Audit: Chicago Elections Board Not Ready for a Cyberattack

An audit by Inspector General Joseph Ferguson found that the elections board was lacking in human resource practices, but perhaps more concerning were the findings that highlighted gaps in disaster and cyber preparedness.

by Todd Lighty, Chicago Tribune / January 30, 2019
Shutterstock

(TNS) — The Chicago elections board can’t guarantee the integrity of voting results in the event of a natural disaster or cyberattack, the city’s watchdog warned Tuesday in a highly critical report of the agency’s operations.

The wide-ranging audit by Inspector General Joseph Ferguson also concluded that the Chicago Board of Election Commissioners does not post many job openings and has not conducted employee performance reviews in a at least 10 years. Ferguson said the board was warned a decade ago about many of the financial problems he’s uncovered and failed to correct them.

It’s the technological vulnerabilities, however, that the inspector general’s office found that could attract the most public attention. Governments have become increasingly concerned about computer hacks and the possibility of meddling in elections.

In the 2016 presidential race, Russians hacked into the Illinois State Board of Elections voter registration database, and compromised the names, addresses, birth dates and partial Social Security numbers of about 76,000 voters, federal authorities and election officials have said.

In Chicago, Ferguson found that the elections board does not have an emergency plan in place, has not inventoried its computer hardware and software, and has not conducted any audits or risk assessments during the past dozen years, leaving the outcome of city elections vulnerable to a computer hack or other catastrophe. He said the lack of a list of computer items could impede the election board’s ability to recover from disruptions.

“Public faith in elections is essential to a healthy democracy,” wrote Ferguson, who recommended that the agency create a detailed contingency plan and keep track of its computer hardware and software. “Taxpayers in Chicago deserve assurance that the resources they devote to the election process are spent in a transparent and accountable way.”

In a written response to Ferguson’s findings, the elections board asserted it already has “contingency plans in place for various emergency scenarios, including matters consulted with and agreed upon with the FBI and the Department of Homeland Security.” The board agreed to put those confidential plans in writing.

The board also said it has begun an inventory of computer hardware and recently hired an elections information security officer that it shares with the county.

Elections board spokesman Jim Allen accused Ferguson of engaging in scare tactics by releasing his report weeks before city voters go to the polls Feb. 26.

“The claim that the Chicago Election Board is not positioned to survive an attack is not only unfounded but highly alarmist, ” Allen said.

Allen said every precinct can function with paper ballots and paper poll books so that in the event of a disruption, voting could continue. Further, he said, voting equipment is designed and programmed to operate separately of computer systems running inside the board’s main office.

“In other words, if the computer systems at the board were to go down on election day, it would not impact the ability of voters to cast ballots. Nor would it interfere with the ability of the election agency or the campaigns to verify the results later.”

The Chicago Board of Election Commissioners, which was created in the 1880s, conducts elections in the city, handles voter registrations and oversees political candidates for city office. The Cook County clerk’s office handles suburban election duties.

The watchdog’s report could renew talks about merging the county and city election boards into a single agency. In 2011, a committee looking into combining city and county government services estimated that merging the separate election boards could save up to $10 million a year. Mayoral candidate Lori Lightfoot, a former federal prosecutor, revived the merger idea last summer when she called for merging the boards, which serve similar functions during election cycles.

In 2016, the city elections board initially resisted Ferguson’s attempts to investigate it, even though the board receives the bulk of its money from the city, and its 118 full-time employees are on the city’s payroll and receive the same benefits as city workers. That led to Circuit Court Chief Judge Timothy Evans — who appoints the three election board commissioners — to tap Ferguson to audit the board’s operations in 2017.

According to the report, Ferguson found that many of the problems were first uncovered by an outside firm in 2009, yet the board allegedly failed to take action and make changes.

Ferguson’s office said it found a host of problems that included sloppy record-keeping, poor budgeting and questionable hiring practices.

The board’s hiring and promotion practices are not transparent, which likely could cause employees to view the process as unfair, Ferguson wrote. “Job postings for managerial positions are almost exclusively internal, while hourly vacancies are not advertised and filled solely through word of mouth,” he wrote.

Ferguson also found that the board does not have a standardized form for job reviews and has not conducted performance evaluations in over a decade. “The most recent evaluation took place in 2008; prior to that, the last occurred in 2003,” he wrote.

In addition, the inspector general found the board has spent taxpayer money on unnecessary business expenses, overpaid three contractors by nearly $325,000 in 2015 and 2016, and regularly overspent money in its personnel budgets.

Ferguson said the unnecessary expenses, which would not have been allowed under city policy, included $7,975 for tickets to events, table sponsorships, and advertisements at galas and other events. He said $847 was spent on breakfast and lunch meetings in the Chicago area, and $246 was spent to upgrade seating on airlines.

Most of the expenses, Ferguson said, were incurred by the election agency’s longtime executive director, Lance Gough.

Ferguson found other financial problems. The watchdog office said it uncovered 27 instances totaling $5.7 million in 2016 where the board violated its own policies by either not seeking competitive bids for contracts, by not providing justifications for modifying existing contracts and by not obtaining required economic disclosure statements from contractors.

The inspector general recommended the board “undergo regular independent, external audits; develop and publish financial policies; develop accurate budgets; ensure that its purchasing department is included in all procurement activities; and correct outstanding financial inaccuracies.”

For its part, the board agreed with some of Ferguson’s findings, disagreed with others and asked for an extension until late May — after the municipal elections — to give fuller responses.

Marisel Hernandez, the board’s chair, wrote to Ferguson on Jan. 16 and said commissioners will continue working with the city and county governments to ensure money is appropriated and budgeted properly.

“The board completely agrees with the need for audits, transparency and certain recommendations for corrective measures, your deadline imposed on the board to respond … does not afford the board an adequate amount of time to assess your conclusions and propose a workable solution, if necessary,” Hernandez wrote in response to a number of Ferguson’s findings.

©2019 the Chicago Tribune. Distributed by Tribune Content Agency, LLC.