[Image via kochies]

The Wisconsin Election Commission voted unanimously yesterday to publicly scold localities who do not use state-provided funds to perform overdue computer security upgrades before the April primary. The Journal-Sentinel has more:

Warning of the risk of hacking, Wisconsin election officials voted Thursday to publicly scold six communities if they do not quickly upgrade outdated computer systems.

The state Elections Commission last year made more than $1 million available to clerks to update their computers, but not all of them took advantage of the funds. The commission has identified 10 computers in six communities that aren’t up to date, making them more susceptible to cyberattacks.

The commissioners have declined to name those communities, but with their 5-0 vote Thursday that could change. 

The commissioners said they would tell the communities to upgrade their systems or be publicly outed. The commission will make federal funds available to them to help pay for the upgrades, which are expected to cost a few thousand dollars. 

Localities who haven’t upgraded are already restricted for security purposes from accessing the state’s election system, but the Commission fears that the outdated computers could be a risk in other ways:

The six communities haven’t been able to access the state’s WisVote elections system because the commission last month barred noncompliant devices from being able to log into it. But election officials found clerks in some cases are using outdated computers for other work.

“It’s our job to make sure they’re using secure computers,” said Dean Knudson, the chairman of the commission…

The commissioners said there may be other out-of-date computers local officials are using that the commission is unaware of. In some cases, local officials do not recognize the scope of the risks they face with outmoded computers, staff to the commission said. 

Wisconsin is uniquely vulnerable to local security practices, given the state’s widely decentralized election system and lack of direct authority over municipal clerks:

Unlike other states, Wisconsin runs its elections at the municipal level. That creates challenges for the state commission, which doesn’t have direct authority over Wisconsin’s nearly 2,000 clerks. The computer equipment the clerks use varies widely from jurisdiction to jurisdiction. 

With no ability to force local officials to upgrade their systems, the commissioners are seeking ways to put pressure on them to take action. Making their vulnerabilities public is one way to do that… 

“I think we need to let them know we’re going to go public soon,” said Commissioner Mark Thomsen, who led the effort to compel local governments to act. “Voters have a right to know who’s not doing it.”

Commissioners aren’t worried about the prospect of publicizing vulnerabilities, reasoning that such issues aren’t a secret to anyone who might exploit them. They’re giving communities a rapidly-approaching deadline to make the upgrades – and reminding them that state money is available to cover all or part of the cost:

[Thomsen] said too often government officials want to keep quiet about their vulnerabilities. He contended bad actors are likely already aware of weaknesses and remaining mum about them only prevents governments from acting. 

“We’re not helping the Russians by identifying them,” he said of communities that haven’t upgraded their computers. 

The commissioners want the new computers installed before April 7, when the state holds its presidential primary and elections for state Supreme Court, Milwaukee mayor, Milwaukee County executive and other local offices. 

The commission last year offered clerks more than $1,200 each to upgrade their computer systems. The commission made $1.1 million in federal funds available, and 862 communities applied for $823,000 of it.

This “name and shame” strategy is somewhat unusual, given that state and local election officials try to respect and maintain the balance of their oft-tricky relationship – but it’s clear that the Commission believes the risk to the entire state is too great. I’ll be curious to see if the remaining localities perform the upgrades – and how the state handles the “shaming” if they don’t. Check for those updates and stay tuned …

Posted in Uncategorized and tagged