Some Republicans in Washington state cast a wary eye on an election security device

In northeast Washington state, a remote region nestled against the Canadian border, the politics lean conservative and wariness of government runs high.

Earlier this year, a Republican-led county commission there made a decision that rippled across Washington — triggering alarm at the secretary of state's office, and now among cybersecurity experts who have worked for the past six years to shore up the security of America's voting systems.

It happened on Valentine's Day during the regular weekly meeting of the three-member commission in Ferry County, where Donald Trump received more than 63% of the vote in the 2020 election.

After an agenda that included an update on the county fair and a discussion about a local water and sewer district, the commissioners took up a proposal to disconnect a recently installed cybersecurity device from the county's computer network.

The device, known as an Albert sensor, was designed to alert local governments to potential hacking attempts against their networks. More than 900 Albert sensors have been deployed across the country, primarily to states and counties, and they have been a key component of the federal government's cybersecurity response following Russian election interference around the 2016 election.

But the commissioners in Ferry County had come to the conclusion that the sensor, which had been provided by the state at no cost, was more of a liability than an asset.

"Let's get rid of it," Commissioner Nathan Davis said before making his motion to remove the device.

The vote in support of the motion was unanimous.

"Bye bye, Albert sensor," one of the commissioners quipped.

Another county in Washington state also disconnected its sensor, and a third decided not to install one. It's an isolated trend in Washington at this point, but one that represents a stark example of how Republican mistrust in elections and government systems more broadly threatens to dismantle bipartisan progress made over the past decade to improve election security.

During the Ferry County meeting, Commissioner Davis quoted from a memo that circulated among Washington state Republicans. That memo, which NPR and the Northwest News Network obtained, raised a number of concerns about Albert sensors and also seemed to allude to the program being part of a left-wing conspiracy.

"Decisions are being made that are hurting the overall security of elections based on lies and untruths," said Matt Masterson, who led election security efforts leading up to 2020 within the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA). "It is entirely healthy and appropriate for citizens and elected officials to ask questions about the nature of the technology they use. ... But those conversations have to be based in fact."

An early-warning system

Named after Albert Einstein, the Albert sensor is what's called an "intrusion detection" device that looks out for known bad actors, or malicious IP addresses, on the network it's connected to. When a match is detected, a notification is sent to an around-the-clock security operations center located near Albany, N.Y. There, analysts review the traffic and, if the threat is deemed credible, send an immediate alert to that government warning of a potential hacking attempt.

The program is operated by the Center for Internet Security (CIS), which was founded in 2000 to address emerging cyber threats. While CIS is a nonprofit, it receives federal funding and works closely with CISA, the DHS cybersecurity agency.

The Albert monitoring program first began in 2011 but was ramped up after the 2016 election, following the Russian hacking attempts on a number of different state and local government systems that happened around that time.

It took months for the federal government to notify and distribute information to the relevant local government officials after those attacks.

"There was zero information-sharing going on in the elections realm with relation to cybersecurity until 2016," said Masterson, who added that Albert sensors were a key piece in addressing that problem.

Not only do Albert sensors help individual counties understand the threats they face, they provide a clearer national picture of what's happening online in all the different localities that administer elections in the U.S.

Because of that, Masterson says a county pulling out of the program also hurts that national visibility.

"The less participation, the less broad deployment of Albert sensors — or frankly, to take it out one step further, the less information being shared broadly across the community, the less secure our elections are," he said.

The Albert sensor in Washington's Ferry County was one of hundreds installed on the networks of state and local governments in the runup to the 2020 election.

While voting equipment is not connected to the internet, hackers could still wreak havoc on an election by breaking into a county's network. Once inside, they could freeze or alter websites, affect registration infrastructure, or do other things to harm public confidence in elections.

It's happened before. For example, in October 2020, just before the general election, a ransomware attack on Hall County, Ga., temporarily took down election-related systems, including a voter signature database.

"Hall County was in a precarious spot and you don't want to be in a precarious spot," said David Levine, a former election official who's now with the nonpartisan Alliance For Securing Democracy.

In an average month, CIS says it investigates more than 25,000 Albert sensor alerts.

"The analogy that I often use here is that we don't ask the county sheriff to be responsible for repelling military invasions, but that is really the equivalent of what they're up against on the internet," said Matt Blaze, a cybersecurity expert at Georgetown University who is not associated with the Albert program or CIS.

But in some Republican parts of Washington, the sensor came to be seen not as an insurance policy against hackers, but as a device that should be viewed with suspicion — a form of "big brother" watching over everything on a county's network.

'Didn't do a damn thing'

Directly south of Ferry County is Lincoln County, a deeply conservative wheat farming community.

In late 2021, Lincoln County commissioners terminated their agreement for an Albert sensor, just 13 months after it was signed, deciding the device was more of a liability than a safeguard. Their skepticism was rooted in the fact that shortly after the sensor was installed, the county fell victim to a crippling ransomware attack.

"This Albert sensor didn't do a damn thing about it," said Lincoln County Commissioner Rob Coffman, a Republican. "It didn't function as it was advertised."

CIS said that while Albert sensors can detect ransomware attacks, they're not foolproof because the program only recognizes known hostile addresses in a rapidly shifting threat landscape.

Blaze, of Georgetown University, said the ransomware attack should've been further evidence for the county that the Albert sensor was a good thing to have.

"The fact that state and local networks are often victimized by this type of attack is an example why you need defenses like this," Blaze said.

After the ransomware attack, Lincoln County beefed up its cybersecurity protections, but Coffman also began doing research about the Albert sensor. He said he learned that his county's information technology director had been wary of installing the device, but felt pressure from the state to do so. Coffman said he also talked to the IT director in neighboring Grant County, who had declined to install an Albert sensor out of concern that it could be a point of weakness for his network.

CIS responded that it has specific recommendations about how to deploy an Albert sensor on a network to allay those concerns.

Suspicion catches on

As part of his research, Coffman said he also started looking into CIS and learned that in 2018 the organization briefly partnered with another nonprofit that the conservative website Influence Watch said was connected with "left-leaning social welfare" groups.

It was enough to add fuel to a brewing conspiracy.

Coffman said he shared his findings with members of the Lincoln County Republican Party. Months later, in February 2022, the county GOP chair, Mary Blechschmidt, issued a two-page memo about Albert sensors to her fellow county Republican chairs.

In her memo, Blechschmidt wrote: "I continue to press on this issue because it is hard to imagine why a county would allow a non-profit organization such as this, access to the proprietary data on its network, 24/7 across the internet."

In an interview, Blechschmidt, who said she believes the 2020 election was stolen from Trump, rejected the suggestion that she was spreading misinformation about Albert sensors.

"We're trying to keep outside influences out of our data and we took the time to research it and determined that we don't want it and we don't need it," Blechschmidt said of the Albert sensor.

Also in the memo, Blechschmidt tried to tie CIS to the left by, among other things, citing a CIS co-founder's stints in the Clinton and Obama administrations. But the Albert sensor program was significantly ramped up under the Trump administration.

"We've had a long track record of being nonpartisan and trusted by states and counties all over the country," said Jason Forget, a CIS spokesperson.

Thirteen days after Blechschmidt issued her memo on the Albert sensors, the Ferry County commission voted to remove theirs.

During their discussion, Ferry's commissioners referenced Lincoln County's ransomware event. Davis, the commissioner who led the effort, also voiced concern about what the Albert sensor was capturing and where the county's data was going.

"It's scanning everything we do on our network and it sends it to a third party," Davis said.

Asked to address this concern, Geoff Hale, who leads the election security initiative for CISA, said Albert sensors passively monitor for potential trouble and don't have unfettered access to a client's data.

"It's almost like seeing a license plate to a car," Hale said. "And so this sensor is looking at all the traffic that passes. And if one of those license plates, one of those signatures, matches up to known bad infrastructure, it sends you an alert."

A 'misinformation campaign'

Word of Ferry County's decision to remove its Albert sensor soon reached Secretary of State Steve Hobbs, a Democrat, in Olympia, Wash.

"Immediately it occurred to me this was the start of, perhaps, a misinformation campaign directed at the Albert sensor and I was quite concerned about it," he said.

The secretary of state's office quickly convened a virtual meeting about the Albert sensor program and invited county officials from across the state to attend. Among the speakers at the February meeting was former Washington Secretary of State Kim Wyman, a Republican who spearheaded the deployment of Albert sensors in the state after the 2016 election. Wyman was appointed to oversee election security efforts for the Biden administration in 2021.

"The Albert sensor program is really a way for us to have one more layer of security and information that we can use to combat people who would do our system harm," Wyman told the counties.

The presentation ended with Hobbs making a direct appeal to skeptical county officials.

"If you do not have an Albert sensor, get the Albert sensor. If you have removed the Albert sensor or are thinking about removing the Albert sensor, please reconsider," Hobbs said.

That plea was not compelling to Ferry County Commissioner Davis, who has a background in IT. He said in an interview that he still has questions about how Albert sensors work, but did not have the time right now to continue researching them.

Davis also said he finds it odd that anyone cares whether his little county, with barely more than 7,000 people, has one or not.

"Why the hard push?" Davis asked. "What are the true motivations to push so hard on something that really doesn't do a lot?"

Davis said he's open to reinstalling the Albert sensor in the future, but would need to have more information before he's willing to do so.

CIS said the counties in Washington are the only ones to disconnect from the Albert program, and Hobbs said he thinks by responding quickly the state succeeded in stopping false narratives about the sensors from spreading.

Nationwide, Albert sensors still seem to have basically unanimous support. Ohio Secretary of State Frank LaRose, a Trump-endorsed Republican, mentioned them during a congressional hearing this summer.

"If you don't have [Albert sensors] at your county boards of elections you should do that," LaRose said. "So that way if something goes wrong on a Saturday night or Sunday morning, you can know about it before everyone comes back to work on Monday and you can mitigate the problem right then and there."

The vast majority of Washington's 39 counties have also embraced the program. In a series of interviews, county auditors, both Democrats and Republicans from small and big counties, praised the program and said they feel better knowing their county has an Albert sensor.

"We put it on and it's been working great," said Charles Ross, the Republican auditor in south central Washington's Yakima County. "It hasn't caused any problems."

Julie Wise, the nonpartisan director of elections in King County, the state's most populous, said the Albert sensor is "another data point" to help keep elections secure. She called efforts to undermine the Albert program part of a concerning pattern.

"This appears to be just another iteration of misinformation to discredit elections, like we've seen with ballot drop boxes, vote by mail and now it's Albert sensors," Wise said.

Copyright 2022 NPR. To see more, visit https://www.npr.org.