Two senators introduced a bipartisan election security bill called the SAVE Act, which aims to improve voting infrastructure and harden state systems against attack.
Two senators introduced a new election security bill with the aim of providing assistance to states in order to protect against cyberattacks on voting infrastructure.
The bipartisan bill -- the Securing America's Voting Equipment (SAVE) Act -- was put forward by Senators Susan Collins (R-Maine) and Martin Heinrich (D-N.M.). The aim of the bill, according to Collins, is to "assist states in protecting the integrity of their voting systems.
"Our bill seeks to facilitate the information sharing of the threats posed to state election systems by foreign adversaries, to provide guidance to states on how to protect their systems against nefarious activity and, for states who choose to do so, to allow them to access some federal grant money to implement best practices to protect their systems," Collins said on the Senate floor.
Collins said that she knew of "no evidence to date that actual vote tabulations were manipulated in any state" during the 2016 U.S. election, but noted that the FBI and Department of Homeland Security (DHS) found 21 states had election systems probed by Russian hackers.
"Our democracy hinges on protecting Americans' ability to fairly choose our own leaders. We must do everything we can to protect the security and integrity of our elections," Sen. Heinrich said in a public statement. "The SAVE Act would ensure states are better equipped to develop solutions and respond to threats posed to election systems. Until we set up stronger protections of our election systems and take the necessary steps to prevent future foreign influence campaigns, our nation's democratic institutions will remain vulnerable."
(R-L): U.S. Sen. James Lankford (R-Okla.) speaks as Sen. Roy Blunt (R-Mo.), Sen. Susan Collins (R-Maine) and Sen. Marco Rubio (R-Fla.) listen during a hearing before the Senate Select Intelligence Committee, Nov. 1, 2017, on Capitol Hill in Washington, D.C.
Requirements of the SAVE Act
According to the announcement, the SAVE Act would require the Director of National Intelligence to designate security clearance to the chief state election official -- usually the secretary of state -- and share all "appropriate classified information with those state officials to protect election systems from security threats."
The SAVE Act would also classify state-run election systems as critical infrastructure and require the DHS to work with states to ensure election security.
Prior to the 2016 U.S. presidential election, the DHS offered to aid states with election security and Jeh Johnson, former secretary of Homeland Security, claimed 18 states had accepted that offer.
The SAVE Act would also call for the creation of the "Cooperative Hack the Election" program, which would essentially be a bug bounty program for electronic voting systems.
The DEFCON team, which has offered to help election officials test voting equipment, did not respond to requests for comment at the time of this post.
Mike Pittenger, vice president of security strategy at Black Duck, said he thought a bug bounty program would help "build more secure voting machines, assuming the bounties are attractive," but wanted more information on the SAVE Act.
If we are talking about vote integrity, the major shortcoming of any electronic voting system is an independent, auditable record.
Mike Pittengervice president of security strategy, Black Duck
"The other point to remember is that security is ephemeral. A secure application can become a ripe target overnight if a new vulnerability is disclosed and not remediated. We saw this with Equifax. How can we ensure that every device is updated?" Pittenger told SearchSecurity. "I do worry about designating this as critical infrastructure, however, if it requires that all states and local governments use electronic voting, even if a variety of choices are available."
At the DEFCON conference in July, Barbara Simons, former president of the Association for Computing Machinery and president of Verified Voting, a nonpartisan and nonprofit organization promoting laws and regulations that support accuracy, transparency and verifiability of elections, said risk limiting audits are an essential part of ensuring election results but are very difficult with electronic voting systems and are much more effective with paper ballots.
While the SAVE Act calls for audits of election systems for states that receive federal grant money, there are no stipulations for auditing actual election results.
"If we are talking about vote integrity, the major shortcoming of any electronic voting system is an independent, auditable record. With paper voting, someone could miscount ballots or 'stuff the ballot box.' It's not perfect, but when an election is over we can match the records of individuals who registered, and rescan and recount the paper ballots," Pittenger said. "With electronic voting, we have an electronic audit trail, but any competent criminal would cover their tracks."
