The Senate Intelligence Committee has issued a heavily-redacted report on Russian interference in the 2016 election. Though it did not discover any evidence that the Russians changed any election tallies, it found that the Russians targeted every state.
Russian efforts exploited the seams between federal authorities and capabilities, and
protections for the states. The U.S. intelligence apparatus is, by design, foreign-facing,
with limited domestic cybersccurity authorities except where the Federal Bureau of
Investigation (FBI) and the Department of Homeland Security (DHS) can work with state and local partners. State election officials, who have primacy in running elections, were not sufficiently warned or prepared to handle an attack from a hostile nation-state actor.
...
In an August 15, 2016, conference call with state election officials, then-Secretary [of Homeland Security Jeh] Johnson told states, "we're in a sort of a heightened state of alertness; it behooves everyone to do everything you can for your own cybersecurity leading up to the election." He also said that there was "no specific or credible threat known around the election system itself. I do not recall—I don't think, but I do not recall, that we knew about [State 4] and Illinois at that point."-- The Committee notes that this call was two months after State 4's system was breached, and more than a month after Illinois was breached and the state shut down its systems to contain the problem. During this call, Secretary Johnson also broached the idea of designating election systems as critical infrastructure.
A number of state officials reacted negatively to the call. Secretary Johnson said he
was "surprised/disappointed that there was a certain level of pushback from at least those who spoke up.... The pushback was: This is our—I'm paraphrasing here: This is our responsibility and there should not be a federal takeover of the election system."
