Chaves County is in the midst of technology and facility upgrades of about $105,000 to ensure the soundness of election processes and systems.
It is also taking steps to establish an ongoing relationship with the U.S. Department of Homeland Security for the same purpose.
U.S. intelligence agencies and the U.S. Department of Justice have stated that Russian nationals targeted election systems in 21 states during the 2016 U.S. presidential election and stole personal information on about 500,000 voters, according to a February 2019 Office of the Inspector General report. New Mexico was not among those. But many U.S. officials also have indicated that they expect foreign hacking and social media propaganda efforts to increase in the years ahead.
The Chaves County Clerk’s Office and its Bureau of Elections — which handle county elections, the county voting for statewide and national elections, and some municipal and school district elections — have not experienced any infiltrations.
“I can at least vouch for this county. Our systems are pretty secure,” said Alfredo Garcia, Chaves County information technology director.
But Garcia and other county managers also are taking additional steps to safeguard the systems and the information they keep, which includes Social Security numbers.
“We are pretty obsessed with security,” Garcia said. “That is just one of the things that we take seriously. It is a duty of the county to safeguard the information that we are given by the public and we take it seriously.”
Staff underwent a voluntary two-day audit in February with two members of the U.S. Department of Homeland Security. The DHS team assessed computer, internet network and electronic data systems, as well as server and voting facilities and election processes.
“We want to make sure that we are doing our part to make sure elections are safe and efficient in Chaves County,” said Cindy Fuller, chief deputy clerk and until recently, the head of the Bureau of Elections. (The elections position is now filled by Casey Higgins.)
Dave Kunko, Chaves County clerk, added that the audit was free, with the New Mexico Secretary of State Office making counties aware of its availability.
“They made some suggestions to tighten things up a little bit,” said Kunko about the conclusions of the DHS representatives from Florida and Idaho who conducted the audit.
The Homeland Security team recommended that all devices used to access the election server, which is not connected to the internet, be manufactured only by certified providers. It also suggested that the county create a locked room, which will cost about $5,000, for the elections server and that blinds be installed on the windows so that people cannot look into the room during voting periods. Security cameras also will be installed. They also alerted management to the need to ensure that any scanners or machines used during voting do not have USB ports on them that would allow someone to introduce a virus.
The team indicated that the county’s strengths included management’s recognition of its need to make cybersecurity a priority and its willingness to secure and fund data backup services, disaster recovery services, vulnerability management, phishing training and systems to ensure that phones and devices, such as printers, connecting to the county’s servers cannot access or attack county data.
But Garcia said the county has decided to invest an additional $100,000 during the fiscal year that begins in July to beef up the systems even more, what he said is close to Pentagon-level security.
“It is not so much because they (the DHS team) found a lot of vulnerabilities, but because the systems we are going to put into place are going to make the system so much more secure,” said Garcia. “It will be like a factor of 10 times more secure.”
He said the upgraded system will be able to block any unapproved device trying to connect to county servers or networks and will be able to separate county functions into various zones on the servers so that someone with access to one part of the county’s network will not be able to access another part.
That is meant to prevent the type of incident that occurred in 2014 when information on about 70 million Target customers was stolen. That happened because people obtained the computer credential of a heating, ventilation and air-conditioning (HVAC) contractor that had access to Target’s network. With the credential and access, the hacker was able to access, record and transfer credit card and debit card data.
The DHS team will return to Chaves County in August for a post-assessment, but Garcia said he also has decided to establish an ongoing relationship with the department.
Once the IT upgrades are complete in about mid-August, he said, DHS teams will attempt to hack into county servers and data. That is a $15,000 service provided for free, Garcia said.
The county already is having outside groups test periodically throughout the year whether they can access the county election server and whether they can find a way into the network by polling IP (internet protocol) addresses.
Kunko and Garcia said they are unaware of any other counties in the state that have undergone the Homeland Security audit, but that they are encouraging their counterparts to do so.
Alex Curtas, communications director for the New Mexico Secretary of State, said that the state is constantly working with Homeland Security and counties on election security.
For example, an upcoming “tabletop exercise” by DHS involving counties that have chosen to participate will ask participants to respond to a security threat scenario and then provide information on how to improve their prevention methods and their reactions.
The Center for American Progress ranked all 50 states last year on election security, giving New Mexico a “B.” It was one of 11 states to earn the grade, the highest given. The nonpartisan group gave good marks to the state for instituting cybersecurity best practices, using paper ballots to guard against electronic mishaps and requiring pre-voting testing and certification of voting machines. But it also noted some weaknesses, most especially allowing people overseas to vote online.
“We work with counties every day and are constantly monitoring our election processes and systems,” said Curtas. “There is always room for improvement … but in terms of having the best practices in place throughout the state in each county such as paper balloting, like post-election audits that the Secretary of State runs, those we nationally recognized best practices for keeping our systems and our elections as secure as possible.”
Senior Writer Lisa Dunlap can be reached at 575-622-7710, ext. 311, or at firstname.lastname@example.org.