By Daniel Patrick Shaffer
Critical Infrastructure and the Power of the Executive Branch
Department of Homeland Security Secretary Jeh Johnson recently proposed the idea of designating election infrastructure as “critical infrastructure.” Critical infrastructure includes pieces of infrastructure that are so vital to the United States, that their destruction would have a crippling effect on our economy, health, and security. This currently includes infrastructure like dams, the power grid, and financial institutions. The Secretary has cybersecurity concerns, citing the recent cyber-attacks on the Democratic National Committee database, and the possibility of more destructive attacks in the future. Pursuant to the Homeland Security Act of 2002, The President and Secretary of DHS both have the power to designate critical infrastructure. The President did this in the Presidential Policy Directive-21, Critical Infrastructure Security and Resilience. The Directive says that department heads are in charge of working with the Secretary of Homeland Security to ensure security in their respective critical infrastructures. The Department of Justice, a part of the executive branch, has jurisdiction to monitor, investigate, and prosecute an attack on any critical infrastructure. Throughout the Presidential Policy Directive, many other executive branch departments and agencies are given the authority to consult with critical infrastructure sectors and even set the standards of their security protocols.
Election Infrastructure as Critical Infrastructure
The Secretary of Homeland Security has proposed the idea that the components of our election infrastructure should be considered critical infrastructure. These components include the actual systems used to tally votes, systems that political parties use while campaigning, and voter databases. Cyber attackers with access to these systems could block information from being collected or accessed, change existing information, or steal information.
In most precincts, the electronic results on Election Day are encrypted and electronically sent to be counted. If there is an issue, a file containing the results is hand delivered on a flash drive to the counting location. If all else fails, most states save the hard copies of the ballots, and these are used to verify the results. These ballot boxes are not connected to the internet. An attack on this component of our election infrastructure would manifest itself as someone walking into a precinct and plugging a harmful flash drive into the back of a ballot box.
Nation Builder, a private company, is what many campaigns across the world use to keep track of the voters they have reached out to and organize their campaigns. Nation Builder was attacked in 2014 and recently before the Brexit vote. These cyber-attacks can affect campaigns though they do not directly affect the votes that people cast.
Cyber-attacks on voter databases result in hackers obtaining information about voters. Thus far, hackers have not been able to change any information. The question is about whether or not the potential protection that DHS can provide is worth the potential issues that come with the federal government’s involvement.
Opponents of the Critical Infrastructure Designation
The heart of the issue here is states’ rights. It is clear in the Constitution that states are responsible for conducting their elections, even at the federal level. There would be a constitutional issue if the federal government had as much jurisdiction over the election administration process as it does over other critical infrastructures. The federal government would have a lot of access and power in locally run election systems. Opponents contend that this could be a way for the federal government to put federal employees and agents in polling places, where they do not have any right to access now, which could cause interference. There is concern that this is a step towards nationalized elections, despite our decentralized system being put in place by the founding fathers to prevent such autocratic control. A decentralized election system is also less vulnerable overall because a nationalized system would be vulnerable all at once.
The President has the power to change the language of the Presidential Policy Directive-21 to include election infrastructure among the list of 16 other critical infrastructures. The executive branch would then have the power to dictate policies that local precincts operate under and many state officials believe this would affect elections and undermine federalism.
A gap in the executive branch’s argument for critical infrastructure designation is that the ballot boxes, the pieces of infrastructure that really matter, are not even connected to the Internet. Everything that has been hacked so far has been connected to the Internet, which is what has allowed hackers to break in. An attack would have to be physical for it to actually affect the results of an election, and there are currently no credible physical threats to our ballot boxes.
Another fear is that DHS involvement in election infrastructure security would result in codified standards as it did with DHS involvement in chemical plants that led to the passage of a chemical facility anti-terrorism standards program. Most consider the chemical plant standards to be a good thing even though it mandates the facilities adhere to certain standards. However, similar mandatory procedures for election infrastructure would have a very different connotation.
Overall, opponents of this critical infrastructure designation of our election infrastructure are blaming the executive for using fear as a tool to tighten its grip on the states and push for a nationalized election system that is contrary to principles of federalism. The uniqueness of elections when compared to any other infrastructure is that they can be an extremely divisive part of our society. Everyone wins when the executive branch protects the power grid, but someone is guaranteed to lose an election. This creates a situation in which one group of people may feel like the standards that the executive branch imposed, or the mere presence of executive branch employees in their precinct, affected the results of their election.
Proponents of the Critical Infrastructure Designation
Proponents of this critical infrastructure designation say the government has not “taken over” any of the other critical infrastructure sectors and anyone that says this could be a takeover is fear mongering.
The executive branch departments will only assess the security situation of election infrastructure and provide recommendations for improvement. The executive will allow the elections sector to utilize information sharing through the government’s information sharing and analysis centers (ISACs). DHS would work with all of the stakeholders in election infrastructure and establish public-private partnerships to improve coordination and overall security. This can only improve the integrity and accuracy of our elections and strengthen the process overall.
Secretary Jeh Johnson was very clear in a September 17th letter to Senator Carper that the DHS election program is voluntary and would not supersede state control of the election process. The Secretary wrote, “Regardless of whether some aspect of election infrastructure is considered critical infrastructure, DHS assistance is strictly voluntary and does not entail regulation, binding directives, and is not offered to supersede state and local control over the process. The DHS role is limited to support only.”
Conclusion
As of now, the election infrastructure services from DHS are all voluntary, so no states’ rights issues are presented, and many states have opted to take advantage of this offer. A bit of good news is that both sides of the aisle agree and have stated in a bi-partisan letter to Todd Valentine, president of the National Association of State Election Directors, that they oppose executive control over election infrastructure. All sides, including the executive, seem to agree that DHS involvement in election infrastructure should remain voluntary, but the President and the Secretary of Homeland Security still have the power to declare election infrastructure as critical infrastructure and impose mandatory compliance. That designation will have to be challenged on its constitutionality.
It would not be prudent to designate election infrastructure as critical infrastructure even if DHS programs remained voluntary for the duration of Secretary Jeh Johnson’s tenure. There are strong legal implications that come with critical infrastructure. Future administrations could take advantage of this and assume a level of control over election infrastructure that would be contrary to the constitution. DHS should continue to offer its security services to states that opt for the help, but the executive should refrain from formally designating election infrastructure as critical infrastructure.
Comments