Elections: The Hidden Security Danger for Governments

Two-factor authentication, which requires a user to know both a password and to possess a second device that authenticates them, allows for much more robust security in general. No software or hardware should be accessible without a strong password protocol and two-factor authentication. These requirements alone can go a long way towards strengthening both hardware and software from outside attacks.

Limited Access

Electoral commissions should limit access to software and hardware systems only to those who require access to those systems. Additionally, all sensitive data should be isolated, and networks should be segregated so that a breach in one part of a network does not automatically lead to a breach of the entire network.

With respect to who should have access to software and hardware, election authorities should take a long hard look at not only who needs access to the systems in general, but also to what parts of the system they should have access. This limited access can control the amount of damage created by any one person and can also limit the damage should a breach of a person's access credentials occurs.

Vendors

Election authorities should require their vendors to prioritize security. When speaking of election machines and the electoral process, limiting both access to the software and physical access to election machines should be a high priority. As such, maintenance crews, janitorial services and other personnel should have restricted access to rooms containing voting equipment. Additionally, any equipment at a polling place should be secured under lock and key with key holders being trusted personnel.

Penetration Testing

Election officials should regularly test the integrity of their networks and the process. This includes regular penetration testing, network vulnerability testing, access control audits and post-election audits. All of these will combine to help to ensure the integrity of the network, and more importantly, assure the public of the integrity of the electoral process.

Understand Your Network

Electoral officials should understand the entirety of the network that supports the voting process and look for weaknesses in that greater network. For example, if voter rolls are authenticated through driver's licenses at the Department of Motor Vehicles (DMV), those networks present a potential weakness. As such, the DMV's networks should be subject to the same security protocols and testing as the actual electoral voting networks. Only with this type of holistic network approach can the integrity of the voting process be ensured.

Personnel Training

All electoral authorities should seek to create a holistic security culture. This type of culture should start at the top and permeate throughout the electoral staff and those that support the electoral process. Like most breaches, a breach in the electoral process will probably originate with a human error. As such, it is important to continuously train all associated personnel not only with cybersecurity protocols, but also physical security protocols. Additionally, this holistic security mindset should be regularly reinforced and tested to ensure not only compliance with applicable policies and procedures but also with what many people call "common sense" actions.

Incident Response Plan

All electoral authorities should have a detailed cyber incident response plan. This plan should be well thought out and tested regularly with all involved personnel. This plan should outline what should happen in the event of a breach, who should be notified, what other resources should be brought to bear, and how communications should be handled. Additionally, this plan should be regularly tested through cybersecurity tabletop exercises, which will allow the parties to understand what they should do in a controlled environment before something actually happens. As it is often said in battle, when the bullets start flying is not the time to figure out what you would do.

Conclusion

Many of the processes that pertain to how local and municipal authorities should deal with cybersecurity are the same as how any enterprises should deal with cybersecurity. First and foremost, there should be a culture of security created throughout the organization. Additionally, testing and auditing should be a regular part of the process of running elections. Lastly, election authorities should have a detailed response plan so that they will know what to do in the event of a breach or an emergency.

That said, unlike other businesses, the integrity of the electoral process is the underpinning to our democracy. It is incumbent upon all of us to ensure that we are doing all that we can to protect this process.

*****

Roy E. Hadley, Jr. is an attorney with Adams and Reese (Atlanta) who serves as independent counsel to companies, governments, and boards on cyber matters, helping them understand and mitigate legal risks and exposures to protect themselves and those they serve. He has previously served in the corporate roles of general counsel and chief privacy officer, as well as special counsel to the president of the American Bar Association and special assistant attorney general for the state of Georgia. He may be reached at [email protected].