Trump Administration on Cybersecurity Risks

Trump Homeland Security officials urge protecting our elections

President Donald Trump: “It’s always good to have a paper back-up … I think it’s a great idea.”

“One of the things we're learning is, it's always good — It's old-fashioned — but it's always good to have a paper back-up system of voting. It's called paper. Not highly complex computers, paper. A lot of states are doing that. They’re going to a paper back-up. And I think that's a great idea. We're studying it closely. Various agencies, including homeland security, are studying it very carefully.”  [“Trump floats idea to secure elections: 'It's always good to have a paper backup'”, POLITICO.com, March 6, 2018]

DHS Secretary Kirstjen Nielsen: “If there’s no way to audit the election, that is is absolutely a national security concern”

“If there’s no way to audit the election, that is absolutely a national security concern. So we’re working with states. There’s a variety of ways to do that – as you know – one is paper ballots, one is having a system itself that has a voter-verified paper audit.

“Sir, we had said it’s [paper ballots] a best practice. We do recommend it. What we say is you must have a way to audit. You can do it through paper ballots or you can do it through this voter verification, but you must have a way to audit and verify the election results.”  Open Hearing on Election Security, Senate Intelligence Committee, March 21, 2018 [C-SPAN]

Christopher Krebs, Undersecretary of National Protection & Programs Directorate (NPPD): “We need to continue that trend toward a voter-verifiable paper trail.”

We need to continue that trend toward a voter-verifiable paper trail… That’s the progress that we’re seeing nationwide.” [Arlington Elections Remain Safe from Cyberattacks, Local and Federal Officials Say, ARLnow.com, June 12, 2018]

Matthew Masterson, Senior Security Advisor, National Protection & Programs Directorate (NPPD): “having an auditable voting system … is critical to the security of the systems”

Senator, the auditability and having an auditable voting system – in this case auditable paper records – is critical to the security of the systems. And those states that have moved in that direction have implemented means by which to audit the vote in order to give confidence to the public on the results of the election.  Hearing on Election Interference: Ensuring Law Enforcement Is Equipped to Target Those Seeking to Do Harm, Senate Judiciary Committee, June 12, 2018 [C-SPAN]

Jeanette Manfra, Assistant Secretary for the Office of Cybersecurity and Communications (CS&C): “prioritize the security of your voting machines”

Sir, I would say to first – as previous Senators mentioned – prioritize the security of your voting machines and the vote tallying systems – ensure that they are not connected to the internet even if that is enabled on those particular devices. Second, ensure that you have an auditing process in place where you can identify anomalies throughout the process – educate polling workers to look for suspicious activity, for example.  Hearing on Russian Interference in the 2016 Elections, Senate Intelligence Committee, June 21, 2017 [C-SPAN]

Background

Secretary Kirstjen Nielsen, Department of Homeland Security

Senator Ron Wyden: [. . .] I’d like to get your views for the record of whether you believe the continued use of paperless voting machines in this country threatens our national security and the Department is now prepared to recommend paper ballots.

Secretary Kirstjen Nielsen, Department of Homeland Security: So yes, sir. If there’s no way to audit the election, that is absolutely a national security concern. So we’re working with states. There’s a variety of ways to do that – as you know – one is paper ballots, one is having a system itself that has a voter-verified paper audit. So in other words, you vote electronically, but the machine spits out almost like a ticker tape what you voted, and you have that for your record and then we can also have it for record. So it’s a different way of doing it from paper ballots. But yes sir, we absolutely have to have a way to audit and be able to verify the integrity of the information of the votes.

Senator Ron Wyden: [. . .] I just want to before we wrap up see if we can drill a little bit further as to the question as to whether you all are prepared to recommend that our country have paper ballots. I think you’re almost there.

Secretary Nielsen: Sir, we had said it’s a best practice. We do recommend it. What we say is you must have a way to audit. You can do it through paper ballots or you can do it through this voter verification, but you must have a way to audit and verify the election results.

Christopher Krebs, Undersecretary of National Protection & Programs Directorate (NPPD), Department of Homeland Security

““Arlington takes a very pragmatic and a keep-it-simple approach,” Chris Krebs, a senior DHS official focusing on cybersecurity, told reporters. “We need to continue that trend toward a voter-verifiable paper trail… That’s the progress that we’re seeing nationwide.” [Arlington Elections Remain Safe from Cyberattacks, Local and Federal Officials Say, ARLnow.com, June 12, 2018]

“Krebs also endorsed the national trend away from digitized ballots. "We need to keep on track toward verifiable paper trails," he said.” [On primary day in Virginia, officials say they're preparing for more cyberthreats against elections, State Scoop, June 12, 2018]

Matthew Masterson, Senior Security Advisor, National Protection & Programs Directorate (NPPD), Department of Homeland Security

Senator Mike Lee (R-Utah): One approach to the threat, the possibility of election infrastructure or voting machines being hacked from the outside is to go low-tech. Some states have gravitated toward that. For example, some states have started making moves back toward paper ballots, so that they can’t be hacked. Is this something that’s helpful? Is it something that is necessary that you think more states ought to consider? =

Matthew Masterson, Senior Security Advisor, National Protection & Programs Directorate (NPPD), Department of Homeland Security: Senator, the auditability and having an auditable voting system – in this case auditable paper records – is critical to the security of the systems. And those states that have moved in that direction have implemented means by which to audit the vote in order to give confidence to the public on the results of the election. And those states that have non-paper systems have indicated a desire – for instance, Pennsylvania – to move to auditable systems. And so at this point, resources are necessary to help them move that direction.

Senator Lee: By that you mean either a paper-ballot system or a system that simultaneously creates a paper trail?

Masterson: An auditable paper record, correct, sir. Yep.

Jeanette Manfra, National Protection and Programs Directorate (NPPD) Assistant Secretary for the Office of Cybersecurity and Communications (CS&C), Department of Homeland Security

Hearing on Russian Interference in the 2016 Elections, Senate Intelligence Committee, June 21, 2017 [C-SPAN]

Senator Roy Blunt (R-Missouri): […] You said that the best practice would be to not have the vote tallying system connected in any unnecessary way to the internet. Is that right?

Jeanette Manfra, Acting Homeland Security Deputy Under Secretary for Cybersecurity & Communications: Both the kiosks themselves and vote tallying systems to not connect them to the internet, and to also have ideally paper auditing trails as well.

[…]

Senator Angus King (I-Maine): [. . .] What would you tell my elections clerk […] would be the top three things he or she should think about in protecting themselves in this situation?

Manfra: Sir, I would say to first – as previous Senators mentioned – prioritize the security of your voting machines and the vote tallying systems – ensure that they are not connected to the internet even if that is enabled on those particular devices. Second, ensure that you have an auditing process in place where you can identify anomalies throughout the process – educate polling workers to look for suspicious activity, for example.

Senator Blunt: Doesn’t auditing mean a paper trail – a paper back-up?  

Manfra: Yes, sir. I would recommend a paper back-up.