National

U.S. voting systems remain vulnerable to cyberattacks three years after documented efforts to penetrate election machines, according to a report released Thursday. The report is based on the findings of the white-hat hacker DEF CON Voting Village, an annual gathering of hackers that uses election machines to find vulnerabilities that could allow someone to interfere with the voting process. This year’s event allowed hackers to test voting equipment, including e-poll books, optical scan paper voting devices and direct recording electronic voting machines — all certified for use in at least one U.S. voting jurisdiction. “Voting Village participants were able to find new ways, or replicate previously published methods, of compromising every one of the devices in the room in ways that could alter stored vote tallies, change ballots displayed to voters, or alter the internal software that controls the machines,” the report said. Despite the “disturbing” findings of the report, the authors wrote that the findings were “not surprising,” particularly in light of the fact that many of the election equipment cyber vulnerabilities found were “reported almost a decade earlier.” Equipment that was tested included those made by leading voting machines companies Election Systems and Software (ES&S) and Dominion Systems.

National: Some Voting Machines Still Have Decade-Old Vulnerabilities | Lily Hay Newman/WIRED

In three short years, the Defcon Voting Village has gone from a radical hacking project to a stalwart that surfaces voting machine security issues. This afternoon, its organizers released findings from this year’s event—including urgent vulnerabilities from a decade ago that still plague voting machines currently in use. Voting Village participants have confirmed the persistence of these flaws in previous years as well, along with a raft of new ones. But that makes their continued presence this year all the more alarming, underscoring how slow progress on replacing or repairing vulnerable machines remains. Participants vetted dozens of voting machines at Defcon this year, including a prototype model built on secure, verified hardware through a Defense Advanced Research Projects Agency program. Today’s report highlights detailed vulnerability findings related to six models of voting machines, most of which are currently in use. That includes the ES&S AutoMARK, used in 28 states in 2018, and Premier/Diebold AccuVote-OS, used in 26 states that same year.

National: Hacking 2020 voting systems is a ‘piece of cake’ | Lisa Vaas/Naked Security

It’s still child’s play to pick apart election systems that will be used in the 2020 US presidential election, as ethical hackers did, once again, over the course of two and a half days at the Voting Village corner of the DefCon 27 security conference in August. The results are sobering. This is the third year they’ve been at it, and security is still abysmal. On Thursday, Voting Village organizers went to Capitol Hill to release their findings, in an event attended by election security funding boosters Sen. Ron Wyden and Rep. Jackie Speier. In a nutshell: in August, hackers easily compromised every single one of the more than 100 machines to which they were given access, many with what they called “trivial attacks” that required “no sophistication or special knowledge on the part of the attacker.” They didn’t get their hands on every flavor of voting system in use in the country, but every one of the machines they compromised is currently certified for use in at least one voting jurisdiction, including direct-recording electronic (DRE) voting machines, electronic poll books, Ballot Marking Devices (BMDs), optical scanners and hybrid systems.

National: With Sanctions on Russians, U.S. Warns Against Foreign Election Meddling | Lara Jakes/The New York Times

The United States issued new economic sanctions on Monday against seven Russians linked to an internet troll factory in what Secretary of State Mike Pompeo called a warning to foreigners who seek to interfere in American elections. The penalties were announced as Congress is investigating whether President Trump tried to enlist Ukraine’s leader in a political smear campaign against one of his top Democratic challengers in 2020, former Vice President Joseph R. Biden Jr. “We have been clear: We will not tolerate foreign interference in our elections,” Mr. Pompeo said in a sharp statement. “The United States will continue to push back against malign actors who seek to subvert our democratic processes,” Mr. Pompeo continued, “and we will not hesitate to impose further costs on Russia for its destabilizing and unacceptable activities.” The Treasury Department said the sanctions sought to punish attempts to influence the 2018 midterm elections, in which Democrats won control of the House. Early last year, the Justice Department indicted 13 Russians and companies linked to the Internet Research Agency on charges of meddling in the 2016 presidential election.

National: Trump told Russian officials in 2017 he wasn’t concerned about Moscow’s interference in U.S. election | Shane Harris, Josh Dawsey and Ellen Nakashima/The Washington Post

President Trump told two senior Russian officials in a 2017 Oval Office meeting that he was unconcerned about Moscow’s interference in the 2016 U.S. presidential election because the United States did the same in other countries, an assertion that prompted alarmed White House officials to limit access to the remarks to an unusually small number of people, according to three former officials with knowledge of the matter. The comments, which have not been previously reported, were part of a now-infamous meeting with Russian Foreign Minister Sergei Lavrov and Russian Ambassador Sergey Kislyak, in which Trump revealed highly classified information that exposed a source of intelligence on the Islamic State. He also said during the meeting that firing FBI Director James B. Comey the previous day had relieved “great pressure” on him. A memorandum summarizing the meeting was limited to a few officials with the highest security clearances in an attempt to keep the president’s comments from being disclosed publicly, according to the former officials, who spoke on the condition of anonymity to discuss sensitive matters. The White House’s classification of records about Trump’s communications with foreign officials is now a central part of the impeachment inquiry launched this week by House Democrats. An intelligence community whistleblower has alleged that the White House placed a record of Trump’s July 25 phone call with Ukraine’s president, in which he offered U.S. assistance investigating his political opponents, into a code-word classified system reserved for the most sensitive intelligence information.

National: Democrats seize on whistleblower report to push for election security | Maggie Miller/The Hill

Democrats renewed their push for election security legislation after a stark warning from acting Director of National Intelligence Joseph Maguire and the release of a whistleblower complaint about President Trump’s call with Ukraine’s leader. Maguire on Thursday warned that the “greatest challenge” the U.S. is facing is “maintaining the integrity of our election system” and said “there are foreign powers that are trying to get us to question the validity of whether or not our elections are valid. “The intelligence official made the comment during testimony before the House Intelligence Committee on Thursday about a whistleblower complaint alleging that Trump tried to persuade Ukraine to mount a corruption investigation against former Vice President Joe Biden, the current front-runner for the Democratic nomination. Democrats also highlighted a section in the whistleblower complaint that Trump’s actions could pose “risks to U.S. national security and undermine the U.S. Government’s efforts to deter and counter foreign interference in U.S. elections.” The two events have bolstered the need for election security legislation, these Democrats argued, not long after former special counsel Robert Mueller’s report highlighted Russia’s efforts to interfere in the 2016 elections. “The President again, just [as] he did in 2016, sought out assistance from a foreign power to help in his reelection,” House Homeland Security Committee Chairman Bennie Thompson (D-Miss.) said in a statement on Thursday. “This is election interference, plain and simple. The President has continually and persistently undermined the integrity of our elections and our democracy.”

National: Russian Secret Weapon Against U.S. 2020 Election Revealed In New Cyberwarfare Report | Zak Doffman/Forbes

The FBI has warned that “the threat” to U.S. election security “from nation-state actors remains a persistent concern,” that it is “working aggressively” to uncover and stop, and the U.S. Director of National Intelligence has appointed an election threats executive, explaining that election security is now “a top priority for the intelligence community—which must bring the strongest level of support to this critical issue.” With this in mind, a new report from cybersecurity powerhouse Check Point makes for sobering reading. “It is unequivocally clear to us,” the firm warns, “that the Russians invested a significant amount of money and effort in the first half of this year to build large-scale espionage capabilities. Given the timing, the unique operational security design, and sheer volume of resource investment seen, Check Point believes we may see such an attack carried out near the 2020 U.S. Elections.” None of which is new—it would be more surprising if there wasn’t an attack of some sort, to some level. What is new, though, is Check Point’s unveiling of the sheer scale of Russia’s cyberattack machine, the way it is organised, the staggering investment required. And the most chilling finding is that Russia has built its ecosystem to ensure resilience, with cost no object. It has formed a fire-walled structure designed to attack in waves. Check Point believes this has been a decade or more in the making and now makes concerted Russian attacks on the U.S. “almost impossible” to defend against. The new research was conducted by Check Point in conjunction with Intezer—a specialist in Genetic Malware Analysis. It was led by Itay Cohen and Omri Ben Bassat, and has taken a deep dive to get “a broader perspective” of Russia’s threat ecosystem. “The fog behind these complicated operations made us realize that while we know a lot about single actors,” the team explains, “we are short of seeing a whole ecosystem.”

National: After Resisting, McConnell and Senate G.O.P. Back Election Security Funding | Carl Hulse/The New York Times

Facing mounting criticism for blocking proposals to bolster election security, Senator Mitch McConnell on Thursday threw his weight behind a new infusion of $250 million to help states guard against outside interference in the 2020 voting. Mr. McConnell, Republican of Kentucky and the majority leader, has been under regular attack from both Democrats and a conservative group for refusing to allow the Senate to vote on various election security proposals, some of them bipartisan, despite dire warnings from the intelligence community that Russia is already trying to replicate the elaborate meddling campaign it carried out during the 2016 presidential contest. The additional funding, Mr. McConnell said in announcing his support, “will bring our total allocation for election security — listen to this — to more than $600 million since fiscal 2018.” The money was quickly approved by the Appropriations Committee later Thursday. Though Mr. McConnell has embraced other seemingly derogatory nicknames over the years, he was incensed at being called “Moscow Mitch” by those who claimed his opposition showed he was willing to accept foreign election interference because it had benefited his own party by helping to elect President Trump, despite the senator’s long record of taking a hard line against Russia.

National: For latest election security moves, the devil is in the details | Derek B. Johnson/FCW

Last week it looked like a logjam was cleared on election security. The Senate approved $250 million in funding to states to secure election infrastructure ahead of 2020. Microsoft announced it would continue supporting Windows 7, the soon-to-be-obsolete operating system used on voting machines in thousands of jurisdictions, throughout the 2020 election cycle. Additionally, the Election Assistance Commission met to discuss its latest security standards for voting machines. While new federal dollars for election security are welcome, experts caution that more money might be required and more direction is needed on how to spend the money in the form of new legislation to put smart policy behind congressional outlays. The Brennan Center for Justice estimates the cost of replacing all paperless voting machines in the country at $734 million over five years. When added to the costs estimated to tackle other problems like protecting voter registration data, implementing post-election audits and extending cybersecurity assistance to state and local governments, the total price comes out to more than $2.1 billion. According to research from the OSET Institute, software licenses, maintenance fees and other costs to support voting machines past their first year are hard to quantify and can end up costing more than the initial equipment purchase. Contract language tends to leave the timing, nature and additional costs of such updates at the discretion of voting machine manufacturers.

National: McConnell’s support for election security funding is just the start of a big fight | Joseph Marks/The Washington Post

Senate Majority Leader Mitch McConnell (R-Ky.) partially relented yesterday in the fight over election security by throwing his support behind a $250 million infusion of cash for state election officials. But that concession is likely just the start of what could be a battle royal in Congress. Democrats, who have derided McConnell as “Moscow Mitch” for blocking progress on election security after the Russian interference in the 2016 election, were already arguing the majority leader had only embraced a half measure. McConnell signed on to a measure, which is expected to be approved as part of a must-pass spending bill, to provide cash to states to upgrade their election systems, but it doesn’t mandate how it should be spent. Senate Minority Leader Chuck Schumer (D-N.Y.) took to the Senate floor to bemoan the language supported by McConnell for not requiring changes such as paper ballots and post-election security audits experts say are vital to thwart hackers from Russia and elsewhere. “It doesn’t include a single solitary reform that virtually everyone knows we need, but it’s a start,” Schumer said. A bill that delivers money for election security but doesn’t mandate any particular fixes is a good bargain for McConnell and many Republicans who are wary of expanding federal authority over state and local-run elections — and who fear blowback from President Trump if they talk too much about Russia’s 2016 hacking and influence operation aimed at helping Trump’s election.

National: Senate’s Election Security Funding Bill Leaves Election Assistance Commission Strapped for Cash | Courtney Buble/Government Executive

he cash-strapped, understaffed federal agency responsible for promoting voting machine security standards and best practices for election administration will receive very little new funding under a Senate appropriations bill aimed at bolstering election security. Bowing to pressure from Democrats and some Republicans, Senate Majority Leader Mitch McConnell last week reversed course and said he would support legislation aimed at preventing foreign interference in U.S. elections. On Sept. 19, the Senate Appropriations Committee reported out the “Financial Services and General Government Appropriations Act of 2020” (S.2524), which includes funding for $250 million in election security grants for state and local election administrators. But the bill includes almost no new funds for the Election Assistance Commission, the severely understaffed and underfunded agency that serves as a clearinghouse for information about voting machine security standards and administrative best practices. Under the Senate legislation, EAC would receive $11,995,000 in 2020, about $2 million more than it received in 2019, however $1.5 million of that would be transferred to the National Institute for Standards and Technology to develop voluntary state voting system guidelines, and another $2.4 million is designated for the EAC’s relocation to new offices.

National: States try to combat election interference as Washington deadlocks | Evan Halper/ Los Angeles Times

With the White House and Congress paralyzed over how — or even whether — to act on intelligence agency warnings about foreign interference in U.S. elections, Maryland opted to take matters into its own hands. The state adopted transparency rules for political advertising on Facebook, Twitter and elsewhere online. The pioneering move drew praise from election reformers as a blow against foreign meddling. Then came the backlash. And it wasn’t from Russia. Newspaper publishers hauled the state into federal court. The new rules ran afoul of the 1st Amendment and created burdens on media organizations that could push struggling local papers under, they protested. Even one of the world’s most vocal advocates for transparency, the Reporters Committee for Freedom of the Press, joined the objectors. Along with the Washington Post, Associated Press and others, they successfully blocked the state’s effort in federal court.

National: EAC says it won’t de-certify voting systems running old versions of Windows | Sean Lyngaas/CyberScoop

The U.S. Election Assistance Commission has told lawmakers that it will not de-certify certain voting systems that use outdated Microsoft Windows systems, a disclosure that highlights the challenge of keeping voting equipment secure after a vendor ceases offering support for a product. While a voting system would fail certification if it were running software that wasn’t supported by a vendor, the act of de-certifying the system is cumbersome and “has wide-reaching consequences, affecting manufacturers, election administration at the state and local levels, as well as voters,” EAC commissioners wrote in a letter to the Committee on House Administration that CyberScoop obtained. To pass certification, voting vendors must meet a series of specifications outlined in the Voluntary Voting Systems Guidelines (VVSG), a set of standards that the EAC has been slow to update. In response to questions from the committee’s staff, EAC commissioners said the laborious de-certification process can be initiated if there is credible information that a voting system no longer complies with the guidelines. However, in the case of Election Systems & Software, the country’s largest voting vendor, for example, the EAC said it didn’t have “grounds to decertify any ES&S product that uses software that is no longer supported by a third-party vendor.” The commissioners also said that there is no stipulation for how far into the future operating systems must support security patches for them to be certified.

National: EAC parting ways with embattled top staffer | Eric Geller/Politico

The embattled executive director of the Election Assistance Commission, whose tenure has been marked by internal turmoil, will not serve another term, two government employees with knowledge of the decision told POLITICO. While the departure of Brian Newby will remove a controversial figure from one of the federal agencies charged with helping states secure their election systems, the shakeup will likely further hamper its mission ahead of the 2020 election, which intelligence officials say hackers working for Russia and other U.S. adversaries will once again attempt to disrupt. EAC commissioners voted over the weekend of Sept. 7-8 not to reappoint Newby for four more years, according to an agency staffer and a House aide, who declined to be named because of the sensitivity of the issue. The commissioners also voted not to retain Cliff Tatum, the agency’s general counsel. Both men joined the EAC on Oct. 22, 2015. The vote on the two appointments was 2-2, splitting the Democratic and Republican commissioners, said the House aide. A decision to reappoint them would have required a majority. The vote came three months after a POLITICO story about how Newby has faced extensive criticism from inside and outside the EAC for undermining its election security work and ignoring, micromanaging and mistreating staff.

National: Microsoft will offer free Windows 7 support for election officials through 2020 | Sean Lyngaas/CyberScoop

Microsoft said Friday it will offer state and local election officials free security support for Windows 7 operating systems used in voting systems through 2020. “We want to make sure that Windows 7 end-of-life doesn’t…become a barrier to having a secure and safe election,” Jan Neutze, head of Microsoft’s cybersecurity and democracy team, said in announcing the news, which CyberScoop was first to report. “It’s the right thing to do,” he said at a conference hosted by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency. Microsoft has long planned to stop providing security updates for Windows 7 users in general in January 2020, but was allowing users to pay for those updates through January 2023. But the offer of free services through next year’s U.S. presidential election is an additional effort to make it easier to update operating software used in voting systems, such as the election management systems that format ballots. Some systems that support voting in the U.S. still rely on Windows 7, which is not nearly as straightforward to update on those machines as it is on a personal computer. Patches require installation and testing to verify that they will not disrupt a voting system.

National: Voting machine companies may throw their doors open to ethical hackers | Joseph Marks/The Washington Post

Voting machine companies, which for years have been loath to acknowledge any security weaknesses, are finally saying they will consider allowing ethical hackers to search for them. But hackers are skeptical of the election industry’s recent commitment to security and transparency. The olive branch to hackers marks a huge about-face for the industry, which last week asked for feedback from researchers and companies about the best ways to let outsiders vet their security. They’ve long argued that researchers, by exposing security flaws, could give a roadmap to foreign hackers intent on compromising the 2020 contest. Now they’re saying the threat of Russian hacking and disinformation is too severe for the security of election systems to be treated as a private matter to be managed behind closed doors. “For many years the industry…preferred to work quietly behind scenes. [But] 2016 brought cybersecurity to the front burner and folks in this industry who were uncomfortable talking about vulnerabilities have warmed up to it,” Chris Wlaschin, the top cybersecurity official for Election Systems and Software, told me. But some ethical hackers worry the industry, which has historically prioritized making their machines easier for election administrators to use rather than making them as secure as possible, isn’t ready to make big changes. They fear the companies won’t work quickly enough to fix the bugs they discover and could use non-disclosure agreements to enforce silence about dangerous bugs that could compromise an election.

National: Democrats launch ‘full court press’ on election security | Joseph Marks/The Washington Post

Democrats are pressing hard this week in what could be their final chance to pass legislation aimed at protecting the 2020 contest against Russian hackers. Senate Democrats have failed for months to force Senate Majority Leader Mitch McConnell (R-Ky.) to allow a vote on bills committing an additional $600 million to election security and also mandating security reforms such as paper ballots and post-election cybersecurity audits. Now they’re shifting tactics and trying to force some of that funding into a must-pass spending bill. Round one of the fight starts Thursday at a Senate Appropriations Committee meeting where the top-ranking Democrat, Sen. Patrick Leahy (Vt.), and the top Democrat on the committee’s general government panel, Sen. Chris Coons (Del.), will try to force the money into the Republican draft of a spending bill. If that doesn’t work, Democrats can keep trying to push Republicans to add the measure through the lengthy give-and-take of the appropriations process that’s likely to drag on for several months. Aides for Leahy and Coons declined to tell me precisely what was in the amendment they’ll be introducing Thursday, but Sen. Ron Wyden (D-Ore.) and other senators are pushing for at least the $600 million that’s included in legislation already passed by the House. If the last-ditch effort fails, many Americans are likely to cast votes in 2020 in a process still governed by the same lax rules as in 2016 – when a Russian hacking and disinformation operation upended the election and severely damaged voters’ confidence in the democratic process. The federal government has surged its cybersecurity help to state election officials since then and several states and localities have voluntarily improved protections, but the improvements are far from universal.

National: Election security funds caught in crosshairs of spending debate | Maggies Miller-The Hill

Funding to bolster election security efforts at the state level could become a sticking point during the ongoing government spending talks, with the House approving the funds while Republicans in the Senate remain staunchly opposed. The spotlight will be on the Senate on Tuesday, as the Appropriations Subcommittee on Financial Services and General Government marks up its portion of the annual spending bill, with the full committee due to vote on the bill Thursday. While the subcommittee will wait until after the markup to release its version of the annual financial services and general government funding bill, which includes appropriations for the Election Assistance Commission (EAC), it’s unlikely to include election security funds due to Republican opposition. This could become a factor in negotiations between the House and Senate over government funding bills and make it even more difficult for Congress to approve funding legislation prior to the end of the fiscal year on Sept. 30, which is needed to avert a shutdown.

National: How state election officials are contributing to weak security in 2020 | Joseph Marks/The Washington Post

It’s not just a question of paper ballots. The offices charged with administering elections across the country are falling short on a slew of basic cybersecurity measures that could make the 2020 contest far more vulnerable to hacking, according to a report out this morning. Numerous state election offices aren’t patching their computer systems against known digital attacks and rely heavily on outdated, weak software, the report from the cybersecurity company NormShield found. They’re not fully protecting their websites against attacks or taking technical steps that would help prevent hackers from impersonating employees over email. And employee emails and passwords have leaked online. Any one of those vulnerabilities could be the weak spot that allows hackers to compromise a swath of election systems — especially since several states with the worst security practices were swing states, the company’s Chief Security Officer Bob Maley told me. He declined to disclose how specific states fared at this time.

National: How counties are war-gaming Election Day cyberattacks | Joseph Marks/The Washington Post

If Russian hackers seek to disrupt the 2020 election, it will be county election officials on the front lines. And some are diving in to war games so they can be ready for anything Moscow or another U.S. adversary can throw at them. Election officials from New Jersey’s 21 counties huddled at tables in a hotel ballroom here, hashing out how they’d respond to Election Day cyberattacks. In some attack scenarios, hackers shut down voter registration databases, loaded voter files with phony information, or compromised county social media accounts so they start spreading false information about polling locations. They also prepared for what happens if attackers locked up election office computers with ransomware or shut down cellphone towers across multiple states. How the U.S. fares during an Election Day hack is likely to rest on the response of local election administrators in the first few hours, state and federal officials told me. “The county level is where all the risk is,” a Homeland Security Department cybersecurity official who was helping one county with its response-planning told me. “They own it in a way no state official does and certainly no federal official could. It’s always live or die at the county level.” The war-games are a sign of how drastically local politics has changed in this new era of cyberwar — preparing responses to attacks by a powerful nation-state is a far cry from more ordinary tasks of getting poll workers to voting locations on time and planning contingency operations for storms or other physical disasters. And there’s no turning back, as federal offiicals have warned Russia is likely to try to repeat its hacking and disinformation campaign in 2020 and other U.S. adversaries, including China, Iran and North Korea, may try as well.

National: Cyber firm examines supply-chain challenge in securing election ecosystem | Charlie Mitchell/InsideCyberSecurity.com

State election officials are doing a better job of securing systems but still need to pay more attention to “internet facing infrastructure” and possible weak links in their supply chains, according to a new report from NormShield, a cybersecurity firm that develops risk scorecards for companies. According to NormShield, “We noticed … that states may be focusing on their internal assets and may not be examining their broader cyber ecosystem footprint. So we undertook the exercise of examining that broader footprint to better understand what election system integrity looks like from that perspective.” The firm did not examine cyber hygiene around voting machines, but did look at “Network Connected Systems and Components” as identified in the Center for Internet Security “Handbook for Elections Infrastructure Security.” It found significant improvements between an initial scan in July and a follow-up August, according to the report issued today. “NormShield privately provided its findings to the Secretaries of State and election commissions in July in order to empower them with the information needed to remediate vulnerabilities,” the firm said. “NormShield ran a second scan in August and found significant improvement in the security posture of several election commissions.”

National: Former Homeland Security secretaries call for action to address cybersecurity threats | Maggie Miller/TheHill

Three former secretaries of the Department of Homeland Security (DHS) on Monday testified that cybersecurity threats to elections and other critical infrastructure are major issues that could impact the security of the nation. Former DHS Secretaries Michael Chertoff, Janet Napolitano and Jeh Johnson all discussed the severity of cyber threats to the U.S. while testifying in New York City during a field hearing at the National September 11 Memorial Museum held by the Senate Homeland Security and Governmental Affairs Committee. Napolitano, who served as secretary under former President Obama from 2009 through 2013, listed cybersecurity as one of the top three threats DHS “can and must confront,” pointing to vulnerabilities in election infrastructure, utility grids and other critical infrastructure as putting the country at risk. “Our adversaries and international criminal organizations have become more determined and more brazen in their efforts to attack us and to steal from us,” Napolitano said. “We need a whole of government and a whole of public and private sector response to this threat, and it needs to happen immediately.

National: Even conservative Democrats are savaging GOP over election security | Joseph Marks/The Washington Post

A group of centrist House Democrats that usually aims for bipartisanship is coming out swinging against Senate Majority Leader Mitch McConnell (R-Ky.) and other Republicans for blocking election security legislation. Members of the Democrats’ Blue Dog Coalition, which includes the conservative wing of the party, charged Republican senators with endangering the country’s democratic process for not forcing a vote on election security legislation during a press briefing. And they leveled their most pointed criticism at McConnell, who has steadfastly refused to allow major election security bills to get a vote on the Senate floor. “The underlying trust of our citizens in their electoral system and who they choose to elect is at the base of this whole process,” Rep. Tom O’Halleran (D-Ariz.) said. “The question should be put day in and day out to Mr. McConnell: ‘Why are you not wanting to protect the electoral system in this nation?’”

National: Here’s why Mitch McConnell is blocking election security bills | Joseph Marks/The Washington Post

As Congress returns this week, Mitch McConnell remains the one-man roadblock for Democrats’ election security bills. He’s still refusing to allow a vote, even as Democrats deride him as “Moscow Mitch” and accuse him of inviting Russia to interfere on Republicans’ behalf in the 2020 election. But why is McConnell so staunchly opposed? Republicans and Democrats offer a fairly straightforward theory: McConnell is wary of drawing the ire of President Trump, who has repeatedly wavered on whether Russia interfered in the presidential contest — and seems to view traditionally bipartisan discussions about election security as delegitimizing his unexpected 2016 victory over Hillary Clinton. “This is a narrative that the White House doesn’t want to approach,” David Jolly, a former Republican House member from Florida and an outspoken Trump critic, told me. “The president’s not comfortable talking about it. He’s someone with a fragile ego. And McConnell is happy to coordinate with this White House. That’s the only thing that explains it.” McConnell is likely also concerned about the political fallout for Republican senators, several of whom have supported and even co-sponsored election security bills in the past, says a former Democratic Senate staffer who worked extensively on cybersecurity issues during the Obama administration.

National: Americans Prepare To Safeguard 2020 Vote. Is It Too Much — Or Will It Be Enough? | Philip Ewing/ NPR

Americans are preparing more than ever to safeguard voting as the nation looks ahead to the Democratic primaries and the general election next year. What no one can say for certain today is whether all the work may turn out to be supeous — or whether it’ll be enough. National security officials have been clear about two things: First, that the Russian government attacked the 2016 election with a wave of “active measures” documented in prosecution documents and the final report of former Justice Department special counsel Robert Mueller. And second, that those measures have never stopped and that interference is likely in coming elections. With that understanding, the United States has spent hundreds of millions of dollars since 2016 to change practices at every level of government. A lot has changed

National: Expanding the Definition of “Election Systems” also Expands Cyber Security Funding Options | Steve Smith/Governing