State details plans for $13M in election security upgrades

They'll use several million more in mostly federal dollars to fund additional auditing and cybersecurity measures as the state works to harden election systems in the wake of nationwide Russian interference in 2016.

State Board of Elections and Ethics Enforcement spokesman Patrick Gannon said the agency has no indication of any "successful infiltration" into North Carolina election systems during the last election. But state officials are taking seriously mounting evidence from the U.S. intelligence community and federal investigators of widespread disinformation campaigns and repeated attacks on critical election infrastructure across the country.

That increased scrutiny, says elections board general counsel Josh Lawson, means preparations for the 2018 midterms look a lot different than they did two years ago.

"Elections for decades were provincial, and now they're international events," Lawson said. "That is a reckoning that is probably long in coming. But it's certainly here, and the adjustment is a substantial one."

The federal Election Assistance Commission announced in March that North Carolina would receive $10.4 million, which would require a $519,000 match from state lawmakers.

State election officials will combine spending outlined in the July 16 memo with another $2.1 million of HAVA grants left over from earlier elections.

Ahead of the 2020 election, most of that funding will go toward the modernization of the Statewide Elections Information Management System, or SEIMS, which was built in-house 10 years ago and controls everything from voter registration to the display of results on election night.

All 100 counties use SEIMS to run their elections. That's why upgrading the system is so critical, said Kim Westbrook Strach, executive director of the elections board.

"It needed to be done whether there was money or not. We were already working on it prior to ever getting this funding," Strach said. "It was just going to be difficult to do it without the General Assembly eventually having to appropriate funding for us to finish it."

The state will use more than $1 million of the HAVA funding to enhance its existing post-election auditing program, hiring two business analysts to help identify potential discrepancies in results.

Another $3.6 million will fund a chief information security officer position, invest in county election worker training and make specific recommended security fixes and support a "Cyber Advisory Panel" of national experts to provide additional guidance on security threats.

Many of these changes, like the upgrades to SEIMS, won't be in place for the 2018 midterms. But Strach said her staff has learned from 2016, and they've been working closely with the Department of Homeland Security since the last election to test for potential vulnerabilities and plan responses to possible intrusions.

"We not only have to get it right, we have to make sure the public trusts we got it right," Strach said.

Those efforts, however, come amid mixed messages from the White House.

Strach's memo detailing plans for HAVA funding came the same day that President Donald Trump met with Russian President Vladimir Putin in Helsinki, Finland, where he cast doubt on the long-held assessment by his own intelligence agencies and allegations in indictments from the U.S. Department of Justice that Russia actively worked to interfere in the 2016 election.

Like other election officials across the country, Strach and Lawson received security clearances to review evidence of Russian interference in 2016. In an interview last week with WRAL News, Strach was asked if she believed the U.S. intelligence community's conclusion about the source of the attacks.

"One hundred percent," she responded.

And those attacks, Strach said, are ongoing.

"The threat is real," she said. "We are addressing it."

Regardless of the source, Lawson said their work to secure the state's elections won't be wasted.

"To those who don't think the threat is real, we lose nothing by preparing," Lawson said. "So, every incentive should be aligned to support our efforts to harden election systems and to ensure only eligible voters are voting, period."