The Cybersecurity 202: Congress is offering millions in election security. States may not use it by November.
States are now free to claim their shares of the hundreds of millions of dollars Congress set aside to secure election systems across the country.
But for many states, getting their hands on the money – and deciding how to spend it – is easier said than done.
In Minnesota, Secretary of State Steve Simon (D) told me he wants to use part of the $6.6 million in federal funds his state was awarded to hire three coders to immediately upgrade the state's aging voter registration system.
The clock is ticking: Minnesota was one of the 21 states that had election systems targeted by Russian hackers during the 2016 presidential race. With U.S. intelligence agencies warning the midterm elections are likely to be hit by another wave of cyberattacks, states are scrambling to secure their voting infrastructure by November.
But Simon says he might not get the funds he needs in time. Under Minnesota law, only the Republican-controlled legislature can release that money -- and local politics have left lawmakers in a stalemate over how to proceed. Right now, language to approve the funds is tucked in a spending bill the Democratic governor has threatened to veto for an array of unrelated issues.
Simon told me he’s worried that Minnesota might not find a way through the impasse before the legislative session ends this weekend, meaning the money could remain frozen until next year. What's more, there's a primary coming in August.
“All we need is a couple sentences from our state legislature allowing us to tap into those funds,” Simon told me. “Without that authorization, there will be $6.6 million dollars that's available for our use just sitting there.”
Congress approved the $380 million to be distributed across all 50 states as part of the massive spending billPresident Trump signed in March. The money was divvied up into shares for each state based on the size of their voting age populations.
To get a hold of the cash, states have to submit a written request -- just a couple pages is enough -- to the Election Assistance Commission, the agency that manages the money. Within 90 days, the states must submit a more detailed explanation of how they plan to spend it.
So far, the EAC told me, 12 states have submitted requests for the money -- and another 17 are expected to do so by the end of the month.
But even some states who can use federal money right away, without input from their legislatures, are finding this process daunting.
The fact that Congress actually agreed to send financial help their way came as a surprise to many state officials I talked to – and it landed right as primary season was getting underway. Some state officials are too busy running their elections to start planning the upgrades they want to make.
“It may have been a quick fix if the money had been allocated a year ago, but we’re already in the middle of a midterm year,” said Tammy Patrick, senior adviser at the bipartisan advocacy group Democracy Fund. “It’s coming in close to the elections, when you don’t necessarily have time to figure out how to use it in the most impactful and effective way.”
That's the case for Colorado. The state has been particularly ahead of the curve in securing its elections. But Colorado is set to hold a primary on June 26, and officials there say they won’t have time to draw up and submit spending plans to claim the federal money until after that happens.
“We just don’t have time,” Lynn Bartels, a spokeswoman for the secretary of state, told me. “We’re waiting until after the primary because we’re so tied up with that.”
For other states, the delay comes down to figuring out how to secure their systems at all. Out of a dozen state officials I talked to, most said they were just starting to weigh their options about how to use the federal money. Some offered no indication that they'd put any of the cash toward election security upgrades this year.
In Florida, for instance, officials said they were on the fence about what to do with a potential $19 million influx. But a spokeswoman for Secretary of State Ken Detzner said the state has already taken steps to boost network security and share information about threats with other states. In Tennessee, officials said they're working out plans to pay for cybersecurity training for local election authorities, but major equipment upgrades aren't on the table right now.
And some may not even want to take the money. Georgia, which signaled last fall it opposed federal assistance for its voter systems, stands to claim some $10.3 million. But officials there tell me that they haven't made any decisions about the cash. “We are still evaluating our options,” said Candice Broce, a spokeswoman for Secretary of State Brian Kemp.
Kemp was among a handful of state election officials who told Politico in September they opposed financial assistance from Congress. He also accused the Department of Homeland Security last year of hacking state voting systems around the 2016 election (the DHS inspector general later said there was no such attack).
Another possible hold-up in submitting a plan: An abundance of caution.
The federal money comes from unused funds under the "Help America Vote Act" or HAVA, passed originally after the 2000 election debacle. The law, which took effect in 2002, set aside more than $3 billion for states to replace punch-card voting machines and other outdated equipment that caused chaos in Florida, and otherwise bring their voting systems into the 21st century.
At the time, many states rushed to purchase digital voting machines on the assumption that they’d provide a more accurate vote count than the old paper-based systems. But those are exactly the types of machines that cybersecurity experts and federal officials now want to scrap because they’re prone to hacking and don’t produce reliable audit trails.
Patrick, of the Democracy Fund, says state officials are being more careful about how they use this new round of funding.
“People are being far more deliberate with this process,” she told me. “They are going out and setting their priorities by speaking with local election officials to find out the best use of these funds.” Knowing that foreign governments could mount cyberattacks, she added, “is giving people great pause. They want to make sure they’re moving forward in the right way.”
By: Derek Hawkins
Source: The Washington Post