Hackers have ways to disrupt balloting, including messing with voter registration

Especially at a time when election hacking is such a hot topic, voters want to feel assured there’s enough attention paid to cybersecurity. With less than two weeks before the primary election, Hawaii state officials who are responsible for the voting systems are seeking to offer that assurance.

That is a more complicated and nuanced problem than people may think, said Philip Reitinger. He’s now president and CEO of the Global Cyber Alliance, a New York-based international nonprofit that develops risk-reduction solutions made available for free.

But in 2009 he directed the National Cyber Security Center at the U.S. Department of Homeland Security. He then dealt much more with critical infrastructure protection, but recognizes this issue, too.

“You might not think it, but elections security is one of the hardest problems out there,” Reitinger said. “There are so many ways to attack it.”

Locally, the experts are reticent to give details about what needs doing — that in itself could be a security breach. But the mission is helped by the injection for federal funds made available March 23 when President Donald Trump signed an omnibus spending bill into law.

That legislation included $380 million in grants to states through the Election Security Fund, part of the Help America Vote Act (HAVA) of 2002.

HAVA was the congressional response to the vote-accuracy concerns raised in the 2000 presidential election, which took a Supreme Court ruling to settle.

The allotment, intended for security improvements, in Hawaii amounted to $3,134,080. The state had to provide a 5 percent match: $156,704. That money is going to be spread over a five-year period, but some of it will be spent for boosting surveillance this year, including the Aug. 11 primary.

This renews and amplifies the concern raised nationally in the run-up to the 2016 general election. Then-candidate Donald Trump was complaining about a rigged election, and there were reports of voter registration rolls being hacked in some states.

At that time, the state Office of Elections and F.M. Scotty Anderson, chairman of the state Elections Commission, pointed out to the Honolulu Star-Advertiser that Hawaii voting machines are not connected to the Internet. The ballots are stored on memory cards (the paper ballots being scanned), and these are sent to the Statewide Counting Center at the state Capitol.

Neighbor island counting centers transmit their data by modem, said Nedielyn Bueno, who heads the voter services section at the Office of Elections.

The contractor being hired for this work was not yet named by Friday, but an overview of how the money is being allocated is posted on the office website . A total of $410,000 is earmarked for the 2018 elections, with $10,000 allotted for training and the remainder split evenly between “staffing augmentation” and software and hardware acquisitions.

These expenditures will be boosted to $510,00 annually over the remainder of the contract, through 2022.

This is the first year same-day voter registration will be implemented, so much of the immediate attention is being focused on the new terminals being purchased to access the state voter registration system statewide. According to a document for the HAVA grant, “by upgrading the equipment, we can ensure that all security features are updated and standardized across all access points to the system.”

The Office of Enterprise Technology Services, the information technology branch for the state, is partnering with elections on the improvements, overseeing the contractor’s work.

“Maintaining the infrastructure takes people. However, automation and improved functionality allow us to focus on the harder problems,” said Vincent Hoang, state chief information security officer, in an emailed response to the Star-Advertiser inquiry.

“The state will hire contractors with senior security expertise who are familiar with software solutions to set up and optimize the environment,” he said. “The specialized personnel will assess vulnerabilities and monitor the environment.”

The officials aren’t disclosing precisely what this entails for Hawaii specifically.

“Our practice is to not disclose cybersecurity methodology, activities and data, because doing so could advertise vulnerabilities, promote phishing, and/or expose or impede investigation activities,” Hoang added. “However, I can mention that some enhancements emphasize securing and protecting data, and where possible, eliminating the data that has traditionally been collected (when no longer needed).

“We’re working to better safeguard the elections infrastructure with layers of protection to keep our elections information safe.”

Speaking from a broad, national vantage point, Reitinger said that vulner- abilities can creep into a system at myriad points, so there’s lots for any contractor to examine.

“Voting is run in small operations all around the country, and by tightly resourced groups,” he said. ” People usually think about interfering with the voting machines. That’s a possibility.

“But an easy way to sow chaos is just creating uncertainty about who’s eligible to vote or not.”

Voter registration databases in different states can have multiple points of entry: Some states add the function to the driver-licensing bureau’s tasks. How that system is managed would have to be considered, and secured, Reitinger said.

And typically voting happens at polling stations where a voter’s name is checked against a paper printout, he said. To monkey with that may require something as simple as gaining access to the printers — many of which can be on unsecured networks.

Chaos can be generated even through social media disinformation campaigns, he added, spreading word that voter lines are too long at this polling place or that, seeking to suppress turnout — but actual long lines also can be generated by confusion over registration.

As for the voting and vote-counting system, Hawaii is in a system contract that will expire after the 2020 elections, so is saving some of the HAVA grant for part of the cost of a new multi-year contract, starting with the 2022 elections.

The existing system has to be federally certified, according to the Office of Elections; tests of the logic and accuracy of the counting system already have been run.

Amee Larsen Kirkpatrick, a former Hawaii resident and now communications officer for the Global Cyber Alliance, said awareness finally has been raised nationally on elections security. The nonprofit Center for Internet Security has published a handbook on securing election infrastructure .

“What’s happened with our elections being compromised made everyone more conscious and paying attention to this issue, because it’s an attack on our democracy,” she said.

“I am heartened to see it being taken seriously.”