Wisconsin elections officials scale back security proposal

Listen to this article

By TODD RICHMOND
Associated Press

MADISON, Wis. (AP) — Wisconsin elections officials scaled back a plan on Tuesday to provide scores of new computers on loan to local clerks who are using outdated systems that are vulnerable to cyberattacks, saying the proposal is too expensive.

Wisconsin Elections Commission staff had proposed spending up to $300,000 on 250 new machines to loan to clerks who can’t afford new systems. The commission agreed to buy 25 computers for $30,000 after learning that only five clerks out of 2,000 were using the old systems.

“If they’re at risk we should help them,” Commissioner Mark Thomsen said. “(But) buying a machine isn’t the answer.”

The chief security officer of the commission, Tony Bridges, wrote in a memo released last week that “at least a handful” of clerks are logging into the state elections system using Windows XP and hundreds more are logging in using Windows 7.

Microsoft stopped supporting Windows XP in 2014. Free security upgrades for Windows 7 will end in January. Bridges wrote that it’s safe to assume a large percentage of clerks won’t make the switch and even clerks with current operating systems often fail to install security patches.

Bridges proposed spending as much as $69,000 annually on software that can test clerks’ vulnerabilities each time they log onto the state election system, as much as $300,000 on 250 computers that can be provided on loan clerks, and as much as $100,000 to hire a technology expert to help clerks with those computers. The money would come from a $7 million federal grant the state received in 2018 for election security.

He told the commission on Tuesday that staff members learned about the outdated systems by both asking all 2,700 local clerks to log into the system one day and by testing their connections. The commission spokesman, Reid Magney, said the test occurred a few weeks ago but didn’t have a date.

Bridges said 2,000 clerks logged in. Staff detected only five who were using Windows XP. Meagan Wolfe, commission administrator, told the panel said she didn’t know who the five clerks were; Magney told a reporter after the meeting he didn’t know why the commission knows none of the names.

Bridges went on to say nearly 600 clerks were using Windows 7. Seven hundred clerks didn’t log in on the test day.

Thomsen complained repeatedly that he hadn’t enough data about clerk vulnerability to justify a loan plan. Commissioner Ann Jacobs balked at the $300,000 price tag, saying it comes to about $1,000 a machine. Simple netbooks, she said, cost anywhere from $100 to $250. She also said a loan plan would reward clerks who don’t get new machines.

Wolfe and Bridges stressed the cost of licensing, tech support, delivery and warranties. Wolfe called the loan proposal an emergency measure designed to ensure elections can continue even as cyberattacks become more and more common.

In the end, Chairman Dean Knudson amended the loaner program language to authorize only 25 machines. The commission adopted the revised motion 4-2. Thomsen and Jacobs voted against it.

The commission voted unanimously to purchase the testing software and asked the board to begin using it in time to ensure there are at least some data for the commission’s Sept. 24 meeting. The panel also unanimously approved setting up the new technical support position but ordered staff to get the panel’s permission before advertising the job