After helping to keep the election secure from hackers, the CISA director turned to refuting the baseless claims of the president.
Five days ago, officials from both parties and across state and local governments issued a historic statement: “The November 3rd election was the most secure in American history.”
Amid the worst global health crisis in living memory, a record number of Americans successfully and safely cast their vote in the U.S. presidential election. That they were able to do so, and that officials across the country could testify to the integrity of the vote, is due in no small part to the efforts of Christopher Krebs, who was fired tonight as director of the Cybersecurity Infrastructure Security Agency, or CISA.
Krebs ran afoul of Donald Trump by refusing to let the president’s lies and baseless assertions about the election go unchallenged. In one of his final tweets as CISA director, Krebs wrote, “ICYMI: On allegations that election systems were manipulated, 59 election security experts all agree, ‘in every case of which we are aware, these claims either have been unsubstantiated or are technically incoherent.’”
For his efforts to secure America’s vote, Krebs was sacked by presidential tweet on Tuesday, nearly two years after Trump signed the legislation that created the agency under the Homeland Security Department. His deputy, Matt Travis, also resigned, reportedly upon learning that he would not take Krebs’s place at the agency’s helm. The acting director will likely be Brandon Wales, CISA's senior career executive and executive director.
Jeanette Manfra, a longtime DHS cyber leader who’s now at Google, described the state of U.S. voting when she and Krebs helped launch CISA in 2018. Election officials from all 50 states, which have historically run their elections independently of the federal government, had little trust in Washington or in one another. Even the various federal agencies tasked with elements of election security didn’t talk much to each other.
Manfra and Krebs viewed that as a vulnerability. “There was a gap in intelligence, if you will,” she said.
They began an outreach campaign. She described long hours on planes, criss-crossing the country, “building trust with the election official community.” Krebs, in particular, “spent a tremendous amount of personal energy on elections,” she said.
They premised their work on two principles. First, they would take an apolitical approach to secure the confidence of the political organizations that they would need as partners. Second, though they were experts on security, they would not pretend to be experts on elections.
“We came with a lot of humility,” Manfra said.
Their initial meetings were about listening to officials describe their processes, gathering information, building a foundation of knowledge. “We came to them and said, ‘We understand risk. We know how to think about risk. We understand security. Help us understand elections,’” she said.
From state to state, their meetings ranged from informal sit-downs to learn about officials’ pressures and challenges, to more formal engagements that different organizations set up.
“Our priority was understanding the world of elections; how it works, in as much detail as people would share with us, to understand what it’s like to be responsible for running an election.”
Krebs and Manfra set up a government coordinating council, which sounds unremarkable but was a first of its kind for the United States, a body of people from across the country who shared little beyond the fact that they were all American and all had some role in executing elections. “We were able to create a representative council so we deliberately had representatives that had urban areas, versus rural areas, highly populated states versus less. West. East. All these different…demographics, and bring them together and really use them as our sounding board and also just took their feedback...And adjusted.”
They also reached out to the hacker community at forums like DEFCON and RSA.
Those dramatic displays of teenagers hacking into voting machines that the president brandishes to sow doubt in the U.S. election outcome? CISA participated in those events. The hacker community was another constituency to win over, slowly, through effort, listening, and persistence.
“You have very passionate individuals that don't always see the bigger picture of the risk. Yes, given a perfectly undefended system, anybody can hack into it. I would hope you could,” Manfra said. CISA’s roles, she said, included taking that important technical information back to the manufacturer — but also evaluating the actual risk presented. How likely is it that you are going to run into enough unguarded voting machines on election day to actually change an election outcome? “I can understand how you can hack into this particular system in this scenario, but is that actually how it works in real life?” she would ask.
The simple fact is, people don’t vote in hotel rooms in Las Vegas as a teenager next to you destroys the machine you just voted on.
On Election Day itself, CISA officials held background calls every few hours, updating reporters on what was happening and not happening. That was typical of Krebs, who was often as accessible to the press as to a state elections officer. Not all of these briefings were particularly interesting, owing only to the fact that it’s hard to make compelling copy out of steady progress.
Krebs made more headlines by being fired than he did working. Krebs’s summary dismissal brought swift rebuke from Sen. Mark Warner, D-Va., the vice chair of the Senate Intelligence Committee.
“Chris Krebs is an extraordinary public servant and exactly the person Americans want protecting the security of our elections,” said Sen. Mark Warner, D-Virginia, in a statement. “It speaks volumes that the president chose to fire him simply for telling the truth.”
Sen. Jack Reed, D-Rhode Island, ranking member of the Armed Services Committee, said, “This is an appalling move by President Trump. He is firing Mr. Krebs out of petty vindictiveness. He clearly wants to remove officials who are in a position to rebut his misinformation… President Trump is still in denial. But there is no getting around the fact that he lost the election fair and square and the results clearly show President-elect Biden won both the popular vote and in the Electoral College by a wide, significant, irrefutable margin.”
That is the ultimate legacy of Christopher Krebs. There is no serious dispute about the integrity of the 2020 elections. There is only an incumbent who has lost. But America’s election infrastructure remains secure. For now.