COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
unfunded mandates.[1] Some states requesting more intensive services have also experienced significant delays before DHS could send a team to assist.
- (U) By October 2018, DHS said 35 states, 91 local jurisdictions, and eight election system vendors had signed up for remote persistent scans.[2] All the requests for these scans have been fulfilled. "They can be turned on basically within the week," according to DHS.[3]
- (U) DHS said that as of October 2018, it had completed 35 in-depth, on the ground vulnerability assessments: 21 states, 13 localities, and one election system vendor. These assessments are one week off-site remote scans followed by a second week on site.[4]
- (U) Two states who completed the in-depth assessments reported in late 2017 they had had a good experience. State 12 officials said the team was "extremely helpful and professional."[5] State 10 said the review was a good experience, although DHS was somewhat limited in what it could do.[6] For example, DHS did a phishing email test that showed the training for employees had worked.[7] DHS gave "good and actionable recommendations." Although DHS "didn't really understand election systems when they came," they learned a lot.[8]
- (U) As of November 2017, State 6 and State 9 requested an on-site scan, but those scans were on track to be delayed past the August 2018 primaries.[9] State 7 was expecting a four-to-six month delay.[10] State 8 signed up for a checkup in October 2017 and was due to get service the following February.[11] As of January 2018, State 17 also had requested an on-site scan.[12]
(U) In a sign of improving relations between the states and DHS, two states that had elections in 2017 attempted to include DHS in the process more extensively than in the past. In State 17, a two-person DHS team sat with election officials during the 2017 special election and monitored the networks. Even though "their presence was comforting," they "really didn't do much." State 17 signed DHS's normal MOU, but also added its own clause to underscore the state's independence: a formal sunset on DHS's access to state systems, one week after the
- ↑ (U) Ibid., p. 60.
- ↑ (U) Ibid., p. 57.
- ↑ (U) DHS phone call with SSCI, October 16, 2018.
- ↑ (U) Ibid.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 12], December 1, 2017.
- ↑ (U) Ibid.
- ↑ (U) Ibid.
- ↑ (U) Ibid.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 6], November 17, 2017; Memorandum for the Record, SSCI Staff, Conference Call with [State 9], November 17, 2017.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 7], January 25, 2018.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 8], February 2, 2018.
- ↑ (U) Memorandum for the Record, SSCI Staff, Conference Call with [State 17], January 25, 2018.
53
COMMITTEE SENSITIVE—RUSSIA INVESTIGATION ONLY
