The agency created to protect elections is broken
More than a decade before anyone worried about Russian bots, there were chads. The hanging chad was the most famous chad of all. But there was also the pregnant chad, the fat chad, the dimpled chad and the tri-chad. These were all minute variations on a scrap of paper a fraction of an inch in diameter, the vestige of a voting ballot not quite fully punched through. Hanging chads that could not be counted led George W. Bush to beat Al Gore in Florida in the 2000 election by 537 votes and become president. The hanging chad became the central image of that election, and of the Supreme Court case that decided it. Scenes of Florida election officials studying indentations on sheets of paper suggested a ridiculously outmoded system.
Two years later, Congress passed the Help America Vote Act, or HAVA, which was designed to provide funds for states “to replace punch card voting systems” and to “establish minimum election administration standards” for the nation’s 10,000 voting jurisdictions.
The law also provided for the creation of the Election Assistance Commission, or EAC, the nation’s first federal agency created to oversee elections at every level of government. But its mission has never been clear, and more than 15 years later, critics say the agency has succumbed to the whims of partisan operatives.
Lawrence Norden, an expert in the democratic process at the Brennan Center for Justice at the New York University School of Law, says that the EAC is a “necessary agency” that has “significantly strengthened federal guidelines for voting machine testing.” At the same time, he acknowledges that its “quite limited” mandate from Congress means that “huge swaths of our election infrastructure are left with no federal security guidelines.” Even more troubling is the risk that the EAC becomes, in Norden’s words “polarized by partisanship.” That has become a particularly disquieting concern since the 2016 election.
Russia’s involvement in the 2016 contest between Hillary Clinton and Donald Trump made Americans suddenly, acutely curious about how voting worked — and also about how easily that process could be subverted. As time went on, the extent of Russian interference became more troubling: there were the Twitter trolls, and fake Facebook groups, but also Kremlin “probes” of the electoral systems of 21 states.
Yet the agency that is supposed to ensure elections run smoothly is at odds with itself, working under a vague but limited mandate and overseen by officials who hold conflicting ideas about what matters in the world of electoral security. The EAC’s annual report for 2017, for example, is 55 pages long and mentions “Russian interference” a single time, and then only in the lengthy name of a congressional hearing. The word “foreign” — as in adversary, whether in Moscow, Pyongyang or Tehran, all of which intelligence experts believe could interfere with the democratic process in the near future — doesn’t appear a single time.
A product of the bitter 2000 election, the EAC was fated to represent partisan divisions instead of transcending them. And the officials who run the agency have not infrequently indulged political fictions while ignoring obvious, indisputable threats. After the extent of Russian interference became clear in 2017, they could have made the case — to Congress, to governors, to the American people — that the EAC needed expanded powers to ensure electoral safety, just as airport security had to be radically reconfigured after the 9/11 attacks.
“Instead,” one election expert laments, “they have focused on far less significant problems.”
*****
Today, the EAC is located in a featureless federal high-rise on a charmless suburban strip, inside the Beltway but miles removed from the real nodes of Washington power. The agency has a budget of about $9 million and a workforce of nearly 30. The commission was conceived as a bipartisan agency, but only in the most literal sense, with two commissioners appointed by each major political party.
For the first 13 years of its life, the EAC attracted little notice. A 2005 paper noted that the EAC had “no regulatory authority” because voting, like gun ownership, is ferociously protected by states as a sign of their independence from the federal apparatus in Washington. That meant, the paper concluded, that the EAC had little “coercive” power. The best it could do was “disseminate information,” which it did with reports on electronic voting, voting by mail and accessibility for disabled voters. It was an agency with few carrots and no sticks.
Nor was there anyone to wield either threats or inducements. From 2010 to 2014, the EAC was effectively a ghost agency, lacking commissioners and senior staff. There was not a single public meeting in 2011, 2012, 2013 or 2014.
Still, Republicans fearful of Washington infringing on states rights’ tried to eliminate the EAC. Rep. Gregg Harper, R-Miss., who chaired the House Administration Committee, made the first earnest effort to get rid of the agency in 2011. Harper called the EAC “an agency with an increasing size and a dwindling purpose;” one that “has proven time and time again that what the agency knows how to do best is be reckless and irresponsible with taxpayer dollars.” Harper argued that eliminating the EAC would save $33 million over five years, a laughably insignificant amount.
The EAC survived, but it remained mired in a philosophical (and political) tug of war between Democrats and Republicans over competing claims of fraud and voter suppression. Democrats accused Republicans of weakening the Voting Rights Act — a key aspect of Lyndon B. Johnson’s civil rights agenda — by implementing new restrictions on voting.
Republicans, meanwhile, were installing operatives in key federal posts.
In 2003, the George W. Bush administration appointed Bradley Schlozman, a young federal prosecutor who’d been working in Missouri, to head the civil rights division of the Department of Justice, which oversees enforcement of the Voting Rights Act and handles other forms of discrimination.
During the four years Schlozman spent at the civil rights division, a later investigation found, he “hired lawyers for career positions based on their political or ideological affiliations.” Schlozman told people he wanted to hire “real Americans,” and followed hiring decisions closely to make sure that mandate was enforced. Among the lawyers hired by the voting division during Schlozman’s four-year tenure was Christy McCormick, an unknown lawyer who’d most recently been a clerk to an appellate judge in Virginia.
In 2014, McCormick joined the EAC as a commissioner. Matt Masterson, a well-respected Republican election official from Ohio, also joined. The following year, the EAC also got a new executive director, Brian Newby, who had overseen elections in Johnson County, Kansas. While in that post, he’d conducted an extramarital affair with a female subordinate, though that was not revealed until an investigation by the Associated Press two years later. That report described Newby as “a rogue election official who berated employees and deliberately bypassed supervision.”
McCormick appeared intent on using the EAC to execute the vision of the Bush-era Department of Justice. The agency, which never had a clearly defined mission, was easy prey for ideological vehemence. In 2013, Arizona and Kansas had tried to institute proof of citizenship requirements for voter registration, but the federal courts said only the EAC could grant permission for the states to put such a policy in place.
In January 2016, Newby did just that, sending letters to the secretaries of state in Kansas, Georgia and Alabama that informed them that they could proceed with their efforts (those letters, like McCormick’s memorandum, are gone from the EAC website). A federal appellate court eventually decreed the proposed requirements “a mass denial of a fundamental constitutional right.” Litigation on the issue is ongoing.
As the November 2016 presidential elections approached, the EAC remained listless and unfocused. Records of meetings show that cybersecurity was discussed by agency staff, but no urgency was ever conveyed to Congress or the public. By the time that EAC Commissioner Thomas Hicks testified before a House subcommittee on information technology, on Sept. 28, 2016, Russian interference on all levels of the democratic process was becoming known. Hicks, however, was not especially concerned. The “American election administration system is secure,” he told Congress.
*****
Despite at least two years of warnings about Moscow’s plans to disrupt elections in the West, it was not until the summer of 2016 that the Obama administration took the Russia threat seriously. When it comes to Russia, “none of the recent US administrations have covered themselves in glory,” says Steven Hall, former head of Russian operations for the Central Intelligence Agency.
Colin Kahl, a former national security adviser to Vice President Joe Biden, recalled that after the president’s family returned from their annual vacation on Martha’s Vineyard, there were “very small, high-level meetings” convened by National Security Adviser Susan Rice. During those meetings, it became clear that the Russians might not just be trying to sway public opinion but were probing for ways to “actually tamper with votes.” Eventually, evidence of Russian probing of voter registration databases would be found in 21 states.
“At some point, there needed to be a public attribution of what the Russians were doing,” Kahl says. But unless there was Republican buy-in to such an attribution, any such announcement would only give credence to Trump’s conviction that the election was being “rigged” in Clinton’s favor.
The effort at a bipartisan condemnation of Russian efforts “hit a brick wall,” Kahl recalls, when it reached Senate Majority Leader Mitch McConnell, Republican of Kentucky, who “just didn’t believe it.”
The EAC’s response, perhaps not surprisingly, tracked closely with McConnell’s: the agency has largely declined to recognize the Russian threat. “They should be explicit about the threats and vulnerabilities of many older voting systems and should be urging election officials to purchase only systems that have voter-marked paper ballots,” says Barbara Simons, board chair of the not-for-profit Verified Voting, who also serves on the EAC’s board of advisers.
Brenda Soder, a spokesperson for the EAC, disputes that characterization. “It’s disingenuous and inaccurate to claim that the EAC doesn’t take election security threats from Russia or any other potential malicious actor — foreign or domestic — seriously,” she wrote in response to questions. “While it’s not our responsibility to identify cyber adversaries or investigate these threats, the commission has worked directly with DHS and the FBI to communicate such threats to election officials.”
Soder also points to the fact that the EAC “tested and certified six voting systems from four separate manufacturers” and conducted 12 training sessions across the country for election officials so they could become more familiar with information technology. She disputes the notion that the EAC has failed to provide oversight over the $380 million disbursement, noting that the agency is not able to do much more than advise states. It recently released an update on how states intend to use those funds, and plans an audit next year.
It is true that Congress hamstrung the EAC from the outset. But it is also true that the EAC’s commissioners dismissed the threat of Russia to the elections.
“Disappointing, underwhelming, and thin” was how McCormick, today the vice chair of the EAC, described the declassified intelligence report released in January 2017 that concluded Russia had definitely tried to influence the 2016 presidential election. “Connecting the allegations in the report to the election administration process and asserting that it rose to the level of interference in our elections is a gross and incorrect characterization,” McCormick wrote (the EAC has since removed the statement from its website).
McCormick’s letter was a collection of talking points Republicans were using in defense of Donald Trump — against the intelligence community that within weeks would be working in his service. The intelligence report McCormick dismissed had determined that “Putin ordered an influence campaign in 2016 aimed at the U.S. presidential election,” and that the goal of that campaign was to “denigrate Secretary Clinton, and harm her electability and potential presidency.” The same day, outgoing Department of Homeland Security Secretary Jeh Johnson designated the nation’s 14,000 separate election systems “critical infrastructure,” making them eligible for federal funds.
The letter caught the attention of Sen. Ron Wyden, D-Ore., who earlier this summer sent the EAC a letter of his own consisting of six detailed questions about how it plans to prevent cyberattacks. Wyden wanted to know how many cybersecurity experts the EAC employed; how it ensured that the voting systems it recommended were, in fact, safe, and how it planned to test those systems.
The commissioners sent back a 13-page letter that largely evaded the issues Wyden raised. “They ignored several of my questions, which is unacceptable,” Wyden told Yahoo News. Among the questions Wyden asked and the EAC declined to answer was whether McCormick remained a skeptic of Russian interference.
The EAC’s only other commissioner, Thomas Hicks, said in an interview he was confident in the measures that have been taken since 2016. Asked about electoral security, Hicks said that “one of the best defenses we have is for people to serve as poll workers,” Hicks said. He declined to talk about the letter McCormick had written. “You should talk to her about her letters,” he said. McCormick did not respond to direct requests for comment.
If the EAC wasn’t focused on the Russia threat, it was following the lead of the Trump administration, which was trying to switch the narrative to that of wide-scale voter fraud on Democrats’ behalf. Trump at once minimized the importance of the report. “Intelligence stated very strongly there was absolutely no evidence that hacking affected the election results,” the president-elect tweeted the day after the intelligence report came out.
In May 2017, Kris Kobach, Kansas’s secretary of state and a close ally of Newby, the EAC’s executive director, was picked to head Trump’s commission on voter fraud, predicated on his belief that millions had voted illegally in New York and California. Among those joining Kobach on that commission was McCormick, who also recommended that Department of Justice statistician Benjamin Overholt be appointed. “We had numerous discussions,” McCormick wrote to a Trump administration official in an email later made public, “that make me pretty confident that he is conservative (and Christian, too).” She offered no other evidence of his qualifications.
The voter commission was dissolved several months later, without having found any evidence whatsoever of voter fraud. McCormick, for her part, remains on the EAC.
In the meantime, the EAC now has two vacancies. One spot has been unfilled for some time; the other, until early this year, was occupied by Masterson, the Ohio official who has earned bipartisan admiration for his work. In February, the EAC made a confounding announcement: Masterson, who was chair of the commission at the time, would not be reappointed, a decision that reportedly came down from House Speaker Paul D. Ryan, Republican of Wisconsin. “It is pretty remarkable that in this environment,” said a Colorado election official, “given the importance of this issue, that the speaker would choose this moment to not reappoint the person doing the most work in this area.”
Asked for an explanation of why Masterson’s appointment was not extended, Ryan spokesperson AshLee Strong offered the following: “Mr. Masterson’s recommendation by the previous Speaker of the House expired in December and he agreed to stay on for an extended period while the next nomination proceeded. The speaker recommends a nominee and then the president formally nominates. Earlier this year, Speaker Ryan recommended Mr. [Donald] Palmer for the Election Assistance Commission and he is pleased the president has now nominated him for Senate confirmation.”
Palmer, a voting official from Virginia, was involved in a 2013 “voter integrity” effort that critics depicted as similar to those that Kobach has undertaken in Kansas. The following year, he was behind a Republican-led effort to enforce voter-identification laws in Virginia.
Not all Republicans on the EAC shared McCormick’s skepticism of the problem posed by Russia. After his term at the EAC ended, commissioner Matt Masterson moved over to DHS, where he is now a cybersecurity specialist. This spring, he testified in front of the Senate Judiciary Committee, offering an upbeat assessment: “Every state I travel to, state official I talk to, is taking this seriously.”
Masterson reiterated that confidence in a recent interview. “The progress made has been very real and immense,” he said, noting in particular the creation of an information sharing center that he says has more than a thousand members who come from all 50 states. The number of election-infrastructure monitors who look for “malicious traffic” has quadrupled, and now includes 36 states and “some” counties. “All 50 states are working with us in some way,” Masterson said, even as he acknowledged a “healthy skepticism” from states about federal involvement.
That skepticism has waned in some quarters of the GOP. “The vulnerability has been exposed by the Russians in 2016, and we’d be wise to close that vulnerability in the days ahead,” said Sen. James Lankford, Republican of Oklahoma, in a recent interview.
Lankford spent much of the spring and summer working with Sen. Amy Klobuchar, Democrat of Minnesota, on a bill that would have significantly strengthen the nation’s electoral systems (the bill was stalled at the urging of the White House). At a July hearing of the Senate Rules Committee, Lankford said he had “absolutely zero doubt” about Russian interference, but he also urged lawmakers to look beyond 2016 — and, in fact, beyond 2018.
Yet at that same hearing, Ted Cruz asked McCormick how seriously she took “the threat of an election being directly hacked.” McCormick did not seem especially worried, evincing the same confidence that Hicks had in his testimony before the 2016 election. Assessing that contest, McCormick agreed with Cruz that hacking did not alter election outcomes — an assertion that may be true but that ignores the complex, lasting damage Russia and other malefactors can (and have) caused.
McCormick offered a pithy summary of the 2016 interference campaign that would not have surprised anyone familiar with her work, or with the history of the EAC, an agency compromised from the start by ideological differences.
“Nothing happened,” she said.
_____
Read more from Yahoo News:
Omarosa says she’s ready to testify at Trump’s impeachment trial
Meet the man behind a new pro-Trump, Russian website in the U.S.
The bell tolls for John McCain: How Hemingway’s antifascist hero shaped the man
The Republicans are beating Democrats on Facebook, but by how much?
Beyond Mexico: How DHS rule changes may affect black immigrants
