On primary day in Virginia, officials say they’re preparing for more cyberthreats against elections

As five more states hold primary elections Tuesday, one of the biggest concerns in this year’s voting cycle continues to be how secure ballot systems are. But the lead elections official in Arlington County, Virginia, is confident votes there will be counted without issue.

“We have a practical, low-key approach,” said Linda Lindberg, Arlington’s director of elections.

Arlington is a bit of a model citizen for how jurisdictions conduct elections. Lindberg’s “practical” hews closely to what many ballot-security advocates call for: recording votes on paper ballots, which are then counted by optical scanners. Lindberg said her office also conducts routine tests of its equipment and scans its voter-registration system for vulnerabilities.

Virginia, where voters Tuesday will pick nominees for races in 11 congressional districts and one U.S. Senate seat — along with a host of local contests — is one of 19 states that only uses paper ballots with a verified paper trail to conduct its elections, according to Verified Voting , a ballot-transparency advocacy group.

Lindberg was joined at her office by Chris Krebs, President Trump’s nominee to be the undersecretary of homeland security in charge of the National Protection and Programs Directorate, a position that oversees several national cybersecurity programs. Krebs, who has been serving as the acting undersecretary since last August has visited elections officials in several states ahead of this year’s primary and general elections.

“Every jurisdiction is going to be a little different,” he said. “Even though we haven’t seen any direct threats like 2016, we need to be prepared.”

Virginia was one of three “purple states” mentioned as potential targets of the Internet Research Agency, a St. Petersburg company with close ties to the Russian government that conducts government influence operations, according to a federal indictment of the group filed in February. And a 2017 DHS report stated that Russian hackers attempted to penetrate voting systems in 21 states during the 2016 election.

In the months leading up to this year’s elections, Krebs said DHS is offering state and local election authorities services like vulnerability assessments and hygiene scans, along with help devising incident response plans. Among the the threats the DHS tools scan for are phishing emails that could target voter-registration files.

But not every problematic voting system is going to be fixed by November. Most of the $380 million allocated to the states by the Election Assistance Commission for security upgrades will not be spent until after 2018, Krebs said. So far, 31 states have requested the funds they were offered in April.

Krebs also endorsed the national trend away from digitized ballots. “We need to keep on track toward verifiable paper trails,” he said. Five states, though, still conduct all their elections on electronic machines that do not produce printed backups — New Jersey, Delaware, South Carolina, Georgia and Louisiana.

While Arlington appears to have mitigated many of its risks — Lindberg bragged her anti-phishing protocols are so aggressive she sometimes misses legitimate emails from colleagues — Krebs hinted there are plenty of other places that still need a lot of work.

“I keep looking for the problem jurisdictions,” he said.