Election Security: Securing America's Future

## Overview

Delivered virtually at Black Hat by Chris Krebs, Director of the Cybersecurity and Infrastructure Security Agency (CISA) at the Department of Homeland Security (DHS), the presentation addresses efforts to safeguard U.S. election infrastructure. Krebs compares the state of election security in 2016 to the preparations underway for the November 2020 election. The federal government’s role under Article I, Section 4 of the Constitution is strictly supportive of state and local election officials, who maintain primary authority over the time, place, and manner of elections.

---

## 2016 Election Assessment and the "Sputnik Moment"

Looking back at 2016, Krebs identifies three core elements that defined the election security landscape: - **Ad Hoc Coordination:** The federal response was mobilized without pre-existing, dedicated structures or information-sharing bodies for election security. - **Broad Adversarial Research:** Russian actors targeted and researched election infrastructure across all 50 states, conducting cyber operations, hack-and-leak campaigns against political organizations, and broad influence operations. - **No Vote Alteration:** Intelligence confirmed that adversaries did not change or affect a single cast vote via cyber means.

Krebs likens 2016 to a modern "Sputnik moment." Similar to 1957, when Soviet ICBM capabilities removed the geographic barrier protecting the nation, the 2016 operations demonstrated that foreign adversaries could reach across borders using cyber techniques to destabilize democratic processes.

---

## Evolution and Structural Advantages in 2020

Compared to 2016, federal and local defense capabilities show three primary advancements:

1. **A Vibrant Election Security Community:** - Established the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), which serves all 50 states and nearly 7,000 local jurisdictions. - Leveraged the Sector Coordinating Council to unite federal, state, local, tribal, territorial governments, private-sector vendors, and security researchers. - Formulated technical investment guidance to assist jurisdictions spending congressional election security grants, informed by risk assessments and penetration testing.

2. **Paper Records and Enhanced Auditability:** - CISA pushed to shift all voting machines to systems backed by physical paper records. - In 2016, 80% of votes cast had an associated paper record; for 2020, coverage was tracking toward 92% or higher. - Due to COVID-19-driven shifts to mail-in and absentee ballots, states using paperless direct-recording electronic (DRE) machines (such as New Jersey) expanded paper-backed voting.

3. **Expanded Network Visibility:** - Deployed **Albert** network intrusion detection system (IDS) sensors across all 50 states, achieving 100% county-level coverage in states such as Florida (all 67 counties).

---

## Current Threats, Defenses, and Operational Resilience

Heading into the 2020 election, CISA’s defensive focus centers on both technical hardening and operational resilience:

- **Threat Landscape:** Intelligence and military partners (NSA, USCYBERCOM) observe daily network scanning without evidence of the targeted, state-directed attacks seen in 2016. However, ransomware remains a prominent threat across state and local networks. - **System Hardening:** In 2019, CISA initiated a voter registration database ransomware initiative emphasizing baseline cyber hygiene, hardened configurations, and multi-factor authentication (MFA). - **Endpoint Detection and Response (EDR):** A nationwide pilot program launched to deploy EDR capabilities to host endpoints in election jurisdictions for threat monitoring and incident response forensics. - **Analog Failover & Redundancy:** To safeguard against outages or ransomware lockouts impacting electronic poll books or databases, CISA promotes analog paper backups at precincts and the use of provisional ballots to ensure uninterrupted voting. - **COVID-19 Adjustments & Voter Preparedness:** Partnering with the CDC and HHS, CISA released operational guidance addressing social distancing, sanitization, and the influx of absentee/mail-in ballots. Krebs emphasizes that because counting absentee ballots takes longer, public resilience requires an informed, patient voter base.