County clerks receive cybersecurity training in Morgantown
MORGANTOWN — In a first-of-its-kind training event, county clerks and their staffs from all corners of West Virginia met in Morgantown Monday to learn more about what they can do to thwart hacking efforts.
The 2018 Election Preparation and Training Conference at the Holiday Inn Morgantown continues this morning with a tabletop exercise for county clerk staff only.
Participants heard from the West Virginia Secretary of State’s Office, the West Virginia Intelligence Fusion Center, the West Virginia National Guard, U.S. Department of Homeland Security and West Virginia University professors.
With the Nov. 6 general election just 106 days away, Secretary of State Mac Warner said it was important to hold this conference to keep cybersecurity on the minds of local election officials.
“It’s critical as we go into the 2018 election; it’s never too late on cybersecurity,” Warner said. “This is sensitizing them to the issues. I’ve already had several clerks come up to me and go ‘Wow, I didn’t know we were exposed in that way in our small county.'”
Participants were greeted at lunch by Matt Masterson, a senior adviser on election cybersecurity for DHS and a former commissioner of the U.S. Election Assistance Commission. Masterson talked for an hour about the various forms of cyber attack, giving real-world examples, and providing his direct contact information for clerks and their staff.
“It’s critically important that local election officials are engaged, and we’re working with them to understand the risks to the process,” Masterson said.
“They were very appreciative that Masterson put up his own personal contact information,” Warner said. “This is someone from DHS saying we can call them. They were impressed. I want them to push the Secretary of State’s Office just like we’re pushing DHS to assist us.”
One of the ways Warner pushed DHS was by getting secretaries of state and their chief information officers security clearances so that DHS could directly communicate about cybersecurity threats.
In 2017, DHS designated elections systems as “critical infrastructure.” According to DHS, Russia targeted the election systems of 21 states in 2016, though West Virginia was not one of them.
To further make sure West Virginia is not a target of future cyber attacks, the Secretary of State’s Office partnered with the West Virginia National Guard to embed a cybersecurity expert in the Fusion Center to watch for cyber attacks aimed at state election systems.
The conference was borne out of a relationship between Warner and the Belfer Center for Science and International Affairs. Through Belfer’s Defending Digital Democracy project, the former campaign managers for Mitt Romney and Hillary Clinton worked together after both campaigns saw cyber attacks.
Belfer and DDD brought in Warner and other Secretary of State staff early in crafting the first tabletop training program to prepare election officials nationwide. Condensing the first six months of elections preparation to an hour, then the first 24 hours of election day into another hour, exercise participants are forced to make decisions quickly, and those decisions — or lack of decisions — can come back to bite participants later on.
After crafting the tabletop exercise, Belfer brought in election officials from state and county offices around the country to train them on how to do training exercises in their home states. West Virginia started planning its tabletop exercise in May.
The first day of the conference helped prepare county clerk staff for the types of cyber threats out there, such a spear-phishing, malware, and ransomware. Participants learned about dealing with and combating misinformation, pushed predominately through Facebook and Twitter.
The second day takes those lessons the participants learned and throws at them scenarios that cause them to think and come up with solutions in hour one. Participants are divided into two fictional states, with a secretary of state, technology director, and communications director. From there, states are divided into two counties, with two precincts per county. Each level of the mock government must plan for various cyber attacks.
Hour two puts their solutions to the test, with scenarios — similar to chance cards in a board game. With a typical election day condensed to one hour, participants have to think quickly, all while being distracted by mock political party officials, reporters, and other officials.
There are no winners, and there isn’t supposed to be. Mistakes are supposed to be made during the tabletop exercise. Moderators take a look at the notes taken by each fictional government body to determine what they did right and what they did wrong.
No one is shamed for making mistakes, but learning about each other’s mistakes drives home the importance of cybersecurity in the election process now, officials said.
“In essence, a tabletop exercise is helping you understand the possible risks to the process and helping to figure out how you’d respond and what steps you’d take,” Masterson said. “I think working through that with local election officials is really important. I think West Virginia is doing the right thing in leading and doing that with local election officials.”
“I think we’re going to be more aware of the sensitivity of the elections security that needs to be taken,” said Marshall County Clerk Jan Pest. “More than anything, it gives us a tool to find steps to get started in making everything more secure.”
Also during the conference, county clerks got a hands-on look at newer elections machines from ES&S, the only vendor that has sought approval to sell voting machines and equipment by the state Election Commission. While a handful of counties use optical scan ballots and many use iVotronic touch screen machines that use a receipt-like paper trail, many counties are switching to ExpressVote machines.
ExpressVote is a touchscreen voting system, but users insert a paper ballot into the machine, make their choices, and the machine prints the selections on their ballot. The voter takes the ballot to another machine that scans the ballot and drops it into a secure box. The newer system allows for quick counting at the end of the night and creates a paper backup many experts say is vital in case of tampering.
Congress passed legislation in the spring creating a pot of money for states to tap into. These funds, available through the Help America Vote Act (HAVA), total $380 million. West Virginia received a total of $3.6 million.
Combined with an additional $2.9 million the state set aside for counties as a loan program to upgrade voting machines, West Virginia has $6.5 million available for counties.
The state plans to use the $6.5 million to help counties upgrade their election systems and equipment, as well as make cybersecurity preparations. The Secretary of State’s Office created a HAVA Grant Board and created a grant and loan program that counties can apply to for equipment purchases. Officials hope to expedite applications, so counties will be ready for elections in November.
“They’ve already been picking up some of the loan applications,” Warner said. “We’re going to have a session just on that at this conference. I’m sure a lot of them are going to walk out of here energized to take advantage of it.”