Russians Want to Hack Your Election? Call Out the National Guard

(Bloomberg) --When floods swept through West Virginia polling places during the 2012 presidential election, the National Guard came to the rescue with tents and electrical connections. For the state’s congressional primaries next month, the Guard will be on the lookout for another disaster: Russian interference.

West Virginia’s top election official, Republican Secretary of State Mac Warner, has embedded a member of the Air National Guard in his office to scour election networks daily. Short on funds and expertise, a number of Warner’s counterparts across the country are also tapping the Guard to bolster their cybersecurity before November’s midterms.

The threat is real: U.S. intelligence chiefs warn that Russians could repeat their attempts to meddle in the 2016 presidential election. The response -- seeking expertise from the Guard -- is unexpected.

Best known for responding to hurricanes and tornadoes with “weekend warriors,” the Guard has been building its cyber-defense expertise, in part with volunteers whose regular jobs involve advanced technology. By next year, it aims to have cyber units in 38 states, with some 3,800 soldiers and airmen. With regard to election security, “there’s room to grow there in the unique space that the National Guard has as a state asset,” General Joseph Lengyel, chief of the Pentagon’s National Guard Bureau, told the House Appropriations Committee this month.

Cyber Chops

To be sure, the cyber chops that the Guard’s largely part-time forces can bring to the task may have some gaps -- and defenses deployed next year won’t help with the midterm elections in November. The Arkansas National Guard, for instance, says the state doesn’t have an operational cyber team yet. The Defense Department has failed to maintain a required “database that identifies the National Guard units’ cyber-related emergency response capabilities,” according to a September 2016 report by the Government Accountability Office.

A 2017 RAND Corp. report estimated that the Army National Guard and Army Reserve have more than 100,000 people with some cyber competence -- though that number represents everything from basic information technology know-how to more specific units trained in cybersecurity.

“The National Guard needs to be ready to respond to a wide variety of disasters that come up,” said Maurice Turner, senior technologist at the Center for Democracy and Technology in Washington. “So getting them on board and developing a response to an election disaster is new territory.”

But the Guard brings one inarguable benefit for states: It’s available quickly. By law, the federal government can deploy the Army and Air National Guard in U.S. missions overseas. Governors can oversee Guard soldiers who help out with large disasters like hurricanes, while the feds pay for it. State-level cyber assistance falls under “state active duty” status: states foot the bills and control the forces.

Department of Homeland Security officials haven’t taken a formal public position on the use of the National Guard, but they have said they welcome any additional cyber help states get to improve their systems.

West Virginia’s Warner, who spent 23 years in the U.S. Army and later worked as a military contractor in Afghanistan, says the Guard airman who’s poring over his election networks brings another key asset to the task: a security clearance.

Some state election officials looking to combat cyber threats have expressed frustration over the pace at which federal authorities grant clearances. After taking office, Warner wanted a faster way to get classified information from federal sources. His office plucked the airman from the Guard in September and covers his salary as the state gears up for its May 8 primary elections. For security reasons, Warner won’t disclose the airman’s name.

Information Warfare

Potential Russian interference in U.S. elections is a “form of information warfare,” Warner says. “You got to think outside the box and fight technology with technology.”

Andrei Krutskikh, Russian President Vladimir Putin’s information security special representative, said Monday that his country can’t give unilateral guarantees that it won’t interfere in U.S. elections in response to ultimatums.

“We won’t make any unilateral statements and give assurances and, even more so, we won’t admit guilt for some incidents in which Russia is allegedly involved,” Krutskikh told Kommersant in an interview.

The National Guard Bureau doesn’t keep a list of how state units are helping with election security. But a quick, rough survey shows some of the efforts underway. In Colorado, Guard soldiers with cybersecurity backgrounds will help monitor networks on Election Day in November, said Trevor Timmons, chief information officer for the secretary of state’s office in Denver. In Rhode Island, the Guard did a vulnerability assessment of the state’s new electronic poll book system that contains voter lists during a special election in January and reviewed the state’s election-management network and voting machines, Secretary of State Nellie Gorbea said.

Learning Curve

Other states, including Ohio and Oregon, say Guard soldiers are helping with election security, but won’t provide details. In Wisconsin, the Guard is providing input for an assessment of election systems under the state’s Homeland Security Council. Washington officials say they’re in talks with Guard officials about how units could support cyber and physical security.

The extra help can benefit states with tight budgets and small information technology staffs. But there’s still an elections learning curve for Guard soldiers to overcome, said Larry Norden, deputy director of the Democracy Program at the Brennan Center for Justice in New York.

“The value of cybersecurity guidance is going to depend on an understanding of the mechanics of elections,” he said. “Merely throwing a bunch of ‘tech’ people at a problem isn’t going to magically secure everything.”

Nonetheless, Guard experts have already demonstrated their value in South Carolina, where state officials are still making improvements to their election systems based on Guard assessments from 2016 on voting and voter-registration systems as well as physical security in each of the state’s 46 counties.

“We consider them part of our security team,” says Chris Whitmire, a spokesman for the South Carolina State Election Commission.

Duncan Buell, a computer science professor at the University of South Carolina, reviewed redacted copies of the Guard’s county-level reports, and he was encouraged to see the Guard soldiers studying such aspects as the counties’ protocols for servers and file transfers.

“Pretty much every county got really strongly negative reports -- virtually every county has high vulnerabilities or critical vulnerabilities across the board” in the 2016 assessments, Buell said. “They weren’t just whitewashing.”