Voting infrastructure protections need fleshing out
Connecting state and local government leaders
The independent federal commission that helps states improve their voting systems wants more clarity on what DHS' critical infrastructure designation means.
Although voting systems have been designated “critical infrastructure” by the Department of Homeland Security on Jan. 6, the federal commission that helps state governments develop voting systems and administer elections is unsure of the implications of the new designation.
U.S. Election Assistance Commission plans to sit down with officials from DHS on Feb. 2 to get a clearer understanding of that protection.
The systems were designated as a subsector the of the existing Government Facilities critical infrastructure sector, one of DHS 15 sectors that also cover the energy, communications and chemical sectors.
"We still don't know what it means," Thomas Hicks, chairman of the U.S. Election Assistance Commission told FCW after his presentation at a biometric technology security conference in Arlington, Va., on Jan 24.
"We're hoping to have a forum to ask DHS and the Trump administration what the designation means and does it go forward" under the new administration, Hicks said.
The EAC is a federal independent agency that serves as a national clearinghouse and resource of information regarding election administration for state and local governments. It develops guidance for states, works on voluntary voting system guidelines and other work to help ensure systems function efficiently and securely.
Hicks said there are many areas under the DHS designation of state voting systems as "critical infrastructure" that need more definition and discussion.
"I'm neither for it or against it. I just don't know what it means," said Hicks in his keynote presentation at the Biometrics for Government and Law Enforcement conference.
Hicks said EAC wants to put some meat on the bones of the announcement by answering basic questions such as, "When can the [federal] government come in, who counts as an election official?"
The designation was made by then-DHS Secretary Jeh Johnson in light of reports of attempts to breach voting registration data in Arizona and Illinois ahead of the November election. The FBI determined that both hacks were from foreign sources, with the Arizona hack coming from Russia.
Under the designation, Johnson said states' requests for cybersecurity help are voluntary. States have to ask for DHS to come in to assess their system security, he said.
At the time, Johnson said the designation covers centralized vote tabulation locations used to support the election process, storage facilities and related information and communications technology, as well as voter registration databases, voting machines and other systems that manage the election process and report and display results on behalf of state and local governments.
Hicks told FCW that another issue surrounds how a state asks for DHS assistance. The parameters are hazy since election systems are run by many local governments within states.
"If Arlington County asks for DHS' help, does that mean the state of Virginia has asked for assistance?" Hicks said.
Some states voiced concern over the designation when it was announced. Georgia Secretary of State Brian Kemp called the designation "provocative" and a "blatant overreach" by the federal government.
Separately, Rep. Jason Chaffetz (R-Utah), chairman of the House Committee on Oversight and Government Reform, has asked the DHS Inspector General to look into Kemp's accusations that DHS probed his state's firewall before the November election.