Committee hears public testimony on election-security bill expanding preapproval, cybersecurity rules

The State Government & Tribal Relations Committee held a public hearing on engrossed substitute Senate Bill 5,014, a Secretary of State request that would expand what election systems and components must be preapproved, tighten breach-disclosure rules, and require new county cybersecurity measures.

Desiree Elmley, OPR staff, told the committee the bill would extend the Secretary's preapproval authority to any component of a voting system and to “any mechanical, electromechanical, or electronic equipment or platforms used to issue ballots,” to facilitate voter responses, to submit ballot-declaration signatures electronically, and to issue or validate voter identification. Elmley said the bill would also broaden which vendors must immediately disclose security breaches and would require new cybersecurity controls for county auditors.

Secretary of State Steve Hobbs said those controls reflect threats the state has seen. "In 2016 ... the Secretary of State's office under Kim Wyman, with the help of the National Guard, found Russian malware," Hobbs said, and later described ongoing targeting of state systems. He told the committee the office has assisted counties when attacks were detected and pushed for the bill as a way to protect elections from nation-state actors.

Kylie Abel, director of the information security and response division in the Office of the Secretary of State, described specific technical changes in the bill. Joining a .gov top-level domain, she said, "provides enhanced security like fraud prevention controls" and signals verified, publicly controlled sources. Abel said CISA (the Cybersecurity and Infrastructure Security Agency) administers the .gov program and that the transition is free for state and local governments. She added the office has provided up to $80,000 per county per fiscal year for the last two years to help counties implement election-security improvements and said the office has supplied nearly $3.4 million to counties previously and projects about $1.8 million this fiscal year, for roughly $5.0 million across three years to support county security work.

The bill would require, by 07/01/2027 (unless the deadline is extended), that each county auditor use a .gov domain for election systems; partition election IT infrastructure from other county assets; isolate ballot equipment from other networks; prohibit configurations that allow voting systems to connect to external networks or devices; require vendors to provide security-configuration documentation; and restrict data transfers from voting systems to single-use devices such as flash drives. Elmley and Abel said some counties already use many of the practices and the bill codifies them.

Paul Jewell, testifying for the Washington State Association of Counties, said association members support election security but worry the bill's language is broad and could be read to impose large, unanticipated costs on counties. Jewell told the committee some counties estimate costs "potentially in the millions," while others expect no added spending, and asked that sponsor amendments align the statute's wording with the administration's intended interpretation.

Several public witnesses urged caution about centralizing control. Sharon Hanek, an election observer from Bonney Lake, said she supports security but cautioned against micromanaging county equipment and called the ballot signature process "sacred," expressing concern about relying on electronic or phone-captured signatures for ballot curing.

Prime sponsor Senator Behnke told the committee his background in cybersecurity informed the bill and argued that standardizing and auditing the technical components would help restore public trust. "We're getting attacks almost a million times a day," he said, urging action to protect confidentially and integrity across counties.

No committee vote on Senate Bill 5,014 occurred during the hearing; the committee closed public testimony, then moved into its scheduled executive session to consider several bills.