A Look at CISA’s Mission to Protect Election Integrity
With the US election coming up in just a month and early voting already available in some locations, protecting election integrity is top of mind. While many people are focused on the presidential contest, elections in the US are administered at the state level and frequently carried out by county, city, or other municipal governments.1 In fact, there are over 10,000 election administration jurisdictions across the country2, meaning there is no one-size-fits-all approach to election security.
Election systems are designated as critical infrastructure, meaning that the US Cybersecurity and Infrastructure Security Agency (CISA) is empowered to assist state and local election officials in their security efforts.3 As part of CISA’s Protect2024 mission, the agency has issued guidance to election administrators—steps that sound familiar to anyone in cybersecurity, including:
- Enable multi-factor authentication
- Know and manage your cyber vulnerabilities
- Rehearse your incident response plan
- Get a physical security assessment
- Join the Elections Infrastructure Information Sharing and Analysis Center (EI-ISAC)
What’s an ISAC?
There are 27 organizations in the National Council of ISACs that are designed to share threat data and mitigation tactics among organizations in a specific industry or sector. Every state, local, tribal, and territorial government organization that supports US elections can join EI-ISAC for free.
Aiding Resilience
The advice from CISA sounds simple, spanning typical cybersecurity pillars such as access control, attack surface management, preparedness, and threat intelligence. However, cybersecurity may not be a strong skillset for the local governments being asked to protect voter registration data, counting and auditing systems, and polling places. That’s why CISA is partnering with these agencies to lend their expertise.
The complexity of US election infrastructure may actually help rather than hurt security efforts. According to Director of CISA Jen Easterly, “Over the last three years learning about elections, what I’ve learned is the diversity of how election officials run, secure, and administer elections is in many ways an advantage because it creates resilience.”4
Fighting Deception
Preventing cyberattacks isn’t CISA’s only goal for this year’s election—they’re also working to combat disinformation. In late July, the US Office of the Director of National Intelligence issued a report stating that foreign actors were employing marketing and public relations firms to influence the outcomes of US elections or promote distrust of the elections process.5 This included creating tools and technology to seed and foster narratives that serve foreign interests.
Disinformation campaigns can be powerful. A bipartisan US Senate Intelligence Committee investigation found that “the IRA [Internet Research Agency] sought to influence the 2016 US presidential election…at the direction of the Kremlin.”6 To help counter common disinformation narratives, CISA has put together a webpage on election security rumors versus reality.
Mitigating AI Risks
The rapid advancement in deepfake technology makes AI another concern for this year’s election. California enacted three new laws last month related to the use of AI-generated content, including one that already took effect, making it illegal to publish election-related deepfakes near election dates.7
CISA published information earlier this year on the many ways generative AI may be used to impact election security, ranging from deepfakes to AI-generated text. However, in a Politico interview, CISA senior advisor Caitlin Conley emphasized that the risks posed by AI aren’t new—AI is another tactic to commit the same types of attacks election officials have been mitigating for years.8
“I am confident in the security and resilience of our democratic process because of all the effort that has gone in,” Conley said. “No matter what [election officials] face, they’re going to be ready for it.”9
- The National Conference of State Legislatures, Election Administration at State and Local Levels, Dec 2023
- New Hampshire Public Radio, Refresher Course: How secure are U.S. elections?, Sep 2024
- US Department of Homeland Security, Election Security, updated Aug 2024
- IdahoNews, CISA Director says she has “enormous confidence” in security of local elections, Sep 2024
- US Office of the Director of National Intelligence, 100 Days Until Election 2024, Jul 2024
- US Senate Select Committee on Intelligence, Senate Intel Committee Releases Bipartisan Report on Russia’s Use of Social Media, Oct 2019
- The Associated Press, California governor signs laws to crack down on election deepfakes created by AI, Sep 2024
- Politico, CISA official: Generative AI won’t pose ‘new risks’ to 2024 elections, Sep 2024
- Politico, CISA official: ‘Confident’ in the security of US elections, Sep 2024
