DHS won't define election systems as critical before November

The Department of Homeland Security will not classify election systems as critical infrastructure before the November presidential election, DHS Assistant Secretary for Cybersecurity Dr. Andy Ozment said at the Billington Cybersecurity Summit Tuesday.

The Department of Homeland Security will not classify election systems as critical infrastructure before the November presidential election, DHS Assistant Secretary for Cybersecurity Andy Ozment said at the Billington Cybersecurity Summit Tuesday.

“This is not something we’re looking to in the near future. This is a conversation we’re having in the long term with state and local government, who are responsible for voting infrastructure,” said Ozment, a former senior director for cybersecurity on the National Security Council. “We’re focused right now on what we can usefully offer that local and state government will find valuable.”

“From our perspective, it gives us more ability to help,” he said of a critical infrastructure designation. “It does not put DHS in charge.”

“To some degree this question of ‘is it critical infrastructure or not’ is a distraction from the important thing, which is that everybody needs to help each other out,” he added.

A reclassification move — which would enable increased resources to protect political elections from hackers, and give DHS additional authorities — is something officials have discussed, but they are still weighing their options, said Ozment.

In recent months, legal professionals, several lawmakers and a cohort of state government officials have argued that federal agencies have no part to play in an electoral process for which local authorities have always been responsible. Georgia Secretary of State Brian Kemp, for example, has strongly objected to any DHS involvement — going so far as to publicly accuse President Barack Obama’s administration of exaggerating the threat of cyber attacks in order to step on local and state governments’ traditional jurisdiction.

“The way we classify critical infrastructure in the future must be largely determined by the development of technology,” said Karen Evans, co-chair of the CSIS Taskforce on Cybersecurity, during a panel discussion at the Billington Cybersecurity Summit.

Earlier this month, FBI Director James Comey said that he believed America’s election systems were largely insulated from cyber attacks due the inherently antiquated technology used in disconnected voting machines. Some cybersecurity experts are worried, however, given the availability of paperless ballot options, among other things, which rely on digital systems to record, transport and store election information.

Previously, Homeland Security Secretary Jeh Johnson said that the department was considering redefining voting systems as a “critical infrastructure” sector and that he took seriously threats to degrade the integrity of the country’s elections, especially that of the upcoming presidential election. In a later letter to state and local election officials, Johnson reiterated an offer of support but desisted from discussing the potential for classifying election systems as critical infrastructure.

“There are services we can offer by way of vulnerability to detection, incident response, we’re in a general environment where there’s an increasing level of sophistication by cyber attackers,” Johnson said during a televised interview with MSNBC’s Andrea Mitchell. “Across the spectrum, whether it’s nation-state actors, plain criminals, hacktivists, and so we want to inform state election officials of what we see on a national level as best practices, and we’re doing that right now.”

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure