February 07, 2018

Sen. Harris Questions Homeland Security Officials on Election Cybersecurity

HD Video of Harris Questioning DHS Officials

WASHINGTON, D.C. – Today, U.S. Senator Kamala D. Harris, a member of the Homeland Security and Governmental Affairs Committee, questioned Deputy Secretary of Homeland Security Elaine Duke and Acting Homeland Security Undersecretary for National Protection and Programs Directorate Christopher Krebs.

Harris pressed the officials on what steps are being taken to secure election infrastructure in advance of the 2018 elections, and the precise timeline for the completion of those steps.

“As you know the midterm elections are coming, they’re around the corner. In fact, in Texas, I believe that voters will go to the polls on March 6th,” Harris said. “And while DHS has provided a ‘risk and vulnerability’ assessment to some states, other states remain on a long waiting list, I’m told. The waiting list being as long as nine months.”

In December 2017, Harris along with co-sponsors Senators James Lankford (R-OK), Amy Klobuchar (D-MN), Susan Collins (R-ME), Martin Heinrich (D-NM), and Lindsey Graham (R-SC), introduced the Secure Elections Act, a bill to modernize election cybersecurity and protect against foreign interference in future elections.

A full transcript of Harris’ questioning is below:

 HARRIS: Thank you and I couldn’t agree more, Senator Lankford, and I thank you for your leadership on those points. Secretary Duke, I have to tell you I was bit troubled by the exchange you had with Senator Portman when he asked if you were familiar with the request that he, as a member of the United States Senate, has made to your department and you were not personally aware. I would imagine that before you come to testify before the United States Senate, you would’ve done an inventory to find out if there were any requests that have come in, what is the status of those, and have they been answered. On the issue of election cyber security, as you know the midterm elections are coming, they’re around the corner. In fact in Texas, I believe that voters will go to the polls on March 6th. And while DHS has provided a risk and vulnerability assessment to some states, other states remain on a long waiting list, I’m told. The waiting list being as long as nine months. And I would like to know what is your timeline for getting these done?

DUKE: Okay, Chris will talk about the specific timeline, but we have made measures in terms of both prioritizing and making the list short.

HARRIS: Can you give me a date, by which it will be done?

KREBS: So first off, starting with the nine month waitlist, that’s actually probably about six months old and in fact, what we’ve done is we’ve reprioritized. That’s the benefit of the critical infrastructure designation is I can take election infrastructure and put it at the top of the list so we’ve done that.

HARRIS: Great. When will they get done?

KREBS: So we’ve conducted five. We have another 10 or 11 in the hopper ready for schedule through probably about the beginning of April. The dependency here is whether we get requested for risk and vulnerability assessments. There are states, South Carolina for example, that has the capacity to conduct their own technical assessment of the security of their networks. So while some states have their own abilities we’re focusing and doing a lot of awareness on those states that need additional help. So that’s what we’re focusing on right now.

HARRIS: How many states have requested that it be done?

KREBS: At this point, as I mentioned up to – so five have been done, and another 11 are in the queue. So everyone has -

HARRIS: So my question is, how many states have requested?

KREBS: 16.

HARRIS: 16.

KREBS: Yes, ma’am.

HARRIS: And when will all 16 be completed?

KREBS: My understanding of the scheduling is probably about mid-April.

HARRIS: Do you have a date certain?

KREBS: I don’t have an April 15th or anything like that, but April is the timeline for completing the requested. And my hope is that we have more come in over the course of the next several weeks in fact, but we will prioritize - 

HARRIS: Where is Texas on that list, since their primaries are March 6th?

KREBS: Unfortunately, I would have to get back to you on that. I don’t have that at my -

HARRIS: Okay, I would want to know that you’re aware of the 16 states at least and what their dates are for their primary and that it would be your goal to have their assessment complete before their primaries actually occur, and before those voters go to the polls. And I’m concerned that you don’t know the timeline given that we have unanimous consensus among our intelligence community that Russia interfered in the election of the President of the United States. It would seem to me that this would be a high priority for the Department of Homeland Security and you would be clear about the timelines. I have other questions. Part of my understanding is that the delay in processing these requests are that you do not have skilled workers to complete the scans. Is that correct? Or is that not the problem? I’m trying to understand what the problem is with the delay.

KREBS: Ma’am, the delay is that the risk and vulnerability assessment capability is also servicing other critical infrastructure sectors, and in fact, also federal high value asset assessment. So what we’ve done is put at the top of the pile the state and local election officials right now. So we have deprioritized others and put those at the top. With more, I can do more. So we are looking at the ways to increase training, to bring additional personnel on, and also there’s an equipment requirement that we’re procuring additional equipment.

HARRIS: So if we can be a little bit more precise, do you have the necessary personnel and funding, and other forms of resources, to provide the states with their request and get this completed in a timely manner?

KREBS: For those that have requested right now, we have the capabilities to conduct as I mentioned on the existing timeline.

HARRIS: Great. How many state election officials have applied for security clearances?

KREBS: At this point, we have approximately, I believe it’s 37 have submitted their paperwork. We have one final secret issued. We have about 17, I believe, interim secret. This changes on a daily basis. But we have, again, the opportunity to do daily, one day read-ins on any issue that might come up. And in fact, we’re going to do a number of briefings over the course of the next couple of weeks for state election officials.

HARRIS: So those daily, one day-

KREBS: One day read-ins.

HARRIS: -read-ins mean that if you wanted to have some consistent information about what is happening you’d have to call in everyday, to get a one day read-in, is that what you’re saying?

KREBS: It depends on the bulk of the information and the intelligence that we want to share, but I could- It would require me to either be in person with those folks or have local intelligence officials read them in that day.

HARRIS: That seems extremely bureaucratic.

KREBS: Of course. And that is-

HARRIS: You’re nodding in agreement.

KREBS: The reason- yes ma’am, and that is the reason we’re prioritizing it.

HARRIS: The goal then is to get them permanently receiving your security clearance.

KREBS: Yes ma’am. And in fact, not just the senior election official in the state, but also additional staff. So we’re at the point right now of one senior election official per state and two additional staff, with security clearances.

HARRIS: So what percentage of those that should receive security clearances to completion, completing that process, have actually received those clearances?

KREBS: The percentages? I don’t have percentages in front of me, I mentioned I have one-

HARRIS: About what number?

KREBS: I think we’re probably at about, today, probably at about a 30% rate for the 50 senior election officials. And that is including an interim secret level. And an interim secret gets you the same, effectively, the same access as a permanent secret. But we have prioritized again, this process of vetting and issuing the clearances, and will continue to do so in advance of the 2018 election.

HARRIS: So let’s just keep going with Texas as the example. March 6th is their primary. Have they received their security clearance?

KREBS: Ma’am again, I’d have to come back to you on the specifics of Texas.

HARRIS: Okay please respond to this committee, and give us a precise timeline on when they will be completed and we’d like to see on that timeline when each of these states are actually conducting their primaries, to see if you’re going to actually get this done by the time people start voting.

KREBS: Yes ma’am.

HARRIS: Thank you, I have nothing else.

###