Lisa Tollefson had to get a security clearance from the FBI as part of her work in protecting elections from evil-doers intent on swaying the vote.
“I can’t tell you,” the Rock County clerk said.
It’s just one of the things Tollefson won’t talk about.
“We don’t want them to know what we’re doing,” Tollefson said.
Saying too much could help those with intent to cause trouble find ways to undermine the voting system and public confidence in it, she said.
Tollefson is concerned about foreign actors such as the Russians or hackers who might try to freeze voting systems and demand payment to unfreeze them.
The secrecy is one aspect of changes in how local elections officials handle threats to the voting system since 2016.
Some changes are simple and practical, such as one at Janesville City Hall.
Janesville City Clerk-Treasurer Dave Godek and his deputy clerk are the only ones with keys to the room where voting tabulators are stored. Before the 2016 election, a much larger number of city workers had access to the room.
Tollefson keeps some critical equipment used for elections in her office, which is kept locked and sealed when she’s not there. Even the night cleaning crew can’t get in. She cleans the office herself.
“The biggest change, from my perspective, is we’re really aware of the threats that exist,” Godek said. “Lisa (Tollefson) in particular has done a lot of training on those cyber security threats, and although I think we always have done a good job in Rock County to minimize those, I think we’ve found areas to improve, and we’ve improved those.”
2020 is coming
With the 2020 presidential election approaching and with U.S. officials saying they expect more attempts at fiddling with U.S. elections, local officials say they are preparing for hacking but also disinformation attempts of the kind seen in 2016.
Tollefson has been involved in training at the state level, including the state’s first tabletop exercise, held in Madison, where officials figured out how they would respond to different kinds of threats.
The exercise was so sensitive officials denied news media access, Tollefson said.
Safeguarding the vote has always been important. Tollefson noted the county bought new voting tabulators that have been used since 2015. These are the machines into which voters slide their ballots.
Other states are struggling with older machines that could be more vulnerable to attack or machines that don’t have a paper backup, making it impossible to verify results.
Tollefson randomly picks polling places after each vote for an audit, and the machines’ totals have always squared with the hand count, she said.
State voting records are kept in the WisVote system, and hundreds of county and municipal clerks around the state have access to those records.
Local officials must update the system with address changes, lists of who voted and who is registered—all key to running elections.
Clerks have a username and password to gain access to WisVote, and last year the state added a third access requirement: an electronic key that plugs into a computer, said Marcy Granger, clerk for the town of Milton.
The username, password and key all must match.
“Mine is under lock and key, and I have the key for it at all times,” Granger said.
Godek said the key has a way of knowing that the attempt to access the system is a person at a computer and not some remote computer hacker.
WisVote is a place where a hacker could do much damage.
Russian hackers probed voter information systems in 21 states in the run-up to the 2016 vote and gained access to at least two systems, according to the Belfer Center for Science and International Affairs at Harvard University.
An attempt to gain access to Wisconsin state computer systems through an apparently random attack on a Rock County Job Center computer was unsuccessful, officials have said.
Tollefson said threats are continually evolving, and officials have to be on the lookout.
“You have to keep anticipating what might happen,” she said.
“We look for potential vulnerabilities and try to shore those up,” Godek said. “Lisa has done a nice job of developing that thought process with (municipal) clerks.”
The attitude is to look for ways to make it harder for the bad guys. Godek likens it to locking your car so thieves will skip it in favor of the unlocked car down the street.
The Wisconsin Elections Commission has upped its game in protecting the vote at the state level, as well. Training of local clerks in the state’s decentralized system is a big part of that.
The commission received a $6.9 million federal grant to upgrade security last September. The agency hired six new employees dedicated to security and spent $1 million on “immediate security needs” in advance of the fall election, according to a news release.
But the commission also asked local officials and the public for ideas and developed training for local officials, Tollefson said.
Trainings included table-top exercises around the state, including one in Rock County last summer, Tollefson said.
Some of the training remains secret so bad guys can’t get clues to dodging countermeasures.
Exercises include contingency plans for power outages, floods, bomb threats and other attacks, Granger said.
Tollefson sees the biggest threat as one she can’t control: false information.
A minor example is the postcards sent by an apparently well meaning advocacy group last summer that listed wrong locations for some Janesville polling places.
More subtle attempts include those of the Russian Internet Research Agency, which published Facebook ads in the run-up to the 2016 elections, apparently designed to play with people’s emotions in an attempt to divide the nation.
Tollefson suggested voters have a responsibility in securing the vote, as well.
“It is extremely hard to control social media, which is the biggest influence a foreign actor could have,” Tollefson said. “So look at your sources when you’re getting election stuff.”
While elections officials can’t stop most disinformation, they can counter it. Tollefson makes sure in advance of each election that she has contact information for newspapers and TV and radio stations that cover Rock County so she can counter bad information with corrections.
Tollefson keeps a binder in her office that lays out best practices. It’s called “The State and Local Election Cybersecurity Playbook” produced by the Belfer Center.
The manual encourages local governments to provide “strong leaders who encourage staff to take all aspects of election security seriously. Most technical compromises start with human error—a strong security culture can help prevent that.”
Godek and Granger credit Tollefson with building that kind of culture locally.
Municipal clerks, county clerks and state officials make up a decentralized system, which “makes it hard, though not impossible, for a single cyber operation to compromise multiple jurisdictions,” the handbook says.
“Smaller jurisdictions with fewer resources may be seen as more vulnerable targets by adversaries,” the handbook continues, and insufficient resources is the most frequent concern noted by election officials.
Granger said she feels confident in her training and precautions.
Tollefson said she feels good about election security at the local and state levels. She points to an award the U.S. Election Assistance Commission gave the Wisconsin Election Commission in February for “outstanding innovations in elections for its cybersecurity training program series.”
“I’m pretty confident because we’re trying to stay so far ahead and stay on top of everything,” Tollefson said. “And if something comes up, we have contingency plans.”