Page 37 - FCW, January/February 2020

REP. STEPHANIE MURPHY (D-FLA.)
JOHN MERRILL, ALABAMA SECRETARY OF STATE
FBI and Justice Department officials recently told reporters they might do so in certain circumstances.
According to the FBI, the federal government does not prevent or inhibit states and localities from telling Con- gress or the public that an election sys- tem has been hacked. But it’s up to the affected states and localities to share that information.
“Victims who have been notified of cyber intrusions by the FBI are free to disclose that notification as they deem appropriate,” an FBI spokesperson told FCW. “If the victims are provided clas- sified information in addition to the notification, they cannot disclose the classified portions, but they are not pro- hibited from disclosing the existence of an intrusion.”
Rep. Stephanie Murphy (D-Fla.), a former national security specialist at the Defense Department who was first elected to Congress in 2016, told FCW she learned that Russian hackers had breached voter registration systems in her state when she read Special Counsel Robert Mueller’s “Report on the Investi- gation Into Russian Interference in the 2016 Presidential Election” — which was released nearly three years after the hacks are believed to have occurred.
Murphy and other Florida lawmak- ers didn’t learn which counties were breached until they were briefed by FBI officials in May 2019. They were told they could not publicly name the affected counties because the lawmak- ers were not considered victims and doing so could jeopardize sources and methods.
Murphy — who has sponsored legis- lation to require federal officials to alert Congress, states and the public about election-related breaches in the future — said the FBI’s definition of victims is not broad enough.
“I disagree with them on this issue.... I believe the victims are the voters,” she told FCW. “They deserve to know what happened and what their leaders are doing to prevent it from happen- ing again.”
“I BELIEVE THE VICTIMS ARE THE VOTERS. THEY DESERVE TO KNOW WHAT HAPPENED AND WHAT THEIR LEADERS ARE DOING TO PREVENT IT FROM HAPPENING AGAIN.”
She also said members of Congress should be considered victims when voter registration systems, electronic poll books and other election systems are hacked. In addition to being unique- ly positioned to use budgets, sanctions and messaging platforms to respond to incidents and protect election infra- structure, lawmakers also rely on the very electoral process that is being targeted.
“State and local election officials hold elections that determine the fate of federal officials, and so it seems to me a matter of course that we would be notified if there was something awry with the way that elections were being held,” Murphy said.
‘A delicate balance’
Connecticut Secretary of State Denise Merrill, who served as president of the
National Association of Secretaries of State during the 2016 election, told FCW she “saw firsthand how frustrated my colleagues and I were by the lack of information we received from federal authorities.”
Still, she cautioned that deciding when to publicly release information about a breach should be determined on a case-by-case basis.
“There is a delicate balance between providing important information and creating a panic or making voters think that our elections aren’t fair that elec- tion administrators have to weigh when deciding how to disclose problems of election administration like cybersecu- rity,” she said. “These decisions have to be made on an individual basis depend- ing on the incident.”
Under the FBI’s new policy, states will not be informed when a vendor
“THEY’RE NOT IN A POSITION TO GIVE ANY ATTENTION TO WHAT WAS GOING ON AND TO TRY TO CORRECT THE ISSUE.”
January/February 2020 FCW.COM 37