Hackers have targeted the voter registration systems of more than 20 states in recent months, a Homeland Security Department official said Friday.
The disclosure comes amid heightened concerns that foreign hackers might undermine voter confidence in the integrity of U.S. elections. Federal officials and many cybersecurity experts have said it would be nearly impossible for hackers to alter an election's outcome because election systems are very decentralized and generally not connected to the internet.
The official who described detecting the hacker activity was not authorized to speak publicly on the subject and spoke to The Associated Press on condition of anonymity. It was unclear, the official said, whether the hackers were foreign or domestic, or what their motives might be. ABC News earlier reported that more than 20 states were targeted.
Last month, Donald Trump, the GOP nominee for president, suggested that he feared the general election "is going to be rigged."
The Homeland Security Department has stepped up its outreach to states and localities, but it is up to them to ask for help. So far, 19 states have expressed interest in a general "cyber hygiene" scan of key websites — akin to ensuring that windows in a home are properly closed, according to another Homeland Security official directly involved in securing local elections who also was not authorized to speak publicly about ongoing efforts.
Homeland Security Secretary Jeh Johnson spoke to state election officials by phone last month, encouraging them to implement existing technical recommendations to secure their election systems and ensure that electronic voting machines are not connected to the internet.
DHS is offering states more comprehensive, on-site risk and vulnerability checks. Only four states have expressed interest in the assessment, and because the election is only weeks away, the department will likely only be able to conduct an assessment of one state before Election Day on Nov. 8, the official said.
These systems have "nothing to do with vote casting or counting," Stimson said in an email. "While it is theoretically possible to disrupt an election by infiltrating a voter registration system, their compromise would not affect election results" and there are system controls in place to catch any fraud.
Rep. Henry Johnson, D-Ga., introduced two bills earlier this month that would require voting systems be designated as critical infrastructure and limit purchases of new voting systems that don't provide paper ballots, among other measures. It's unlikely the bills will be passed before the election.
A presidential directive released in 2013 details 16 sectors that are considered critical infrastructure, including energy, financial services, healthcare, transportation, food and agriculture, and communications. The designation places responsibilities on the Homeland Security secretary to identify and prioritize those sectors, considering physical and cyber threats. The secretary is also required to conduct security checks and provide information about emerging and imminent threats.