Gregory A. Miller, E. John Sebes, Joy London

Free and fair elections are an essential ingredient to the administration of American democracy. American elections have a core mission: select political leadership in a manner that ensures a constitutionally mandated orderly transfer of power. Accordingly, election infrastructure is critical to our democracy and the administration of U.S. elections. Elections are an element of U.S. sovereignty and therefore, the technology of election administration is an asset of national security. 

This Briefing provides you a thorough review of the technology infrastructure of election administration and operation.  We address its criticality and what is required for it to be treated as such, and assess the challenges of official designation, as well as the immediate and longer-term challenges to protecting this vital aspect of our democracy.

There have been a number of helpful and important reports and white papers produced recently about America’s election security.  The OSET Institute’s CDI Briefing is the only one of its kind, researched and developed by election technology specialists with over a decade of experience in election and voting systems engineering to increase integrity, lower costs, and improve usability.  

This Briefing is intended to be an educational resource on the technology challenges, with a minimum of techno-babble. While we offer recommendations, this paper is not intended to be a policy strategy, although we hope it will inform those discussions.

Foreword

By William P. Crowell
Former Deputy Director, National Security Agency; Partner, Alsop Louie Partners

In 2016 we witnessed an unprecedented election cycle wherein at least one foreign state adversary launched successful attacks on our election processes and technology.  One clear outcome is that U.S. election infrastructure is now a matter of national security.  Arguably, that makes election technology part of the assets of critical infrastructure. Unless we protect this infrastructure against future attacks, the potential for damage recognized in 2016 could be realized as soon as next year’s 2018 Midterm Election.

Russian state sponsored activities in 2016 are now a recipe for refined capabilities to inflict even greater damage by themselves and others.  As a former Deputy Director of the National Security Agency years ago, fortified by my engagement in breakthrough information security innovations ever since, I can say with confidence that in order to combat the threat of growing foreign adversarial attack capabilities, election machinery must be re-designed with a security-centric engineering approach in order to address this mounting cyber-threat.

Protecting against this threat requires a new mindset and a new infrastructure to ensure that election administration can occur with minimal to no disruption.  We know our current election technology is obsolete, and relies on an untrusted dwindling supply chain of replacement parts.  We also know there is a challenging and difficult reality regarding an inherently insecure underlying architecture of current voting and election administration technology.  Like it or not, polling places are now pop-up data centers, and the fact that no Internet connectivity is involved is irrelevant to their integrity and security.  Moreover, elections workers cannot be expected to match wits and resources with increasingly capable cyber adversaries.  Unless there is a reset of the priorities for resourcing election organizations across the nation with better protocols, policies and platforms, our electoral process will continue to be at greater risk of chaos, uncertainty and upheaval.  Proper protection of our election infrastructure is the basis for trust in the results of its operation: declared and accepted election winners and losers, and the orderly transfer of power.

So, what must be done? This Briefing presents the basis on which to work toward a comprehensive solution: adopting and adapting the principles of critical infrastructure protection to America’s election technology infrastructure—as distributed and diffuse as it is, obsolete as its becoming, and re-invented as it must be.

Unfortunately, partisan polarization has made this topic and conversation on how to protect our election infrastructure difficult, if not nearly impossible.  This must change. I’ve said it before and it bears worth repeating, the earlier you make the decision to bank on the future at some present cost, the better off you are.  Our adversaries have no partisan preference; they are opportunists. Therefore, a patriotic approach must prevail.  I believe this Briefing, thoroughly researched and thought-through, offers a non-partisan basis to help understand the questions, and seek good answers to securing this imperative aspect of our sovereignty.  I hope you agree.