DHS: Gearing up for elections security

Concerned about election security? DHS says it’s ‘here to help’

Eight months after election systems were designated as critical infrastructure by the Department of Homeland Security, officials there are finding their footing when it comes to coordinating any potential fixes for local government.

Learn More

How DHS can help your elections office

“From what I’m learning, every state is different,” said Juan A. Figueroa, who is leading the Election Infrastructure Sector Specific Agency Team at DHS.

“If you’ve seen one fusion center, you’ve seen one fusion center,” he said. “You haven’t seen them all. That’s the one caveat, couple of caveats, I’m learning about election infrastructure.”

Earlier this summer, officials from DHS told the Senate Intelligence Committee that there was evidence that 21 states’ election-related systems had been targeted by Russia. The issue has raised alarm bells about the risk to voter registration and digital voting machines.

In response, DHS is currently building a staff, coordinating with interests in the field and forming councils made up of public and private entities, Figeuroa said.

“We, DHS, in a sense have come on the scene most recently with the [critical infrastructure] designation in January,” Figueroa noted. “Prior to that, with last year’s election, with the potential hacking and things like that…DHS and the FBI have been involved, hard, since March of last year, but more recently since the designation, we’re in the process of forming a sub-sector.” The Elections Sub-Sector falls under the Government Facilities Sector, one of 16 critical infrastructure sectors at DHS.

Secretaries of state oppose the critical infrastructure designation based on “the federal government’s continued lack of transparency and clarity with chief state election officials on plans for implementing the designation,” the group said.

Security clearances? ‘Still in early stages’

DHS caught some flak earlier this summer after a meeting with secretaries of state at their conference in Indianapolis, mainly about election officials not having access to classified information to find out about potential election hacks.

“Unfortunately, despite assurances from DHS representatives that this issue is being worked on internally, no secretary of state has been granted such a clearance, nor has any process for requesting such clearance been communicated with NASS members,” the National Association of Secretaries of State said.

“Security clearance is something we grant across all of the sector partnerships — private sector as well as government officials,” Figeuroa said. “In this case, we have initiated security clearance processes. It’s still in its early stages, but we think that it’s important to be able to have state and local folks be able to handle classified information if necessary.”

DHS is currently forming a government coordinating council and would “probably work a lot of those discussions in there as to how to prioritize who should be receiving clearances,” he said. Figueroa said ideally, local and state election officials will “share your playbook with another state or county; it doesn’t all have to come from the federal government; I think states should get used to sharing some information, especially those [with systems] that are ‘architected’ the same way.”

The fact that states and counties use different election systems, Figueroa said, “is a secure thing…a good thing that everybody has their own nuanced processes.”

As far as any election officials wary of working with the federal government, Figueroa said that they should look at DHS as a tool to help, if they need it. “Having DHS in the picture, or just the federal partners in the picture…it’s a voluntary process,” he said. “If you want to participate, please do.”

“If there are those that need support, if it’s something the federal government can coordinate with cyber support, then we’re here to help them do that,” he said.

If you’re a county looking for help with your election infrastructure security? You should most likely start with your state election office, DHS recommends.

The most prevalent issue they’re seeing in the field? “So far, it’s certainly interest in what we can do from the cyber perspective,” he said. DHS has protective security advisors in each state and cyber security advisors in lesser numbers that cover state-level engagements and requests.

Meanwhile, DHS is looking at the big picture. “It’s been really fascinating, because you never realize how detailed and how different some of the election processes are,” Figueroa said. “It all has worked for years and years and years.”

---

How DHS can help your elections office

The Department of Homeland Security makes its cybersecurity services available to state, county and local election officials that request them.  These services include cyber “hygiene” scans on Internet-facing systems, as well as risk and vulnerability assessments.  Cyber hygiene scans are conducted remotely, and provide a report identifying vulnerabilities and recommendations to improve online voter registration systems, election night reporting systems and other Internet-connected election systems.

     To make contact with DHS, the department recommends first contacting your state elections office, which should be able to link you to help at DHS. You can also contact DHS at: SLTTCyber@hq.dhs.gov.

Helpful websites include:

• National Cybersecurity and Communications Integration Center
• Multi-State Information Sharing and Analysis Council (MS-ISAC): The council provides cyber capabilities to local partners and offers free resources.