[Image via dhs.gov]

Last Friday, Secretary Jeh Johnson of the U.S. Department of Homeland Security announced that his agency was designating election infrastructure as “critical infrastructure” eligible for DHS assistance with cybersecurity for state and local election systems. From his statement:

I have determined that election infrastructure in this country should be designated as a subsector of the existing Government Facilities critical infrastructure sector. Given the vital role elections play in this country, it is clear that certain systems and assets of election infrastructure meet the definition of critical infrastructure, in fact and in law.

I have reached this determination so that election infrastructure will, on a more formal and enduring basis, be a priority for cybersecurity assistance and protections that the Department of Homeland Security provides to a range of private and public sector entities. By “election infrastructure,” we mean storage facilities, polling places, and centralized vote tabulations locations used to support the election process, and information and communications technology to include voter registration databases, voting machines, and other systems to manage the election process and report and display results on behalf of state and local governments.

The designation, which had been a source of discussion but was still a surprise, raises numerous questions but here are three big ones that define the debate going forward:

What exactly does the designation mean? Right now, the only thing that’s clear is that the designation exists; beyond that, the effect of the announcement is uncertain. Sec. Johnson seems to suggest the designation creates opportunities, rather than obligations, for state and local election officials:

The designation of election infrastructure as critical infrastructure subsector [means]that election infrastructure becomes a priority within the National Infrastructure Protection Plan. It also enables this Department to prioritize our cybersecurity assistance to state and local election officials, but only for those who request it. Further, the designation makes clear both domestically and internationally that election infrastructure enjoys all the benefits and protections of critical infrastructure that the U.S. government has to offer. Finally, a designation makes it easier for the federal government to have full and frank discussions with key stakeholders regarding sensitive vulnerability information. [emphasis added]

EAC Commissioner Christy McCormick, in a statement released on Saturday, is skeptical about the degree of voluntariness involved:

[Sec. Johnson] told the Secretaries [of State] that their participation is “voluntary,” but he has now also made clear that if the States don’t “volunteer, they will not be able to receive information from DHS to secure their own systems. ”This begs the question–if they “volunteer,” does that allow DHS to invade ALL of their “information, capabilities, physical assets, and technologies” in order to get the information that may be known by DHS and the U.S. Intelligence Community (USIC)?

The import and effectiveness of this designation will depend heavily on what exactly it entails – and at this point we simply have to wait and see.

How does this affect the federal/state balance of control over elections? A key issue in the DHS designation was the opposition by some states (most notably, Georgia SoS Brian Kemp) on the grounds that it would tip the balance of control over elections in favor of the federal government – a move many states have long fought. Johnson acknowledges these concerns in his statement:

Prior to reaching this determination, my staff and I consulted many state and local election officials; I am aware that many of them are opposed to this designation. It is important to stress what this designation does and does not mean. This designation does not mean a federal takeover, regulation, oversight or intrusion concerning elections in this country. This designation does nothing to change the role state and local governments have in administering and running elections.

But given the uncertainty over what exactly the designation means, it’s hard to gauge its impact on the federal/state balance – and again, critics like EAC’s McCormick are skeptical:

If States do “volunteer,” will they be able to decide on the scope of the Federal Government’s access? Will they be able to ask the Federal Government to leave? Will they be required to provide uniformity or consistency in order to participate in DHS’s efforts? Will DHS or other Federal agencies require States to conform to a new security standard? If DHS were truly only concerned with the security of these elections, they would simply provide these resources without the declaration or requiring states to “volunteer” before any information or resources will be shared. 

Rest assured this will be a key flashpoint in the weeks ahead.

Will it stick? It’s impossible to assess the meaning of the DHS designation without acknowledging that a new Administration – with, eventually, a new Secretary of DHS – will begin on January 20. While the new President can allow actions like this to stand, there is no obligation to do so – and until it’s clear whether or not the designation will persist states and localities are almost certainly going to sit back and wait for the picture to focus before deciding on the next move. Until then, don’t be surprised if this issue – like so many others – results in partisans taking sides.

Back in my lawyering days, I had a colleague who was fond of saying that “when all is said and done, more will have been said than done.” I suspect that’s what’s going to happen here; the DHS announcement is a big deal for the elections community, but these three questions likely mean that we are in for more debate than action in the near future.

Buckle your your seat belts and stay tuned …

Posted in Uncategorized and tagged