The Opportunities and Challenges of Securing the 2024 Election

The 2024 presidential election is just under 50 days away, and federal agencies are reassuring voters’ concerns on election security.

Earlier this year, Iran attempted to hack former President Donald Trump’s campaign and Vice President Kamala Harris’s campaign team has also reported attempted attacks. The federal agencies tasked with protecting elections are working together to battle new threats while balancing the challenge of decreased federal funding. 

The Cybersecurity and Infrastructure Security Agency released the Election Infrastructure Cybersecurity Readiness and Resilience Checklist as a resource for election officials which provides a set of current practices and steps to boost cyber resiliency ahead of Nov. 5.  

CISA’s checklist will serve as a guide when it comes to planning for a possible cyber incident threatening election infrastructure. The list details tech tools that can prevent ransomware and distributed denial of service (DDoS) attacks as well as help election officials recognize which areas need operational resilience and cybersecurity at election facilities. 

Last week, CISA and the FBI released a joint public service announcement related to false claims of a voter registration data leak. Thus far, the agencies have no information indicating the election infrastructure has been attacked.  

“Most U.S. voter information can be purchased or otherwise legitimately acquired through publicly available sources. In recent election cycles, when cyber actors have obtained voter registration information, the acquisition of this data did not impact the voting process or election results,” the agencies said in the release. 

Ransomware Threats

To block ransomware from targeting election networks, CISA officials have recommended implementing and enforcing network segmentation, which is a security measure that stops intruders from generating exploits or moving laterally within an internal network. 

Endpoint Detection and Response (EDR) software can also be utilized to monitor malicious traffic on internal networks, according to CISA leaders. The agency also offers these guidelines for securing election infrastructure: 

• Implement Malicious Domain Blocking and Reporting (MDBR) across your network devices to prevent IT systems from connecting to harmful web domains. 

• Develop and maintain incident response plans that specifically detail how to operate mission-critical processes in the event of a cybersecurity incident. 

• Maintain backups that let you recover data at least 30 days prior.  

• Encrypt backup files and ensure credentials for accessing the backups are not stored in the targeted environment. 

“Election officials around the country are unwavering in their commitment to enhance the cyber and physical security of election infrastructure to meet an evolving threat environment,” said CISA Senior Advisor Cait Conley. “As election officials and their teams enter into final preparations for November, these checklists help highlight some of the most common threat vectors, security practices, and resilience measures for consideration.” 

Helpful and Harmful Tech

Emerging technology can provide election offices with the resources needed to be more efficient. U.S. Election Assistance Committee Chairman Ben Hovland said technology has helped with electronic poll books, which allow poll workers access to real-time information. But as states create more voting centers, the need for electronic poll books has increased. 

“Technology in this space certainly provides a lot of opportunities and efficiencies in an area that’s resource-challenged, that’s promising,” said Hovland. “It wasn’t that long ago that online voter registration wasn’t a thing. It dropped [the cost of] voter registration from 83 cents to three cents. This is a cost savings and cuts down things like [illegible] handwriting.” 

Hovland pointed to the increased amount of online misinformation generated by AI as an evolving issue for officials. India’s 2024 election showed how AI can be used to create deepfakes of candidates and to improve candidates’ reach on social media. Hovland said being mindful of AI can help poll workers and voters mitigate the harmful impacts of the technology. 

“Elections are harder than they’ve ever been to administer. We’re going to continue to see misinformation related to artificial intelligence like the ability to amplify or increase the quality,” said Hovland. 

Iran’s Attack

The FBI and CISA are urging campaigns to strengthen online systems with more secure passwords, avoiding the opening of suspicious emails and using multi-factor authentication. On Aug. 19, the FBI and CISA issued a joint statement with the Office of the Director of National Intelligence addressing Iran’s intent to corrupt the U.S. election process. 

“We will not tolerate foreign efforts to influence or interfere with our elections, including the targeting of American political campaigns,” according to the statement. 

The statement acknowledged Iran’s increased intent to interfere with online platforms, and the need for greater resiliency in U.S. systems. CISA and the FBI said practicing good cyber hygiene, like multi-factor authentication, will drastically improve online safety and security. 

The FBI and CISA on Aug. 15 released a joint public service announcement to address ransomware attacks during the election cycle. FBI Cyber Division Deputy Assistant Director Cynthia Kaiser said the PSA highlights the significant threat that cyber incidents pose to voting operations. 

Ransomware-related Bank Secrecy Act (BSA) filings neared $1.2 billion in 2021, a 188 percent increase compared to $416 million in 2020, according to a 2022 Financial Crimes Enforcement Network (FinCEN) report. Recent ransomware attacks have been on larger corporations resulting in decreased profits and data leaks. CISA and the FBI, among other agencies, are ensuring best practices and standards when it comes to reporting cyber incidents.  

“Combatting ransomware attacks is a top priority for the FBI, especially during elections,” said Kaiser. “While the FBI will continue to leverage its tools and partnerships to combat cyber criminals, the public should be aware that ransomware is extremely unlikely to affect the integrity of voting systems or the electoral process.” 

Decreased Funding

In addition to cybersecurity, election officials are focused on physical security for mail-in paper ballots. According to a memo from the EAC,  30% of the advisory board members reported ineffective communication such as illegible or incorrect ballot envelop information. Over the last two years, 90% reported they experienced significant delivery delays of ballots. 

Funding for election-related efforts has decreased since the 2016 election. Congress appropriated $380 million for Help America Vote Act (HAVA) election security grants to states in FY 2018. In 2020, funding increased to $425 million but has decreased in the past two years. This year, Congress appropriated $55 million for election security. These funds are split between the 50 states, the District of Columbia and territories; states are awarded a minimum of $1 million. 

Hovland said more funding from Congress is needed to ensure enhanced cybersecurity in future elections. 

“Public security funds have been used to replace paperless equipment, to do countless training on tabletop exercises and cybersecurity training, to upgrade and enhance physical security,” said Hovland. “It’s important to tell that story and how it made elections more secure, but also make sure that Congress is aware … additional funding is needed.”