Jeh Johnson: Cyberattacks 'are going to get worse before they get better'
- Former Department of Homeland Security Secretary Jeh Johnson says he does not know of evidence that Russian hacking affected 2016 vote tallies.
- But he adds that he can't say whether Russian efforts affected public opinion.
- Johnson outlines possible methods for state election officials to improve their cybersecurity.
Obama Homeland Security Secretary Jeh Johnson testified Wednesday that he does not believe Russian hacking "altered or suppressed" votes in the 2016 election.
Still, he contended that the United States "can and should do" more to protect its election systems from cyberattacks.
"There are lessons learned from this experience and, in the future, there is probably more we can and should do," he told the House Intelligence Committee.
In a prepared opening statement, Johnson said that cyberattacks "are going to get worse before they get better." During the hearing, he said possible fixes include giving state election officials grants to improve cybersecurity, better educating state and local officials about phishing attacks and putting a federal official at the DHS in charge of boosting protections.
Johnson appeared before the House committee as part of its probe into Moscow's efforts to influence last year's election. The Senate Intelligence Committee held a separate hearing with current officials. The U.S. intelligence community concluded in a January report that Russian President Vladimir Putin directed a campaign to sow doubts about the electoral process and damage candidate Hillary Clinton.
While Johnson said he had not seen evidence that vote tallies were influenced, he stressed that he cannot say whether Russia's effect on public opinion affected the election.
Current and former officials have warned of the potential for efforts to influence future elections. Johnson said he worries about the "vulnerabilities" in state voter registration databases.
"I think there needs to be more done to secure registration databases," he said.
In his testimony, Johnson said he found out about the hack of the Democratic National Committee in 2016, "months" after the FBI and DNC were already in contact about the cyberattack. The DNC "did not feel it needed DHS' assistance at the time" for the attack, which the U.S. has attributed to Russian-backed hackers.
In a statement, DNC spokeswoman Adrienne Watson said the organization "has and will continue to cooperate with law enforcement" and has "provided all the information [the FBI] needed to make its assessment." She said that DHS contacted the DNC "months after [the DNC] worked closely with the FBI" and that the DNC gave DHS "detailed information" about the attack.
Johnson offered help to state secretaries of state and other state election officials in mid-August and floated the idea of making election systems "critical infrastructure," which would make them a "top priority" for DHS services. He said state officials did not warm to the idea because some felt it was federal intervention in their systems.
He eventually did designate it critical infrastructure before President Barack Obama left office in January.
Around that time, Johnson said, he started to see reports of "scanning and probing" of state voter registration systems. By the time of the election, 33 states and 36 cities and counties used DHS cybersecurity tools.
Jeanette Manfra, undersecretary for cybersecurity at DHS, told the Senate on Wednesday that 21 state election systems were targeted. She did not disclose which states.
In October, Johnson and then-Director of National Intelligence James Clapper released a statement accusing the Russian government of cyberthefts and disclosures that "are intended to interfere with the US election process." The Obama administration has faced criticism for not making a bigger deal out of the Russian efforts before the election.
The House panel's ranking Democrat, Rep. Adam Schiff of California, asked Johnson on Wednesday why Obama did not divulge it publicly.
"We did make the statement," Johnson said of the one he and Clapper issued. "And we were very concerned that we not be perceived as taking sides in the election, injecting ourselves into a very heated campaign" or undermining the integrity of the election.
Johnson said he issued other public statements about cyberattacks on the election systems besides the October one. He added that he feels Americans paid less attention to the October statement because it came around the same time as the release of a 2005 tape in which then-candidate Donald Trump bragged about groping women.
Asked if he would do anything differently, Johnson said that "hindsight is brilliant."
He added: "In retrospect, it would have been easy for me to say I should have brought a sleeping bag and camped in front of the DNC."