CISA Unveils Mail-in Voting Risk Assessment

The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has released its Mail-in Voting in 2020 Infrastructure Risk Assessment to help with risk management of critical election systems.

“For the November 2020 election, the COVID-19 pandemic will likely impact voters’ voting patterns,” the assessment states. “Many states and jurisdictions have modified their processes and infrastructure to address the change in the environment to include considerations of how to utilize mail-in voting.”

Among key findings from the assessment:

  • An increase in cyberattacks coinciding with additional infrastructure and technology needed for outbound and inbound processing of mail-in ballots;
  • An increase in integrity attacks on voter registration data and systems because voters will not be in person and able to answer questions regarding eligibility or identity verification;
  • Shifts in operational risk management responsibility from in-person voting officials to outside entities like ballot printers, mail processing facilities, and the U.S. Postal Service;
  • Changes in risk management for a mail-in voting environment as “these processes require implementing secure procedures for storage, access controls, and chain of custody, such as ballot accounting;”
  • More time being required for mail-in ballot processes and tabulation; and
  • Disinformation risk to mail-in voting infrastructure similar to disinformation surrounding in-person voting, but utilizing different content.

Additionally, the risk assessment includes “compensating controls” for how to best address the risks involved with the key findings from the report.

“Our state officials must adapt by changing outdated voting rules that prohibit no-excuse absentee voting and early voting, both of which would reduce lines and crowding, making it safer to vote,” Rep. Bennie Thompson, D-Miss, said during a Cybersecurity, Infrastructure Protection, and Innovation Subcommittee hearing today. “They must seek out reliable sources of accurate information and engage in the election process.”

Jordan Smith
About Jordan Smith
Jordan Smith is MeriTalk SLG's Staff Reporter covering the intersection of government and technology.