Election Cybersecurity Improvements in Action
Colorado’s Primary Day
his past Tuesday, I was privileged to be invited to visit with election officials from the State of Colorado and Denver County during their primary election day. It was a great opportunity to watch professionals in their environment and see how their work isn’t static–they are constantly seeking improvements in security and efficiency.
As many of you know, about five years ago Colorado switched to a new model of voting. Since the 2014 elections, all active Colorado voters have received a ballot in the mail for each election, which they can mail back or drop off in a secure drop-box or at a voting site at any time before the close of voting. In addition, Colorado voters have the option of voting in person–either early or on Election Day–at any one of dozens of vote centers in each county. It’s the ultimate choose your own adventure–every voter can choose the method of voting that they prefer (mail, drop-off, or in-person) and do so at a time and place of their choosing.
This results in somewhat of an oddity on Election Day. I’ve observed voting in hundreds of elections during my career, and Election Day in Colorado is perhaps the calmest. Most voters–over 70%–had already cast their ballots by the time the polls opened on Tuesday. Even more voters–well over 90%–chose to complete their ballots in the comfort of their own home, without time pressures and with plenty of opportunity to review any information they might need to vote an informed ballot. This, in turn, means that fewer polling places are needed and that those staffing the vote centers are the cream of the crop and very well-trained.
As part of their partnership with state and local election officials, the Department of Homeland Security visited both the Secretary of State’s office and the Denver County Elections office. I tagged along for the tour of Denver’s facility, and the attention to security and process was impressive. Individual ballots are tracked through the entire process, and each voter can sign up for Ballot Trace, which provides updates about where their ballot is throughout the process. Tabulation rooms are completely air-gapped from the internet, and once results are tabulated, there are multiple redundancies, including hard copies of the results, that ensure the right count is recorded. Finally, chain of custody of each ballot is maintained throughout the process (to the point where individual ballots can be compared to how they were tabulated) to ensure a full risk-limiting audit can be conducted just days after the election.
In addition, information sharing about potential cyber threats occurs throughout the day. Through efforts like the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC), the federal government (DHS and others) and state and local election officials are sharing information in real-time about any intrusive activity, enabling better coordination and security. These coordinated efforts are layered on top of the cybersecurity that each office maintains on its own, including sophisticated monitoring of all systems, sites, and devices. For example, in Denver County virtually every voting site, drop-off box, and room in their facility has 24-hour video surveillance.
Colorado and Denver County are at the leading edge of blending efficiency, convenience, and security for voters. But these best practices are becoming much more common with other state and local election officials. Even in the face of significant threats from foreign countries and others, thanks to examples like those in Colorado and Denver County–and many other places–election cybersecurity is improving substantially and will continue to improve through 2018 and 2020.