Releasing information on whether Harris County election systems saw attacks from Russian hackers would threaten the county's cyber security by emboldening hackers to further target local systems, county officials said this week.
The county's argument was dismissed by experts, who said the secrecy is unnecessary, and could actually downplay the seriousness of the threat and the resources needed to combat it.
"There's this concept in security called 'security through obscurity,' sort of, if they don't know about it they won't come after it," said Pamela Smith, a consultant at Verified Voting, a San Francisco-based nonprofit that promotes voting integrity. "But to really have robust security, you want people to be able to know that it's there ... I think what the public wants to know is that you're aware of the threat and you're taking steps to mitigate."
Bruce High, the chief information officer and executive director of the county's Central Technology Services, said Harris County overall sees on average more than a million hack attempts every day. He even acknowledged a recent "spike" in attempts to hack Harris County servers from outside of America's borders.
He declined to answer, however, whether any foreign actors behind those attempts have been identified.
"Harris County is working with Homeland Security and the FBI to protect our systems and the information on them," High said in an e-mail. "The information you are requesting is too detailed and could cause a cyber-security risk."
The county's lack of disclosure comes amid a fierce national debate over whether and to what degree American politics have been intentionally manipulated by sophisticated international adversaries, like Russia.
In June, Bloomberg reported that Russian hackers "hit" voter databases and software systems in 39 states, in some cases penetrating campaign finance databases and software used by poll workers, and attempted to alter or delete voter data in Illinois.
The Dallas Morning News published a story last month that election officials there had found attempts to hack their election system ahead of the November election - possibly to try to delete voter registration rolls and cause chaos on election day. The newspaper reported that election officials there cross-referenced hundreds of suspicious or possibly Russian-linked IP addresses provided to them by the U.S. Department of Homeland Security against those that had attempted to access Dallas County servers in early October and found 17 matches.
Dallas County election officials could not be reached for comment Thursday.
Harris County officials will not say whether something similar happened here.
Dan Wallach, a Rice University computer science professor and scholar at the Baker Institute for Public Policy, who has testified before Congress about the cyber security threat to elections, said that to an advanced threat like Russia, there likely are no secrets about Harris County elections.
Asked if Harris County had been targeted in a similar manner as Dallas County, High said the county had not received a list of IP addresses from the Department of Homeland Security. He added that both the FBI and theHomeland Security department will flag Harris County when they have concerns about specific IP addresses.
High did not respond to questions seeking details on how often such concerns are brought up, how big of a "spike" in hacking attempts the county was experiencing and over what period of time, whether that spike was election-related or which systems had been targeted.
Wallach said he was concerned about the ability of many local jurisdictions, including Harris County, to protect against a targeted threat from an advanced adversary like Russia. He said he believed it was probable that Russia had at least targeted Harris County servers, but also that in many cases, attackers are so sophisticated that local officials would not even know that their systems had been breached.
"The category of adversary we're facing now is not something that Harris County government is equipped to deal with," Wallach said.
High said the county uses both outside firms and internal resources to check its systems for vulnerabilities.
"Harris County uses a multi-layer approach to cyber security with preventative, detective and corrective controls, including vulnerability management, intrusion prevention, threat management and security governance," High said in an email. "We are constantly working proactively to enhance our security posture."
Precinct 3 Commissioner Steve Radack said he would defer to High's judgment on whether to release information.
"The more we boast, the more we talk about it, just gives people, some people, inspires them to try to attack us," he said.
In response to questions about not releasing more information and the potential threat from Russia, Precinct 2 Commissioner Jack Morman said in an email that High has "extensive private and public sector experience in technology."
"I don't think any organization is ever totally safe from hackers ... that's why we have to stay ahead of the curve as much as possible," Morman said.
Harris County Judge Ed Emmett, Precinct 1 Commissioner Rodney Ellis and Precinct 4 Commissioner Jack Cagle did not respond to requests for comment.
Wallach said more likely targets for Russian hackers would be battleground states, like Florida, where influencing or manipulating the vote could have greater impact.
"The saving grace of Harris County is that we are in Texas, and Texas is not a battleground state," Wallach said.
Still, he said it was important to understand the full picture to set up the right protections.
"The important thing is not obsessing over what Russia did or did not do in 2016, it's what Russia and China and other countries do in 2018 or 2020 and beyond," he said.
©2017 the Houston Chronicle Distributed by Tribune Content Agency, LLC.
