Are elections in WA safe from cybersecurity attacks and misinformation? Here’s what experts say
In her 26 years working in elections, Thurston County Auditor Mary Hall said she never thought she would have to become a cybersecurity or election misinformation expert.
“Prior to 2016, we were the people who never wanted to be in the paper because if you were in the paper that meant you made an error, or something went wrong … so you never wanted it to be you,” Hall told McClatchy. “And now, we have to be out there, we have to be out there telling our story, we have to debunk misinformation before it gets out of control.”
Hall said she is no stranger to misinformation, mal-information or disinformation.
During the 2020 presidential election, Hall said a picture was circulated on Facebook of a truck with a ballot box in the back alongside a caption that claimed the box had been stolen. The truth was much simpler: a local auditor had picked up a used ballot box from a neighboring county, and happened to stop at a mall with the empty box in his truck. Luckily, she said, she was able to get the photo taken down within 12 to 14 hours.
Had the photo gone viral, Hall said the concerns could have gotten out of control as the misinformation spread. She said her office has a good relationship with social media platforms such as Facebook, Twitter and YouTube, so if misinformation is caught early enough, it is easy to take down.
In fact, Facebook even has a department established within the company that is specifically trained and equipped to handle those sorts of misinformation incidents.
Other counties have different methods for handling misinformation.
Kyle Haugh, elections supervisor for the Pierce County Auditor’s Office, said the office has worked hard for decades with local stakeholders and political parties to educate local voters on the election process to avoid misinformation. The preventative approach, Haugh believes, has helped the county avoid any big misinformation campaigns.
Instead of repeating misinformation if it crops up, Haugh said the office leads with facts first.
However, Haugh and Hall said they believe mail-in voting has created a source of misinformation nationally, despite the mail-in election process being secure and many other states now adopting the model.
Hall thinks the motives of misinformation and disinformation stem from certain bad actors who want to “erode our democracy,” which is also why she thinks the issue has become so critical to combat now.
Cybersecurity efforts
Advanced cybersecurity measures have become increasingly necessary for election-related offices now, as well.
In 2017, election infrastructures were deemed critical by the Department of Homeland Security, along with other infrastructures such as nuclear power plants and energy grids.
As a result of that designation, DHS agents began attending election conferences where they provide free resources for elections officials, Hall said. After hearing a DHS agent speak at one of those conferences, a rep came to Hall’s office for penetration testing, a total cyber assessment and a cyber audit.
Eventually her office was given the budget to purchase all the security tools they needed, and now Hall said she feels like Thurston County is well-protected.
There are multiple levels of cyber security at Hall’s office; she said that even if someone were to steal her credentials, they would not be able to log in. If something were to happen to threaten the integrity of the cybersecurity in her office, Hall has a direct 24-hour line to the FBI and DHS.
Additionally, computers used in ballot processing are not connected to the internet and go through a process called hardening where all the programs are completely stripped from the computer prior to use. Hall said some people have claimed they could still hack into the internet at the auditor’s office and access the information on the computer, which she said is not possible.
Pierce County also has multiple layers of cybersecurity protection, Haugh said. The office is a member of the Elections Infrastructure Information Sharing and Analysis Center as well as the Cybersecurity and Infrastructure Security Agency, which provide training to election staff and IT staff to prevent cybersecurity attacks. Their systems also are not connected to the internet.
Physical security such as secure buildings, cameras and security patrols are other important measures Pierce County has taken, Haugh said.
Part of the Secretary of State debate
The most recent Secretary of State debate showed just how concerning misinformation and cybersecurity have become to elections offices.
Current Secretary of State Steve Hobbs said during his opening remarks of the debate that Homeland Security is now approaching secretaries of state around the nation to give top secret clearances for the position.
The Washington Secretary of State’s Office houses the statewide voter registration database, which Hall said is a good thing because of the resources available at the state level to protect that information.
Layered security systems are key, a spokesperson for the office said. The desired output, they said, is to have as many layers as possible in case any of the protective layers fail.
The spokesperson said that Albert Sensors have been implemented to detect any attempted intrusions into the system and monitor the network that voter systems are on. The sensor can identify any incoming threats from nefarious IP addresses and then notifiy Cybersecurity and Infrastructure Security Agency, they said. Most county election offices in Washington use Albert Sensors, the spokesperson added.
If voters are still skeptical of the election process, Haugh and Hall both said they are always welcome to come see the process at their offices.
“We find the best way to teach skeptics or people who may be confused by misinformation is to have a one-on-one conversations with them,” Haugh said.
Hall had a word of advice when sharing information online.
“I think people really need to analyze things before they share them. Google the author of the article, google the topic and see if there is confirmation,” she said.
Misinformation and disinformation also can be reported to the Thurston County auditor’s office, she added.
