The primary activity undertaken by the Russian government, the report concludes, was the “scanning of election-related state infrastructure,” which Dr. Samuel Liles, acting director of the Department of Homeland Security’s Cyber Analysis Division, described in a committee hearing as “analogous to somebody walking down the street and looking to see if you are home.”
“A small number of systems were unsuccessfully exploited, as though somebody had rattled the doorknob but was unable to get in,” Liles said. “[However,] a small number of the networks were successfully exploited. They made it through the door.”
For the states that Moscow was successfully able to infiltrate, though, the report found that there isn’t any evidence that any votes or voter data were actually changed. In Illinois, which “experienced the first known breach by Russian actors of state election infrastructure during the 2016 election,” the Kremlin gained the ability to manipulate voter data, and DHS staff said that with “the level of access that they gained, they almost certainly could have done more.”
“Why they didn’t… is sort of an open-ended question,” DHS staff told the committee. “I think it fits under the larger umbrella of undermining confidence in the election by tipping their hand that they had this level of access or showing that they were capable of getting it.”
As for why DHS and state election officials weren’t able to put a stop to the election meddling, the answer seems to be a combination of a lack of knowledge or information and poor communication between DHS and state election officials.
“For most states, the story of Russian attempts to hack slate infrastructure was one of confusion and a lack of information,” the report notes, explaining that state officials were given notifications about suspicious I.P. addresses without ever being told that they had come from a “nation-state actor.”
The DHS, meanwhile, “saw its efforts as far more extensive and effective,” resulting in a “disconnect” between the two groups that lasted well into 2017.
“States reported that DHS seemed to have little to no familiarity with elections,” the report says, explaining the resulting “trust deficit” that happened between state officials and DHS after the election.
“DHS didn’t recognize that securing an election process is not the same as securing a power grid,” one state official told the committee. (Things have seemingly improved since then; the report notes that state officials believe DHS “[made] significant progress” ahead of the 2018 election.)