Idaho Secretary of State Lawerence Denney says the U.S. Department of Homeland Security may have tried to penetrate the state’s election website around the Nov. 8 election, without notifying state officials in advance.
“I don’t know what they penetrated, or what they tried, I just know their IP address showed up as hitting our website,” Denney told the Post Register on Monday. “I don’t know what they were doing. It would have been nice if they had told us.”
Denney’s comments follow similar accusations made by Georgia Secretary of State Brian Kemp in December. Kemp sent a letter to then-Homeland Security Secretary Jeh Johnson, saying that on Nov. 15, a week after the election, it appeared a DHS internet address tried to hack Georgia’s election network, including the voter registration database.
Denney said the Idaho incident was limited to the state’s public election website, which doesn’t contain any sensitive voter information.
A DHS spokesman said the department planned to study the Idaho incident specifically, but did not have an explanation Tuesday. A DHS statement said the department “will work with Secretary Denney’s office to address his concerns.”
It added: “When DHS conducts a cybersecurity scan of a network or system, we do so only with the cooperation and consent of the system owner.”
DHS officials previously said in the Georgia incident, an employee had been legitimately accessing databases on the Secretary of State’s website. But his computer was wrongly configured, and it falsely made it appear that an attempted hack had occurred on Kemp’s system.
Denney said Kemp was the one that tipped off other secretaries of state across the country, telling them to look for the same DHS internet address he claimed had attempted to “breach” Georgia’s computer firewall. Denney said “several states” reported back to Georgia that they found similar DHS addresses in their systems.
Denney initially mentioned the DHS incident as part of a larger speech on voter fraud and election hacking during the Feb. 4 Lincoln Day Banquet in Idaho Falls, hosted by the Region 7 Republicans. His comments come amid ongoing — and unproven — voter fraud allegations made by the Trump Administration, as well as concerns over Russia’s hacking and other efforts to influence the election’s outcome.
Denney said following the election, Idaho officials “looked at IP addresses that tried to get into our system.” They didn’t find “a single IP address from a foreign country.” Finding that would have been a major concern for many state election officials following allegations of Russia meddling in the election.
But, Denney said, “there was an interesting IP address that we found. That was our own Department of Homeland Security.” Denney said he was frustrated the agency would try to penetrate the state’s election website “without knowledge of why they would want to hack, and without telling us that they were trying to do penetration tests.” He said the finding “really concerned me, and it concerned a number of other secretaries of state across the country.”
In his speech and then interview Monday, Denney also expressed frustration over last month’s move by DHS to label elections as “critical infrastructure.” The designation — part of the Obama administration’s response to alleged Russia election hacks — put election equipment in the same protected group as the electric grid, nuclear reactors and the financial system, among other infrastructure.
“We don’t know for sure what declaring elections as critical infrastructure means,” Denney said Monday.
Johnson, in announcing the new designation Jan. 6, said the the change would “not mean a federal takeover, regulation, oversight or intrusion concerning elections in this country.”
But Denney and Deputy Secretary of State Tim Hurst say they are skeptical, and hope the new administration overturns the designation.
“The concern is, are they going to nationalize elections?” Hurst said in an interview. “If it’s to give states or counties access to computer expertise that the Department of Homeland Security has, that’s one thing. But if they’re just going to step in and do (the election) for you, that’s something else.”
Denney said the alleged DHS hacks and critical infrastructure designation would be hot topics of conversation as the nation’s secretaries of state gather for their Winter Conference over the next three days in Washington, D.C.
Another likely discussion topic: voter fraud. President Trump and members of his administration have repeated unsubstantiated claims of widespread voter fraud in the November election.
Denney said at least in Idaho, widespread voter fraud doesn’t exist. “I’m not going to say there’s not voter fraud anywhere in the country, but I’m going to say it’s pretty small in Idaho,” he told the crowd of Republicans earlier this month.
Denney said he is aware of just three cases of possible voter fraud in the last election. “And two of those can maybe be explained away by age,” he said. “There were two elderly people who voted absentee and then showed up at the polls to vote again.”
The last case occurred when a man allegedly attempted to vote in both Washington and Idaho. It was not known Tuesday if charges had been brought against any of the three individuals.