On the same day that top U.S. intel officials published a declassified report detailing Russian interference in the 2016 presidential campaign, Secretary of Homeland Security Jeh Johnson on Friday officially declared the U.S. electoral system as critical infrastructure.
In an official Department of Homeland Security (DHS) press release, Johnson admitted that many state and local election officials are opposed to his decision, but insisted that the designation does not signify a U.S. government takeover of electoral systems, nor does it portend the introduction of federal regulation. It does, he continued, allow the DHS under its National Infrastructure Protection Plan, to prioritize the provisioning of cybersecurity assistance to state and local election officials who request help.
The designation also “makes it easier for the federal government to have full and frank discussions with key stakeholders regarding sensitive vulnerability information,” the release added.
However, Kay Stimson, director of communications at the National Association of Secretaries of State (NASS), a nonpartisan organization representing public officials including top state election officials, voiced concern about a lack of written guidance surrounding this decision. “Our members have asked repeatedly for the DHS to provide their concept of how this designation would be applied to elections… since our group first learned about Secretary Johnson considering the designation back in August. We have never, to date, received anything in writing regarding how this would work.”
Regardless, the DHS has had ongoing discussions with state officials since August, capped off by a 45-minute phone call Thursday with numerous secretaries of state and chief election officials to discuss the implications of this designation and to address lingering questions, the DHS told SC Media via email.
There are currently 16 sixteen critical infrastructure sectors recognized by the U.S government. Election systems will not be counted as a 17th; instead, they will be considered a subset of the already existing Government Facilities sector, noted Johnson. The DHS considers "election infrastructure" to consist of storage facilities, polling places and centralized vote tabulations locations, as well as information and communications technologies including voter registration databases, voting machines and other systems.
While the intelligence community has found no evidence of Russian agents sabotaging voting machines to change vote tallies, investigators have determined that hackers did gain access to various assets operated by U.S. state or local electoral boards.
As concern spread over possible Russian interference in the months leading up to the presidential election, the DHS in August 2016 extended its cybersecurity expertise, information and services to concerned state and local election officials. According to the DHS, the agency was in talks with all 50 states by Election Day.
Stimson told SC Media that the DHS proved to be helpful partner and received positive feedback from state and local election officials. However, “The question is why this [critical infrastructure] designation is needed, since they were able to provide those resources already in 2016 without the designation,” she added.
In response to this inquiry, DHS sent the following explanation to SC Media: “The designation formalizes or institutionalizes the availability of those services and assistance. They remain voluntary. Additionally, critical infrastructure enjoys the protection of various cyber norms in the international community.”
