Even as Americans begin voting in the earliest 2018 midterm primaries, the public still doesn't have solid answers about what happened to its election systems in 2016.
Instead it has conflicting accounts and official denials.
The latest example this week came from the Department of Homeland Security, which slammed a report by NBC News that said the intelligence community had evidence in early 2017 to believe Russian operatives compromised more state voter systems in 2016 than previously known. DHS said NBC's story was "factually inaccurate and misleading" and stood by its previous assessment, that just one state, Illinois, had its system breached.
NBC then slammed that response in a subsequent defense of its story, which quoted a former cyber-expert from the Obama administration, Michael Daniel, who said that when he was in the White House, it believed seven states had been compromised.
What's the real story? How serious were the Russian cyberattacks across the United States?
"We simply don't have enough information unfortunately because nobody is going past these one-line statements that are obscure or obtuse [at best]," said Mark Nunnikhoven, a vice president at the cybersecurity company Trend Micro.
In a written statement to NPR, Daniel declined to specify the number of states he believed had their systems compromised. He did, however, seem to offer a justification for why intelligence that officials had in early 2017 could have pointed to a different conclusion than DHS officials are drawing now.
"Since [January 2017], there have been numerous factual developments resulting from the various ongoing investigations related to Russian election interference," Daniel said. "The most important consideration is that the threat to electoral systems remains, and we need to continue to improve the security of such systems."
Government agencies probably have more detail than they've revealed about the attacks launched by Russia's military GRU intelligence agencies and other cyberaggressors over the past two years.
One clue about that was in a leaked National Security Agency report that laid out how Russian hackers targeted a specific elections vendor in Florida. Another was in the indictment released by Justice Department special counsel Robert Mueller charging 13 Russians and three Russian entities with using social media to amplify controversy within the United States.
On Tuesday, NSA Director Adm. Mike Rogers told members of Congress he expected that cyberaggression from Russia would continue this year and beyond as part of a strategic objective to shake Americans' faith.
"I believe they're attempting to undermine our institutions," he said.
Unless the government releases more information, however, the back-and-forth will likely continue between press accounts of the attacks and the denials from officialdom. Even the basic numbers quoted since 2016 of the states affected somehow by the cyberattacks have fluctuated all the way up to 50.
Six of the seven states mentioned in the NBC report told NPR that they found no evidence through their own independent reviews that their systems had been compromised. The seventh, Illinois, has been working with DHS since its voter registration system was broken into — though not altered — in the summer of 2016.
Other states said they couldn't corroborate the NBC story.
"After NBC reached out to our office, we contacted our partners in state and federal intelligence and law enforcement," said Jesse Melgar, California's deputy secretary of state. "None of them could corroborate NBC's claims nor has NBC provided any evidence to support their assertions."
All seven states were on the list of 21 states that DHS had previously said were probed, or scanned, by Russians. Experts liken the scanning process to looking into the window of a locked home without actually opening the window or climbing in.
So could Obama-era officials and people today in the Trump administration look at the same data from 2016 election and reach different conclusions?
Nunnikhoven said intelligence officials may have since either found out more about the events or found out more about the attackers, "so it might be easier to associate certain behaviors."
For now, though, "[Intelligence officials] are leaning a little too far on withholding information as opposed to right out and saying it," Nunnikhoven said. He added, "There needs to be a little more detail so it's far more credible when you hear those reassurances."
DHS says that it's being as forthright as possible and committed to continue building trust with the state officials it is helping. Reports like NBC's, it complained, undermine those bridges it is attempting to build.
Secretaries of state and election directors received a classified briefing from intelligence officials two weeks ago, and DHS is in the process of getting security clearances for officials in every state — efforts meant to mend a rocky relationship, between the intelligence community and the states, that only got rockier when it took more than a year for the states to find out they were scanned by Russians in 2016.
"You want a government that's a transparent as possible but there's always a recognition there are some places where transparency can be counter- productive to defense or other values," said Kevin Kennedy, who oversaw elections in Wisconsin until June of 2016.
"That's the nature of democracy — that tension."
Copyright 2021 NPR. To see more, visit https://www.npr.org.
