Test aims at hackers

CELINA - Mercer County Board of Elections members on Tuesday morning moved to accept federal services to further safeguard the local voting systems.

The decision to accept U.S. Department of Homeland Security services was made in part at the recommendation of Ohio Secretary of State Jon Husted, board chairman Phil Long noted at the board's regular meeting. Also, other county officials gave their OK to proceed with the analysis, director Laura Bruns said.

Long was reluctant to discuss plan specifics since they had been reviewed during a previous executive session.

Bruns, however, gave a general overview of the analysis.

"It's a vulnerability scan. The Department of Homeland Security essentially is going to try to hack into the county's network and see if they can get in," she explained. "And then they will identify any weaknesses and recommend remediation to repair that, if they find anything."

Bruns said it probably will be a monthslong process but wasn't sure about a specific time frame, adding that likely will depend upon how many other counties participate.

"They're going to be working specifically through our IT department," Bruns said.

On Election Day, county assistant prosecutor Andy Hinders said he had no legal concerns with the proposal, Bruns said. Moreover, county auditor Randy Grapner, who oversees the IT department, also indicated he was OK with the analysis, she said.

"For the county, they're seeing it as a positive only because it can be done at no cost, again because elections have been determined to be critical infrastructure - that's why the services are available to us," Bruns said.

A representative of the county's voter registration database provider said nothing in the contract prevents the board from authorizing the federal security analysis, Bruns said.

She contacted numerous officials from other counties to see if they plan to pursue similar measures.

A Miami County IT official said his county will do a self-audit of its voting system.

"That is the only county we heard from," she said.

Husted on
April 11 reminded all county boards of elections of important security precautions and practices.

"Prior to the November 2016 Presidential Election and the 2017 General Election, my office issued guidance to boards of elections regarding security best practices and precautions," Husted wrote. "Because cybersecurity threats are an ongoing concern, this Directive is to underscore the importance of these security practices and precautions and ensure that they are being routinely exercised."

Husted told officials to "take advantage of the cyber hygiene and risk and vulnerability assessment services offered by the U.S. Department of Homeland Security."

Government efforts to protect state and local elections from Russian cyberattacks in 2016 didn't go far enough, leaders of the Senate intelligence committee said earlier this year as the panel released recommendations to safeguard against foreign meddling in the ongoing 2018 primary season.

Senators are urging state and local election officials to use resources provided by the Homeland Security Department, such as comprehensive risk assessments and remote cyberscanning of their networks to spot vulnerabilities. Overall, experts say far too little has been done to shore up those vulnerabilities in 10,000 U.S. voting jurisdictions that mostly run on obsolete and imperfectly secured technology.

Earlier this month, The Associated Press reported the Department of Homeland Security has completed security reviews of election systems in about half the states that have requested them so far.

Homeland Security designated elections systems critical infrastructure just months after the 2016 presidential election, adding them to a list that includes chemical plants, dams and nuclear reactors.

The department earlier this month said it has completed risk assessments of election systems in just nine of the 17 states that have formally requested them so far. It has pledged to finish them by November for every state that asks, but the reviews are not likely to be done in time for some state primaries, many of which are in May and June.

The number of states is likely to grow. Officials in at least 28 have said they want Homeland Security to conduct the risk assessments, according to a 50-state survey of state election officials by The Associated Press.

The security reviews are designed to identify any weaknesses that could be exploited by hackers; such examinations are routinely conducted in the private sector. They are just one tool, although an important one, to ensure a computer network has a robust defense.

Homeland Security officials attribute the backlog to increased demand for such reviews since the 2016 election and say they are devoting more money and shifting resources to reduce wait times. The reviews typically take two weeks each.

"Elections remain a top priority," said Matt Masterson, the department's senior adviser for cybersecurity.

Officials in some states prefer to do the security checks on their own, with some, such as New Hampshire's, expressing concern about federal overreach in a country where elections are run by state and local governments.

Cybersecurity experts say as long as the process is robust, it should not matter who conducts the risk assessments.

-The Associated Press contributed to this story.