County shoring up cybersecurity going into elections

BY CHUCK VANDENBERG

PCC EDITOR

FORT MADISON - With fall elections about seven weeks away, Lee County officials are taking steps to ensure that county voters feel safe about the integrity of their ballots.

Nikki Sugars, the county's election administrator, said the county has gone over and above state recommendations to ensure that Lee County voter information and ballots are kept secure.

"Since the 2016 presidential election, elections have been redesignated as critical infrastructure so there's federal funds to help secure the elections process," she said Monday afternoon.

"So basically we've been doing all this server security planning, and firming everything up. We've been working with Luann Schmitt, the county information technology coordinator, to make sure our firewalls are protecting our servers."

Sugars said last year the staff at the Lee County Auditor's office went through cybersecurity training, which was done online through the Secretary of State's office, but this year the focus was on the rest of Lee County employees who have access to county servers to complete the training.

She said the Iowa Secretary of State's office has provided all counties with processes they need to go through before the upcoming elections to raise voter confidence in Iowa elections.

"We've got a list of things the Secretary of State's office has given us that, in a snapshot, shows the processes we need to go through to raise voter confidence," she said, "We've always had the same processes with paper ballots and ballot security, but now we have different initiatives we have to meet before this next election."

Some of the initiatives include cyber security workshops that Sugars said the staff has completed. She said the state can mandate the training courses, but the county is taking security very seriously and she said the state is taking it very seriously, so the county is doing all they can to take protect the processes and information.

Lee County is also registered with the Elections Infrastructure - Information Sharing and Analysis Center (EI-ISAC) and a multi-state ISAC. She said the two groups create a cooperative of people in the fields of state and local governments and elections officials who are trying to prevent any form of cyber attacks.

"So if something happened, say in Illinois, they would let us know by saying 'Hey, this happened over hear and you might want to be aware of it'."

She said the state has also been doing random cyber-hygiene scanning on county servers to make sure they are all healthy and pass inspection. Lee County has already had one scan done and Sugars said they passed, but the state will continue to randomly scan county systems.

Sugars said her biggest fear is the weakest link.

"The happy clicker is my biggest fear, honest to God, it can really wreak havoc with communications. I've already had one election where ransomware hit and I had to administer an election without my email. When they were rebooting my email, we lost power, so I learned from that you've got to be prepared for anything. I'm thinking about this stuff in my head all the time and I have a lot of backup plans."

She said she's been visiting with many groups in the county, including service clubs, to talk with people about what the county is doing to ensure their votes are counted and their information is protected.

"We just want people to know that we are doing everything in our power and going over and above to make sure everything is secure," Sugars said.

Lee County Auditor Denise Fraise said she thinks people are still concerned about using touch screen machines during elections.

"I think a lot of people are afraid of our touch screen machines," Fraise said. "It's just a ballot marking device, it has nothing to do with the tabulation of your ballot. It's not hooked up to the Internet or server or anything. It's just plugged into an electrical outlet, so there is nothing to fear there. We would prefer people use that because it's just a blank thing and it's .03 cents compared to a printed ballot."

Sugars said when you use the machine it prints out the ballot with a bar code and it shows what your vote was, and it costs the county 25 cents less when people use the touch screen machines.

The ballot goes into the tabulators and it reads the barcode where the vote information is stored. It also prints out your selections so you can make sure that it prints what you selected.

The only time the ballots are on the Internet is when the county forwards the information to the state, but Sugars said there are safeguards in place there, too.

"We have the original information here and we have to verify what we sent with the state, so nothing can be changed."

She said the county will do a pretest and a public demonstration on the machines prior to using them.

Also, for the first time ever, the Secretary of State's office will be doing randomly selected audits of precincts in each county. Sugars said the absentee board will conduct the audit and that will involve counting ballots in the randomly chosen precinct.

"That will be done before the canvas, so if we find anything off, Denise could call for an administrative recount. She said the state will ask for a hand recount of the ballots to see how the results match the machine," Sugars said.

Through 2018 voters will still be able to vote without an ID but they have to sign an oath of identity. In 2019 voters will only be allowed to vote with a state issued ID card. In lieu of that, they would have to cast a provisional ballot and then show ID within a predetermined number of days following the election for the ballot to count.

Sugars said she doesn't foresee any security issues going into the election.

"We've gone over and above what we're being asked to do because security is very important to us."