With agencies like the Cybersecurity and Infrastructure Security Agency and the FBI keeping an eye out for foreign interference — and states and counties more heavily fortified than ever — the 2020 presidential contest turned out to be the “most secure in American history,” according to federal officials.
That's a far cry from four years ago, when Russian hackers targeted all 50 states affecting voter systems in 21 different states, hacked databases at the Democratic National Convention (DNC), hacked accounts for both GOP and Democratic congressional candidates and generally made a real mess of things.
While several early incidents did take place (most notably an Iranian information operation and two ransomware attacks in Georgia and New York), the election's processes and results ran smoothly.
According to officials, a combination of increased vigilance and multi-stakeholder collaboration helped ward off operational threats this year — though an uptick in online disinformation has still threatened to escalate political polarization nationally.
Technical Issues, But No Real Interference
In a number of counties, alleged software glitches led to mistakes in vote tabulation for both the presidential and other, local races (a county in Michigan known to be a Republican stronghold "went blue" after an apparent error involving its Dominion Voting Systems program, for instance). Clerical errors also caused temporary miscounts in certain communities.This smattering of technical issues has had little impact politically, however, and is hardly the foreign interference apocalypse predicted by so many security researchers in the lead-up to this year's contest.
"If you look at direct hacking of the voting process or someone getting into a voter database or just some very simple Web defacement, I think we didn't see that," said retired Maj. General Brett Williams, COO at cyberfirm IronNet.
Williams, who in a previous decade served as director of operations for U.S. Cyber Command, told Government Technology that he felt 2020 had been a success due to increased stakeholder vigilance.
In concrete terms, that vigilance has meant new federal programs like the ones rolled out by CISA to combat disinformation (see its "Rumor Control" page). States, such as Colorado, also implemented special teams to optimize cyberdefenses, while Secretary of State offices worked to increase the number of counties participating in the Center for Internet Security's EI-ISAC. Information sharing was a big help, implemented through partnerships built between a multitude of entities over the last several years (groups like the National Association of State Election Directors, the National Association of Secretaries of State, CISA and the federal intelligence community worked together to keep threats at a distance).
To sum up: governments were much more prepared than they were in 2016. They worked together more effectively — collaborating at the state, local and federal levels — while also prioritizing cyberpreparedness and best practices more than in previous years.
Disinformation Deluge
This is not to say there weren't some bumps along the way. In particular, disinformation and misinformation flooded online communities in the weeks leading up to the election (especially in Black and Latino communities), pushing an already divided electorate into an even more polarized position.Most recently, a story began circulating online that suggested U.S. intelligence had requisitioned a nefarious supercomputer called HAMMER, upon which it was running a program called SCORECARD in order to manipulate vote tabulation on a grand scale. The HAMMER and SCORECARD story has been shared widely on rightwing media channels, despite the fact that CISA quickly shot the theory down.
All of this has been complicated somewhat by President Trump's ongoing claims of "widespread voter fraud," the basis of which has been disputed by state and federal leaders. Similarly, the unconventional decision by Trump to contest the projected election results has helped to exacerbate existing divisions within the electorate.
Luke McNamara, threat analyst with FireEye, said that the capacity for disinformation to "weaken people's confidence in democratic institutions" has to be dealt with in a more organized, comprehensive way than it has been so far.
"I think one thing that people are going to continue to research and look at coming out of this [election] is how do we address and frame these campaigns [to the public]," said McNamara, explaining that officials need to figure out how to address disinformation without amplifying it. "You don't want to amplify something that wouldn't otherwise gain much traction," he said, adding that there should be ways to address false information without doing the bidding of trolls and foreign enemies.
Improving Transparency and Accuracy
Since disinformation's success rests on public distrust of institutions and electoral processes, Barbara Simons, former president of the Association for Computing Machinery, suggests that increased transparency and more dedicated investment in auditable machinery should be prioritized.A big part of this involves expansion of vote verification mechanisms, such as risk-limiting audits (RLAs) — a relatively new form of post-election audit. RLAs, which deploy statistical sampling techniques to verify that vote tallies are consistent with voter interest, are only used by a handful of states. Several states, like Colorado, have legally mandated RLA programs; other states have recently launched pilot programs.
At the same time, the use of paperless voting machinesneeds to be curtailed, said Simons, speaking with Government Technology. Paper-based systems, when paired with processes like RLAs, are our firewall against any adversary, she said.
"If we had that throughout the country, it wouldn't matter what any of our adversaries did in terms of attacking the actual voting mechanisms," Simons said. "We can protect ourselves against enemies — foreign and domestic [with those two components]."
To do that, communities will have to continue to prioritize funding for elections.
"We don't spend enough on elections. This has been a problem for quite some time. Election officials tend to be under-resourced and underfunded," said Simons. "In the case of voting systems that need to be replaced, such as paperless machines, we need to provide them with the funding to replace them with paper-based systems."
Editor's note: The initial reference to the number of states affected by 2016 hacking efforts was adjusted to reflect congressional findings.
