Oregon, counties take part in election security drill

(Update: Adding AP story)

SALEM, Ore. (AP) — Huddled in small groups in at an Eastern Oregon university campus, county and state elections officials tried to overcome hacking attempts, power failures and other problems as election day approached and finally arrived.

It was a tabletop exercise, held as federal officials work to bolster defenses against interference in the 2020 elections, with states being a main line of defense against attempts by Russia or others to disrupt the elections.

Officials from the Department of Homeland Security and the Cybersecurity and Infrastructure Security Agency traveled to La Grande, a town located in ranching country in northeast Oregon, for Wednesday’s exercise with county and state officials.

During the event held on the campus of Eastern Oregon University, the officials had to work through various scenarios, like official websites being hacked, disinformation being spread on social media and electrical power and communications going down, Oregon Elections Director Stephen Trout said in a telephone interview.

Disinformation involves deliberately spreading falsehoods and rumors, while misinformation — another election security threat that experts point to — entails simply disseminating incorrect or misleading information.

The federal officials are doing these exercises in states across the country. Earlier this summer, the Cybersecurity and Infrastructure Security Agency, or CISA, also hosted the second annual “Tabletop the Vote” national exercise involving 47 states, other government agencies and private sector election companies.

Matt Masterson, senior cybersecurity adviser at CISA, said the exercise displayed a strong partnership between CISA, the office of Oregon Secretary of State Bev Clarno and county election officials.

“Exercises like this play a critical role in election security by bringing everyone together, so we can better understand each other’s processes and improve incident response plans,” Masterson said.

New Jersey’s secretary of state is preparing to hold a similar drill on Sept. 10 in Princeton.

Besides participating in the national table-top exercise, Vermont officials held a New England Regional Summit, with attendance from secretary of state offices, the Department of Homeland Security, the FBI and others, said Eric Covey, chief of staff of Vermont’s secretary of state’s office.

Federal officials also provide the Vermont secretary of state’s office with weekly scans, looking for vulnerabilities in election infrastructure so action can be taken to mitigate risk, Covey said. Vermont is also in the queue for a DHS-conducted simulated phishing campaign, Covey said.

In 2016, hackers famously gained access to the email account of Hillary Clinton’s campaign chairman, John Podesta, and stole over 50,000 emails. The hackers used phishing emails to steal login credentials. U.S. special counsel Robert Mueller charged 12 Russian military intelligence officers with breaking into Democratic Party emails, and indicted other Russians who used phony social media accounts to spread divisive rhetoric and undermine the U.S. political system.

Trout said federal officials are right to focus their efforts to protect the 2020 election at the state level.

“The state is the top level,” he said. “There are no federal election administrators.”

Homeland Security officials are also visiting every county in Oregon to check on systems, Trout said. Oregon has a vote-by-mail system, where votes are tallied at county clerk’s offices.

Trout said his biggest fear is disinformation, and that it underscores the need to advise voters not to believe everything they read and to bolster their confidence that their vote is going to be counted as cast. Oregon is looking at using Facebook, YouTube and other tools in an education campaign, he said.

Clarno said she feels the state is more able now than in previous elections to fend off any disruptions, and that the biggest threat is misinformation.

“That was the biggest problem in 2016, and we expect more of the same in 2020. Just because you read something on social media or online doesn’t mean it’s true,” Clarno said in a statement.

Trout said these tabletop exercises also build bonds between technology specialists and clerks and other election officials.

“Three years ago, election folks didn’t even know what cybersecurity was,” he said.

___

AP writers Wilson Ring in Montpelier, Vermont, and Michael Catalini in Trenton, New Jersey, contributed to this report.

—

News release from the Oregon Secretary of State’s Office:

Last week in La Grande, county election and IT officials from around the state participated in an election security exercise organized by the Elections Division of the Oregon Secretary of State’s Office, in partnership with the U.S. Department of Homeland Security and the U.S. Cybersecurity and Infrastructure Security Agency.

The four-hour exercise was intended to increase the preparedness of Oregon’s elections offices to successfully deal with physical and cybersecurity threats during the 2020 election cycle. All 36 Oregon counties belong to the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), which promotes threat information sharing through all levels of government.

The topics of the training included improving password strength, identifying phishing attempts, and a number of scenarios related to election security. These scenarios gave county officials an opportunity to think of and plan ahead for issues that may arise during the 2020 election cycle.

It was noted that Oregon’s vote by mail system makes elections more secure because it allows the state and counties to focus their security resources on the 36 county election offices, rather than having to secure thousands of voting booths across the state.

Each of those 36 locations has secured rooms where ballots are tallied, and which are equipped with video surveillance. The tallying systems are not connected to the internet and there is a paper backup.

“We are in a stronger position now than we were for the 2016 and 2018 elections, even though we successfully secured both of those elections,” said Secretary of State Bev Clarno. “The biggest threat to elections is misinformation. That was the biggest problem in 2016, and we expect more of the same in 2020. Just because you read something on social media or online doesn’t mean it’s true. Much of the election information you find online is not accurate.”

“There is a lot of misinformation online saying that non-citizens are being registered to vote. That is simply not true,” said Elections Director Steve Trout. “Only those who have provided proof of citizenship when they go to DMV are automatically registered to vote.

“There is also a lot of information online saying that our elections were hacked in 2016 and will be hacked again. Do not believe it. Oregon continues to be a leader in secure elections and innovative voter protections, and voters can have confidence that their ballots will be counted as they were intended,” Trout added.