Following the 2016 federal elections, the U.S. Department of Homeland Security (DHS) designated elections systems as “critical infrastructure,” thereby joining American elections systems with other sectors such as energy systems, financial services, healthcare and transportation.
Acknowledging the increased focus on election security and an emerging threat from foreign actors, preparations for the 2018 midterms began immediately upon Secretary Warner’s inauguration as Secretary of State in 2017.
Beginning in January of 2017, the West Virginia Secretary of State’s Office surveyed local election officials and assessed their cyber and physical security needs, amended state law to authorize county grants for election systems and security upgrades, and repurposed existing state resources to maximize election security.
These comprehensive assessment efforts have allowed the state and counties to focus our resources and prioritize upgrades to election security infrastructure and procedures.
Secretary Warner's letter to the EAC offers a narrative of West Virginia's plan to expend HAVA funds out of the West Virginia Secretary of State's (WVSOS) Office.
In preparations of this narrative, WVSOS surveyed local election officials for cyber and physical security assessments, amended state law to authorize county grants for election systems and security upgrades, and repurposed existing state resources to maximize election security from the state level. Read more...
Upon taking office as the incoming Secretary of State in January 2017, WVSOS prioritized the review of the 2016 election procedures and completed a full assessment of West Virginia’s election security. The assessment identified many areas for improvement, upon which immediate action was taken to resolve previously unaddressed vulnerabilities of West Virginia election security.
In 2017, WVSOS immediately implemented cybersecurity training programs for local election officials that covered spear phishing, password protections, and best practices for using the Statewide Voter Registration System (SVRS).
Important West Virginia election security practices include the ability to audit results and mandatory public testing of voting equipment by local election officials. Post-election audit procedures are possible due to the statutorily required voter verified paper trail (VVPT) for all electronic tallying voting machines.
Thankfully, each of West Virginia’s 55 counties are in compliance. As part of every statewide election, logic and accuracy tests are run on each machine upon delivery from the vendor. West Virginia also requires a post-election hand count audit of 3% of precincts, selected at a random at canvass, to ensure accuracy of the voting equipment. If a variance of just 1% is identified, or if the outcome of any race changes as a result of the audit, the entire county must be recounted by hand.
Coordinating resources between federal, state and local agencies is the number one priority for election officials when doing security preparations heading into the 2018 elections. The communication barriers across federal agencies to state and local officials proved difficult in 2016 with the lack of information sharing platforms and not having sponsorships for clearance to classified information regarding election systems.
In the Fall of 2017, WVSOS entered a partnership with the West Virginia National Guard (WVNG) for a full-time Guard member with Top Secret clearance to monitor state-level cyber activity and give recommendations on WVSOS security efforts. This advanced partnership is the first instance in the country to imbed a National Guard member in the elections arena as a cyber-expert.
Through this partnership, the WVNG was also able to facilitate vulnerability testing on elections systems prior to the 2018 midterm primary elections at no additional expense to either agency. The WVNG assets have also been successful in designing and managing an appropriate “whitelist” for online access to the state election systems.
In 2017, WVSOS partnered with the WV Fusion Center to merge WVSOS cyber resources and the WVSOS investigations unit with the state’s multi-agency emergency responders to bolster state agencies’ communication efforts
Additionally, WVSOS joined two information sharing networks with the Multi-State Information Sharing and Analysis Center (MS-ISAC) and the Election Information Sharing and Analysis Center (EI-ISAC) to monitor cyber activity and receive important notifications and best practices from other states to increase West Virginia’s awareness of the elections landscape on a macro level.
WVSOS has been working diligently to identify all available resources prior to spending funds on election security needs. The Department of Homeland Security (DHS) has provided, at no cost to the state, an Albert Sensor to allow off site monitoring of state level web traffic of our SVRS and elections systems servers.
WVSOS and DHS are also in discussions to perform an additional vulnerability scan prior to the 2018 midterm general elections, as well as discussing a partnership to administer physical security assessments for local election officials to be completed by the end of July 2018.
During the 2018 legislative session, WVSOS worked with the West Virginia Legislature to pass a bill that authorizes grant funding opportunities for local election officials for election systems upgrades and additional security necessities ahead of the newest round of federal funding.
The West Virginia Legislature added the granting opportunity to a previously existing HAVA loan fund for election systems totaling around $2,905,628.
These funds will be used for improving the administration of elections for federal office by enhancing election technology and security by purchasing election systems, election system upgrades, electronic voting systems, or physical security.
These grants may be applied beginning in July 2018, and will cover reimbursement for any local election official who intends to upgrade voting equipment of security efforts prior to the 2018 general elections.
Beginning FY19, WVSOS will repurpose previously existing HAVA funds which had been earmarked for SVRS maintenance to be used for one-time expenses such as:
Increase cybersecurity protections of the SVRS;
Offer additional security training for state and local election officials;
Offer the option for local election officials to have “cyber navigators” who conduct in-house assessments and offer suggestions for security protections;
Implement two-factor authentication for users of the SVRS;
Penetration testing of the SVRS and other internet-facing election systems;
To create a disaster recovery site; and
To continue funding opportunities for ADA-compliant polling locations in 2018 midterms.
West Virginia’s long-term security profile will be bolstered leading into the 2018 midterms with the repurposing of state funds for maintenance of the SVRS, and the use of existing HAVA 1 funds for one-time upgrades to security from the state.
This will allow West Virginia to use the newly appropriated HAVA 2 funds exclusively as grants or loans directly to local election officials to boost their purchasing power for election systems and security. The additional $3,611,943 of HAVA 2 funds will be added to the current “County Grant and Loan Fund” that, upon amending the WV HAVA State Plan, will have $2,905,628 available to grant, totaling a fund balance of $6,517,571 available for counties’ use.
Any new funds will be distributed by a HAVA Grant and Loan Board to the counties for election equipment (up to 50% grant with a 50% local match), physical security (up to 85% grant with a 15% local match), cybersecurity (up to 85% grant with a 15% local match), and e-pollbooks (up to 85% grant with a 15% local match). Our expectations of the total purchasing power is approximately $10,000,000.
The move away from federal funding for maintenance of the SVRS and increasing our funding priorities to include election security has put the state-level systems in a position to have a long-term and stable funding source for cybersecurity. We fully understand that any cyber system is only as good as the weakest link. West Virginia will continue to stay dedicated to increasing our protections, bolstering our detection capabilities, and staying prepared for corrective action if and when an attack occurs.
Auditable paper records of votes cast are the strengths of West Virginia’s election systems that allow for a fail-safe option of recreating election results in the extremely unlikely event of tabulation errors occurring. The WVSOS is currently studying advanced audits that will limit any risks of electronic tabulation used in other states for feasibility in West Virginia.
While West Virginia has leveraged every resource possible from existing funds and new funds to the County Grant and Loan Fund, we estimate that local election officials' efforts will result in only half of all registered voters having access to new or upgraded election systems by the 2020 elections. I find the most important financial need moving forward is to replace local voting equipment with new, more secure equipment.
West Virginia’s economic situation since the first round of HAVA in 2002 has deteriorated and many less-populated counties simply do not have resources to prioritize funding election systems over debts that continue to rise, such as increasing jail bills and underfunded road maintenance. Even with the matching opportunities for voting equipment and cyber upgrades that we will offer, local funding opportunities are proving difficult as West Virginia is just now beginning to recover from the economic storm of recent years.
Funds to acquire HAVA mandated machines that come with the latest and greatest technology and protections simply do not exist in many counties. HAVA 2 funds are greatly appreciated and helpful to local election officials, but I am hopeful that our local election officials’ needs remain in consideration when Congressional funding discussions resume.