As National Cybersecurity Awareness Month, October is a great time to highlight Securing WisVote, a 2018 Clearie awardee in the Outstanding Innovations in Elections category. Developed by the Wisconsin Elections Commission (WEC), the program’s targeted training modules help to guard the state’s election database while promoting cybersecurity awareness for local election officials. Started in July of 2018, the WEC’s Securing WisVote series is a homegrown system that bolsters election security across the state and empowers localities to protect Wisconsin’s elections.
I recently interviewed Robert Kehoe, Technology Director for the WEC, along with the WisVote Training Team about the program. Below are my questions and the training team’s responses.
EAC: Please tell us about Wisconsin’s statewide elections database, WisVote. What are some of the challenges and opportunities in managing a system for over 1,800 municipalities across the state?
WisVote Training Team: The WisVote system, which the Wisconsin Elections Commission developed in-house, is more than a voter registration database. It is a comprehensive election management system that municipalities and counties use to manage voters, absentee ballots, poll workers, and other election details. WEC developed the current system in 2016 to ensure voter data contained within remains secure. Unlike other states where elections are administered at the county level and the number of system users is relatively low, Wisconsin faced the challenges of developing and protecting a system with nearly 3,000 users.
Because the population of Wisconsin election officials is so varied, the WEC examined how we might establish a baseline level of computer security awareness for election officials across the State. After researching several commercial options, we concluded the most effective option was to create our own electronic learning modules. This allowed us to focus on cybersecurity best practices while tailoring the curriculum for our diverse audience and the unique WisVote system. The published training modules comprise the “Securing WisVote” series.
Wisconsin election officials possess varying computer skills and access to resources. Some clerks live and conduct elections in small towns with personally-owned computers and limited technical support. Others serve in large cities with comprehensive information technology infrastructure. In addition, WisVote users also have different degrees of system permissions, from read-only to the ability to change and update their jurisdiction’s election and voter data. Finally, many Wisconsin election officials also serve in other municipal or county capacities, such as municipal treasurer, and therefore have access to personally-identifying information in their other roles.
EAC: The award-winning Securing WisVote series serves nearly 3,000 Wisconsin election officials. How does the program operate and what are the major goals of the effort?
WisVote Training Team: The Securing WisVote series program operates online at our Wisconsin Election Training – TLC website. Election officials with access to the site can complete the training modules and earn badges for compliance. Completion of the training is required before users can receive credentials to access the WisVote system. Our goals include:
- Promote targeted cybersecurity training for our local county and municipal officials
- Host training on a learning management system platform controlled by WEC staff
- Offer training that can be assigned and tracked by WEC staff
- Deliver training that can be efficiently updated by WEC training staff
- Provide access to additional cybersecurity resources to accompany training modules including a personal computer security checklist and WisVote technology standards
- Provide free cybersecurity training to the hundreds of municipal clerks who do not use the WisVote system because of their small size, but who can still benefit from learning about best practices in cyber hygiene, password management, and safe browsing.
EAC: The Securing WisVote series contains six training modules. Please highlight a few of them and their intended outcomes.
WisVote Training Team: We centered our information around common cybersecurity themes, familiar to those in the field but less so to the common user. These videos presented a baseline for our election officials to work more securely. While they are focused on election security, the modules provide cybersecurity best practices applicable to anyone safeguarding public information. Many clerks include these modules as part of their staff training.
- Phishing Facts
One of the most common forms of cybercrime. Phishing attacks are so simple that anyone with an email address can try it.
- Password Protocols
Even with the very latest and greatest anti-virus software and the most powerful firewall, your passwords could be leaving you open to hackers and phishers. Today’s sophisticated cybercriminals can exploit weak passwords in a matter of minutes. Take some time to strengthen yours.
- Browsing Safely
Modern internet browsers are packed with security features designed to stop you from visiting dodgy websites and to prevent sites from taking control of your computer. To ensure these features are always present and correct and to guard against the latest threats, keep your browser software updated.
- Computer Safeguards
Safeguarding your computer requires protecting your hardware against damage or theft, protecting computer systems from malware, and preventing valuable data from being accessed by unauthorized personnel or stolen by disgruntled staff. Physical security devices, security software, and data protection procedures should all be a part of your overall security plan.
EAC: Cybersecurity is constantly evolving. How will the Securing WisVote series identify and address new threats in this program series?
WisVote Training Team: The WEC recognizes that the evolution of technology, risks, and vulnerabilities will demand we remain vigilant. Because WEC training staff creates learning modules in-house, we can easily update and supplement them when needed. As our cybersecurity needs evolve, so will this easily-accessible library.
EAC: In providing a baseline for security database training across Wisconsin, how has the initiative been received by election officials?
WisVote Training Team: The Securing WisVote series represents a significant step towards enhanced cybersecurity at the local government level. The initiative has been a success as clerks throughout the state have viewed the series. While state agencies have long had access to professional IT support, not every municipal office is so fortunate. By creating a baseline training program open to all local governments, the WEC helps bridge cybersecurity awareness gaps within the WisVote user population. Heightened awareness and the information within the videos have promoted election security and redefined this vigilance as the new normal. While the program is designed to safeguard the voter registration database, it has the added value of enhancing overall cybersecurity in local governments statewide.
EAC: As we approach the 2020 presidential election and states continue to look at ways to secure their databases, how might other states and local government entities benefit from developing similar training? Are you willing to share the program concept with other states interested in developing similar initiatives?
WisVote Training Team: Absolutely. While this training is now mandatory for clerks to access WisVote, the electronic learning modules are accessible to any government official or election worker upon request. The WEC provides county and municipal clerks access to the agency’s Learning Center platform and encourages the modules to be incorporated as part of poll worker training. We have extended this opportunity to as many election officials as possible, helping them keep WisVote – and other electronic platforms – safe from cyberthreats. We believe these electronic learning modules could be replicated and would encourage any state to customize them to fit the needs of their users and systems. Currently, several states are reviewing the Securing WisVote series and looking at it as either a model for their own program or for use as-is. To request access, please contact the Wisconsin Election Commission for details.
We thank the WEC and the WisVote Training Team for their commitment to cybersecurity and willingness to share the program’s successes and fundamentals with other municipalities. This is truly a collaborative effort that positively impacts thousands of elections officials and millions of Wisconsin voters. Congratulations on a well-deserved EAC Clearinghouse Award and an outstanding cybersecurity program!
Please check back with us over the upcoming weeks for additional interviews and information about the 2019 Clearie competition.
We hope election administrators will consider submitting their programs, no matter how large or small, for recognition in this year’s contest.