First, communications are key — and a new battleground. Effectively communicating with the news media and being able to use multiple channels of communication are key. Those new communication channels shouldn't exclude old-school methods, either. When attackers compromised law enforcement communications, amateur radio operators helped fill critical gaps until service was restored.
Next, new and developing technologies make threat prediction difficult and raise the level of unpredictability in the process. Law enforcement should have steady and positive communications with technology companies so they are aware of new technologies, how they can be used, and what at least some of the implications of their use might be.
Finally, no amount of planning could match reality. Developing playbooks can help turn certain responses into automatic actions, but law enforcement and elections officials must remain light on their feet and responsive to developing threats. They must also deploy and act sooner rather than later and quickly reach out to other agencies and actors to help.
Every Vote Matters
Taking all the threats into account, it may seem odd that many experts are optimistic about a successful, reliable election day in 2020.
"I think we have the capability. I really do," says Maley. "We did a report last year on some cybersecurity hygiene around government systems that touch the election. And in those reports, we found some states that are doing amazingly well."
Other states, he says, give him pause, and not necessarily because of actions in their election offices.
"Their ecosystem is not just the infrastructure that they manage, but it's all the third parties that they also touch," says Maley. "And in the election systems, the Department of State for each state usually manages those systems, and there are some who are extremely good at that. But there are some that then consume services from their states, things like email, domain name services, and they don't consider those things as part of the election systems. That frightens me."
And dealing with the overall issue of election security needs to start soon. Barak is adamant about election security before the polls open. He says that successfully suppressing votes for one party or candidate in key areas might lead citizens to question the validity of the entire election process.
"When they start looking at the process that keeps one party at home, people might ask whether the results are valid, and if the suppression is in a swing state, whether the national results are valid," Barak says.
And the worst result, the experts agree, would be for voters to lose confidence in the process of electing their leaders.
- Schneier on Hacking Society
- Cyberspace Solarium Commission Slams US Cybersecurity Readiness
- Forget Hacks... Ransomware, Phishing Are Election Year's Real Threats
- Securing Our Elections Requires Change in Technology, People & Attitudes
- How Enterprises Are Attacking the Cybersecurity Problem - 2019
- State of Cybersecurity Incident Response
A listing of free products and services compiled for Dark Reading by Omdia analysts to help meet the challenges of COVID-19.