Majority of election security grants going toward cybersecurity, equipment upgrades

Several states are using their HAVA funding exclusively on either cybersecurity or replacing equipment.

About a third of federal funding meant to improve election technology will be spent on cybersecurity-related improvements, while another third will be used to upgrade old equipment, according to plans released Tuesday by states and the U.S. Election Assistance Commission.

In March, Congress appropriated $380 million for states to use for upgrades to election infrastructure, under the Help America Vote Act. It’s the first time the federal distributes HAVA funding since 2010.

“The 380 [million] is something new in terms of additional funding, but it’s in that same realm of ensuring that our voting process remain secure and that vote of confidence remains high,” Tom Hicks, chairman of the EAC, told CyberScoop.

While states have a lot of leeway in how to spend the money, Congress and the EAC emphasized the need for boosting election security, given heightened concern over foreign meddling.

“I would say it’s a magnitudes more on security,” said Mark Abbott, the EAC’s director of grants.

Forty-one states are spending at least some of the funding specifically on cybersecurity upgrades to their election infrastructure. That makes up about 36 percent of the $380 million. Three states — New York, Illinois and Wisconsin — are spending the entirety of their grants on cybersecurity, amounting to more than $13 million.

Several states, like Arizona, Illinois, Nevada and New Mexico are hiring additional IT staff to focus on cybersecurity for the 2018 election, according to Abbott.

“Those are expertise and people that would not be in place but for these grants,” Abbott said.

Other cybersecurity spending covers training, boosting incident preparedness, evaluating risks and improving information sharing, among other things.

Roughly 28 percent of the HAVA funding is going toward replacing old voting and tabulation equipment. Voting machines used throughout the country are often touchscreen systems, which do not produce a verifiable paper trail. Experts warn that these machines are susceptible to hacking because it’s hard to detect vote tallies that have been tampered with.

Alaska, Arkansas, Delaware, Louisiana, North Dakota and Pennsylvania using their entire shares of the HAVA funding to upgrade equipment, but the upgrades are not likely to be complete by the upcoming election. Abbott stressed that that doesn’t preclude them from making security improvements by November.

“They’re not doing this in absence of a strong security posture. Our guidance was if you want to buy equipment with this money, that is an acceptable and good idea. Make sure you’ve got your security stuff handled so they clearly have deployed state and local resources against the emerging threats,” Aboott said. “So I don’t see this as an ‘either-or.’”

An effort in Congress to top up the HAVA funding with an additional $250 million failed due to partisan disagreements. Hicks said that it will be up to Congress whether more funding is warranted in the future, but that states certainly would welcome it.

“I will say that the states that I’ve been to in the last five or six months and even the three and a half years I’ve been here, the states have continually asked for additional resources from the federal government,” Hicks said. “So I think that they’ll continue to ask for that.”

Hicks added that the EAC does continually provide states with election resources, as it serves as a standards clearinghouse. But more monetary assistance, if it ever comes, will be from Congress.

House intel bill includes provisions on state and local threat intelligence, election security, AI

The House Intelligence Committee advanced its fiscal 2027 authorization legislation Monday.

States are building their own election defense networks as federal support evaporates 

Supreme Court approves mail-in ballots that arrive after Election Day 

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure