Counties need human help to combat cyber attacks on elections
The national security community warns us to expect more sophisticated, evolving attacks. Local election officials are on the front line -- 108 officials in Illinois and 8,000 nationally, most of us county officers, are facing down this powerful, shadowy adversary, like county sheriffs sent to repel an invading army.
We are pressing for resources -- better technology and routine hand-counted audits to give confidence that digital results are accurate, and most critically, we need top-notch personnel with skills to navigate the cyber minefield and help us defend ourselves against the onslaught of digital threats.
Over the past 15 years, our office has tried to lead on technology and security -- using applied forensics in elections, creating cyber-security checklists and publishing the first White Paper written by election officials in the wake of the 2016 attacks. Additionally, we helped the Center for Internet Security and the Defending Digital Democracy program at Harvard's Belfer Center adapt their digital security expertise to the unique context of elections. As co-chair of the council that Homeland Security created to help address this election security effort, we have worked intimately with federal, state and local leaders in elections, technology, intelligence and law enforcement.
In all of these efforts, it became crystal clear that we need someone, some person, to take ownership of security in each election office. In our office, we worked with our colleagues at the Chicago Board of Elections to share the cost of hiring a digital security expert. We can't fathom how other election officials can meet a foreign threat without a similar investment. And it's a hefty investment.
Congress just released $380 million to combat the election cyber-security threat. That's an important start. It may be necessary to invest that much annually. Meanwhile, Americans justly concerned about the costs need confidence this money will be spent well.
There are two top priorities. A handful of states and counties still have paperless voting systems. These must be replaced as soon as possible.
Every election jurisdiction must improve the defensive capacities of local election offices. We envision an army of digital defenders serving election offices around Illinois and the nation, starting now and working through the 2020 presidential election and beyond.
These digital defenders need to accomplish three vital goals. First, they will improve defenses within election offices, following the specific recommendations of CIS and DDD. Second, they will work with outside vendors who provide much of the elections infrastructure to eliminate or defend specific vulnerabilities; and, they will do the work necessary to secure the free support being offered by public and private organizations. More important, they will build a culture of security that adapts to the evolving threats we face through training and assessment efforts.
This can be done. And it can be done now. States will receive initial federal funding in the next month. They can and must cut through the red tape that can delay action. After all, the danger is not hypothetical. We're bracing against the renewed attacks. If we fail to shore up our defenses, we will regret it.
Election officials deploy a variety of digital services, such as informational websites, poll books, voter registration systems and unofficial election results displays. Each of these is a target for our adversaries. A successful attack against those services may not change a single vote, but could still damage public confidence. This is particularly true in a time of suspicion, gracelessness and partisan grandstanding.
Losing candidates are already apt to call their defeats into doubt. A new digital breach -- no matter how far removed from the vote counting system -- could turn sore losers to cynicism, disbelief, even revolt. That's the reaction our enemies want.
We can't eliminate every chance of breach, but we can make successful attacks rare. We do that best by investing in people first -- digital defenders who can guide a coherent, flexible strategy against slippery adversaries.
If we fail today, we may not be free to write the next Op-Ed or commentary explaining what went wrong.
David Orr is Cook County clerk. Noah Praetz is director of elections for the clerk's office,