Bloomberg Businessweek - USA (2019-08-19)

38

◼ SOLUTIONS Bloomberg Businessweek August 19, 2019

legislatureshistoricallyhavebeenstingyin fundingefforts.

Florida’sRepublicangovernor,RonDeSantis,saidin June

thathe’didentified$5.1milliontofortifycybersecurity.The

statespendsmoreoncitrusresearchandanimalcontrol,

accordingtoits 2019 budget.

Thestate’sRepublicanseniorU.S.senator,Marco

Rubio,saysit makessensethathackerswouldcontinue

totargethisstate.“Ifyouwantedtoconductinfluence

operationsin thiscountrybyunderminingpeople’sconfi-

dencein ourelectionsystem,Floridawouldbeonthetop

ofyourlist,”hesays.“We’rea largestate.We’rea diverse

state.We’repoliticallycompetitive.”

RussiansinfiltratedtwounnamedFloridacountiesin

2016,butstateofficialshadnoideathecountieshadbeen

breacheduntilaftertheelection,whentheywereinformed

byfederalagents,accordingtoofficialsclosetotheinves-

tigationwhoaskednottobeidentified.Federalauthori-

tiesaren’treleasingthenamesofthecountiestostaveoff

embarrassmentandtoencouragelocalgovernmentsto

beforthcomingif additionalflawsarediscovered.

InIllinois,electionauthoritiesareatoddswithDHS

overhowsuccessfulRussianhackerswereinbreach-

ingthestate’ssystem.IllinoisofficialssayRussiancyber-

sleuthsgainedaccessforalmostthreeweeks,secretly

downloadingandattemptingtoaltermorethan200,000

registrationrecordsbeforetheywerecaught.Theybar-

ragedthesystemwithsomanycommandsthatthereg-

istrationsitestoppedworking,saysMattEmmons,who’s

overseeingthestate’selectionsecurityeffort.“Thegen-

eralconsensusis theywantedustoknowwhattheyhad

doneandwheretheyhadbeen.”DHSstafftoldtheSenate

IntelligenceCommitteethattheattackerscouldhave

donefarmoredamageandmaybedid,accordingtothe

panel’sreport.Thedifferingaccountssuggestcontinuing

frictionbetweenstatesandtheagency,potentiallycreat-

inganintelligencegapasthe 2020 electionapproaches.

OfficialsinIllinoisareresortingtosomeold-school

techniquestobolstersecurityattheirstripmallhead-

quarters.WhenEuropeangovernmentofficialsvisitedin

JulytodeterminehowU.S.electionsystemsdifferfrom

theirs,thestaterequiredthemtoundergobackground

checks.It wasanacknowledgmentthatpreparingfor

another2016-styleattackisn’tenough.“We’reconstantly

tellingourclientsthatit’snolongera matterof‘if’you’ll

beattacked,butrathera matterof‘when,’” saysHaiyan

Song,vicepresidentandgeneralmanagerofSplunkInc.,

a SanFrancisco-basedcybersecurityfirm.“Thatcer-

tainlyappliestogovernmentsin electionsecurity,aswell.”

�KartikayMehrotraandAlyzaSebenius,withJonathan

LevinandDanielFlatley

THE BOTTOM LINE Illinois is spending millions to safeguard its voting

systems for the 2020 presidential election, but it might not be enough as the

number of nations committing data breaches multiplies.

elections,” says Governor J.B. Pritzker, a Democrat.

“We’re securing our elections with state resources, but

there is a federal need. This is a national crisis.”

State election authorities are more prepared than they

were four years ago, when they weren’t focused on the

threat of voting system hacks. But Illinois’s struggles illus-

trate how outmatched most states are and how money—

and the cyberskills of local authorities—will determine

whetherelectioninfrastructurefromIllinoistoFloridawill

besecurein November2020. While those two were the

only states named in special counsel Robert Mueller’s

report as targets of election meddling by Russian hack-

ers, the Senate Intelligence Committee in July concluded

there were “extensive” efforts to hack all 50 states.

In 2016, Russia’s cyberforces sent e-mail phishing mes-

sages and tested the vulnerabilities of voting systems.

Election-security experts fear that was merely prac-

tice for a much more aggressive effort, according to the

Senate panel’s report. The biggest concern is that foreign

actors could change enough votes to swing an election.

Experts say that’s almost impossible because machines

generally aren’t connected to the internet and votes are

counted and audited at thousands of individual polling

places. A more plausible concern: Hackers meddle with

data that poll workers depend on. If voters’ information

is altered or their names removed from registration lists,

the result could be anger and chaos that undermine the

election’s legitimacy.

Fundingremainsa keyobstacle.In Illinois,officialshave

saidtheyneedabout$175million to rebuild and defend

the election apparatus but have received slightly more

than 7% of that amount. Like Illinois, most states don’t

have enough money to pay for new security measures

that experts say are required to ward off increasingly

sophisticated attacks, according to state election officials

across the country, academics who study election secu-

rity, and executives at cybersecurity companies.

The scale of the country’s election infrastructure is

a big part of the problem. Elections are administered by

state and local officials, which means all 50 states must

wage their own battles with the U.S.’s geopolitical rivals.

Convincing smaller and rural counties with few resources

that they too could be targets remains a challenge, says

Matthew Masterson, senior adviser on election security at

the U.S. Department of Homeland Security. They often lack

even basic security measures, such as two-step verifica-

tion for accessing internal election databases. “They think,

‘Whowouldwanttobotherus?’” hesays.

Sincelastyear,Congresshasdistributed$380mil-

lion to the states, which have used much of that money to

install a threat-monitoring system called Albert, a spinoff of

a federal surveillance program. But Senate Majority Leader

Mitch McConnellhasblockeda Senatebilltodistributean

additional $600million for state election security, and state