Wisconsin elections officials scale back security proposal

MADISON, Wis. (AP) — Wisconsin elections officials scaled back a plan Tuesday to buy scores of new loaner computers for local clerks using outdated systems open to cyberattacks, saying the proposal is too expensive when they don’t have a firm grasp on how many clerks really need new computers.

Wisconsin Elections Commission staff had proposed spending up to $300,000 on 250 new machines to loan to clerks who can’t afford to upgrade their systems. The commission agreed to buy 25 computers for $30,000 after learning that only five clerks out of 2,000 are using old systems.

“If they’re at risk we should help them,” Commissioner Mark Thomsen said. ”(But) buying a machine isn’t the answer.”

The commission’s chief security officer, Tony Bridges, wrote in a memo released last week that “at least a handful” of clerks are logging into the state elections system using Windows XP and hundreds more are logging in using Windows 7.

Microsoft stopped supporting Windows XP in 2014. Free security upgrades for Windows 7 will end in January. Bridges wrote that it’s safe to assume a large percentage of clerks won’t upgrade and even clerks with current operating systems often fail to install security patches.

Bridges proposed spending up to $69,000 annually on software that can test clerks’ vulnerabilities each time they log onto the state election system, up to $300,000 on 250 loaner computers for clerks, and up to $100,000 to hire a technology expert to help clerks with the loaner computers. The money would come from a $7 million federal grant the state received in 2018 to upgrade election security.

He told the commission Tuesday that staff learned about the outdated systems by asking all 2,700 local clerks to log into the system one day and testing their connections. Commission spokesman Reid Magney said the test occurred a few weeks ago but didn’t have a date.

Bridges said 2,000 clerks logged in. Staff detected only five using Windows XP. Commission Administrator Meagan Wolfe told the panel said she didn’t know who the five clerks were; Magney told a reporter after the meeting he didn’t know why the commission doesn’t have the names.

Bridges went on to say nearly 600 clerks were using Windows 7. Seven hundred clerks didn’t log in on the test day.

Thomsen complained repeatedly that he didn’t have enough data about clerk vulnerability to justify a loaner program. Commissioner Ann Jacobs balked at the $300,000 price tag, saying that works out to about $1,000 per machine when simple netbooks cost anywhere from $100 to $250. She also said a loaner program would reward clerks who don’t upgrade with new machines.

Wolfe and Bridges stressed the cost licensing, tech support, delivery and warranties. Wolfe called the loaner program an emergency stopgap designed to ensure elections can continue as cyberattacks increase.

In the end, Chairman Dean Knudson amended the loaner program language to authorize only 25 machines. The commission adopted the revised motion 4-2. Thomsen and Jacobs voted against it.

The commission voted unanimously to purchase the testing software and asked the board to implement it in time to produce at least some data for the commission’s Sept. 24 meeting. The panel also unanimously approved setting up the new technical support position but ordered staff to get the panel’s permission before posting the job.

Kelly Michaels, president of the Wisconsin Municipal Clerks Association, said she suspects clerks need more than 25 computers but there’s still time before the 2020 elections begin in earnest.

The commission also approved spending up to $341,000 to hire Madison-based advertising firm KW2 to develop an outreach campaign to combat disinformation about election security. The money will come from the 2018 federal election security grant.

Follow Todd Richmond on Twitter at https://twitter.com/trichmond1