Election (in)security

The Commissioners Court will decide next month whether to participate in a state-led, grant-funded program to strengthen election security ahead of the 2020 presidential election when hackers will almost surely attempt to thwart American democracy, according to current and former government officials.

The county judge and commissioners could ultimately turn down that help, if their lukewarm responses to the plan outlined by AT&T representatives and state employees at a workshop Wednesday are any indication.

On Thursday, the U.S. Senate Intelligence Committee released a 61-page bipartisan report stating that the country’s election infrastructure is not prepared for attacks. The report, which includes proposals for shoring up those systems ahead of next year’s contest, echoes warnings from former special counsel Robert Mueller who testified before Congress on Wednesday and told lawmakers that Russia is planning a repeat of its 2016 election interference.

“They’re doing it as we sit here,” he said.

Mueller’s written report on Russian interference in the 2016 election, released in April, states that Russia interfered “in sweeping and systematic fashion.” The Senate Intelligence Committee’s report states that Russia attempted to hack elections systems in all 50 states.

In Texas, the Secretary of State’s (SOS) office is encouraging every county to participate in its federally funded Election Security Assessment (ESA) program by the end of the year. Scheduling is currently being done for the month of September.

In March of last year the SOS received $23.3 million in federal funding through the Help America Vote Act (HAVA) to enhance election security.

The spending proposal that the SOS submitted to the U.S. Election Assistance Commission included providing free local-level election security assessments to determine whether any upgrades are needed to thwart hackers.

The ESA program is administered jointly by the SOS and the Texas Department of Information Resources (DIR) through the DIR’s Shared Technology Services program. Under that umbrella, the state partnered with AT&T after conducting a vetting process.

AT&T representatives Gene Moore and Mark Hooper led Wednesday’s workshop at Annex 1, which was attended by about 15 people, including the county’s four commissioners and County Judge Ron Massingill. Several DIR representatives participated by phone.

QUESTIONS RAISED

Comments by Hood County elected officials and IT Director Drew Wiederkehr indicated a belief that Hood County’s elections system is already secure.

The county’s voting machines do not connect to the internet, according to Elections Administrator Crickett Miller, but the county does send election-related information to the Secretary of State via the county’s computer system.

Hooper stated that “there is almost nothing that can’t be hacked” and that counties can’t fix a problem if they’re not aware of it.

Precinct 4 Commissioner Dave Eagle expressed concern about unclear contractual language possibly putting the county on the hook for future unforeseen costs.

It was stated that one-third of the federal money that was received by the state will be used for county assessments, and two-thirds will be used to address problems found.

However, Moore and the DIR representatives said that the SOS is still working out details on how the problem-solving portion of the funding will be distributed.

That uncertainty seemed to leave some members of the Commissioners Court uneasy about agreeing to the partnership.

Allowing an outside party access to the county’s computer system was another source of apprehension.

Massingill stated that the only way he can see the county getting hacked “is through AT&T.”

When Moore stated that the company would never risk its reputation that way, Massingill said he was concerned that a lone AT&T employee might be able to corrupt the county’s system.

TOOTHLESS TIGER?

On Sept. 1, House Bill 1421 relating to the cybersecurity of voter registration lists and other election-related documents, systems and technology will go into effect.

The law requires the Secretary of State to increase the protections of Texas election systems, train employees and county election officers, and provide timely notification when an elections security breach occurs.

Another new law, HB 3834, requires state and local government employees and state contractors to complete cybersecurity training.

The laws carry no real penalties, though, according to Miller.

As for the proposed partnership with the state and AT&T, the county isn’t required to jump on board.

Under those partnerships, AT&T conducts on-site assessments, which can take between one and five days. A report and scorecard based on each county’s assessment is provided to that county within about six weeks, and then AT&T schedules a wrap-up call to answer questions and discuss any recommendations.

The information provided to county officials through the assessment process is not subject to Open Records for security reasons, Moore said.

Information from the assessments will be sent to the Secretary of State’s office to provide an “aggregate” picture of election security in Texas, but the reports will not identify individual counties, Moore said.

According to the July issue of County Progress magazine, about two-thirds of the state’s 254 counties are either in the process of receiving a free assessment or have expressed interest in doing so.

Miller told the HCN after the workshop that she feels confident in the security of Hood County’s elections systems. As for whether the county should participate in the ESA program, she said: “I can go either way but, as they say, it’s better to be pro-active than reactive. Nobody’s perfect.”

According to County Progress, Potter County Elections Administrator Melynn Huntley credited the assessment and AT&T’s recommendation for an emergency plan with “saving an election” after a malicious virus infiltrated the county’s computer system one business day before the start of early voting last April.

Near the end of Wednesday’s workshop, Moore stressed that county elections systems throughout the state “are very safe” overall and “in good shape.”

He noted that the ESAs are intended to “advance and strengthen” security measures.

Massingill said that whether to participate in the ESA program will be on the agenda for the next regular meeting of the Commissioners Court.

That meeting will be at 9 a.m. on Tuesday, Aug. 13 at the Hood County Justice Center.

kcruz@hcnews.com | 817-573-7066, ext. 258