For trusted elections, we should model 2020

In the wake of the horrific Jan. 6 attack on the U.S. Capitol — which was fueled by months of lies and conspiracy theories — election officials are left to pick up the pieces of our fractured democracy and begin to rebuild trust in our elections. They cannot and should not be asked to do this alone. 

It took a whole of government effort to secure the 2020 election and it will take that same level of investment to restore confidence in future elections. President Biden and his administration can play a critical role in this work.

First, the new administration must double down on support to state and most importantly, local election officials. These heroes are being asked to defend their systems against threats from criminal actors, nation states and purveyors of disinformation. 

In the lead-up to the 2020 election, the Cybersecurity and Infrastructure Security Agency, in partnership with the Federal Bureau of Investigation and intelligence community, led the federal effort to support election officials in all 50 states to improve the security and resilience of their systems. 

This included pushing actionable information regarding cyber activity targeting election networks to thousands of election offices, scanning and testing election networks for vulnerabilities, literally pulling apart election systems to the chips and boards to find and mitigate weaknesses, responding to cyber incidents such as ransomware at the state and local level and sharing intelligence regarding foreign threats to elections broadly across the election community.  

In the end, this was as smooth and well run a presidential election as I have ever experienced in my fifteen years in elections. In the face of a global pandemic, historic turnout and baseless claims of rigging and malfeasance, state and local election officials rose to the occasion and administered a secure, accessible and accurate election. 

Never in our nation’s history have federal, state and local officials — as well as the private sector — worked so closely together to ensure the security of our democracy. The expectation should be set that the full capabilities of the federal government will be actioned to support election officials going forward. 

This means that actionable intelligence regarding threats to our elections from our adversaries like Russia, China and Iran must be released from the restricted halls of classified departments and put in the hands of election officials, state and county IT officials and private sector companies who can defend these systems. 

This happened in 2020 as Iranian actors targeted election infrastructure and American voters in an attempt to undermine the election. Intelligence was quickly analyzed, downgraded and shared with election officials and the American public.  This commitment to the timely and actionable sharing of downgraded intelligence should be the norm instead of just an exception for the 2020 election. CISA, the FBI and the National Guard should all be resourced to foster resilience and more importantly, respond to significant incidents affecting elections.    

There are more than 8,000 local election offices in the United States and many lack the personnel and resources to meet the growing risks to our election systems. The new administration must prioritize scalable services like remote penetration testing and proactive scanning of election networks that even the smallest jurisdiction can use to secure its systems. 

Second, the Biden administration should quickly push for the replacement of any voting system that does not produce a paper record of the vote. Election officials have made steady progress in this area, with more than 92 percent of votes cast on a verifiable paper ballot in the 2020 election. This improvement proved to be vital in the days following the election, when lies about hacked voting machines began to spread among the public. In response to these lies, the state of Georgia took the unprecedented step of hand counting more than five million ballots to verify the accuracy of the machine-counted results. Georgia would not have been able to do this as recently as 2018, when the state used completely paperless systems that produced no independently auditable record. 

Failure to replace these systems and support the advancement of effective and efficient auditing will allow for those conspiracy theorists hell bent on further damaging our democracy to exaggerate and lie about any minor change or error during vote counting and again make claims of rigging and hacking. 

Finally, the administration should work with the nation’s governors, secretaries of state, election directors, mayors and county officials to make meaningful financial investments in state and local IT security. An investment in local IT security and resources is an investment in election security. 

Ransomware continues to ravage state and local governments across the United States. This scourge costs billions of dollars to respond and recover, with some localities falling victim multiple times. State and local governments are a target of ransomware because many lack the cybersecurity protections and resources necessary to defend against attacks, rendering them “soft targets.” Lacking the basic protections like up-to-date systems and regular patching of vulnerabilities, it’s a matter of when, not if, a county, city or township will be locked up with ransomware. 

Funding streams, including grants offered by the Department of Homeland Security, should be supplemented by Congress and prioritized to support state and local government investment in these vital protections to our nation’s critical systems — including election systems. 

The administration can also lessen financial burdens in more creative ways. For instance, all state and local government websites should be transitioned by CISA to be .gov web addresses free of charge. This would improve the security of many of these websites and provide a basic protection against disinformation. While the cost savings may seem trivial to the federal government, every dollar matters to cash-starved local election offices.

The 2020 election tested our democracy, but also showed the resilience and courage of our nation’s election officials. We should be grateful that election officials rejected attempts to overturn a free and fair election and upheld their oath to protect and serve the Constitution and leaders should respond by providing them with the support and investment they require to continue to secure our elections.  

Matt Masterson is a non-resident fellow at the Stanford University Internet Observatory, working on issues related to election security and disinformation. Previously, he served as the lead for election security at the Cybersecurity and Infrastructure Security Agency (CISA) within the U.S. Department of Homeland Security.