Senators push for better election security

WASHINGTON -- Government efforts to protect state and local elections from Russian cyberattacks in 2016 didn't go far enough, leaders of the Senate intelligence committee said Tuesday as the panel released recommendations to safeguard against foreign meddling in the 2018 primary season.

Federal warnings last time did not provide enough information or in some cases go to the right people in state and local governments, the committee's leaders said, though they reiterated there was no evidence votes were changed. Russian agents targeted election systems in 21 states ahead of the 2016 general election, the Homeland Security Department has said, and top U.S. intelligence officials have said they've seen indications Russian agents are preparing a new round of election interference this year.

The committee's recommendations include urging states to make sure voting machines have paper audit trails and aren't capable of being connected to the internet. Senators also are pushing for better communication among the various U.S. intelligence agencies and federal, state and local governments about cyber threats and vulnerabilities in computer systems.

The committee's recommendations preview an election security report expected to be released in full in the coming weeks. It is the first of four reports the panel plans to write in its wide-ranging investigation into Russian meddling in the 2016 election.

Committee chairman Richard Burr, R-N.C., and Virginia Sen. Mark Warner, the top Democrat on the panel, released the recommendations ahead of a Wednesday hearing examining attempted hacks on state election systems in 2016 and the federal and state response.

The proposals, in large part, echo those made by cybersecurity experts and address concerns raised by state and local officials. Even with Republican and Democratic support, it's unclear whether the recommendations will translate into legislation. Burr said his panel doesn't have jurisdiction over the issues, so another committee would have to write any bills in Congress.

"While our investigation is still ongoing, one conclusion is clear: The Russians were relentless in attempting to meddle in the 2016 elections, and they will continue their efforts to undermine public confidence in Western democracies and in the legitimacy of our elections," said Republican Sen. Susan Collins of Maine.

Burr said the committee's investigation revealed the Russian cyber effort exposed "some of the key gaps" in the security of the nation's election infrastructure. He said the committee wants to maintain state control of elections, but the federal government should be doing more to help.

"Clearly we've got to get some standards in place that assure every state that at the end of the day they can certify their vote totals," he said.

Senators are also urging state and local election officials to take advantage of resources provided by the Homeland Security Department, such as comprehensive risk assessments and remote cyberscanning of their networks to spot vulnerabilities. Overall, experts say far too little has been done to shore up those vulnerabilities in 10,000 U.S. voting jurisdictions mostly running obsolete and imperfectly secured technology.

As of last month, just 14 states had requested risk assessments and 30 had asked for remote cyberscans of their networks, according to Homeland Security officials. But even those requests strain resources, since many of those risk assessments have not been completed.

Illinois, which held the second-in-the-nation primary Tuesday, requested the assessment in late January but it's not scheduled to be completed until after the primary.

The senators are also recommending states consider implementing "more widespread, statistically sound audits of election results." Currently, 32 states and the District of Columbia require postelection audits.

Cybersecurity experts say the best approach would be for states to require risk-limiting audits, a type of an audit using statistical methods and considered a more rigorous process. So far, three states -- Colorado, Rhode Island and Virginia -- have passed legislation to require them.

Other states, including Georgia, are weighing legislation this year to implement risk-limiting audits.