Few Ohio county boards of elections have adopted digital alarm used to detect hacks – Chillicothe Gazette

By Rick Rouan, The Columbus Dispatch Published 11:45 a.m. ET Dec. 14, 2019 | Updated 11:47 a.m. ET Dec. 14, 2019

The vast majority of Ohios county boards of elections havent installed the digital burglar alarm Secretary of State Frank LaRose says helped his office detect a hack attempt of his offices website on Election Day.

With less than two months to go before the deadline LaRose imposed to install the so-called Albert systems, just 13 out of Ohios 88 county boards of elections have operational alarms. The remaining 75 have until Jan. 31.

Ross County Board of Elections Director Sarah Williamson said they have already completed some parts of the directive, and have contracted with BSSI out of Lancaster to complete the rest by the January Deadline.

The most important consequence is not being prepared, LaRose said Friday after the start of a daylong security conference for county elections officials in Columbus. This is too important to take lightly.

Even with the threat of digital attacks, LaRose said Ohio elections are secure. None of Ohios elections equipment used to cast or tally ballots is connected to the Internet. Doing so would violate Ohio law.

In June, LaRose issued a security directive to county boards instructing them to install the alarms, conduct assessments and training on physical and cybersecurity and change email systems, among other security measures.

So far, 52 counties have completed half of the security directives instructions, and all of them have requested security support from the U.S. Department of Homeland Security.

LaRose said he is optimistic about the prospects of the boards meeting the Jan. 31 deadline now that they are past the November election. That drew nervous laughter from the assembled elections officials.

The Election Day 2019 hack attempt came from the Russian company OKPay Investment Company but was traced to Panama, according to the secretary of states office.

LaRose has called the attack on his offices website unsophisticated, but on Friday he said that it was different from the typical carpet bomb hacks that search for security holes. Instead, it specifically targeted the voter registration form on his website and the voter lookup tool that is used frequently on Election Day to find polling places and determine what is on the ballot.

The goal of those sorts of attacks is to undermine the credibility of elections in the minds of voters and make the average voter wonder if its worth it to go to the polls, he said.

We know that the threat is very real, LaRose said. We know that the threat comes from a variety of sources that these sources include state actors, that these sources include people with motivations such as financial reward or notoriety or fame.

The state hopes to combat some of what LaRose called dedicated and well-resourced opponents with the launch of a cyber reserve under the Ohio National Guard created with the passage of an election security bill earlier this year.

The cyber reserve will operate similarly to the military reservists in the National Guard, with regular training and mobilization initiated by Gov. Mike DeWine. The state is recruiting cyber professionals around the state to be part of the first cyber reserve teams, which should be up and running by the end of January, said Major General John Harris, adjutant general of the Ohio National Guard.

The goal of the reservists will be to mitigate consequences of a cyber-attack and to return systems that have been attacked to working order, Harris said. They will be available for hacks of any government entity, not just elections boards.

In a room full of elections officials in jackets, ties, and dresses, Harris said he made the conscious decision to dawn military fatigues, as he always does when discussing cybersecurity, to make a point about the digital war that is being waged.

Policy around the digital fight is lagging, he said. He compared the current way the government addresses cybersecurity to a military group under attack that just keeps building thicker walls rather than mounting an offensive.

"We dont think about the digital battlefield and the importance of the digital battlefield. We are engaged today in a pretty significant digital fight, Harris said. "It is truly a persistent fight and one we're engaged in every single day."

Gazette reporter Justin Reutter contributed to this report.

Read or Share this story: https://www.chillicothegazette.com/story/news/2019/12/14/few-ohio-county-boards-elections-have-adopted-digital-alarm-used-detect-hacks/2630396001/

View original post here:
Few Ohio county boards of elections have adopted digital alarm used to detect hacks - Chillicothe Gazette