Pop quiz: which part of the federal government is tasked with preventing cyber interference in our elections? Congress has refused to say. We have reached a point of a significant gap between an important federal need and existing federal power. And in the absence of that federal power, federal agencies have stepped into the gap and extended their authority into domains unanticipated by Congress. Of course, there is clear statutory guidance for some aspects of protecting election integrity. We can think about preventing campaign interference in our elections. Portions of that job fall squarely within the domain of the Federal Elections Commission, which enforces campaign finance laws. We can also think about prosecution or punishment of those who engage in either foreign campaign interference, like the Justice Department’s recent criminal indictment of a Russian woman with interference in the 2018 midterm elections, or foreign cyber interference, like actions from the Obama and Trump administrations to sanction those who interfere with election systems in the United States. But that’s focused on punishing election interference that has already occurred.
Preventing cyber interference is another matter. Cyber interference could take different forms. It might mean disruption of election-related websites, a version of the recent teenage hacker who manipulated a public-facing website to alter the site’s display of vote totals—a form of vandalism with no material impact on our democracy. It’s an inconvenience, the equivalent of a server failure or a power outage on Election Day.
Worse, it might mean infiltration of voting systems, like voter registration databases, and altering them, such as changing information or deleting names from the lists of registered voters. And perhaps the least likely, but by far the most troubling to our democracy, foreign or domestic actors might attempt to modify the outcomes of votes cast using electronic voting machines in ways that are undetectable.
Who in the federal government is tasked with preventing these scenarios from happening? Congress has not directly empowered any federal agency to protect elections from cyber interference. But that hasn’t stopped various agencies from stepping in anyway. The justifications for agency activity largely arise from two perhaps unlikely statutory sources: one enacted after 9/11, another after Bush v. Gore.