The U.S. Department of Homeland Security notified the Wisconsin Elections Commission on September 22 for the first time that “Russian government cyber actors” unsuccessfully targeted the state’s voter registration system in 2016.
WEC Administrator Michael Haas has informed WEC Chair Mark Thomsen, who directed Commission staff to investigate why election officials were not notified earlier.
“This scanning had no impact on Wisconsin’s systems or the election,” Haas said. “Homeland Security specifically confirmed there was no breach or compromise of our data.”
Wisconsin is one of 21 states whose chief election officials were notified by DHS officials that their systems were targeted by Russians, said Haas. DHS did not disclose which other states were notified, but said the states were free to disclose the information.
According to DHS, it appeared that Internet-facing election infrastructure in Wisconsin was targeted by Russian government cyber actors. They scanned internet-connected election infrastructure likely seeking specific vulnerabilities such as access to voter registration databases, but the attempt to exploit vulnerabilities was unsuccessful.
Haas said the Commission is seeking more specific information, including when the scanning activity occurred in 2016.
The news that 21 states were targeted was first announced by DHS at a U.S. Senate Intelligence Committee hearing on June 21, 2017. Coincidentally, Haas also testified at that hearing and said in response to questions that the Elections Commission had not been notified by DHS and concluded that Wisconsin was not one of the targeted states.
Some states felt it was unacceptable that DHS waited a year to send notifications of Russian targeting, despite repeated requests for information. Homeland Security spokesman Scott McConnell said in a statement the government believes “officials should be kept informed about cybersecurity risks to election infrastructure” but also wants to protect “the integrity of investigations and the confidentiality of system owners.”
U.S. intelligence agencies determined in August that the Kremlin orchestrated an operation that included hacking and online propaganda intended to help Trump win.
Wisconsin was one of a handful of battleground Midwestern states that helped Trump win the presidency over Democratic rival Hillary Clinton. Trump carried the state by 22,748 votes, or about 0.8 of a percentage point.
Meanwhile, Wisconsin is moving ahead with implementing a new election security plan by early 2018. The challenges are particularly acute in the state, Haas said, where elections are not centrally run. Instead the ballots are handled locally by 1,853 municipal clerks. One local security breach where a key password is divulged could cause problems statewide, Haas said.
As a result of the system, the state is considering to mandate that local clerks meet minimum security requirements for hardware and software they use, Haas said.
