2 days of the most advanced election security training just went down — at a West Virginia Holiday Inn

MORGANTOWN, West Virginia — A Holiday Inn in Morgantown, West Virginia, was the site of some of the nation’s most advanced cybersecurity preparations this week.

That’s where nearly all of the state’s 55 county clerks gathered on Monday and Tuesday for briefings from Department of Homeland Security (DHS) and West Virginia state officials on how to prepare their election systems for a potential attack — and how to deal with the damage if one occurs.

And an attack, West Virginia’s Secretary of State Mac Warner said, is inevitable. The state is still seeing hacking attempts on a “routine basis,” according to Warner, who’s a member of the federal government’s working group tasked with coordinating how DHS works with state and local governments on election security.

“It's an ongoing thing,” he told VICE News.

That’s why Warner’s trying to make his state a nationwide leader in election security preparations. At the Holiday Inn this week, West Virginia became one of the first states in the nation to run a day of election simulations with officials from DHS, to give county clerks real-world training with the types of threats and attacks they may face and how to respond to them. But many of the clerks are also still learning; some were surprised to hear they needed to change their passwords on a regular basis.

“I want to stay on that cutting edge to stay ahead,” Warner said. “This is a race that doesn't have a finish line. We just always have to stay a step ahead of our adversaries, and that's what we're doing here in West Virginia.”

Nearly half the election clerks at the conference represent counties with fewer than 20,000 people. And many of these smaller jurisdictions, in West Virginia and across the country, don’t have the funds or staff to focus on cybersecurity and other updates. That’s part of what inspired Congress to approve $380 million in grant money for states to update their election security systems.

West Virginia received $3.6 million from the new fund. In addition to leftover money from a previous grant and other funds appropriated for elections, the state has about $10 million to help local officials shore up their security. In addition to hosting the cybersecurity conference, West Virginia also opened up its 30 day application period for that money this week — and a heated discussion about how it should be spent.

To start, the state’s voting systems are facing what Warner described as “penetration attacks” — like a criminal eyeing your house to evaluate weak points but not taking anything.

“They get inside our cyber arena, but they may not go and actually start downloading all your information,” Warner said. “They gather passwords, so they know how to download information from the voter registration system, and then right before an election, do that massive download, put it out to the world.”

So far, Warner’s brought on a dedicated National Guard officer to act as a liaison between the state and federal government, to improve communication about potential threats between the two. Warner’s also held multiple briefings for local election officials on security.

Although West Virginia may be ahead of most states when it comes to election security, the training the county clerks received this week during open-press sessions at the Holiday Inn covered largely the cybersecurity basics.

DHS officials briefed clerks on how to spot a phishing attempt, a malicious hacking attempt sent via email; they encouraged the clerks to update their voter registration software and emphasized the importance of changing their passwords frequently. And they offered guidance on how to respond if an attack happens and urged clerks to be upfront and honest if they accidentally fall for a phishing scam. The clerks have to be proactive in sharing information with the public and press if there are issues on Election Day.

The response to attacks, said Department of Homeland Security Senior Advisor on Election Security Matt Masterson, is key — because there’s no way to completely protect our election systems from an attack.

“There's no such thing as perfectly secure, right? And that's why, when we talk about securing the process, we don't talk just about protection — which is critically important — but also about detection and recovery — that’s resilience — and ensuring that the process can continue to run if there is an incident,” Masterson told VICE News.

Masterson emphasized to clerks that each one offers a potential entry-point into the state’s election system for hackers, so each one needs to be vigilant.

“If the goal is to sow discord, to sow distrust in the process, what that means for all of you is that all of you are a target,” he said during his keynote to the group of clerks. “We're only as good as our weakest link. So all of us have a responsibility as a community to work together to improve the resilience of the process.”

Masterson’s words were a wake-up call for some of the clerks in attendance.

“We live in a small world, so I tend to think that no one's going to be interested in little Wetzel County, West Virginia,” said clerk Carol Haught, whose county had just over 16,500 residents at the last census count.

“It’s something that's sort of been eye-opening for me, that maybe I need to be a little bit more concerned about any type of outside influence or someone hacking into our systems,” she added. “It's just something that we haven't really put a lot of emphasis on.”

After the application period closes, county officials will have about 70 days before Election Day to spend the funds they receive. The money can go toward an array of security updates, including new voting machines, software, security consultants, and even new locks and cameras for their offices.

But not everyone agrees how the funds should be spent.

State officials hope the federal grant money they received will go toward replacing the state’s voter machines, which have been in operation since 2006. West Virginia’s not alone in using older machines — a Brennan Center analysis found 43 states used some machines that were at least 10 years old in 2016. But experts have warned the nation’s aging voter machines pose a real election security risk.

Still, West Virginia hasn’t seen any significant issues with the current machines, and many of the clerks said they didn’t feel replacing them was urgent. Instead, they plan to use the funds for cybersecurity, or even more mundane concerns like surveillance cameras and new locks to protect their systems.

Other clerks said their biggest priority coming out of the conference was to implement some of the basics. Vera McCormick, the clerk for Kanawha County, the state’s largest, realized she needed to change her passwords.

“It's a concern that we haven't been changing passwords all along. You know you get that password, and you're familiar with it and you and use it more, especially in voter registration,” she said.

But many states lag far behind West Virginia when it comes to election security preparations. And there are no national standards, since every state runs its own election systems.

Some have done few or no cybersecurity reviews or tests, and a handful of states have voting machines that leave no paper trail. The $380 million in grant money marked a welcome infusion of cash into some of these struggling county governments, but in a few states, like Minnesota and Florida, those funds are tied up in the state legislature by bureaucracy and partisan bickering. It’s unclear when the money will make it down to local officials to spend.

With about 100 days left till Election Day, DHS officials are working with state governments to patch whatever holes they can and offering free cybersecurity evaluations and trainings for local jurisdictions.

But Masterson acknowledged that there’s still some skepticism from local governments when it comes to federal involvement in their elections process. For him, the biggest challenge is ensuring local governments understand “how we can help, and that we're not looking to take over the election process.”

“We don't run elections. They run elections,” he said. ”Our role is to provide information and to provide support, in the form of free services to them.”

Cover image: VICE News