David Levine Testifies before House Homeland Security’s Subcommittee on Cybersecurity, Infrastructure Protection, and Innovation

Statement of David Levine, Elections Integrity Fellow, Alliance for Securing Democracy

Subcommittee on Cybersecurity, Infrastructure Protection & Innovation of the Committee on Homeland Security Hearing On “Safe, Secure and Auditable: Protecting the Integrity of the 2020 Elections”

August 4, 2020

Introduction

Chairman Richmond, Ranking Member Kotko and Members of the Subcommittee on Cybersecurity, Infrastructure Protection & Innovation: Thank you for the opportunity to testify today on protecting the integrity of the 2020 elections during the COVID-19 pandemic.

My name is David Levine, and I am the Elections Integrity Fellow for the Alliance for Securing Democracy (ASD), a bipartisan, transatlantic initiative housed within the German Marshall Fund of the United States. ASD develops comprehensive strategies to deter and defend against authoritarian efforts to undermine and interfere in democratic institutions. Election integrity has been a core priority since our inception, and we continue to be at the forefront of efforts to raise awareness of threats and recommend legislative and technical mitigation measures.

Prior to joining ASD, I served as the Ada County, Idaho Elections Director, where I collaborated with the county’s elected officials to plan, oversee and administer elections for more than 250,000 registered voters across 150 precincts. Before that, I spent several years as a senior election administrator and consultant, helping administer elections in Richmond, Virginia and Washington, DC. And on behalf of the Organization for Security and Cooperation in Europe, of which the United States is a member, I have been privileged to act as an observer for a number of elections overseas.

This year, the United States has had a primary election season unlike any other. Since the primaries began, our country has endured a public health crisis that has claimed the lives of more than 150,00 people;¹ experienced substantial protests and unrest in the aftermath of George Floyd’s death;² and conducted elections while trying to secure them from foreign adversaries, including Russia, China and Iran.³ State and local election officials, partner organizations, voters and other stakeholders are being forced to grapple with new election-related challenges in real time as they strive to hold safe, secure and accessible elections. Changes to voting processes to account for the coronavirus impact the security of our elections. The steps we take to combat the coronavirus must therefore consider the threat of foreign interference, in addition to public health and election administration.

My testimony today focuses on steps that can be taken now to help ensure that the 2020 general election is safe, secure, and fair. To do this, I will address election infrastructure, information, administration and funding.

Election Infrastructure

One noteworthy success from the 2020 primary elections is that there hasn’t yet been any confirmed successful attack on our country’s election infrastructure. I think that is a testament, at least in part, to the strides our country has made in improving our election security since the 2016 presidential election, when we had relatively little awareness of the threats foreign actors posed to our elections. State and local election officials have subsequently become more well versed on cybersecurity issues, and with the assistance of federal agencies like the Department of Homeland Security’s (DHS) Cybersecurity & Infrastructure Security Agency (CISA), and a whole host of civil society organizations and private sector actors, there is now much more information sharing and awareness of potential threats, as well as proactive measures to protect our election infrastructure than before.

That said, the work of securing the 2020 presidential election is far from over. Below are three steps that election officials and their partners must continue taking to help ensure that November’s 2020 election is a secure one.

First, state and local election officials, with help from their partners, must continually evaluate their election infrastructure to ensure it is as secure as possible. Testing and auditing existing systems is essential.

In June of 2016, the state of Illinois experienced the first known breach by Russian actors of state election infrastructure during the 2016 election. By the end of 2018, Russian agents had successfully penetrated Illinois’s voter registration database, accessed as many as 200,000 voter registration records, and exfiltrated an unknown quantity of voter registration data. And while we are not aware of any evidence that voter registration data was deleted or changed, the U.S. Senate Select Committee on Intelligence found that Russian cyber actors were in a position to modify the data they accessed.⁴
The Colorado Secretary of State’s office recently announced that it is partnering with a security firm to conduct penetration tests of its election systems ahead of the presidential vote. Trevor Timmons, the chief information officer for Colorado Secretary of State Jena Griswold, indicated that the firm’s ‘white-hat’ hackers would examine the agency’s election infrastructure, including the statewide voter registration database, the Secretary’s main website, and electronic pollbooks at physical precincts for people who choose to vote in person because “We need to know [vulnerabilities]. We’ve got enough time that if they found anything we’d be able to respond to them.”⁵
While the security of our election infrastructure, including our state voter registration databases, appears to have improved since 2016, this kind of testing still has tremendous value. At a recent meeting of the National Association of Secretaries of State, Matt Masterson, an advisor with CISA, told state officials that DHS testing of state and local election systems had found a number of “concerning” vulnerabilities. These included 1) sharing passwords and other credentials, and using default passwords commonly known to outsiders; and 2) continuing to fall for ‘phishing’ attacks that allow hackers to install malware, including ransomware that could paralyze Election Day operations.⁶ As Masterson noted, the good news is that many of these issues can be easily fixed by Election Day. The bad news is that many local election offices are unable to make these fixes quickly because they lack the necessary resources or IT support. The coronavirus has exacerbated the problem by forcing a number of states to divert election security funding to cover other unanticipated costs stemming from the pandemic.⁷

Second, as the election infrastructure is modified to account for the coronavirus or other intervening events, security and resiliency measures must be part of the design and not introduced after the fact.

In its June 2nd primary election, the Washington, DC Board of Elections (DCBOE) — inundated with complaints from voters who did not receive requested absentee ballots — decided as a last resort to allow a number of domestic voters to submit their ballots by email so that their votes could be cast and counted.⁸ While the effort was well-intentioned,⁹ it put the election results at risk because there is no way either for those voters to verify that their votes were recorded accurately, nor is there a way to ensure that those votes were not altered in transmission by bad actors.¹⁰ 

And even if there is no actual interference with emailed ballots, allowing them provides fodder to foreign adversaries who could use such actions to sow doubt and confusion about the legitimacy of our elections. That is not idle speculation – it has been voiced by authoritative sources ranging from the Senate’s Select Committee on Intelligence,¹¹ to the National Academies of Science, Engineering and Medicine,¹² CISA, the Election Assistance Commission (EAC), the Federal Bureau of Investigation, and the National Institutes of Standards of Technology.¹³

While the DCBOE has already said that it does not plan to allow email voting in November, the situation it found itself in is one that other jurisdictions could face, especially if COVID-19 continues to make in-person voting challenging, requests to vote by mail continue to multiply, and additional funds are not made available.¹⁴ It is important that contingency plans for scenarios such as those above be developed well in advance of November and rely on proven, secure, resilient voting processes.

Finally, state and local officials should continue to be offered help in securing their election infrastructure before November.

Federal agencies such as CISA and the EAC have resources available to help detect and fix flaws, provide security training, and share best practices for securing our elections. Some civil society organizations can act quickly to help secure elections from the bottom up.¹⁵ With fewer than 100 days before November 3rd, one of the best ways such organizations could assist election officials at this juncture would be to help identify pollworkers who are willing to assist with in-person voting at a time when the coronavirus is still expected to be circulating.

But civic action and commitment are not enough. The single most important assistance that election officials could use at this juncture is additional federal funding. Congress provided $400 million to the states for election assistance in March as part of the Coronavirus Aid, Relief and Economic Security (CARES) Act. That was an important first step that has helped enable many states and localities to go to greater lengths to try and conduct accessible, secure elections during the pandemic. That said, as a recent report put out by a(n) ideologically diverse group of organizations, including ASD, Brennan Center for Justice at NYU Law, the R Street Institute and University of Pittsburgh Institute for Cyber Law, Policy and Security noted, $400 million isn’t enough to cover the remaining 2020 election costs in Georgia, Michigan, Missouri, Ohio and Pennsylvania, let alone the costs of the other 45 states and entities like DC, Puerto Rico, and the US Virgin Islands.¹⁶ Without further federal assistance, the likelihood of there being significant issues in the November general election will go up. States and local governments across the country are facing severe budget challenges as a result of COVID-19.¹⁷ Not surprisingly, dealing with the disease itself gets first priority, but that means that many are not in a position to cover the unanticipated election costs arising from the virus.

Election Mis- and Disinformation

Regardless of how secure our elections are, many election experts and officials are concerned that some voters could dismiss November’s results as invalid or rigged because of mis- and/or disinformation. Voters could argue, for example, that the much-longer-than-usual time required to count an anticipated surge in mail-in ballots is prima facie evidence of nefarious conduct. While most of us know that such allegations are not true, similar rhetoric is already being amplified by foreign adversaries, such as Russia and Iran, to diminish confidence in the election results and undermine our democracy.¹⁸ In response, we need to do at least two things.

First, we need to ensure that our elections are run as smoothly as possible, so that mis- and disinformation is less likely to be effective. If our general election is plagued by significant problems, inaccurate information is more likely to find a receptive audience.

For example, during the February 3, 2020 Iowa Democratic caucuses — which were administered by political party officials, not election officials — the new app that the Iowa Democratic Party used to report caucus results did not work as planned,¹⁹ resulting in a systemwide meltdown.²⁰ That provided enough of an opening for a conspiracy theory to go viral and be amplified by accounts with Russian links. This conspiracy theory accused Robby Mook (Hillary Clinton’s 2016 campaign manager) of developing Iowa’s mobile app to rig the Democratic primary against Senator Bernie Sanders (Secretary Clinton’s former rival) — even though Mr. Mook had not developed (or even heard of) the app.²¹

Even reasonable decisions about our voting processes can be become fodder for foreign adversaries.²² In April, New York tried to become the first state to cancel its presidential primary over coronavirus concerns, a move that was subsequently overturned²³ by a federal court. Never wanting to miss an opportunity to cry foul, Russian actors seized on the move to highlight domestic “outrage” at the change and suggest that it constituted a “blatant coronation” of Vice President Joe Biden at the expense of Senator Bernie Sanders.²⁴ Reasonable minds can differ about the State Board of Election’s (SBE) decision to cancel the presidential primary, but the transparent, legal process that played out after that decision stood in stark contrast to the lack of recourse or due process offered by authoritarian regimes like Russia.

Second, we must seek to flood the information space with credible, consistent election information so that voters are ‘immunized’ against falsehoods.

This will admittedly be challenging in light of the coronavirus—because many voters are likely to be voting in a different manner than they have previously, and election officials have been forced to make continuous changes to their voting processes as the pandemic evolves. But it is doable, particularly if federal authorities can 1) provide state and local election officials additional funding to publicize and explain changes to their voting processes; and 2) communicate as much information about election threats as possible to election officials and the public. Flooding the space with this kind of information will also sensitize journalists, candidates and the public to the fact that we may not know the election results immediately and that this is not, in and of itself, proof of malfeasance.

Election Administration

The 2020 primary elections gave many states an opportunity to conduct at least one election during the pandemic prior to November. There are at least three important take aways from these elections that can be applied to November.

First, it is essential that partisan politics be kept out of election administration to build public confidence in the integrity of the election process, and this must happen long before Election Day.

Wisconsin’s April 7 primary illustrated what can go wrong when state leaders refuse to act on a timely basis, and ended up conducting in-person voting in the middle of the state’s coronavirus outbreak. There were not enough poll workers and dueling court cases sowed confusion about absentee voting, contributing to thousands of missing or nullified ballots.²⁵ In Milwaukee, where roughly 4 in 10 residents are Black, officials closed all but five of the city’s 180 polling places, forcing thousands of voters to congregate at a handful of voting sites. Many voters were forced to choose between risking their health to cast a ballot or staying at home and forfeiting their vote.²⁶ 

Such mishaps provide openings to adversaries such as Russia, which has targeted African-Americans with disinformation operations since the 2016 presidential election,²⁷ as well as China and Iran, both of whom have used the coronavirus in an effort to undermine our democracy.²⁸ 

In contrast, Kentucky had a relatively smooth primary election despite early fears of turmoil, in part due to a bipartisan agreement reach well in advance of the election between the Democratic Governor, Andy Beshear, and the Republican Secretary of State, Michael Adams. Beshear and Adams took a number of joint steps to help the state prepare for its primary, including allowing for an unprecedented expansion of absentee voting and allowing “in-person absentee voting”, which is effectively early voting and does not typically take place in Kentucky.²⁹ 

Second, election officials must have sufficient resources to plan for reasonably foreseeable contingencies.

From an election administration, election security and public health standpoint, it would be optimal if as many voters as possible voted before Election Day, either in person or from home. That increases the time and choices available to address any issues that may arise, such as malfunctioning voting equipment, long lines at voting locations or unexpected delays in the mail service. But whatever election officials do, many people will likely insist on voting in-person on Election Day regardless of the pandemic — a development Georgia experienced firsthand during its primary.

After twice postponing its primary due to the coronavirus, Georgia substantially modified its election process to try to account for the virus. It took the unprecedented step of mailing out absentee ballot applications to all of the 6.9 million active registered voters in Georgia to encourage more mail-in voting,³⁰ and while a much higher percentage of ballots were cast by mail than in previous elections, more than half of all votes were still cast in-person;³¹ many of those voters had a difficult experience. For example, voters in parts of metro Atlanta waited in lines for more than four hours on Election Day as election officials conducted an election with fewer voting machines in polling places, fewer places to vote, and fewer experienced poll workers because of the pandemic.³² 

Offering robust voting by mail, early voting, and Election Day options to minimize confusion and risk are optimal, but many jurisdictions don’t currently have the resources and/or personnel to offer these approaches. For example, Maryland Governor Larry Hogan decided last month that the state would hold a traditional election in November, offering many in-person voting locations and allowing voters to vote in their customary precincts. At the end of July, the President of the Maryland Association of Election Officials indicated that local election boards are experiencing tremendous difficulty in recruiting Election Day poll workers, with roughly 13,000 vacant positions statewide.³³ On July 27, Howard County, Maryland Election officials reported that 491 people had signed up to serve as Election Judges for the general election, about a third of the number needed. By the time the county election board met soon thereafter, the number of confirmed Election Judges had dropped to 12 as Judges hurriedly withdrew their pledges to participate in the face of the pandemic.³⁴

Additional resources from federal authorities will help enormously with the administration of the 2020 presidential election, but with fewer than 100 days to go until November 3rd, time is of the essence. As other experts have noted, more funding could enable election officials to procure personal protective equipment (PPE) to make in-person voting safer; purchase additional mailing, ballot and postage supplies in preparation for the anticipated surge in absentee voting; conduct robust voter education campaigns so that voters are aware of how to vote safely; recruit and train needed poll workers; and identify additional polling places.³⁵ 

New funding could also mitigate any cyber or technical-related problems that would impact the administration of the general election. While jurisdictions in 41 states and the District of Columbia use electronic pollbooks (EPBs) to verify voter eligibility at polling places, only 12 states and DC appear to require paper backups in case the EPBs malfunction.³⁶ More funds could help more jurisdictions obtain paper backups for use if their EPBs become inoperable due to a cyberattack or technical glitch.³⁷ To cite just one other example, localities with electronic voting machines could use funding to purchase extra provisional ballots in the event that their voting machines go down during the general election so that voters don’t have to wait for extended periods of time following a system failure.³⁸ 

Conclusion

Administering and securing a presidential election is no small feat in ordinary times, and these times are anything but ordinary. Success will require a coordinated nationwide effort. Congress needs to provide election officials with additional funding to help them administer and secure the November election.

Federal officials involved in helping secure and administer our country’s elections need to continue to actively support the efforts of state and local election officials to, among other things, mitigate any efforts by foreign adversaries to interfere in our elections. And civil society and private sector actors need to work with government entities to help fill any remaining gaps.

Voters have a part to play as well. They must plan now for how they will vote in November. And if they want to vote in-person, they should give serious thought to serving as a poll worker.

The late congressman John Lewis once said, “Your vote is precious, almost sacred. It is the most powerful nonviolent tool we have to create a more perfect union.” We urge Congress to do everything possible to ensure that every person who wants to exercise their right to vote can do so.

Thank you.