Gov. Cuomo voting (photo via the Governor's office)

Governor Andrew Cuomo announced on Tuesday new measures to enhance the security of the state’s elections. They include “comprehensive risk assessments, intrusion detection devices, and managed security services for all county boards of elections,” as well as training for election staff on cyber security.

The initiatives make use of $5 million allocated in the 2019 state budget for enhanced cybersecurity related to elections, which included the creation of an “election support center” and an “election cyber security toolkit,” provides “cyber risk vulnerability assessments” for state and local Boards of Elections, and requires BOEs to report data breaches to the state.

The announcement comes in the wake of the indictment of 12 Russian nationals for interference in the 2016 presidential election, involving the theft and release of emails from the Democratic National Committee and Hillary Clinton campaign chair John Podesta. A news release from the governor’s office said that the state would solicit contracts in the coming days for the risk assessments, intrusion detection devices, and security services for county boards of elections.

The broader issue of election security has become increasingly prominent in the wake of the 2016 election and the allegations of Russian interference. Cuomo’s announcement of new election security measures came just a few hours after a Tuesday panel at City & State’s Protecting NY Summit, moderated by Gotham Gazette’s Ben Max, where panelists discussed the issue as it relates to state and local elections in New York. New York is in the midst of a busy election year that features races for all of its statewide state-level positions, all of its state legislative seats, one U.S. Senate seat, and all of its House of Representative seats, among others.

The panel consisted of State Senators Todd Kaminsky and Liz Krueger; Assemblymember David Buchwald; Michael Ryan, executive director of the New York City Board of Elections; Eric Hodge, of cybersecurity firm CyberScout Solutions; and Eva Guidarini, a member of Facebook’s U.S. Politics and Government Outreach team.

In something of a twist from how New York’s dysfunctional elections are usually discussed, the state’s election security measures in the wake of the 2016 election were highly praised by the panelists. Unlike many states, New York never abandoned paper ballots so as always to leave a “paper trail” in the event of a hack. New York’s voting machines are also not “networked,” but rather are all independent machines. This makes it impossible to hack the entire system or even the machines.

“The election results are stored on the device, on two separate -- they look like flash drives, we call them portable memory devices, PMDs -- one is for unofficial results, the other remains with the machine itself for the official results,” said Ryan. “And, in addition to that, there is paper ballots. So if there was ever a really catastrophic event, we still have the paper to make sure that even though the mischief occurred, the outcome and the integrity of the outcome, which is all we could ultimately preserve, is maintained.”

Still, in the event of a hack, the city and state may still be underprepared. Ryan suggested that the BOE may be due for an increase in staffing to supplement its monitoring services.

Senator Krueger, a Manhattan Democrat, ranking member of the Senate finance committee and a member of the elections committee, said that the focus should be not just on whether the 2016 elections were meddled with, but when and how it would happen again, in 2018 and beyond.

“Rather than talk about the fact that, apparently, they are hacking our elections, and we have to assume we’ll have future elections hacked, I think the lesson from yesterday, I agree, the timing was perfect for this discussion, was if you don’t have any faith that your elected officials are going to follow the law and uphold their duties and responsibilities, we are in serious trouble as a state, a city, or a country,” Krueger said, in reference to the press conference held by President Donald Trump alongside Russian President Vladimir Putin.

Twice during the hour-long discussion, Krueger stressed that New York has never adopted electronic-only voting systems, instead opting to leave the paper trail to ensure votes are counted. She explained that she had been part of the fight to ensure paper ballots were still used as many other states were moving to digital-only, which has come back to haunt them.

Ryan noted that the 2016 election-related hacking led the BOE to conduct, for the first time, election security exercises and simulations meant to quickly and efficiently identify and neutralize threats.

“We did our first tabletop exercises in the lead-up to Election Day,” Ryan said of November 2016. “Tabletop exercises are the way that agencies keep the muscles limber, reenacting real world scenarios in a serious way, and we did a tabletop exercise on the Thursday before a presidential election for almost seven hours. Shows you the seriousness with which everyone took that.”

Asked whether New Yorkers should stop expecting immediate and secure election results, Ryan demurred. Kaminsky said he would love to see Long Island election night results come in more quickly, like New York City is able to do.

Ryan indicated that if there was a vulnerability to hacking it would be in the uploading of results from polling places to the BOE, and that if a bad actor was intent on causing some "chaos" they would possibly be able to do that for a short period of time, but that systems, while expensive, are in place to mitigate any effects fairly quickly. There may be some temporary confusion, he said, but it would be quickly corrected.

“If there is a problem,” Ryan said, “we have backup systems in place. We can leverage police department personnel to shut down the uploading of the results from the poll sites, and shift that to the local police precincts.” Ryan said that BOE sytems are now constantly monitored throughout the year through work with New York City's technology department.

Krueger kept to her admittedly skeptical theme by recounting an anecdote of first-year computer science students successfully breaking into voting machines in Ohio within an hour-and-a-half.

“When everyone who takes the college computer class can do it in the first hour and a half, you should be very, very worried,” she said.

Hodge, whose firm is hired by governments to sure up their cyber security and election systems, said that along with the voting machines and election results, the voter databases and rolls should be protected and secured as well. He also said that policymakers should prioritize being able to detect problems immediately, and that New York carefully vet election vendors to ensure that security is prioritized.

"Thankfully," Assemblymember Buchwald said early in the program, "we've had a fairly proactive approach here in New York, not to toot my subcommittee's own horn, or the entire Assembly election committee, but we've actually had already two public hearings on election security, the most recent of which was this past November after the local elections. And if you were at the hearing, if you watched it online, you would have heard the words 'Cambridge Analytica' four months before they became national news."

Governor Cuomo’s announcement of new measures comes on the heels of a new law aimed at securing the state’s elections passed earlier this year. The law prohibits foreign entities from forming independent expenditure (IE) committees to buy ads on social media, requires ad buyers on social media to register as IE committees and for the name of the IE that bought the ad to be clearly displayed, and requires the State BOE to make political communications more transparent and accessible.