Critical infrastructure designation for voting goes too far, says state official

Designating election systems, which are managed by states, as national critical infrastructure would be unconstitutional and unnecessary, Louisiana's secretary of state told a congressional panel.

In the wake of breach attempts against voter registration systems in Illinois and Arizona, the Department of Homeland Security has been considering placing election systems under the same critical infrastructure protections as the power grid and banking systems."I don't think critical infrastructure protection is needed at all," Louisiana Secretary of State Tom Schedler said at a Sept. 9 hearing of the House Science, Space and Technology Committee.

"We can go to [DHS] now and get [cybersecurity] tests," he said. Furthermore, states can take advantage of cybersecurity best practices issued by the National Institute of Standards and Technology, and "most states are cooperating with the FBI" on the issue.

"I don't mean to be flippant, but do we really want to create a new TSA for elections in the country or a new Postal Service?" he asked. "I don't think we need that."

He said he understood the desire to protect election systems because they are a crucial element of U.S. democracy, but declaring the state-run systems to be federal critical infrastructure was an unconstitutional "overreach and unnecessary."

"I don't know of any secretary of state who has voiced an opinion they want to be part of that," he added.

Committee Chairman Rep. Lamar Smith (R-Texas) cited reports that the attempts to penetrate voter databases in Arizona and Illinois have been linked to Russia. "We have yet to take decisive steps to defend ourselves and deter attackers," he said.

At a hearing of the Senate Armed Services Committee, National Security Agency Director Adm. Michael Rogers did not share views regarding voting system hacks, citing an ongoing investigation led by the FBI. However, he did say that the diverse and highly distributed nature of U.S. voting systems gives it some built-in defense against adversaries.

"One advantage I do see from a defensive standpoint: The structure is so disparate, with some elements still being very manually focused [and] others being more electronic and interconnected," Rogers said. "Because it's not just one nationwide, single, integrated structure, I think that tends to help us defensively here."

At the House hearing, Dan Wallach, professor of computer science and Rice faculty scholar at Rice University's Baker Institute for Public Policy, said states should have contingency plans similar to the ones that were developed when Hurricane Sandy threatened the Northeast on Election Day 2012.

Database backups and large orders of paper ballots could allow governors to declare a state of emergency and take appropriate action, up to and including rerunning the election on a different day, Wallach added.