Election Systems as ‘Critical Infrastructure’: What Comes Next?
President-elect Donald Trump Shutterstock
The U.S. Department of Homeland Security’s designation creates some questions for state and local elections administrators.
WASHINGTON — Homeland Security Secretary Jeh Johnson released a statement late last week designating “election infrastructure” as critical infrastructure. In the Department of Homeland Security’s announcement, Johnson explained:
“This designation does not mean a federal takeover, regulation, oversight or intrusion concerning elections in this country. This designation does nothing to change the role state and local governments have in administering and running elections.”
If the past is any guide, this is most likely true. However, the big question of what state and local government officials should expect moving forward—besides promises of greater coordination and resources—was left unclear.
“I’d love to read what it means for elections—we simply don’t know,” said Kay Stimson, the communications director for the National Association of Secretaries of State, whose members serve as the chief state election official in 40 states. “The number one priority at this moment is to get some kind of clear guidance from the Department of Homeland Security on what this means for election administrators.”
The process for working with critical infrastructure has stayed relatively stable since Congress gave the president the ability to deem “physical and virtual” infrastructure as critical via the “Critical Infrastructures Protection Act of 2001.” Looking at how the federal government has dealt with critical infrastructure designations in the past gives us clues on what will likely happen next.
1.) Create Agreed Upon Standards
When an infrastructure sector is designated critical, it sets bureaucratic wheels in motion. The federal “coordinating agencies” responsible for working with that sector—in this case the Department of Homeland Security and General Services Administration—convene study groups made of experts and stakeholders from across all levels of government. Assisted by public comments, the working groups develop voluntary consensus standards.
These voluntary consensus standards are exactly as they sound—an outline of what safety precautions should be implemented. These consensus standards typically take into account risk assessments as well as cost constraints.
2.) Voluntary Consensus Standards Drive Federal Support
Rather than attempting to regulate state and local activities, the federal government has provided free services to share information, assess risk and vulnerabilities, and generally used incentives to encourage states to adopt better security. This is most evident with state and local IT systems, where DHS has provided millions in funding for vulnerability assessments, information sharing and other activities that attempt to help states raise their cybersecurity capabilities.
As far as elections are concerned, DHS, the U.S. Election Assistance Commission, and the National Institute of Standards and Technology already work together on voluntary guidance and best practices around cybersecurity and elections. The likely result? The existing work will be updated and made more formal. From there, the department will provide support that will help state and local election officials better align themselves with these security standards.
3.) The Designation Drives Others to Change Behavior
To date, the standards that have been developed regarding critical infrastructure protection have not been utilized by federal regulators except in sectors that were already highly regulated, such as the chemical and energy sectors. This does not mean they have not driven substantial change, though.
In some states, expect the legislature, governor, or even election executives to potentially impose these standards on themselves. This may result in state-imposed mandates to the local entities that do the yeoman’s work in U.S. elections.
Beyond the public sector, expect the private sector partners who help state and local governments run elections to scramble to comply with the standards once they are released. For a contractor, compliance with any standards agreed upon may initially be a competitive advantage, but in the long-term will likely become a requirement of doing business.
4.) The “What If” Scenario
The wildcard in all of this will be the changing of the guard at the White House and leadership at the Department of Homeland Security. No one knows how the incoming administration and Congress will react to a designation made on the administration’s way out the door. Although it may not be politically feasible, they could even repeal the designation on Day One.
Mitch Herckis is Senior Program Director for Government Executive’s Route Fifty and is based in Washington, D.C.
NEXT STORY: Giving Cities Room to Experiment and Innovate