The Cybersecurity 202: Nationwide voting by mail will be a massive undertaking say those who’ve done it

A box of ballots mailed in for the Washington state primary election. (Ted S. Warren/AP)

THE KEY

It will take a massive effort of time and resources to increase voting by mail across the nation if the coronavirus pandemic is still jeopardizing in-person voting in November. 

And the $400 million appropriated by Congress is nowhere near enough to make it feasible. 

That’s the warning from election officials in states that vote almost entirely by mail, who say it took years of careful planning for them to make the transition. 

“It’s going to be a herculean effort, but failure is not an option,” Washington state Secretary of State Kim Wyman, whose state is among five that vote that way, told me. By contrast, there are 13 states that don’t currently even offer all their voters the option of casting ballots by mail, according to a tally released yesterday by the Brennan Center for Justice at New York University.

The warnings underscore the unprecedented challenge facing officials who are beginning to contemplate a complete overhaul of their election operations during just seven months and in the midst of a global health crisis. The shift to better secure elections against hacking after Russian interference in 2016, by contrast, took place over more than three years and still produced mixed results. 

“It’s a heavy lift and not all states are going to have the infrastructure and resources,” Wyman said. She described the election security money contained in a $2 trillion coronavirus stimulus bill that’s likely to pass the House today as “helpful seed money” but “not even knocking at the door for what we’re going to need.” 

The Brennan Center has estimated the cost for nationwide voting by mail at around $1.2 billion plus another $800 million for other measures to ensure safe elections during the pandemic. 

The coronavirus has already run roughshod over primaries, forcing states where only a few percent of voters typically cast their ballots by mail to urge far more to do so.

Making a similar shift in the general election would require new machinery to sort and count ballots and updated processes to verify ballots come from legitimate voters. Voting-by-mail equipment, such as industrial-size scanners and secure boxes where voters can drop off their ballots, are also made by just a handful of companies that may not be able to ramp up production fast enough – especially as they’re also strained by quarantines and financial woes brought on by the pandemic. 

Some states may even have to shift from tabulating votes at the county level to doing all their tabulation in one central place, Colorado Election Director Judd Choate told me. And the process will be even harder because officials probably will have to make the transition while also protecting themselves from the virus, he said. 

“It’s absolutely possible, but it might not be pretty,” Choate told me. “And, unfortunately, these aren’t the best conditions to make a big shift like that. You can’t even get all of your team in a room to have a conversation with them.” 

Colorado began pushing for more voting by mail in the 1990s and began allowing voters to sign up to automatically receive ballots by mail for all elections in 2006. By the time the state switched to effectively all-mail voting in 2013, about 70 percent of ballots were already coming in that way. 

Washington state also began ramping up the number of its residents who voted by mail during the 1990s, and about 60 percent of residents were voting that way by 2005. Even still, it took more than five years to shift to the current system where nearly 100 percent of votes are cast outside a polling place. 

Other states where voters cast ballots almost exclusively by mail are Oregon, Utah and Hawaii. 

Choate warned that “it’s going to take a lot more money” than Congress has appropriated for others states to dramatically increase voting by mail. 

That will be a tough sell in Congress, however, where Senate Majority Leader Mitch McConnell (R-Ky.) has historically opposed new money for election security and where lawmakers are likely to be consumed by other efforts to respond to the pandemic and the severe economic downturn that has accompanied it. 

Sens. Amy Klobuchar (D-Minn.) and Ron Wyden (D-Ore.), who sponsored a bill to mandate access to mail-in voting for all Americans, pledged during a news conference yesterday to keep fighting for the changes as well as for more money. But they couldn’t name any Republican senators who planned to support their bill. 

Under the systems in Washington and Colorado, registered voters automatically receive ballots in the mail  they can either return by that way or drop off into specialty boxes. A small percentage also still vote in person at voting centers. The states verify voters’ identities by matching saved copies of their signatures with signatures on the outside of the envelopes containing their ballots. 

Even those systems could be jeopardized by the pandemic, though, and both states are working on contingency plans. 

If the Postal Service has to curtail some services, for example, Colorado could deliver ballots by FedEx or with another delivery service, Choate told me. The final option, he said, would be to deliver ballots over the Internet and have voters return them using a secure, encrypted file exchange system similar to Dropbox. 

Washington is developing plans in case everyone at a county election office is quarantined because one person is infected with the virus. The plans include enlisting a neighboring county to tabulate that county’s votes. 

“There are no easy answers even if all the resources are there,” Wyman said. “But we have a hard stop on Election Day that we all have to meet. There’s not an option to change or postpone it.” 

Correction: This article has been updated to correctly describe a bill that would ensure voting-by-mail access for all Americans. 

PINGED, PATCHED, PWNED

The Huawei logo at the IFA consumer tech fair in Berlin in 2019. (Hannibal Hanschke/Reuters)

PINGED: Top Trump administration officials want to further restrict the supply of computer chips to Chinese-owned Huawei Technologies, sources tell Karen Freifeld, David Shepardson and Alexandra Alper at Reuters. The crackdown comes as the coronavirus pandemic is straining already tense relations between the United States and China. 

The proposed rule change would require foreign companies using U.S. chip-making equipment to receive a license from the U.S. government before selling to the Chinese telecom that U.S. officials have accused of being a spying tool for Beijing. Huawei is already blacklisted from buying most technologies from U.S. companies directly. The move would have the greatest impact on Taiwan Semiconductor Manufacturing Co, which produces chips for Huawei. Huawei, which has denied aiding Chinese spying, did not respond to a request for comment. 

It’s unclear, however, whether Trump will sign off on the rule change, Reuters reports. The president expressed hesitancy about the plan last month. “I want our companies to be allowed to do business,” he said. “I mean, things are put on my desk that have nothing to do with national security, including with chipmakers and various others.” 

House Speaker Nancy Pelosi (D-Calif.). (Erik S. Lesser/EPA-EFE/Shutterstock)

PATCHED: The $2.2 trillion coronavirus stimulus bill making its way through Congress includes at least $12 million to expand teleworking capabilities for government employees who have been forced to work from home during the pandemic, Frank Konkel at Nextgov reports. The money could help agencies as they struggle with the increased cybersecurity risks posed by the telework surge.

Emergency funds released ahead of the bill becoming law also provided agencies with money to reimburse contractors for sick leave during the pandemic, Frank reports. 

Unions representing federal workers praised the legislation. “For those employees who are able to work from home, this bill targets much-needed funding for technology to improve their remote access,” Tony Reardon, president of the National Treasury Employees Union, said in a statement.

Keith Middlebrook is accused of peddling a fake coronavirus cure to his millions of social media followers while fraudulently soliciting investors. (Instagram/Keith Middlebrook)

PWNED: The FBI arrested a Southern California man for soliciting investments for a fake coronavirus vaccine and cure, my colleague Meagan Flynn reported. It’s the first arrest that the Justice Department has made since Attorney General William Barr promised earlier this month to crack down on cyber criminals exploiting coronavirus fears. 

The accused scammer, Keith Lawrence Middlebrook, claimed in social media posts that he’d developed pills to prevent coronavirus infections and a serum that would cure people already infected with the virus. The videos racked up over half a million views on YouTube and 1 million views on Instagram before his arrest. 

Middlebrook also falsely claimed his company delivered massive profits for investors and that basketball legend Magic Johnson was on his board of directors. Middlebrook tried to sell an FBI agent the pills for almost $10,000.

“To those who perpetrate these schemes, know that federal authorities are out in force to protect all Americans, and we will move aggressively against anyone seeking to cheat the public during this critical time,” U.S. Attorney Nick Hanna said in a statement.

PUBLIC KEY

— Cybersecurity news from the public sector:

PRIVATE KEY

— North Korean and Iranian hackers are impersonating reporters to dupe victims, Google’s Threat Analysis Group researchers wrote in an update on the company’s efforts to fight phishing attacks released yesterday

Overall, government-backed phishing and malware attacks dropped nearly 25 percent between 2018 and 2019, the company found. That’s because hackers are becoming more deliberate in their attacks, researchers say. The company sent 40,000 alerts to Google users targeted by hackers in 2019. 

— More cybersecurity news from the private sector:

THE NEW WILD WEST

— Cybersecurity news from abroad:

ZERO DAYBOOK

• The U.S. Election Assistance Commission will host a virtual public hearing on VVSG 2.0 Requirements at 10am today.

CHAT ROOM

Even in these trying times, the fight against disinformation continues. Here’s background for the uninitiated.