Ahead of election, Lincoln and Ferry counties resist urging from secretary of state to reinstall cybersecurity device

In the last year, commissioners from Lincoln and Ferry counties voted to remove a security device that monitors county network traffic for threats, due to their suspicions of the nonprofit that operates the device. Heading into the general election Tuesday, the rural counties have indicated no interest in reinstalling the device.

At a Spokesman-Review debate two weeks ago, Secretary of State Steve Hobbs called it the result of a misinformation campaign.

The devices have wider implications for election security, but removing them will not alter the outcome of the election, experts said.

Nearly every county in Washington uses an alert system called an Albert sensor that monitors network traffic for known or suspected threats.

The sensors are operated by the Center for Internet Security (CIS), a nonprofit with programs that focus on providing cybersecurity for state and local governments and their election offices.

These programs receive federal funding from the Cybersecurity Infrastructure Security Agency (CISA) under the Department of Homeland Security, which allows local government organizations to participate at no cost.

There are more than 900 Albert sensors deployed by local governments across the country, and just over 50 in Washington state, according to Jason Forget, a CIS spokesperson.

After the 2020 election, Lincoln County was hacked with a ransomware attack that took months to resolve. The Albert sensor didn’t recognize the attack, which county commissioner Rob Coffman said was from a known virus.

Albert sensors are an intrusion detection system, not a firewall, so it only warns of threats when they are detected, but it does not block them.

After the attack, Coffman began researching the Albert sensor and CIS. He learned that the county IT director had recommended against installing the device. He also found what appeared to him to be organizations with left-wing ties donating to CIS. And he worried CIS could have direct access to the county network.

Pressure from the secretary of state’s office to use the device made him even more suspicious.

“I’m not claiming Albert sensors are nefarious or have a nefarious purpose,” Coffman said, but he doesn’t trust it.

The sensor only monitors metadata, Forget said. It cannot inspect or alter the content of network traffic.

Coffman remains skeptical. “They will tell you they are only passively monitoring. We’re going to take their word? We’re going to assume? That’s a tough pill for me to swallow.”

Coffman, a Republican, compiled a document listing his concerns, which was shared with GOP chairs in other counties.

Lincoln County disconnected their Albert sensor late last year. Neighboring Ferry County followed suit, removing theirs in February.

Hobbs, alarmed this trend might spread to more counties, provided talking points to county auditors across the state “to help them push back on this false narrative.”

Hobbs said he is committed to working with the counties to encourage them to turn their Albert sensors back on.

“This is a serious game,” he said. “We have overseas actors that are trying to constantly probe and disrupt our systems, whether public or private.”

As far as elections, Albert sensors have nothing to do with voting tabulators, because tabulators are on a self-contained system and are not connected to the internet or the county network. However, other parts of election infrastructure including voter registration databases are vulnerable.

For another example, a hacker could tamper with election result numbers displayed on a county website. It wouldn’t change the actual result of the election, but it could sow confusion and mistrust.

A hacker could tamper with many county operations besides elections, including the courts.

Albert sensors are an important part of having a robust security system, said Spokane County Auditor Vicky Dalton. She said Spokane County was one of the first counties in Washington to install an Albert sensor.

“What people may misunderstand is that the Albert sensor isn’t one-stop protection,” she said. “The function the Albert sensor performs is like a brick in the wall. You have to have the whole wall in order to have functionality. That’s why a good network has many, many layers of protection that are a variety of different pieces of software that serve a different function.

In Ferry County, Republican commissioner Nathan Davis said the fact that Albert sensors monitor the entire county network makes it a commissioner issue, not an auditor issue. He said a lot of commissioners had no idea it was on their networks.

Davis, who has a background in IT, questioned the value of nationalizing election security. “Is it a good idea to have one central port with access to every county in the country?” he said.

Since disconnecting their Albert sensor, Lincoln County has used a private company called Carbon Black to monitor its network.

The difference, Coffman said, is that the commissioners chose the company and it wasn’t pushed on them by the secretary of state. “We have what we feel is a better solution to securing our network,” he said.

The downside of this option, besides costing the county money, is that they are not part of a coordinated effort of information sharing of current threats across the state and country, said Charlie Boisner, a spokesperson for the secretary of state’s office. If there is a problem, the county will be on its own to deal with it.

Editor’s Note: This story was updated on Nov. 7, 2022 because the original version was missing the full name and title of Lincoln County Commissioner Rob Coffman.