in the 2020 budget.

At the same time, election officials face another, more complex challenge: How to counter the impact of disinformation campaigns by outsiders who use social media to sow division and undermine trust in US institutions. Unfortunately, there are no quick-and-easy solutions.

“With the quickly approaching 2019 elections in New Jersey and Virginia and the 2020 Presidential election it is imperative that corporations, campaigns, governments and citizens remain vigilant in protecting the security and integrity of our most sensitive data. The partnership between government and the private sector will be key to hold those who seek to sow discord and chaos to our democracy at bay,” said Kim Allman, Director of Government Affairs at Symantec.

At the same time, election officials face another, more complex challenge: How to counter the impact of disinformation campaigns by outsiders who use social media to sow division and undermine trust in US institutions.

Just recently, Facebook revealed it had discovered groups linked to various nation-states “engaged in inauthentic behavior” on Facebook and Instagram regarding elections. This is something that the US and other democratic nations need to expect, according to former DHS chief Michael Chertoff, who said the goal was to disrupt a nation’s unity by waging a cyber campaign of misinformation.

“Then, basically, you win without firing a shot, because people don't trust each other and they don't trust institutions,” he said. “And I think that is what we have seen over the last ten years. In fact, it goes back decades. What has changed most recently is social media, and the ability to manipulate that to drive very carefully tailored messages to particular individuals.

“And that's an area where I think we're still trying to implement standards and approaches that would mitigate the effect of that,” Chertoff continued. “And job number one is to get people to be critical in their thinking when they see a story and not simply accept that it's true because, quote, `It's on the Internet.’"

In the end, the solution rests on finding ways to inoculate the public against disinformation campaigns. Apropos, Facebook is making greater investments to improve media literacy while putting in place policy changes designed to fight "inauthentic behavior” such as the use of coordinated fake accounts to spread disinformation. Unfortunately, we may need to wait until after the next election to learn whether these and similar initiatives had the desired impact.

You might also enjoy
Election Security3 Min Read

As 2020 Looms, Clock Ticking in Race to Enforce Stronger Election Security

Looking to protect against recurrence of foreign meddling, states and local agencies debate how to bolster election security

You might also enjoy
Election Security3 Min Read

RSAC 2019: The Greatest Adversary to Election Security: Social Media

How do we fight against misinformation in the arena of public opinion?

About the Author

Charles Cooper

Consulting Editor

Charles Cooper has covered technology and business for more than 25 years. He is now assisting Symantec with our blog writing and managing our editorial team.