Department of Homeland Security (DHS) officials tried to hack Indiana’s state electoral system with at least 14,800 “scans” or hits between Nov. 1, 2016, to Dec. 16, 2016, The Daily Caller News Foundation Investigative Group has learned.
The attacks are the second confirmed IT scanning assault by DHS officials against states that resisted then-President Barack Obama’s attempt to increase federal involvement in state and local election systems by designating them as “critical infrastructure” for national security.
Members of the National Association of Secretaries of State voted Saturday at their winter meeting to oppose the designation. They are asking President Donald Trump to overturn it.
Will this presidential election be the most important in American history?
Former Indiana Gov. Mike Pence was also Trump’s vice presidential-elect during much of the period covered by the DHS scans of the Indiana system.
Indiana Secretary of State Connie Lawson, the incoming president of the association, told TheDCNF Tuesday, “We know that between November 1 and December 16 we were scanned with about 14,800 scans, nearly 15,000 different times.” The state’s IT team traced the intruder to a DHS computer’s IP address. The same DHS unit attempted 10 times in 2016 to hack into the Georgia electoral system.
Federal officials are barred under DHS rules from trying to penetrate a state system without the express approval of the state. Neither Georgia nor Indiana approved the DHS scanning attempts.
The DHS inspector general has launched an official investigation into the Georgia breach attempt. Thomas Vessely, IT director for the Indiana secretary of state, told TheDCNF, “We kindly declined [DHS] assistance because we were very comfortable in the work we were doing in monitoring our election system.”
Lawson said she “always assumed it was because I was the incoming President of the National Association of Secretaries of State and because we declined their assistance.”
Georgia Secretary of State Brian Kemp told TheDCNF Jan. 24, 2016, he was suspicious because four of the 10 attacks against the Georgia election network occurred as he was about to talk to DHS officials, or coincided with his public testimony opposing the critical infrastructure designation. “It’s certainly concerning about the dates,” Kemp said.
Kemp hopes the IG can determine if the hacks were timed to intimidate him.
Lawson said despite the scale of the scans, the DHS efforts to attack its election system was unsuccessful. “Our voter registration system was not penetrated.” She said there was “one slight penetration on an [election] website that was actually old and out of date, so it didn’t go anywhere.”
Governmental deployment of IT technology could be an evolving new tool against political opponents or to impose censorship, according to James Scott, a senior fellow at the Institute for Critical Infrastructure Technology, a cybersecurity think tank.
“Censorship has always been an issue in the brick-and-mortar world. So, censorship in the digital landscape is simply just transference of methods,” Scott said. “I think within federal agencies it is possible to imagine that there are some overreaching, aggressive managers.”
Indiana officials have not yet asked the DHS IG to look at their state’s situation. “We’re taking the matter under consideration,” Lawson said, adding that “we have sent letters to our congressional folks, our governor, and others to make them aware this happened. I’m very concerned, very concerned.”
A DHS spokesman told TheDCNF that, “we take the trust of our partners in the public and private sectors seriously and will work with them to address any concerns. DHS does not conduct scans of networks or systems without the cooperation and consent of the system owner.”
Marc Lotter, a spokesman for Pence, told TheDCNF his boss personally knew Lawson while in Indiana and had complete confidence in her handling the attacks.
“The VP has tremendous faith in the Secretary of State and knows it’s in good hands,” said Marc. He’s sure she will handle it properly,” he said.
This report, by Richard Pollock, was cross-posted by arrangement with the Daily Caller News Foundation.
