Wisconsin’s election IT infrastructure must be better secured before the 2018 election after federal officials said “Russian government cyber actors” targeted it during last year’s campaign, state elections commissioners said.
“We now know from (the federal Department of) Homeland Security that the Russian government attempted to gain access to the Wisconsin election structure — and that they’re going to come back again,” commission chairman Mark Thomsen said.
How the state should respond will be the topic of a special elections commission meeting next month. But Thomsen, a Democratic appointee to the commission, said Gov. Scott Walker’s decision to cut funding for the commission in the state budget will make the task more difficult.
A Republican commission appointee, former state Rep. Dean Knudson, said there are some encouraging takeaways from last month’s disclosure that Russian government cyber actors targeted election systems in Wisconsin and 20 other states in 2016.
In Wisconsin, hacking attempts were thwarted by measures taken by the IT agency for state government, the Division of Enterprise Technology.
But Knudson said he favors additional security measures for state election systems, including the state’s voter registration database and election administration system, WisVote.
The database should be encrypted and two-factor authentication required for those with access, he said.
Communication with federal agencies that oversee homeland security and national intelligence matters also must improve, Knudson said. Homeland Security officials first informed state officials in September, 10 months after the election, of the hacking attempts. Even then, poor communication between the agencies resulted in confusion over whether state election systems were indeed targeted.
“They’ve got to figure out how they can communicate more quickly,” Knudson said.
In Illinois last year, Russian hackers gained access to the state’s voter registration database, which contains sensitive data on 15 million people, Bloomberg News reported. Hackers tried but failed to alter or delete some data.
In Wisconsin, however, the hacking attempts don’t appear to have come close to their intended target.
In July 2016, Homeland Security officials said they confirmed Russia-linked scanning activity at an inactive IP address assigned to a Wisconsin Department of Workforce Development site. Federal officials said they believe the scans “were looking for vulnerabilities in order to gain information about how to target elections systems,” according to the elections commission.
State IT officials say they ward off millions of such attempts each year. The commission said “these scanning attempts were unremarkable, except for the fact that (Homeland Security) later identified their source as being Russian government cyber actors.”
In August 2016, state firewalls blocked an embedded ad at a public website from being displayed on an elections commission computer.
The ad could have led the user to a suspicious IP address connected to Russian government cyber actors, the commission said.
In the face of such threats, Thomsen said the commission must train local election officials, who frequently use the WisVote system, to secure it. That will require resources that Thomsen said he’s concerned the commission won’t have.
Walker, using his line-item veto authority last month, cut funding for five vacant positions at the elections commission that had been funded by a federal grant now set to expire.
Walker spokesman Tom Evenson rebuffed any suggestion that the governor’s veto will make elections in Wisconsin less secure.
“The fact is these vacant positions had nothing to do with IT or cyber security as the Department of Administration provides cyber security for the commission,” Evenson said.
Evenson added that the governor “believes the commission can more cost effectively manage peak workload periods by hiring limited-term employees or contractors, as they did during the 2016 presidential election.”
Knudson said he believes the commission “can be effective” even after Walker’s veto. If a need for more staff is demonstrated in the coming months, Knudson said, he’s open to asking the Legislature’s Joint Finance Committee to fund it.
“They’ve got to figure out how they can communicate more quickly.” Former state Rep. Dean Knudson, Republican Elections Commission appointee