Cybersecurity and Infrastructure Security Agency Director Christopher Krebs is pointing to three major developments as underpinning his assertion that there’s a “night and day” difference between security preparations undertaken for the 2020 elections and those in place in 2016.
Krebs spoke today during the opening of the Black Hat USA 2020 virtual briefings, delivering pre-recorded remarks followed by a live chat.
He cited the emergence of a “vibrant community” around election security over the past four years, “a better understanding of the risk” following the attempted system intrusions and disinformation of 2016, and better visibility into election systems.
“That visibility gives us confidence that 2020 will be the most secure election in history,” Krebs said.
He stressed that “my team is here in support of state and local officials,” and noted CISA-crafted guidance to states “on buying down risk [that’s] tailored specifically” for their needs. An auditable paper voting trail is “one of the best risk reduction techniques,” he said, and officials across the country are “on track for 92 percent of votes to have a paper trail, and more.”
CISA-supplied ALBERT sensors are in place in all 50 states, Krebs said, including every county in Florida and in some other states. “Starting in 2016 we worked to understand the systems” at the state and local level, Krebs said, but “what we didn’t have was trust.”
CISA and intelligence agencies are seeing daily activity aimed at elections, such as system scanning, Krebs said, but nothing yet on the scale of 2016. In his update today he mentioned possible targeting of election-night reporting of results and of voter registration databases.
He said federal officials and their partners are preparing for a “capable adversary,” while taking into account the complications posed by the COVID-19 pandemic, and he urged security pros and researchers to get involved along with state and local officials.
Krebs also raised his concern about ransomware aimed at election systems and highlighted a package issued last year to protect databases from such attacks. “We’re also looking at resilience measures” such as analog backups, he said.
In his update today, Krebs mentioned the vulnerability disclosure guide CISA issued last week for election security officials.
Krebs at an event on Monday discussed how CISA’s critical infrastructure work around the COVID-19 pandemic is proving that the agency has the capabilities to understand security gaps and work with government and industry partners to strengthen relationships. – Charlie Mitchell (cmitchell@iwpnews.com)