Federal program offers new cybersecurity tool for elections

Full Screen
1 / 2

Copyright 2020 The Associated Press. All rights reserved

Voters walk to a polling station to cast votes for GOP and Democratic primary candidates Tuesday, Aug. 4, 2020, in Chandler, Ariz. (AP Photo/Ross D. Franklin)

ATLANTA – State and local officials are receiving additional tools from the federal government to help defend the nation’s election systems from cyberthreats ahead of the November vote, as intelligence officials continue to warn about foreign efforts to interfere in the U.S. election.

Under a $2.2 million pilot program that began in March, the Department of Homeland Security’s cybersecurity agency in partnership with the Center for Internet Security has been deploying software to election offices. It is then placed on devices, including laptops and servers used for voter registration and reporting vote totals, to detect malicious activity. The program was highlighted during a congressional hearing Tuesday.

“This is the next step, the evolution of helping state and local entities,” said Matt Masterson, a top cybersecurity official within the Department of Homeland Security. “This really advances their ability to protect their networks.”

Thirty state election offices have already integrated the so-called endpoint detection and response tools, which are routinely used in the private sector but less common at the local level. Through the federal program, officials expect to have this deployed in at least nine additional states by November. Fewer than 100 local government agencies have signed up so far.

Endpoint detection is a key component of network defense designed to detect intrusions early. The software identifies known threats as well as suspicious behavior that could indicate an attack.

“The threat actors are creating over a million new strings of malware a day,” said Michael Atkinson with FireEye, a leading cybersecurity firm that provides such software. “If you don’t have the capacity to search in your endpoint infrastructure for the bad guys and have human cybersecurity experts work on that for you, in the end, compromise will likely be inevitable.”

Under the program, CIS analysts would receive alerts of suspicious activity, allowing them to monitor and track suspicious activity across jurisdictions with the goal of early detection and mitigation. Officials said the effort was just the latest in steps taken to shore up cybersecurity since the 2016 presidential election.

“While there are no guarantees in cybersecurity, I can assure you that the security defenses we have in place for November 2020 are vastly improved over those in place a short four years ago,” John M. Gilligan, president and CEO of the Center for Internet Security, told the House Homeland Security Committee.