US elections have never been more secure, says CISA chief

Black Hat US Cybersecurity and Infrastructure Security Agency (CISA) director Jen Easterly and her counterparts from the UK and EU want the world to know that, when it comes to securing elections, they've never been more prepared.

Easterly, EU Agency for Cybersecurity (ENISA) COO Hans de Vries and National Cyber Security Centre (NCSC) CEO Felicity Oswald took the stage for Black Hat's opening keynote, and all agreed that their countries (or international blocs, in De Vries' case) have managed to make their voting systems pretty resilient to outside threats. 

"I can say with confidence that election infrastructure has never been more secure," Easterly claimed, and she had a ready explanation as to why: "the election stakeholder community has never been stronger." 

2024 is set to be the biggest election year in the history of the modern world, with citizens in more than 60 countries heading to ballot boxes this year. That equates to more than half the world's population voting, and it makes 2024 a pivotal year for proving that elections in the digital age can be done securely.

Easterly's comments on American election security echoed much of what she said about the subject at Black Hat last year, right down to saying that there weren't any material impacts on US election systems since Russia's interference in 2016. 

China has been the primary threat in the UK, where elections have already taken place this year, Oswald said. Beijing's attempts to undermine UK election infrastructure in early 2024 were ultimately unsuccessful, and also gave the NCSC more ammunition to further fortify its positions. 

"We were laser focused on risks not just from Chinese, but from other state actors and malicious actors as well," Oswald said. "We absolutely saw attempts to engage or disrupt our election, but … it was a very clearly a smooth process, people were able to vote securely on the day, which is a fantastic outcome."

De Vries, likewise, said elections in the EU also went off smoothly. "We did find attacks, even during the voting process," he said. "I think the impact was little because we were prepared."

Of course, just because things have been good so far doesn't mean elections are entirely in the clear.

"We can't be complacent, because the threat environment has never been so complex," Easterly added, citing "Cyber threats, physical threats … foreign adversaries attempting to influence our elections, disinformation [and] malign influence operations" as continuing dangers to election security.

Russia is the predominant threat for much of the influence and disinformation efforts targeting US elections, Easterly said, and she argued Vladimir Putin's administration is getting savvier with those sorts of campaigns, too. 

Moscow, according to the CISA chief, has taken to "using commercial companies like PR firms or marketing firms, or unwitting Americans, to hide their hand as they try and get out influence messaging." 

That said, the world's democracies have had several years to think about election security. Close collaboration between agencies like CISA, the NCSC and ENISA have been key to taking democratic nations from being surprised by Russian meddling to minimizing the impact, the trio agreed.

To keep that momentum, the believe that additional data sharing is essential, constant exercises need to be run to test the physical and cyber resiliency of election systems and clear, auditable paper trails have to be maintained.

Beyond that, it's just hoping local election officials are able to keep control of their systems, which can vary greatly from locality to locality - especially in the United States. 

"Things will go wrong - I can guarantee that," Easterly said. But "while these types of events are disruptive, they will not affect the security or the integrity of the votes passed or as they're counted as cast." 

With governments aware of election threats and allegedly prepared to face them, it all comes down to convincing people not to buy into the propaganda that's being spread by foreign governments. That's a lot harder to do, and Easterly took the opportunity to toss the ball back onto the citizens' side of the court.  

"Foreign adversaries will try to sow discord, and try to undermine American confidence in democracy," Easterly said. "We should be prepared for it, we should expect it and we … should not allow that. It's up to all of us to preserve democracy." ®