Election officials push back against draft federal rule for reporting potential cyberattacks

SAN JUAN, Puerto Rico (AP) — A group of state election officials is urging the nation’s cybersecurity agency to revise a draft rule that would require election offices to disclose suspected cyberattacks to the federal government, casting the mandate as too burdensome on overworked local officials.

The new rule is the result of a 2022 federal law that directed the U.S. Cybersecurity and Infrastructure Security Agency to develop regulations that require certain entities to report potential cybersecurity breaches or ransomware attacks to the agency. Election offices fall under the requirement because their systems are considered critical infrastructure, along with the nation’s banks, nuclear power plants and dams.

In a letter, the executive board of the National Association of Secretaries of State asked CISA to consider making the rule voluntary, limit the types of information requested and more clearly define what types of cyber incidents would trigger a report. The proposed rule says state and local election offices must report suspected breaches within 72 hours.

The association is holding its summer conference this week in Puerto Rico, and some state election officials have been discussing their concerns directly with CISA Director Jen Easterly, who is attending. Easterly said in an interview Wednesday that she has been reviewing the group’s letter along with comments submitted individually by state election officials. She said her agency would consider the feedback and adjust as necessary.

The rule is not expected to be finalized until sometime next year.

“CISA was stood up to largely be a voluntary agency, and it’s our magic. It is how we’ve been able to build success,” Easterly said, noting the agency held multiple