Only half the members of a federal commission advising states on election threats have security clearances, raising questions about whether it can effectively help local and state officials defend against adversaries such as Russian hackers.
And no members of the four-person Election Assistance Commission had clearances during the last two election cycles, including the period when Kremlin-linked hackers are suspected of mounting a range of cyberattacks against state election offices, the Democratic Party and Hillary Clinton’s campaign in 2016.
The delay in issuing security clearances for commission members is part of a massive backlog of application approvals throughout the entire federal government. But it’s a particularly acute problem for the EAC, one of the key agencies offering guidance to state and local officials about how to protect themselves from security risks.
“The people entrusted with securing our elections need to know what threats they’re supposed to address,” Sen. Ron Wyden (D-Ore.), one of the lawmakers who has focused the most on election security, told POLITICO in a statement. “An Election Assistance [Commission member] without a security clearance is like making a baseball player hit without a bat.”
Vermont Secretary of State Jim Condos, who previously led a national group of secretaries that works closely with the EAC, called it “imperative” that the commissioners receive their clearances “so that we can all be rowing in the same direction to defend our democracy against our foreign adversaries.”
“Ensuring the integrity of our elections and protecting them from undue foreign influence takes a whole team,” he said.
The situation may be on the verge of improving. Commission members Thomas Hicks and Donald Palmer, who lack clearances, hope to receive interim ones “in the near future,” EAC spokeswoman Brenda Soder said, adding that they have “completed the necessary paperwork and fingerprints.”
“In public comments, private meetings, official letters and testimony before Congress, the Commissioners have clearly and consistently stated their desire to obtain security clearances,” Soder said. “The EAC is pleased the Commissioners are now on track to gain their security clearances and believes this development will help the Commission enhance its ability to assist election officials and voters.”
Hicks, who chaired the commission in 2016 and 2018, first revealed he lacked a security clearance in an interview with a Baltimore television station in July. “We’re working on correcting that problem,” he said at the time.
Hicks has actually been waiting since August 2016, Soder told POLITICO. Palmer joined the agency in February.
Christy McCormick, the agency’s current chairwoman, has an interim clearance. Only Benjamin Hovland, who joined the EAC in February, has a full clearance, which he received in his previous job as a Senate staffer.
In addition, Hicks, McCormick and then-Commissioner Matthew Masterson all lacked security clearances during the 2016 election, and Hicks and McCormick still didn’t have them in 2018 — both periods when intelligence officials warned of Russian hackers probing vulnerable election systems and state officials frantically sought more information about the threat.
Without clearances, Hicks and Palmer have limited access to classified intelligence, potentially restricting their awareness of specific threats and vulnerabilities.
The government provides one-day “read-ins” so that people without clearances can attend specific events, and all four EAC commissioners were invited to a classified briefing in February under that arrangement, according to a U.S. official who requested anonymity to discuss internal processes. (Condos noted that the commissioners “have always had access and invitation to the briefings” for state officials.) But these temporary read-ins do not cover ongoing access to classified files.
Ben Buchanan, a cyber conflict researcher at Georgetown University who has written about election security, said a security clearance “almost always seems to be a necessary condition for meaningful understanding and policymaking in government cyber operations.”
“It’s possible that a lot of the commissioners’ work is state-focused and doesn’t require one,” said Buchanan, “but a clearance and appropriate briefings seem necessary to understand and help counteract foreign threats.”
The clearance issue also appears to undermine one of the core missions of the EAC, which is to serve as an emissary between local officials and federal bodies such as the Department of Homeland Security.
Even though relationships between DHS and states have improved, many state and local election officials contact the EAC more regularly than they do other federal agencies. But because Hicks and Palmer lack security clearances, they can’t fully serve as intermediaries or brokers on many sensitive security topics.
Many secretaries of state already have their security clearances, meaning there may be rooms that the secretaries can enter but the two EAC commissioners can’t, unless they received prior approval.
“I hope that the lack of clearances doesn’t prevent the commissioners from receiving threat and incident information and working with elections officials across the country to secure our democracy,” California Secretary of State Alex Padilla said in a statement.
The interim clearance that McCormick has — and that Hicks and Palmer may soon receive — is functionally identical to a permanent clearance, according to an official at the DHS Cybersecurity and Infrastructure Security Agency, who requested anonymity to discuss security matters. Agencies award interim clearances to people who are expected to pass their background checks to let them review classified material while that process continues.
Hicks and Palmer aren’t alone in waiting. DHS has acknowledged that the backlog in security clearances is particularly acute for state and local election officials, and in advance of the 2018 midterms, the department began making it a priority to approve clearances for election supervisors ahead of other applicants. But that priority evidently did not extend to the leaders of the EAC, ostensibly one of the closest partners to DHS on election security.
The clearance issue has probably compounded existing bureaucratic struggles for the EAC, a tiny agency that many lawmakers have treated as a backwater of the federal government ever since its creation in 2002.
President Barack Obama nominated Hicks to fill a vacant spot in April 2010. But the Senate was slow to act, and in December 2011, after the other EAC commissioners’ terms expired, the EAC went dormant for three years, with no leaders to vote on policy decisions. In December 2014, the Senate finally confirmed Hicks, along with Masterson and McCormick, whom Obama had nominated that July.
But the fourth commission spot remained open for several more years, and when Masterson left the EAC in March 2018, the commission again lost its quorum, preventing major decisions. President Donald Trump restored the EAC to full membership by nominating Palmer and Hovland, who were confirmed in January.
Article originally published on POLITICO Magazine