Nevada tightens election security in years after targeting of 2016 Democratic data

Millions of dollars and enhanced protections have helped Nevada shore up systems protecting voter data and ballot-casting since the 2016 election marked by suspicions of foreign interference.

One of the latest suspected Russian ties to election interference includes an indictment last week over emails and data stolen from Democratic groups in 2016, which Nevada officials say are separate from and can be much less secure than the systems safeguarding voter data and ballot-casting.

The indictment also pointed to an information breach of about 500,000 voter records in Illinois in 2016. But elections officials emphasized that much of the data was publicly available.

The Nevada Secretary of State’s Office has hired an information security officer and implemented upgrades, including software used to detect and repel attacks, said Wayne Thorley, deputy secretary of state for elections.

“We’ve done a lot in the last two years, since the revelations came out about the 2016 election interference,” he said.

Layers of protections coupled with security awareness training for employees help prevent unauthorized access, he said, without detailing those safeguards for security reasons.

“When it comes to security, oftentimes people are your weakest link,” he said. “It’s important to have that ongoing training.”

The Secretary of State's Office sees and repels tens of thousands of possible attacks, people looking for ways into the system every day, Thorley said.

“These aren’t sophisticated attacks, lots of times,” Thorley said. “You think of a teenager in their parents’ basement just kind of goofing around or whatever. It’s all day, every day.”

The indictment of a dozen Russian individuals last week primarily focused on their suspected role in breaching Democratic emails related to the 2016 election, systems that have no connection to the state’s data or vote-casting infrastructure, Thorley said. He pointed to Google and others that are offering sometimes free resources to campaigns to boost security.

“This is a kind of eye-opener to campaigns that they need to spend and focus more of their attention on security,” Thorley said.

Election infrastructure was designated as critical by the Department of Homeland Security in January 2017, triggering an information sharing and analysis center for elections that gives states resources. Thorley said the Secretary of State’s Office is part of that, as are at least 13 of 17 Nevada county election offices, including Clark County.

The 2017 Legislature put $8 million toward the Secretary of State’s Office to help counties purchase updated voting equipment, which were in place statewide for this year’s primary. Electronic poll books in use statewide are connected to a network that communicates with county voter registration databases, protected by counties, Thorley said.

If poll books go offline, for whatever reason, systems are in place to verify voters over the phone in cooperation with vote centers. Thorley said Clark County has been a leader on this, with mobile units that can respond if polling places go down. People can also report election-day complaints to a multi-agency command center that will be announced before the election, and was in place for the 2016 general election.

Joe Gloria, Clark County registrar of voters, said work to secure election and voter infrastructures was ongoing well before 2016.

“We’ve done considerable work that started late last year to begin preparing for anything that might happen this election cycle,” Gloria said.

Nevada’s new machines have several security enhancements, such as with encryption and access, Gloria said. Machines where voters make their selections are not connected to the internet, with cartridges transferred from voting sites to tabulation rooms in an isolated network, Gloria said. Equipment verified before every election, he said.

“There’s quite a bit of security work that goes into preparing the machines, and we have to make sure that it matches the federal certification and the state certification, prior to early voting starting, prior to election day, and then again after the election,” he said. “And then we also have some random audits that are run on some machines that were used in the field for early voting and election day.”

Gloria said there is data that is publicly available about voters, but that driver's license and Social Security numbers and email addresses are always confidential.

“It’s not just our website, but anything that’s available to the general public on any of the county departments’ websites are guarded as well,” he said.

People can contact the Clark County Registrar of Voters’ Office to further restrict publicly available information, such as their residential address and phone numbers.

Gloria said the county and state are using a federally-provided sensor to guard against hacking through tracking, and used a vendor to provide penetration testing on items available on the website. Weak spots identified in the testing were tightened up, he said.

The state’s new systems allow voters to use some of the newer touch screens available for voter equipment. Much of the equipment in place nationwide was purchased in the mid-2000s and utilizes touch screen technology that requires calibration — tests that let the screen know exactly where the user is indicating.

Voters using machines that need calibration can feel like their vote is being intentionally recorded incorrectly, a perception that can be avoided with new technology that has been in place statewide since the primary election.

Thorley said it’s important for voters to feel confident that systems are reliable on election day, and new machines cut out the frequent maintenance breaks the old machines required. Thorley said the old machines were reaching end of life, being cannibalized for parts to repair other equipment, and might have required recalibration a couple of times on election day.

“It’s also a perception issue too — voters don’t want to be seeing us constantly tinkering with machines in the field,” he said. “Having machines that we don’t need to field-strip and open up … helps get that message across that we’re using secure, reliable equipment.”

Remote-access technology present in some machines in the rest of the country are a security risk, Thorley said, though have not been present in Nevada.

“Election officials, meaning the state offices and the county offices, spend a lot of time and resources on making sure that our election systems are secure, because we want people to have confidence in the process,” Thorley said. “We want people to know that the vote they cast is counted accurately so that when we announce the election results they know it’s actually the will of the people.”