statement from commissioner christy mccormick · statement by commissioner christy mccormick...

Statement by Commissioner Christy McCormick

January 7, 2017

Borrowingapenandaphonefromhisoutgoingboss,SecretaryofHomelandSecurityJehJohnson,inaFridaynightdrop,announcedhehasdesignatedelectionsintheUnitedStatesascriticalinfrastructureinaccordancewithPresidentialPolicyDirective(PPD)#21(2013).Thescopeofthedesignationisvastandincludes“atleasttheinformation,capabilities,physicalassets,andtechnologieswhichenabletheregistrationandvalidationofvoters;thecasting,transmission,tabulation,andreportingofvotes;andthecertification,auditing,andverificationofelections.”ThelistprovidedbyDHSincludes,but“isnotlimitedto”:storagefacilities,whichmaybelocatedonpublicorprivatepropertythatmaybeusedtostoreelectionandvotingsysteminfrastructurebeforeElectionDay;pollingplaces(includingearlyvotinglocations),whichmaybephysicallylocatedonpublicorprivateproperty,andmayfacephysicalandcyberthreatstotheirnormaloperationsonElectionDay;centralizedvotetabulationlocations,whichareusedbysomestatesandlocalitiestoprocessabsenteeandElectionDayvotingmaterials;informationtechnologyinfrastructureandsystemsusedtomaintainvoterregistrationdatabases,votingsystemsandassociatedinfrastructure,whicharegenerallyheldinstoragebutarelocatedatpollingplacesduringearlyvotingandonElectionDay;informationtechnologyinfrastructureandsystemsusedtomanageelections,whichmayincludesystemsthatcount,audit,anddisplayelectionresultsonelectionnightonbehalfofstategovernments,aswellasforpostelectionreportingusedtocertifyandvalidateresults.InacalltotheNationalAssociationofSecretariesofStateonThursday,billedbyDHSasacalltoinformtheSecretariesaboutSecretaryJohnson’scurrentthinkingonwhetherornottodesignateelectionsascriticalinfrastructure,theDHSSecretarystated,“Thisdesignationissimplytherightandobviousthingtodo.”SecretaryJohnsonrepeatedthissentenceinhisPressReleaseonFridaynight,clearlyindicatingthathewasreadingoffadraftofthePressReleaseonThursdaywhenhespoketotheStates’Secretariesandthathis“thinking”wasnotactuallyopentofurtherconsiderationordiscussionwiththeStates’Secretaries,whoaretheChiefElectionOfficialsinmostofthefiftyStates.IchallengeSecretaryJohnson’sstatement.Itisnot“simply”rightandcertainlynotobviousforatleastthefollowingreasons,manyofwhichIhighlightedinmypreviousstatementonthisissue,madeonSeptember8,2016.

1.Thescopeandeffectofthisactionisunknown.Therewasnotathoroughdiscussionorreviewofwhatthedesignationmeans.Electionofficials,includingtheCommissioners,werestillaskingforinformationatthetimethedesignationwasannouncedonFridaynight.Seriousquestionsstillremainontheactualbenefitsofthedesignation,andtheroleoftheotherFederalagenciesasoutlinedinPPD#21,suchastheDepartmentofJustice,theCommerceDepartmentandtheGeneralServicesAgency.Theso-calledbenefitsofacriticalinfrastructuredesignationprovidedbyDHSappearnodifferentthanthosethathavealreadybeenprovided.SecretaryJohnsonstatedbothonThursday’scallandinhisPressRelease,“Thisdesignationdoesnotmeanafederaltakeover,regulation,oversightorintrusionconcerningelectionsinthiscountry.Thisdesignationdoesnothingtochangetherolestateandlocalgovernmentshaveinadministeringandrunningelections.”Butthatisfarfrombeingclear.HetoldtheSecretariesthattheirparticipationis“voluntary,”buthehasnowalsomadeclearthatiftheStatesdon’t“volunteer,theywillnotbeabletoreceiveinformationfromDHStosecuretheirownsystems.”Thisbegsthequestion--ifthey“volunteer,”doesthatallowDHStoinvadeALLoftheir“information,capabilities,physicalassets,andtechnologies”inordertogettheinformationthatmaybeknownbyDHSandtheU.S.IntelligenceCommunity(USIC)?IfStatesdo“volunteer,”willtheybeabletodecideonthescopeoftheFederalGovernment’saccess?WilltheybeabletoasktheFederalGovernmenttoleave?WilltheyberequiredtoprovideuniformityorconsistencyinordertoparticipateinDHS’sefforts?WillDHSorotherFederalagenciesrequireStatestoconformtoanewsecuritystandard?IfDHSweretrulyonlyconcernedwiththesecurityoftheseelections,theywouldsimplyprovidetheseresourceswithoutthedeclarationorrequiringstatesto“volunteer”beforeanyinformationorresourceswillbeshared.IamstillunconvincedthatadeclarationofcriticalinfrastructurestatusisnecessaryforDHStohelptheStateswithsecurityefforts,becausewe’vealreadyseenthemdoso.2.Thisactionpoliticizeselections.ThereisareasonthattheFoundingFathersgavetheauthorityofconductingelectionstotheStates.ThereisareasonthatwhenCongresssetuptheU.S.ElectionAssistanceCommission(EAC),theymadeitabipartisan,independentagencyandgaveitnoregulatoryauthority.OurnationselectionsshouldnotbehandledorgovernedbyapartisanbranchoftheFederalGovernment.ThepartythatoccupiestheWhiteHousesingularlycontrolstheDHSandotherFederalagenciesintheExecutiveBranch.Pickwhichpartyyouwantdrivingthesecurityofourelections--areyoucomfortablewiththeotherpartydoingso?It'simportantthatwemaintainthedecentralizednatureofourelectionssothatourvotersandcitizenscanmaintainfaithandconfidencethatourelectionsarerunfreelyandfairly,andthattheycandependontheintegrityandaccuracyoftheoutcomes.3.Thedesignationcreatesalayerofnon-transparencyandunnecessaryFederallycontrolledbureaucracy.Electionsneedtobetransparentatalllevels,andournation’selectionsofficials

pridethemselvesonopeningtheirprocessesateverystep.Theydosobecauseitisnecessaryforthepublictoseewhattheyaredoinginordertotrusttheprocess.ThiscriticalinfrastructuredesignationdepartsfromthattransparencystandardandprovidesfortheestablishmentofnumerouscouncilsandcentersthatwillbeoutoftheviewofthepublicandrunsolelybyFederalbureaucrats.Electionofficialsalreadymeetanddiscusssecurityissuesasnecessary,andthebureaucraticstructuresthatwillbeformedafterthisdesignationwouldbesecret.Closeddiscussionorcontrolofelectionadministrationbyvariouscouncilsandgroupsoutoftheviewofthepublicdoesnotengenderfaithorconfidenceintheelections.Certainly,ifthereisconfidentialinformationthatneedstobesharedwithelectionsofficials,itcanbedoneasitiscurrentlywithouttheadditionalbureaucracy.Bytheway,thesecouncilsandcentersalsocostthetaxpayermoneythatcouldbebetterfocusedelsewhere,includingonfundingmoremodernandsecurevotingsystems.3.Thetechnicalexplanationforthisdesignationisinsufficient.Therecentlydeclassifiedreporton“Russianhacking,”thereleaseofwhichisanextraordinaryeventinandofitself,hasbeendescribedbyintelligenceexpertsasdisappointing,underwhelming,andthin.ThisdeclassifiedreportwasnotabouttheNovemberelections;itwasaboutpolitics.Connectingtheallegationsinthereporttotheelectionadministrationprocessandassertingthatitrosetothelevelofinterferenceinourelectionsisagrossandincorrectcharacterization.JohnMcAfee,acybersecurityexpertandcreatoroftheMcAfeeanti-virusprogramhasstatedthattheintelligencereport,nicknamed“GrizzlySteppe”bytheintelligencecommunity,is“utternonsense.”McAfeebelievesthatthereportisdeceptivepropagandaperpetratedontheAmericanpublic,andIagree.Usingintelligenceagenciesandreportsthatarefullofallegationsandpurporttodemonstrate,withnoactualevidence(andwhichactuallyveerawayfromthe“hacking”narrative),tojustifytheextraordinaryandinvasiveactionofdeclaringtheStates’electioninfrastructureascriticalinfrastructuresubjecttoFederaloversightisoutrageousandwrong.ThedeclassifiedreportallegationthatRussianintelligencehad“obtainedandmaintainedaccesstoelementsofmultipleU.S.stateorlocalelectoralboards”ispatentlyuntrue.TheDHSandotherintelligenceagencieshaveprovidednoevidenceofthistotheEAC,ortotheSecretariesofState.Infact,uponinquiryofthisparticularallegation,DHSofficialstoldusthatitwasamistaketoincludethatstatementinthereportandthattheydonothaveevidencetosupportthestatement.TheDHSefforttojustifythisaction,whichoccurredduringtherunuptothe2016GeneralElection,robbedvaluabletimefromelectionsadministratorswhohadtocontinuallyrespondtotheconcernscausedbytheDHSandotherintelligenceagencieswhoplayedoutthe“hacking”narrativeinthemedia.Anyonewhohasworkedonnationalintelligenceconcerns,asIhave,knowsthatthispubliccampaigntojustifythisactionisunprecedentedandunprofessionalandwascalculatedtocreateundueconcernandworryamongthepublicandwiththeAmericanvoter.WhatISobviousisthatitsmacksofpartisanpolitics.Insteadofacceptingwhatthe

intelligencecommunityisplyingasevidenceof“hacking”oftheelection,thepublicandthemediaoughttobechallengingit.TheonlyactualevidenceofStatemeddlinginstateandlocalelectoralboardsisattemptedmeddlingfromourownDepartmentofHomelandSecurityandtheyhaveyettoexplaintheiractionsadequately.InhisThursdaycalltotheSecretariesofState,SecretaryJohnsonassertedthatthedesignationofcriticalinfrastructureprotectstheelectioninfrastructurebyintrusionbyforeignstatesthroughdeterrence,becauseofaninternationalagreementmadeattheUnitedNationsrequiringnationstokeeptheirhandsoffotherstates’designatedcriticalinfrastructure.Eitherheisdelusionalornaïve.Sincewhenarecybercriminalsdeterredfromtheireffortsbyaninternationalagreementwithnoteethandnoenforcementremedies?SecretaryJohnsonalsostatedthathewasstandingontheOctoberJointStatementonElectionSecurityhemadewithTheOfficeoftheDirectorofNationalIntelligence.ThatStatementincludedthefollowing:

Therecentdisclosuresofallegedhackede-mailsonsiteslikeDCLeaks.comandWikiLeaksandbytheGuccifer2.0onlinepersonaareconsistentwiththemethodsandmotivationsofRussian-directedefforts.ThesetheftsanddisclosuresareintendedtointerferewiththeUSelectionprocess.(Italicsadded.)

BeingconsistentwithandhavingevidencethatdemonstratesitactuallywastheRussianGovernmentaretwodifferentthings.TheStatementwentontosay:

Somestateshavealsorecentlyseenscanningandprobingoftheirelection-relatedsystems,whichinmostcasesoriginatedfromserversoperatedbyaRussiancompany.However,wearenotnowinapositiontoattributethisactivitytotheRussianGovernment.TheUSICandtheDepartmentofHomelandSecurity(DHS)assessthatitwouldbeextremelydifficultforsomeone,includinganation-stateactor,toalteractualballotcountsorelectionresultsbycyber-attackorintrusion.Thisassessmentisbasedonthedecentralizednatureofourelectionsysteminthiscountryandthenumberofprotectionsstateandlocalelectionofficialshaveinplace.StatesensurethatvotingmachinesarenotconnectedtotheInternet,andtherearenumerouschecksandbalancesaswellasextensiveoversightatmultiplelevelsbuiltintoourelectionprocess.

Whathappensonortotheemailsystemsofpoliticalpartiesortheircommittees,purportedinfluencecampaigns,andcelebrationsforonecandidateoranotherhavenoimpactonthesecurityandintegrityofourelectioninfrastructure.Inspiteofthisstatement,DHSandtheUSIChavenotprovidedanyevidenceofthescanningandprobingof“election-relatedsystems”ofANYstateorlocalelectionofficeconnectedtotheRussians.TheyHAVEstatedtousmanytimessincetheOctoberstatementthatthereisNOEVIDENCEvotingsystemsortheresultsoftheelectionwerehackedorchanged.DirectorofNationalIntelligenceJamesClapperrecentlytestifiedontheHillthatthatthepurportedhacks“didnotchangeanyvotetalliesoranyofthat

sort.”Infact,theelectionreflectedthe“choicesoftheelectorate.”OurStateandlocalelectionadministratorsdohavemanylayersofprotectioninplaceandtheydidanexcellentjobsecuringtheirprocessesandsystems.Theywereprepared,asalways,withcontingencyplanstoaddressanysituationofpossibleconcern.TheNovemberelectionwasoneofthesmoothestinmemory.Voterscanandshouldhavefaiththatthe2016GeneralElectionwasrunwiththehigheststandardofintegrityandsecurity,andthattheresultisaccurate.4.ThecriticalinfrastructuredesignationopenstheStatestolegal,financialandprivacyliabilities.IftheDHSinstructsaStatetotakeaparticularcourseofactionandtheStatedeclinestodoso,willtheStatebeopeningitselfuptolawsuitsrequiringittoconformtotheFederalstandard?Wehaveseenthishappenmanytimesintheelectionadministrationcontext,whichmeansthattheStatescouldlosesomedecision-makingauthorityoverelections.IfDHSrecommendsaparticularcourseofaction,whowillpayforit?DHSwillbeholdingactivitiesrelatedtothisdesignation,includingworkinggroups,meetings,exercises,trainingsetc.Electionadministratorsalreadyhaveincrediblybusy,deadline-orientedjobs.WillStateswho“volunteer”berequiredtoparticipateinthoseactivities?Whowillpayfortheexpensesandcosts?WilltheStatesberequiredtomonitorandreporttotheFederalGovernmentontheiractivitiesortheactivitiesofothersthatcouldhaveaneffectonelections?Willtheybeabletomakethedecisiontohandleasituationontheirown,orwillthecriticalinfrastructuredesignationtriggerafloodofadditionalreportingresponsibilities?TherehasbeennodiscussionontherequirementsthatfallonthestatesasaresultofthisdesignationoroftherecentExecutiveOrdersignedbythePresidentlastweek(EO13694,December29,2016)providingfortheSecretaryoftheTreasuryto“sanctionpersonsresponsibleforcyberenabledactivitiesthattamperwith,alterorcauseamisappropriationofinformationwiththepurposeofeffectofinterferingwithorunderminingelectionprocessesorinstitutions.”WhatisthescopeoftheseactionsandwhatdotheymeanpracticallyandlegallytoStateandlocalelectionofficials?Whyhavethesedecisionsbeenmadewithoutconsultingwiththosewhoactuallyconducttheelections?ThedesignationgivestheFederalgovernmentaccesstoinformationandsystemsusedtomanageelections,whichnecessarilyincludestateagencydatabases.IfStates“volunteer,”whichofcoursetheywillhavetodoinordertogetneededcybersecurityinformation,willthatincreasetheFederalGovernment’saccesstothedatabasesofDMVs,publicassistanceagencies,vitalstatisticsbureausandotheragenciescontainingpersonalinformationtowhichitmaynotalreadyhaveaccess?WhatisthescopeoftheinformationthatelectionofficialswillhavetosharewiththeFederalGovernment?WealreadyknowhowonerousitisfortheStatestoreplytoourCongressionallymandatedElectionAdministrationandVotingSurvey(EAVS).WhatadditionalinformationwilltheStatesnowneedtoprovidetotheFederalGovernment?WilltheStatesbeopentolawsuitsfromtheFederalGovernmentfornotrespondingtotheirinformationrequestsastheyalreadyarefortheEAVSinformationrequirements?

5.Theprocessleadinguptothisdesignationhasbeendisingenuous,atbest.Thisdesignationblindsidedelectionofficials,whowerenotprovidedanadequateopportunitytoengageinthedecision-makingprocess.WhileDHSclaimedthatitwouldpublishnoticeoftheconsiderationofthedesignationintheFederalRegisterandprovideacommentperiod,itdidnotdoso.Additionally,DHSsetupan“ElectionInfrastructureCybersecurityWorkingGroup,”whichincludedsomeoftheSecretariesofState,toparticipateintheprocess,butiteffectivelyneverutilizedthatgroup.ItisobvioustomethatSecretaryJohnsondiscardedanddismissedtheopinionsandconcernsoftheSecretariesandoftheEACCommissioners,theverypeoplewhoactuallyhavedeepprofessionalexperienceinconductingandadministeringelectionsinthisCountry,beforemakingthisdecision.DHSofficialsrepresentthattheyarespeakingfortheFederalGovernment,butthisFederalagency,thesolemissionofwhichistoassisttheStatesandlocalelectionofficialsintheadministrationofelections,andwhichsetsthenationalguidelinesforvotingsystemsandtestsandcertifiesthosesystems,andisaclearinghouseforthebestpracticesinelectionadministration,speaksforitself,anditdoesnotagreewiththisdesignation.WhilethisstatementisnotonbehalfoftheCommissionormyfellowCommissioners,IcansaythatalloftheEACCommissionershavepubliclystatedtheyarenotinfavorofthisdesignationandhadadvisedSecretaryJohnsonandhissubordinatesthatheshouldnotmoveforwardwithit.Moreover,wehaveoftenbeendismayedandconfusedovereitherthelackoforconflictinginformationthathasbeenprovidedtous.TherehavebeenoccasionswhenwehavespokentoorbeenbriefedbyDHSofficialsandsometimesevenlessthananhourlaterseendifferentoradditionalinformationprovidedbyorleakedtothemediabyDHSofficials.NumeroustimesafterourdiscussionswithDHSand/orothermembersoftheUSICwehavebeenleftshakingourheadsandunabletoreconcilethepiecesofinformationthattheyhavegiventous.Onemustquestiontheendgameofthiseffort,especiallywhenthetoutedbenefitsofthisdesignationhavealreadybeenofferedandprovidedtoelectionsofficialsthroughoutthepastfourmonths.OurstatesandterritorieshaveConstitutionalauthoritytoconductelections,NOTtheFederalGovernment.Electionsofficialshavebeenawareofandhavebeendealingwithcybersecurityandphysicalsecurityofelectioninfrastructureformany,manyyearsanddoanexcellentjobofit.Thisdesignationappearstobepurelypolitical,especiallygiventhatitwasmadewithtwoweeksbeforethechangeinadministrations.Electionsofficialsaskedformoretime,conversation,anddiscussionandathoroughunderstandingofthescopeandbenefitsofthecriticalinfrastructuredesignation.ThatrequestwasflatoutdeniedbytheunilateralactionofSecretaryJohnson.IaskthatPresident-electTrumpandhisdesignatedDHSSecretaryGeneralKellyimmediatelyreversethisunjustifiedandunsupportedcriticalinfrastructuredesignation,aswellasExecutiveOrder13694,reviewtheactionsofDHS,provideanon-intrusivewayforourintelligencecommunitytoprovideinformationandresourcestoourelectionadministrators,andleavetheconductofelectionstotheStatesasmandatedinourConstitution.Thankyou.