5 Big Takeaways From Senate Intel's Election Security Investigation

Senate Intelligence Chairman Richard Burr, R-N.C., right, accompanied by Committee Vice Chairman Mark Warner, D-Va.

Senate Intelligence Chairman Richard Burr, R-N.C., right, accompanied by Committee Vice Chairman Mark Warner, D-Va. Andrew Harnik/AP

The bottom line is future elections are in danger of Russian meddling and we haven’t done enough to secure them.

The Senate Intelligence Committee held rare a two-panel hearing on election security Wednesday, a day after releasing its big-picture takeaways from the committee’s months-long investigation into Russian meddling in the 2016 election.

Here are five big takeaways:

1. Just because there’s no evidence votes were changed this time doesn’t mean they won’t be changed next time.

Public officials and pundits have made much of the fact that investigators turned up no evidence that Russian hackers changed actual vote totals in the 21 states where they probed election systems in 2016.

That doesn’t mean hackers won’t successfully change votes in 2018 or 2020, though, and our electoral process does them some big favors.

Here’s how former Homeland Security Secretary Jeh Johnson, who oversaw the department’s initial response to the Russian meddling operations put it: “The reality is that, given our electoral college and our current politics, national elections are decided in this country in a few precincts in a few key swing states and the outcome, therefore, may dance on the head of a pin.”

Though Homeland Security tries to steer clear of electoral politics, the department does take into account that adversaries might be more likely to target swing states and districts, Assistant Secretary Jeanette Manfra told Sen. Kamala Harris, D-Calif., during the hearing. Manfra called it part of the department’s “risk-based approach.”

Because states have overall authority over elections, however, the department can only vet and secure election systems in states that request that help. So far, only 19 states and localities have requested that vetting, Homeland Security Secretary Kirstjen Nielsen told lawmakers.

2.  State election systems aren’t the only good targets.

If Russia or another adversary wants to sow chaos around an election, hacking voting systems isn’t the only way to do it.

For example, prior to the 2016 election, then-Secretary Johnson became concerned that malicious hackers might compromise systems the Associated Press uses to project election victories based on partial vote totals and exit polls, he said.

Johnson spoke with the AP CEO and was convinced that the organization had enough safeguards and redundancy in its systems that it was reasonably safe, he said. If AP had incorrectly called numerous swing states or the entire election, however, it could have created serious doubts about the election results.

Hackers might also target the companies that manufacture voting machines before they reach states, Sen. Ron Wyden, D-Ore., noted. Wyden has pressed voting machine companies about how well they adhere to cyber best practices and whether they undergo regular audits and been disappointed by their responses.

Even a breach that didn’t reach critical voting systems could raise questions about an election outcome if federal and state officials don’t convince the public about the limits of the breach or get their facts wrong, said Eric Rosenbach, a former top cyber official at the Pentagon and now co-director of Harvard’s Belfer Center for Science and International Affairs.

Rosenbach encouraged states and the federal government to beef up their ranks of public relations professionals who can ensure accurate information gets out in a crisis.

3. States are still worried about a federal takeover of elections.

Homeland Security’s decision to designate election systems as critical infrastructure makes it easier for the department to funnel money and resources to protect those systems, and sends a message to Russia and other adversaries that hacking those systems will invite consequences. It also makes it easier to share cyber threat information with state election officials and to give them security clearances.

State officials remain wary, however, that the designation represents a federal power grab of an inherently state function.

“In our hearings, we’ve found that states do not want a critical infrastructure designation,” Committee Chairman Richard Burr, R-N.C., said. “There’s a red line there and we’ve learned that…We’ve seen that it’s visceral.”

That visceral dislike can be overcome, Burr added, if states come to trust Homeland Security and see the benefits of its assistance.

Burr and other committee members also stressed multiple times—and listed as the first finding of their investigation—that states “should remain firmly in the lead on running elections” while the federal government “should ensure they receive the necessary resources and information.”

Johnson told lawmakers he took a road trip to speak with state election officials in August of 2016 and previewed a possible critical infrastructure designation. The response was so negative that Johnson shelved the idea, he said, believing that a contentious election year was a bad time to make the move.

After the election, however, Johnson went ahead and made the designation anyway.

4. But someone has to hold states accountable.

Even if states are in charge of elections, however, someone needs to hold those states accountable if they’re not doing what’s necessary to secure election systems against hacking or to provide an auditable paper trail of votes, the committee’s ranking member Sen. Mark Warner, D-Va., said.

“I believe the public does have a right to know if their state or their community basically is ignoring this problem,” he said.

When Homeland Security is having a problem with intransigent state officials, it often reaches out to those states’ U.S. senators as a way to gain leverage, Nielsen told Warner.

Nielsen noted that two states are “not working with us as much as we’d like right now,” but did not name the states.

A handful of states do not have an auditable paper trail for all their votes—a best practice highlighted by the Senate Committee report.

5. We haven’t gotten it right yet, but we’re still working.

Early in the hearing, Johnson stated the obvious. “With the benefit of hindsight,” he said, the sanctions the Obama administration imposed in December 2016, in response to Russian election meddling “have not worked as an effective deterrent.”

Additional sanctions recently imposed by the Trump administration and indictments by Special Counsel Robert Mueller, though recent, also have yet to make a substantial difference.

Homeland Security’s efforts to beef up state election security have also faced roadblocks. Only about 20 of 150 state officials slated to receive security clearances have received them so far, Nielsen said, and only 19 states and localities have asked Homeland Security to vet their election systems for cyber vulnerabilities.

There’s some positive news, though.

The not-yet-released omnibus spending bill contains something close to the $25 million Homeland Security requested for election security, several senators said.

Committee Chairman Burr and ranking member Warner also pledged, at the close of Wednesday’s hearing, to add their names to an election security bill sponsored by Sens. James Lankford, R-Okla., and Harris, giving it a significant boost.

“States should not be asked to stand alone against a nation,” Burr said, praising Homeland Security for becoming “a true partner to the states.”

X
This website uses cookies to enhance user experience and to analyze performance and traffic on our website. We also share information about your use of our site with our social media, advertising and analytics partners. Learn More / Do Not Sell My Personal Information
Accept Cookies
X
Cookie Preferences Cookie List

Do Not Sell My Personal Information

When you visit our website, we store cookies on your browser to collect information. The information collected might relate to you, your preferences or your device, and is mostly used to make the site work as you expect it to and to provide a more personalized web experience. However, you can choose not to allow certain types of cookies, which may impact your experience of the site and the services we are able to offer. Click on the different category headings to find out more and change our default settings according to your preference. You cannot opt-out of our First Party Strictly Necessary Cookies as they are deployed in order to ensure the proper functioning of our website (such as prompting the cookie banner and remembering your settings, to log into your account, to redirect you when you log out, etc.). For more information about the First and Third Party Cookies used please follow this link.

Allow All Cookies

Manage Consent Preferences

Strictly Necessary Cookies - Always Active

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data, Targeting & Social Media Cookies

Under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information to third parties. These cookies collect information for analytics and to personalize your experience with targeted ads. You may exercise your right to opt out of the sale of personal information by using this toggle switch. If you opt out we will not be able to offer you personalised ads and will not hand over your personal information to any third parties. Additionally, you may contact our legal department for further clarification about your rights as a California consumer by using this Exercise My Rights link

If you have enabled privacy controls on your browser (such as a plugin), we have to take that as a valid request to opt-out. Therefore we would not be able to track your activity through the web. This may affect our ability to personalize ads according to your preferences.

Targeting cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

Social media cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies you may not be able to use or see these sharing tools.

If you want to opt out of all of our lead reports and lists, please submit a privacy request at our Do Not Sell page.

Save Settings
Cookie Preferences Cookie List

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. More specifically, we use cookies and other tracking technologies for the following purposes:

Strictly Necessary Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Functional Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Performance Cookies

We do not allow you to opt-out of our certain cookies, as they are necessary to ensure the proper functioning of our website (such as prompting our cookie banner and remembering your privacy choices) and/or to monitor site performance. These cookies are not used in a way that constitutes a “sale” of your data under the CCPA. You can set your browser to block or alert you about these cookies, but some parts of the site will not work as intended if you do so. You can usually find these settings in the Options or Preferences menu of your browser. Visit www.allaboutcookies.org to learn more.

Sale of Personal Data

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Social Media Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.

Targeting Cookies

We also use cookies to personalize your experience on our websites, including by determining the most relevant content and advertisements to show you, and to monitor site traffic and performance, so that we may improve our websites and your experience. You may opt out of our use of such cookies (and the associated “sale” of your Personal Information) by using this toggle switch. You will still see some advertising, regardless of your selection. Because we do not track you across different devices, browsers and GEMG properties, your selection will take effect only on this browser, this device and this website.