What Ohio Election Officials Have Learned About Cybersecurity This Year

In the months leading up to the midterms, Ohio election officials tried to make their computer systems harder to hack.

They role-played how to handle cyberattacks and received help from the U.S. Department of Homeland Security.

They say last week’s vote went off without major cybersecurity problems. Now they have to prepare for an even bigger election—the 2020 presidential race.

Getting Up To Speed On Cybersecurity

Before the election, the state required local boards to kick the tires on their computer systems, so to speak. It was part of a new focus on cybersecurity in the wake of email hacking in 2016.

Boards say that focus paid off. The Scioto County Board of Elections in southern Ohio bought a better firewall system, director Julia Gearheart said.

“As soon as we installed it, and up and running, they found that we were actually getting a hit from Germany,” Gearheart said.

That hit, she said, turned out not to be suspicious.

“And, of course, it was stopped immediately, but there was someone that was trying to peek in on us,” she said.

She said board staff learned other things, too—like why they shouldn’t charge their phones by plugging them into computer USB ports. There’s a risk that malware could travel from a phone to the network.

Boards sought outside opinions from experts like Paul Weingartner, who chairs the computer network and cybersecurity program at Cincinnati State Technical and Community College.

“This was, as my understanding was, kind of the first baseline that the state was going after to see where all the counties kind of stood,” Weingartner said. “And there’s quite a bit of diversity in the six that I saw.”

He said some boards worked more closely with county governments, using stronger firewalls and sharing IT staff. Other boards, he said, had less sophisticated firewalls.

“So still a firewall, yes, that’s good, but not one that can actually detect any inbound threat,” he said. “It just does its basic filtering kind of in a very simplistic way.”

Weingartner said the state could help boards work with counties to strengthen those protections.

The secretary of state’s office this year directed boards to sign up for computer system scans by DHS. The agency reports if a firewall is doing its job. Boards also started receiving alerts from the Center for Internet Security about potential threats to computer systems.

Overall, Lorain County Board of Elections Director Paul Adams said, local election officials have learned a lot this year.

“I see, over the next couple years, leading up to the next presidential election, that boards of elections are just going to continue to hone those skills,” he said. “But there was certainly a learning curve for election administration officials to process all of this information before all the deadlines.”

Halting Misinformation Online

Hacking isn’t the only online threat that election officials have to worry about. There’s also the spread of misinformation on social media.

Franklin County received its share of that on Election Day.

A video posted online that day showed a vote cast for Mike DeWine on a Columbus voting machine. It panned to a paper receipt recording a vote for his opponent, Richard Cordray.

“When we were made aware of that, at probably about the three o’clock hour, kind of went into crisis mode reviewing the video,” Franklin County Board of Elections spokesman Aaron Sellers said, “ultimately, pretty quickly determining that there was a paper jam in that particular machine.”

Meaning the machine did not flip a vote, but instead showed an old receipt. The board put out a statement debunking the posts.

The Ohio Secretary of State’s Office said it flagged the video for social media platforms. Facebook and Instagram took it down, according to a company spokesperson. Twitter did not remove the video, which has been viewed more than 100,000 times on the platform.

Installing New Voting Machines

In the coming months, county boards will be buying new voting machines with state money.

That’s a step forward, according to Candice Hoke, the co-director of the Center for Cybersecurity and Privacy Protection at Cleveland-Marshall College of Law.

“At the same time, it could be a step backwards if the types of voting systems that are purchased are machines that rely on computers more rather than less,” she said.

Boards are considering buying hybrid machines that use touchscreen devices to mark paper ballots, the Dayton Daily News reported in August.

Election boards plan to use their new machines in next year’s elections. It’ll be a trial run for 2020.