States question DHS’s last-minute election infrastructure designation

The state officials who actually run U.S. elections have written to the Department of Homeland Security to question the recent designation of elections systems as “critical infrastructure,” saying they don’t know what the move means and fretting it will interfere with efforts to secure voting machinery, both online and in the physical world.

State officials told CyberScoop they felt blindsided by the decision, and some plan to ask the incoming administration of President-elect Donald Trump to repeal the move — which places large swaths of the physical and digital property of countless state and county government offices on a special list of 16 “sectors” of vital U.S. national industry, ranging from banking and telephones to water and sewage systems.

“The members of [the National Association of Secretaries of State] have many questions,” wrote the group’s president, Connecticut Secretary of State Denise Merrill, in an email to DHS Secretary Jeh Johnson this week. “Until we have a comprehensive outline of what a critical infrastructure designation practically means for election infrastructure, the lack of information will surely complicate the ability of states to work with your federal agency and others to pave a clear pathway forward.”

“We will seek repeal of [the designation] from the incoming Trump administration,”David Dove, chief of staff to Georgia Secretary of State Brian Kemp, told CyberScoop last week.

The designation was announced Friday Jan. 6, the day after a conference call in which Johnson told state officials he was leaning towards the designation, but gave no hint that that an announcement would come the following day.

State officials on the call “were absolutely gobsmacked and … blindsided,” said Kay Stimson, the National Association of Secretaries of State’s director of communications, “There was no indication [on the call] that the decision was imminent.”

“Frankly, we don’t understand why they did this,” Merrill told CyberScoop, noting that officials have repeatedly stressed that the designation provides no additional funding and gives no new authority over election systems to the DHS. Her email to Johnson asks for a written explanation of what the decision actually means.

“As you know,” she wrote, “We have asked for a written description of DHS plans for a critical infrastructure designation for elections for many months. The designation defines a major new role for the federal government in elections. We would like to have a practical understanding of how it will — or will not — affect state and local election administrators and their work in securing and protecting election systems.”

For instance, she goes on, it’s not clear what the role of the General Services Administration will be. GSA is the federal agency that oversees the government facilities sector of critical infrastructure. The new designation technically made election systems — including polling places and administrative offices — a subsector of government facilities, alongside the two current subsectors: national monuments and icons and education facilities.

Each of the 16 sectors of critical infrastructure have a single “sector specific agency,” or SSA, that oversees them. For the banking and financial services sector, for example, the Department of the Treasury is the SSA, and in general it’s an agency or department with a long history with the sector in question.

But, as Merrill’s email states, “we do not understand what relationship GSA has with election infrastructure, or how GSA is planning to work with election officials. We also don’t understand how GSA will incorporate the sharing of cyber services from the Department of Homeland Security.”

A DHS official declined to directly address the GSA issue, but told CyberScoop by email that “the designation formalizes or institutionalizes the availability of services and assistance DHS offers to states, including cyber hygiene scans, risk and vulnerability scans, and onsite assistance in remedying an incident. These services remain voluntary.”

When Georgia and other states ask the incoming Trump administration to repeal the move, they will find an uncertain legal process but a receptive audience, said Republican former senior DHS official James Norton.

Although there’s no process for revoking the designation, “the Homeland Security Act of 2002 gives the president and the secretary of Homeland Security the authority to designate critical infrastructure … [and that] presumably includes the power to change or rescind previous designations,” he told CyberScoop.

“The outgoing administration [made the designation and then] dropped the mic,” Norton said, “It’s yet another unclear, unfunded mandate from DHS that state and local governments have to figure out how to deal with,” he added, noting the next elections were less than 18 months away.