Page 36 - FCW, January/February 2020

ARE THE FBI’S NEW
BREACH NOTIFICATION
RULES ENOUGH?
Although the
FBI is pledging to notify states more quickly about election system hacks, some say its narrow definition of victims is counterproductive
BY DEREK B. JOHNSON
The FBI has a new policy of notifying states when local election systems are hacked, but some state officials and lawmakers believe a broader range of stakeholders should be informed.
The federal government in general and the FBI in particular have been widely criticized for taking three years to notify Florida officials and Congress that voter registration systems in two of the state’s counties were breached by Russian hackers leading up to the 2016 elections. Although U.S. officials said they do not have evidence that vot- ing machines or tallies were compro- mised, security experts say bad actors can tamper with registration data to sow confusion and wreak havoc on Election Day.
Alabama Secretary of State
John Merrill said he and his counter- parts in other states spent years urging the federal government to notify states about local election hacks because many counties and municipalities lack the technical resources to detect and respond to such breaches.
“They’re not in a position to give any attention to what was going on and to try to correct the issue, and so if \[the federal government isn’t\] contacting us, what’s the value of calling anyone?” he told FCW. “And when we explained that to \[the federal government\], they understood.”
Officials in Ohio, Pennsylvania, Iowa and others states have issued statements that generally support the
shift in
FBI policy and laud
the increasingly cooperative relation- ship among stakeholders since the 2016 elections.
“This is a positive step in communica- tions between the federal government and our states,” Iowa Secretary of State Paul Pate, who is also commissioner of elections, told FCW. “It’s important I’m aware of any problems or attacks on our systems. We already require the counties to notify us.”
Who are the real victims?
The FBI’s new policy does not include notifying Congress or the public when an election system is breached, though
36 January/February 2020 FCW.COM