Report: 7 states’ election systems compromised before 2016 election

An intelligence assessment undertaken at the end of Barack Obama's presidency found that seven states’ election systems were compromised before the 2016 election, NBC News reports.

Update: The Department of Homeland Security has released a statement claiming the findings were preliminary, out of date and later disproven.

• Michael Daniel, Obama’s former cybersecurity coordinator, tells Axios that a classified report on the topic was compiled by the intelligence community and included findings from July 2016 to January 2017. Daniel did not have access to assessments past January 2017.
• The report indicated that systems in Alaska, Arizona, California, Florida, Illinois, Texas, and Wisconsin were compromised, per NBC.
• What it means: While some systems had voter registration databases breached and others had their websites entered into, no votes were changed and no voters were taken off the rolls, state and federal officials tell NBC News. Six of these seven states deny they were breached.

Full DHS statement:

“NBC’s reporting tonight on the 2016 elections is not accurate and is actively undermining efforts of the Department of Homeland Security to work in close partnership with state and local governments to protect the nation’s election systems from foreign actors. As we have consistently said, DHS has shared information with affected states in a timely manner, and we will continue to do so. We have no intelligence – new or old – that corroborates NBC’s reporting that state systems in seven states were compromised by Russian government actors. We believe tonight’s story to be factually inaccurate and misleading. In fact, the formerly classified documents released to Mr. Moss and shown on NBC were working documents based on preliminary information and ongoing investigations, not confirmed and validated intelligence on Russian activities – in any case they do not show what NBC claims they do. The department has been clear and consistent that we are aware of 21 states targeted by Russian government cyber actors leading up to the 2016 election. In nearly all states, only preparatory activity like scanning was observed. We have said it before and will say it again: in no case is there any evidence that votes were changed or that Russian actors gained access to systems involved in vote tallying. Once again, reports using anonymous, outdated, and incomplete information are being misconstrued as fact. We stand by our state and local partners who are working diligently to secure the nation’s election infrastructure in 2018 and beyond.”

What we knew before:

• Illinois has acknowledged it was compromised in the buildup to the 2016 election.
• Arizona was alerted by the FBI of a cyber threat to its voter registration system in 2016, although there’s no evidence the system was compromised.
• Last year when the Department of Homeland told these 7 states and 14 others they were targeted, they did not tell these 7 states that they were compromised, per NBC.

One key point: Texas and Florida are the only states on this list that use a combination election system that does not leave a paper trail of all votes. When there’s no paper trail of votes, it’s nearly impossible to verify that vote totals reflect the way citizens voted.

• Florida Gov. Rick Scott and state election officials have said they want to spend $2 million on election cybersecurity, per the AP.
• Texas has 23 counties that have updated their election systems since 2016 and 8 have updated to systems with paper trails, Texas’ Secretary of State Communications Director Sam Taylor tells Axios. Texas will be host to the first primary of 2018 on March 6 next week.
• Go deeper: The five states without a paper trail of votes

Michael Daniel's insight to the matter:

"During my time at the White House, President Obama directed the Intelligence Community to assess and summarize the available intelligence reporting on Russian efforts to compromise IT systems associated with the U.S. election process. As publicly known, the Intelligence Community issued a report in early 2017. That report concluded, among other things, that Russian intelligence obtained and maintained access to elements of multiple U.S. state or local electoral boards. Moreover, DHS assessed that the types of systems Russian actors targeted or compromised were not involved in vote tallying. Since the issuance of this report, there have been numerous factual developments resulting from the various ongoing investigations related to Russian election interference. The most important consideration is that the threat to electoral systems remains, and we need to continue to improve the security of such systems. A key part of that effort includes building stronger relationships between federal, state, and local governments and the private sector in this area to address these type of issues, and I strongly support that increased cooperation."

This story has been updated with the DHS response to the NBC report and a full statement from Michael Daniel.