Majority of election security grants going toward cybersecurity, equipment upgrades

About a third of federal funding meant to improve election technology will be spent on cybersecurity-related improvements, while another third will be used to upgrade old equipment, according to plans released Tuesday by states and the U.S. Election Assistance Commission.

In March, Congress appropriated $380 million for states to use for upgrades to election infrastructure, under the Help America Vote Act. It’s the first time the federal distributes HAVA funding since 2010.

“The 380 [million] is something new in terms of additional funding, but it’s in that same realm of ensuring that our voting process remain secure and that vote of confidence remains high,” Tom Hicks, chairman of the EAC, told CyberScoop.

While states have a lot of leeway in how to spend the money, Congress and the EAC emphasized the need for boosting election security, given heightened concern over foreign meddling.

“I would say it’s a magnitudes more on security,” said Mark Abbott, the EAC’s director of grants.

Forty-one states are spending at least some of the funding specifically on cybersecurity upgrades to their election infrastructure. That makes up about 36 percent of the $380 million. Three states — New York, Illinois and Wisconsin — are spending the entirety of their grants on cybersecurity, amounting to more than $13 million.

Several states, like Arizona, Illinois, Nevada and New Mexico are hiring additional IT staff to focus on cybersecurity for the 2018 election, according to Abbott.

“Those are expertise and people that would not be in place but for these grants,” Abbott said.

Other cybersecurity spending covers training, boosting incident preparedness, evaluating risks and improving information sharing, among other things.

Roughly 28 percent of the HAVA funding is going toward replacing old voting and tabulation equipment. Voting machines used throughout the country are often touchscreen systems, which do not produce a verifiable paper trail. Experts warn that these machines are susceptible to hacking because it’s hard to detect vote tallies that have been tampered with.

Alaska, Arkansas, Delaware, Louisiana, North Dakota and Pennsylvania using their entire shares of the HAVA funding to upgrade equipment, but the upgrades are not likely to be complete by the upcoming election. Abbott stressed that that doesn’t preclude them from making security improvements by November.

“They’re not doing this in absence of a strong security posture. Our guidance was if you want to buy equipment with this money, that is an acceptable and good idea. Make sure you’ve got your security stuff handled so they clearly have deployed state and local resources against the emerging threats,” Aboott said. “So I don’t see this as an ‘either-or.’”

An effort in Congress to top up the HAVA funding with an additional $250 million failed due to partisan disagreements. Hicks said that it will be up to Congress whether more funding is warranted in the future, but that states certainly would welcome it.

“I will say that the states that I’ve been to in the last five or six months and even the three and a half years I’ve been here, the states have continually asked for additional resources from the federal government,” Hicks said. “So I think that they’ll continue to ask for that.”

Hicks added that the EAC does continually provide states with election resources, as it serves as a standards clearinghouse. But more monetary assistance, if it ever comes, will be from Congress.