The Surprising Good News About Voting Security

The hacking attempts haven’t slowed. The disinformation campaigns are ongoing. And the warning lights have been “blinking red” for a potential foreign operation aimed at disrupting the midterm elections, according to the country’s top intelligence official.

But if there is anything positive to take away from Russia’s election interference in 2016, it’s this: America’s election infrastructure has never been more carefully monitored in the days, weeks, and months leading up to a nationwide vote—and voters themselves are more wary than ever of foreign propaganda masked as a political ad or Twitter troll.

That heightened awareness is a key takeaway from a report published just one day before the election about hacking attempts on election infrastructure. The Boston Globe revealed on Monday that it had obtained leaked threat reports filed by state and local election officials across the country alerting federal agencies to cyber intrusions and other suspicious activity that appeared to be targeting voter registration databases, election officials, and election networks in the days before the midterms. One unnamed state—the threat reports don’t name states or detail specific incidents—successfully blocked more than 51,000 login attempts from foreign countries in a 24-hour period, the documents reportedly revealed. Some hackers even had “limited success.”

Yet voting and cybersecurity experts I spoke to seemed less alarmed than one might expect. “I’m heartened by this,” said David Becker, a former trial attorney in the Voting Section of the Department of Justice’s Civil Rights Division who now runs the Center for Election Innovation & Research. “We expected there to be this level of activity,” Becker said, pointing to warnings issued by the Department of Homeland Security and the intelligence community in the months leading up to the election. “What’s different this time is that we know about it,” Becker continued. “I think the story here is that DHS even has these threat reports, because of the unprecedented information sharing that’s going on.” That’s how DHS sees it, too. “This sharing is helping us build a national-level understanding of the cybersecurity threats facing our nation’s election infrastructure,” DHS spokesman Scott McConnell told the Globe.

The coordination between the various levels of government in preparation for potential meddling in Tuesday’s election represents a major leap forward since 2016, when many states declined help from the Department of Homeland Security to secure their election systems and balked at declaring such systems “critical infrastructure.” Such a designation, which was finally made in January 2017, puts election infrastructure in the same category as the U.S. power grid and financial sector, and gives states quicker access to classified threat information sharing. It also means that states can participate in joint-defense exercises. In addition, all 50 states have now opted in to the DHS-funded program that has allowed election officials to share information with each other and with the government. Many have enrolled in a DHS program that offers states computer- vulnerability scanning for their election systems.

But aging voting machines and outdated software are still a major problem, and Congress has not allocated nearly enough money—only $380 million has been appropriated for the whole country—to help states completely revamp their infrastructure, experts say. Only one state, Virginia, has completely replaced its electronic voting machines since 2016. And while Illinois has bolstered its cyber defenses since hackers infiltrated its voter database in 2016, its voting machines are still outdated and vulnerable to attack. According to NBC News, there are still counties in 14 states—including Georgia and Florida—whose voting districts have no paper backup for their electronic voting machines. That means it would be impossible to conduct a paper recount if necessary.

That’s particularly concerning because, two years on from Russia’s unprecedented interference, there is no sign that the threats are waning. In a joint statement released on Monday night, the DHS, Director of National Intelligence, FBI and DOJ warned that “Americans should be aware that foreign actors—and Russia in particular—continue to try to influence public sentiment and voter perceptions through actions intended to sow discord." Senior Trump administration officials, including DHS Secretary Kirstjen Nielsen, FBI Director Chris Wray, and DNI Dan Coats, issued a similar warning during a rare joint press conference in August  “Russia attempted to interfere with the last election,” Wray said, “and continues to engage in malign influence operations to this day.” Days earlier, Missouri Democratic Senator Claire McCaskill, who is seeking re-election in a state that went for Trump in 2016, confirmed that Russians had tried to hack her senate computer network but were unsuccessful.

So far, however, the kind of massive hacking-and-leaking operation that took the law enforcement and intelligence communities by surprise in 2016 has not materialized. And, overall, the preparation and response to irregularities in the run up to the midterms has been reassuring, experts say.

Robert Johnston, the cybersecurity expert who was the first outside investigator to uncover the extent of Russia's hacks into the DNC during the 2016 election, said that while he believes there’s been an uptick this year in the number of attacks on voter registration databases and election infrastructure, it would be “disingenuous” to say that it’s “business as usual” on an institutional level in terms of protecting against and responding to these attacks. “There’s still a long way to go,” he said. “But when you have the government providing more money to the states than ever before, the DOJ pumping out indictments against anyone who hacks our election, and our intelligence agencies intimidating people overseas who aren’t acting in our best interests, it becomes clear that we’re on the right track.” (The NSA has reportedly begun sending messages directly to Russian hackers, reminding them that they are being watched.)

Those seeking to sow disinformation and wage information warfare, meanwhile, continue to prey upon social media users, despite their increased awareness of organized foreign-influence operations.

The Justice Department has already charged the first Russian with interfering in the midterms: Elena Khusyaynova, a 44-year-old Russian national who allegedly managed the finances of an election-interference campaign run out of the Internet Research Agency in St. Petersburg, code-named Project Lakhta. The troll factory’s budget for the project, which Khusyaynova allegedly controlled, exceeded 73 million Russian rubles—or roughly $1.2 million—per month. The budget grew almost monthly between January and June of 2018 as the Russian trolls targeted the midterms, according to the DOJ’s criminal complaint.

Russia’s brazen interference in 2016 has also heightened awareness among social-media companies, which have been either proactive or cooperative in shutting down nefarious actors.

Facebook—which did not discover until late 2017 that the Russians had purchased hundreds of political ads that were seen by approximately 10 million users in 2016—revealed over the summer that it shut down Russian and Iranian accounts that were waging political influence campaigns to influence the midterms, and set up a “war room” where a team will monitor fake news and disinformation on Election Day. The Democratic Congressional Campaign Committee, meanwhile, successfully encouraged Twitter to delete more than 10,000 “bot” accounts that were posing as Democrats while discouraging people from voting in Tuesday’s midterms.

Experts broadly agree that the disinformation campaign leading up to the midterms has been more muted than in 2016. “We’re seeing activity in the U.S., but we’re seeing it at levels less than we saw in 2016,” Tom Burt, the vice president for customer security and trust at Microsoft, told The New York Timesthis month. The Russian trolls that are still active have largely focused on Europe, where they’ve sought to deflect blame away from Russia for the poisoning of former Russian spy Sergei Skripal and his daughter, said Clint Watts, a senior fellow at the Center for Cyber and Homeland Security at George Washington University and a Foreign Policy Research Institute fellow. “You only have so many English-language operators,” Watts said. Johnston agreed, noting that Russia’s attention has turned toward fueling division in Europe and Ukraine, which has been a battleground for disinformation and propaganda since at least 2014 when Russia invaded eastern Ukraine and annexed Crimea.

It’s harder, moreover, for foreign actors to influence a local election than a national, presidential election. There is still one fairly easy way, however: sowing doubt in voters’ minds about the legitimacy of the election, either by waging a disinformation campaign alleging voter fraud and voting-machine irregularities—an increasingly common narrative among Russian bots and trolls, according to Brett Bruen, a former U.S. Diplomat who served as Director of Global Engagement at the White House under President Obama. There’s also the option of an actual cyberattack. Experts still worry that a bad actor could interfere at the eleventh hour, altering voter-registration files in databases or hacking websites to change polling locations in a way that would depress turnout and potentially spark mass panic among voters.

“There have been important strides” since 2016, said David Turetsky, a professor at the College of Emergency Preparedness, Homeland Security and Cybersecurity at the University at Albany. But he expressed concern that five states still use direct recording electronic machines, which provide no paper trail of the votes. He noted that “it doesn’t take much in a busy election to disrupt” voting—long lines resulting from faulty equipment or manipulated databases could be more than enough to depress turnout. (If something like that were to happen, the Pentagon will reportedly be ready to retaliate with an offensive cyber-strike.)

The bottom line, Turetsky said, is that we’re on the right track—but much more still needs to be done. “If we have a good day, it’s not because we’ve done everything possible to earn it,” he told me. “It’s because we’ve done some of the things possible to earn it, and we got lucky.”