1
00:00:00,000 --> 00:00:03,780
Barbara Simons, who's the president of Verified Voting.

2
00:00:07,700 --> 00:00:09,300
I'll let everybody get seated really quick.

3
00:00:09,880 --> 00:00:17,080
And I'll let you guys do just a couple minutes each on who you are and your organization and so on.

4
00:00:19,400 --> 00:00:22,200
And then Dave Forsey with the National Governor's Association.

5
00:00:25,260 --> 00:00:29,840
And Eric with the Center for Internet Security, which is the group that runs the MSISAC,

6
00:00:29,980 --> 00:00:32,260
as well as the 20 critical cybersecurity controls.

7
00:00:32,500 --> 00:00:38,300
So with that, I'll actually turn it over to you guys to be able to talk a little bit about your organization and yourself.

8
00:00:38,600 --> 00:00:42,240
Okay. All right. So hi, everybody. I'm Eric Kammerling. I'll start out, I guess.

9
00:00:42,840 --> 00:00:47,240
I'm from the Center for Internet Security and CIS. I'm going to refer to it as CIS.

10
00:00:48,000 --> 00:00:52,180
CIS produces a number of free things for the larger cybersecurity.

11
00:00:52,200 --> 00:01:00,560
Among them being the top 20 security controls, which are a set of technical controls that any organization can use for free

12
00:01:00,560 --> 00:01:07,260
to enhance the cybersecurity stance of their organization, be it private, educational, government, you name it.

13
00:01:07,300 --> 00:01:08,260
Everyone's free to use them.

14
00:01:08,900 --> 00:01:16,180
And so that's one half of CIS, secure benchmarks, top 20 controls, a community that we run for the benefit of everybody.

15
00:01:16,340 --> 00:01:21,480
And the other half of CIS is the MSISAC, which is a DHS-funded program.

16
00:01:22,120 --> 00:01:25,740
MSISAC standing for Multi-State Information Sharing and Analysis Center.

17
00:01:25,920 --> 00:01:32,940
And the MSISAC has built a relationship with all of the 56 states and territories throughout the U.S.

18
00:01:33,240 --> 00:01:35,620
And we run a network called Albert.

19
00:01:35,800 --> 00:01:43,220
And Albert is closely related to the federal network called Einstein, which is used to monitor .gov space.

20
00:01:43,540 --> 00:01:47,200
Albert monitors state, local, tribal, and territorial space.

21
00:01:47,540 --> 00:01:51,300
And we have sensors throughout the United States in almost every single,

22
00:01:51,480 --> 00:01:53,380
state and territory in the U.S.

23
00:01:53,840 --> 00:02:00,840
So you can think of us, one half of CIS, as an intrusion detection system that covers the entire continental U.S.

24
00:02:01,300 --> 00:02:03,140
So that's my intro to what I do.

25
00:02:03,260 --> 00:02:04,420
And over to you.

26
00:02:04,520 --> 00:02:04,880
There you go.

27
00:02:05,320 --> 00:02:06,220
Thank you very much.

28
00:02:06,540 --> 00:02:10,760
I help lead our cybersecurity work at the National Governors Association.

29
00:02:11,060 --> 00:02:15,900
For those who don't know, the National Governors Association is a special snowflake.

30
00:02:15,940 --> 00:02:18,500
Half of it was actually created by statute.

31
00:02:18,680 --> 00:02:20,040
So it's not a 501c3.

32
00:02:20,360 --> 00:02:21,420
It's not a corporation.

33
00:02:21,420 --> 00:02:21,460
It's not a corporation.

34
00:02:21,480 --> 00:02:23,200
It is a statutory entity.

35
00:02:23,420 --> 00:02:25,300
It's called the instrumentality of the states.

36
00:02:25,440 --> 00:02:28,480
So every state that's a member, which is virtually every state and territory,

37
00:02:28,700 --> 00:02:32,320
pays in dues, and it pays for certain services for governor's offices.

38
00:02:32,600 --> 00:02:37,540
I work at the other arm, which is called the Center for Best Practices, which is a 501c3.

39
00:02:38,100 --> 00:02:45,880
So we get money from foundations, corporate donors, and federal grants to help states with policy problems.

40
00:02:46,320 --> 00:02:50,280
Specifically, I help states with cybersecurity strategy.

41
00:02:51,040 --> 00:02:54,500
Cybersecurity governance and cybersecurity disruption response.

42
00:02:54,880 --> 00:03:02,520
We like to say that, as everyone in this room knows, we have in many ways figured out the technical methods needed to stop cyberattacks.

43
00:03:02,680 --> 00:03:07,000
A lot of the state CIOs and CISOs who run the state systems know this.

44
00:03:07,160 --> 00:03:11,520
The hard part is actually getting people to do it, and that's where governance comes in.

45
00:03:12,140 --> 00:03:20,260
We have become much more involved in the election issue, and I'm here to talk more about that, but I'll let you ask questions, and I'll leave it to you.

46
00:03:20,280 --> 00:03:20,620
Barbara.

47
00:03:22,420 --> 00:03:23,580
I'm Barbara Simons.

48
00:03:23,620 --> 00:03:25,020
I'm president of Verified Voting.

49
00:03:25,460 --> 00:03:32,580
I'm a computer scientist by training, and I got into the whole voting issue around 2003,

50
00:03:34,220 --> 00:03:40,740
and because several of us computer scientists were kind of appalled that Silicon Valley was about to buy paperless voting machines.

51
00:03:41,160 --> 00:03:43,920
And despite our best efforts, they went ahead and bought them.

52
00:03:44,160 --> 00:03:49,500
But we got sucked into this, and like many of my colleagues,

53
00:03:49,600 --> 00:03:50,060
who,

54
00:03:50,280 --> 00:03:56,320
I've observed over the years, the more they get, the more they learn, the more they get, have to get involved because they just can't believe what's going on.

55
00:03:56,420 --> 00:04:01,580
And I hope that will happen to all of you here, if it hasn't already, because we need all the help we can get.

56
00:04:02,260 --> 00:04:09,600
I'm very concerned, and I know many of you are, too, about what will happen to our democracy if we don't fix our badly broken voting systems.

57
00:04:09,960 --> 00:04:11,940
That's what Verified Voting has worked on for years.

58
00:04:12,060 --> 00:04:14,080
We've worked on making voting secure.

59
00:04:14,180 --> 00:04:15,580
We've focused on the technology.

60
00:04:16,180 --> 00:04:18,500
We're basically mainly a bunch of geeks.

61
00:04:18,540 --> 00:04:20,040
We have some attorneys and election officials.

62
00:04:20,280 --> 00:04:22,760
Also, who are involved on our board and advisory board.

63
00:04:22,900 --> 00:04:27,640
But our main focus has been on making voting technology more secure.

64
00:04:27,960 --> 00:04:29,240
We know how to do it.

65
00:04:29,280 --> 00:04:30,480
We know it needs to be done.

66
00:04:30,620 --> 00:04:31,840
We just have to get it done.

67
00:04:34,220 --> 00:04:34,840
All right.

68
00:04:34,880 --> 00:04:35,880
Thank you, everybody.

69
00:04:36,120 --> 00:04:38,580
So I guess my first question, I'll go to Eric.

70
00:04:39,320 --> 00:04:42,780
You mentioned a little bit about the 20 critical cybersecurity controls.

71
00:04:43,080 --> 00:04:49,960
And I know several of the speakers today have talked about the need for state and locals,

72
00:04:50,280 --> 00:04:58,960
to implement basic cyber hygiene, I think, that on their networks and their databases most people in this space

73
00:04:58,960 --> 00:05:03,420
would consider basic cyber hygiene to be at least doing the top five critical cybersecurity controls.

74
00:05:03,600 --> 00:05:06,040
Do you mind just kind of telling folks what those are?

75
00:05:06,360 --> 00:05:09,340
You have to do all of them and even that's not even a four-word answer.

76
00:05:09,980 --> 00:05:10,460
Okay.

77
00:05:10,620 --> 00:05:11,280
Oh, sorry.

78
00:05:12,460 --> 00:05:15,960
So, well, let's start by talking about what cyber hygiene is, right?

79
00:05:16,020 --> 00:05:20,260
Hygiene meaning trying to raise the bar for some sort of a system or system that's going to be able to do all of these things.

80
00:05:20,280 --> 00:05:27,120
And so we're talking about a system of systems to a level where, you know, it's generally resistant or at least more resistant to epidemiological type threats.

81
00:05:27,260 --> 00:05:29,260
That's why I think of hygiene, cyber hygiene.

82
00:05:29,780 --> 00:05:31,520
And so what are the top five?

83
00:05:31,740 --> 00:05:35,700
I mentioned the top 20 security controls that CIS produces, but what are the top five?

84
00:05:36,580 --> 00:05:44,600
We often tout the top five as the easiest way for any organization to get to that sort of hygienic stance, right, where you know that you're taking care of the low-hanging fruit.

85
00:05:44,920 --> 00:05:50,260
So the top five CIS controls are asset inventory of old assets.

86
00:05:50,280 --> 00:05:54,280
Asset inventory over what is known or authorized or unauthorized hardware in your environment.

87
00:05:54,820 --> 00:05:59,440
Asset inventory over what is known or authorized or unauthorized software in your environment.

88
00:06:00,070 --> 00:06:02,900
Secure configuration of that software and that hardware.

89
00:06:04,080 --> 00:06:09,680
Continual and cyclical vulnerability assessment of that hardware and software, of said hardware and software.

90
00:06:10,000 --> 00:06:17,900
And lastly, figuring out who should have administrative control and what does administrative control mean in your environment over that hardware and software.

91
00:06:18,180 --> 00:06:19,590
So those five topics.

92
00:06:19,590 --> 00:06:24,350
If everybody, let's use it, since we're talking about elections, those five topics.

93
00:06:24,570 --> 00:06:34,710
If all election networks or if all election systems were to implement those top five pieces of guidance, then the overall hygienic stance of the election system would be enhanced thusly.

94
00:06:34,750 --> 00:06:34,990
Right?

95
00:06:35,070 --> 00:06:37,530
So that's cyber hygiene or that's the top five for you.

96
00:06:37,710 --> 00:06:38,050
Great.

97
00:06:38,130 --> 00:06:38,450
Back.

98
00:06:40,490 --> 00:06:43,710
So I guess, and Barbara, I'll put this to you.

99
00:06:45,010 --> 00:06:49,570
You know, as I think we know, you know, most state and local governments, for various reasons,

100
00:06:49,570 --> 00:06:56,050
many of which are out of their control, aren't able today, at least, to implement those top five controls.

101
00:06:56,830 --> 00:07:08,810
But a lot of those controls are the actual sensors and so on on the network that can tell you when the bad guys got in, what did the bad guys do, and so on.

102
00:07:08,970 --> 00:07:19,550
And so what I think we've seen reported to Congress and in the media by a lot of folks is like, is this term of, oh, we haven't seen any evidence that this,

103
00:07:19,550 --> 00:07:25,190
you know, we haven't seen any evidence that votes were tampered with or that the voting registration databases had deletions or changes or so on.

104
00:07:25,570 --> 00:07:36,170
But I guess the question is, if they're not doing even these basic five controls and the sensors aren't there to really understand what's going on, isn't the more appropriate,

105
00:07:36,330 --> 00:07:44,490
isn't the more accurate answer, well, we really don't know what happened in the election and have no way of telling what happened until those sensors and so on are in place?

106
00:07:44,770 --> 00:07:48,190
So, Barbara, I know you guys have been working on this.

107
00:07:48,190 --> 00:07:48,450
What do you think?

108
00:07:49,550 --> 00:07:50,470
A couple of different thoughts.

109
00:07:50,470 --> 00:07:51,930
And by the way, anybody else who wants to jump in?

110
00:07:51,990 --> 00:07:52,090
Yeah.

111
00:07:52,950 --> 00:08:01,230
First of all, obviously these top five requirements need to be in place, but frankly, they're not adequate.

112
00:08:01,710 --> 00:08:04,510
I mean, they certainly will not protect against a nation state attack.

113
00:08:04,870 --> 00:08:06,670
In fact, the top 20 won't.

114
00:08:06,810 --> 00:08:09,350
It's much more serious than that.

115
00:08:09,390 --> 00:08:18,230
I mean, the fact that we are here talking about trying to get the top five in place I think is a very sorry reflection on the state of the security of our voting systems in this country.

116
00:08:19,490 --> 00:08:21,770
I mean, I don't mean to take away from what you're doing.

117
00:08:21,790 --> 00:08:22,450
It's very important.

118
00:08:22,650 --> 00:08:23,470
I don't disagree with you.

119
00:08:24,690 --> 00:08:25,030
Yeah.

120
00:08:25,850 --> 00:08:27,270
So, we need much more.

121
00:08:27,390 --> 00:08:28,870
We need a sense of urgency.

122
00:08:28,990 --> 00:08:33,830
We need sort of like, what was it, the Chicago project?

123
00:08:33,930 --> 00:08:36,390
Well, the bomb, what was the project for building the bomb?

124
00:08:36,490 --> 00:08:36,870
Was it Chicago?

125
00:08:37,230 --> 00:08:37,570
Manhattan.

126
00:08:37,710 --> 00:08:37,990
Manhattan, yes.

127
00:08:38,090 --> 00:08:39,810
But it was at Chicago, but it was called the Manhattan Project.

128
00:08:40,170 --> 00:08:40,510
Right.

129
00:08:40,610 --> 00:08:42,590
We need a Manhattan Project for our voting systems.

130
00:08:42,750 --> 00:08:43,630
That's really what we need.

131
00:08:44,390 --> 00:08:48,130
Now, in terms of the 2016 election, I don't think we're going to be able to do that.

132
00:08:48,130 --> 00:09:02,410
We do know that at least one voter registration database, one vendor for voter registration databases was hacked, and we know, for example, that that vendor was what was used in Durham, North Carolina, where there were major problems on election day.

133
00:09:02,970 --> 00:09:18,110
As far as I know, nobody has gone back to do an analysis of the voter registration database in Durham, North Carolina, to see if there were a lot of changes made to people's names or addresses or various information that would send them off to the wrong address.

134
00:09:18,130 --> 00:09:19,470
There's no way that a voter registration database would be in the wrong place to vote and create chaos.

135
00:09:19,830 --> 00:09:23,630
So we don't know, even in that case, where we know that the vendor had been hacked.

136
00:09:24,330 --> 00:09:37,170
In the case of throughout the country on the voting machines, even where there are paper ballots in most cases, we did not do an adequate check to see if any hacking had occurred there.

137
00:09:37,270 --> 00:09:41,270
And of course, where there is no paper, it's almost impossible to check.

138
00:09:41,390 --> 00:09:48,110
I mean, we could try impounding the machines and doing a forensic analysis, but it's very hard, as I'm sure you guys know, it's very hard to do a forensic analysis.

139
00:09:48,130 --> 00:09:52,570
analysis of a computer, and even if you do it and don't find something, it doesn't mean

140
00:09:52,570 --> 00:09:53,370
something wasn't there.

141
00:09:53,550 --> 00:09:58,510
So the bottom line is we do not know if the 2016 election, the votes themselves were hacked

142
00:09:58,510 --> 00:09:58,870
or not.

143
00:09:59,010 --> 00:10:02,290
We don't know if the voter registration databases were hacked or not.

144
00:10:03,350 --> 00:10:05,930
And it's unacceptable to be in that state of ignorance.

145
00:10:06,410 --> 00:10:12,150
We need to make our election such that we know that the correct candidates, the candidates

146
00:10:12,150 --> 00:10:14,210
who were declared the winners, were in fact the winners.

147
00:10:14,210 --> 00:10:16,990
We do know how to do that, but we're not doing it now.

148
00:10:17,270 --> 00:10:19,290
So did you want to defend?

149
00:10:21,370 --> 00:10:23,850
Although you were right to hand it to Dave because my next question is for him.

150
00:10:24,190 --> 00:10:28,330
But so, you know, some of this is kind of really technical, like the stuff CIS does.

151
00:10:28,630 --> 00:10:33,550
I think some of the auditing and so on that verified voting talks about is obviously really

152
00:10:33,550 --> 00:10:33,770
important.

153
00:10:33,910 --> 00:10:40,270
But, you know, oftentimes we hear about what secretaries of state want or county clerks,

154
00:10:41,150 --> 00:10:43,110
you know, suggesting to do this, that, or the other thing.

155
00:10:43,110 --> 00:10:46,990
But it seems to me that governors are actually really important to this conversation.

156
00:10:47,310 --> 00:10:56,630
And I'd really love to hear how NGA or you, Dave, specifically are thinking about this

157
00:10:56,630 --> 00:10:58,530
in terms of the role of governors and so on.

158
00:11:00,090 --> 00:11:01,330
Okay, so a few caveats.

159
00:11:01,970 --> 00:11:08,250
Nothing I say here today is in any way articulating an official position of the National Governors'

160
00:11:08,290 --> 00:11:09,810
Association or any governor's office.

161
00:11:10,670 --> 00:11:11,150
Okay.

162
00:11:11,210 --> 00:11:11,590
Period.

163
00:11:11,590 --> 00:11:11,670
Period.

164
00:11:12,630 --> 00:11:19,930
That being said, my team at NGA, we're not, we don't have technical backgrounds, right?

165
00:11:20,010 --> 00:11:22,630
We're engineers at heart, but we do not have degrees in computer science.

166
00:11:22,790 --> 00:11:23,370
We're lawyers.

167
00:11:23,750 --> 00:11:25,550
We think this is a huge problem.

168
00:11:26,990 --> 00:11:32,230
We know that governors have a role because while under many state constitutions the

169
00:11:32,230 --> 00:11:37,890
secretary of state is a constitutionally separate branch from the governor, the fact is that

170
00:11:37,890 --> 00:11:41,570
a lot of the deployable assets and a lot of the assets that the governor has, they're

171
00:11:41,570 --> 00:11:46,050
actually expertise relevant to cybersecurity, resides in state agencies that are under the

172
00:11:46,050 --> 00:11:47,370
purview of the governor.

173
00:11:48,070 --> 00:11:53,290
In many cases, a lot of the back end systems that are used to run elections, like voting

174
00:11:53,290 --> 00:11:58,630
registration databases, are actually part of the services that the CIO's office manages.

175
00:11:59,070 --> 00:12:05,390
So there's no question that when it comes to actually preventing attacks and responding

176
00:12:05,390 --> 00:12:07,430
to attacks, that governors have a role.

177
00:12:07,670 --> 00:12:11,550
I'd also point out that if you want to make any changes to election law, governors have

178
00:12:11,550 --> 00:12:14,390
a role, not necessarily policy, but law, you'll need to sign legislation.

179
00:12:14,730 --> 00:12:18,090
And governors are the ones that sign legislation, and if you want them to sign it, they need

180
00:12:18,090 --> 00:12:18,670
to have buy-in.

181
00:12:18,810 --> 00:12:23,550
I'd also say that the bully pulpit that governors have is incredibly valuable in terms of raising

182
00:12:23,550 --> 00:12:27,490
the profile of this issue at the county level, state level, and federal level.

183
00:12:27,630 --> 00:12:31,550
If you want a HAVA 2.0, you're going to need governors on your side.

184
00:12:31,710 --> 00:12:33,810
So that's why we definitely deserve to be in the conversation.

185
00:12:35,910 --> 00:12:41,530
So in the same vein, I'm wondering from the MSISAC's perspective, if you're seeing, if

186
00:12:42,290 --> 00:12:50,430
you're seeing governors or other state executives bringing their CIO or CISO into the conversation

187
00:12:50,430 --> 00:12:56,770
on how to better secure our voting systems, both from the back-end database and network

188
00:12:57,770 --> 00:13:01,070
perspective, as well as kind of the front-end stuff that Verified Voting talks about, which

189
00:13:01,070 --> 00:13:02,470
is the machines themselves and the ballots.

190
00:13:02,690 --> 00:13:09,390
So Eric, what is MSISAC seeing on a CIO and CISO participation in this?

191
00:13:10,670 --> 00:13:11,170
MR.

192
00:13:11,170 --> 00:13:11,530
Thank you.

193
00:13:11,530 --> 00:13:16,850
So that's actually an interesting question for myself and for my organization, because

194
00:13:16,850 --> 00:13:22,750
the MSISAC interacts daily, I would have to say daily, with CISOs from all of the states

195
00:13:22,750 --> 00:13:23,490
in the U.S., right?

196
00:13:23,530 --> 00:13:25,330
So what are we seeing?

197
00:13:25,470 --> 00:13:29,730
Well, we've been seeing since the advent of basically the news cycle with election hacking

198
00:13:30,290 --> 00:13:34,890
an uptick in communication from CISOs from state cybersecurity departments and so forth.

199
00:13:35,050 --> 00:13:39,250
We're seeing a lot of activity coming from the DHS side at us, right, regarding setting

200
00:13:39,250 --> 00:13:40,810
up committees and so forth.

201
00:13:40,810 --> 00:13:45,530
And councils and meetings, a lot of activity coming at us from the National Association

202
00:13:45,530 --> 00:13:47,750
of Secretaries of State, right?

203
00:13:47,870 --> 00:13:50,830
So we're interacting with election officials left and right.

204
00:13:51,070 --> 00:13:55,570
MSISAC really plays a middleman role in a lot of this in terms of we're watching the

205
00:13:55,570 --> 00:13:56,050
wire, right?

206
00:13:56,090 --> 00:13:58,890
We're watching what's happening over the Internet that's bound for the states.

207
00:13:59,070 --> 00:14:04,370
And so when stuff like this happens with election cyber hacking, our communication, I'm not

208
00:14:04,370 --> 00:14:08,290
sure if this answers your question, but our communication volume basically skyrocketed,

209
00:14:08,290 --> 00:14:09,050
right, regarding this.

210
00:14:09,770 --> 00:14:10,790
We have been facilitating this.

211
00:14:10,790 --> 00:14:11,670
We've been facilitating some meetings.

212
00:14:11,990 --> 00:14:15,110
I can't necessarily tell you between who, but we've been facilitating meetings.

213
00:14:15,210 --> 00:14:16,230
We're seeing a big uptick.

214
00:14:16,390 --> 00:14:17,870
So hopefully that answers your question.

215
00:14:21,630 --> 00:14:25,370
So then on top of that, I guess my question back to Barbara.

216
00:14:26,830 --> 00:14:33,550
So you know, if governors are, you know, showing interest in this, and the CIO and CISO and

217
00:14:33,550 --> 00:14:40,710
the state are, are you guys getting more traffic from clerks and secretaries of state?

218
00:14:40,790 --> 00:14:43,090
Asking you guys, you know, about best practices and so on.

219
00:14:44,250 --> 00:14:47,650
And if so, you know, what are you hearing?

220
00:14:47,750 --> 00:14:48,630
Are you hearing good questions?

221
00:14:48,750 --> 00:14:54,130
Are you hearing very technical questions or people trying to figure out the right answers

222
00:14:54,130 --> 00:14:54,630
to this stuff?

223
00:14:54,830 --> 00:14:57,230
Or what is the nature of the conversation?

224
00:14:59,130 --> 00:15:04,010
Well, I don't know about traffic to our website, and I don't know if we keep tabs on that or

225
00:15:04,010 --> 00:15:04,250
not.

226
00:15:04,450 --> 00:15:07,550
I mean, one of the things that we have on our website is a map of the United States

227
00:15:07,550 --> 00:15:10,530
which shows what types of machines are used in every state.

228
00:15:10,530 --> 00:15:14,890
And breaking it down to every county, and we're really the only resource that provides

229
00:15:14,890 --> 00:15:15,230
that.

230
00:15:15,390 --> 00:15:19,050
So incidentally, if you want to know what's going on around where you live, just check

231
00:15:19,050 --> 00:15:22,090
verified voting, click on the verifier, and you can get that information.

232
00:15:22,490 --> 00:15:30,490
As far as technical questions coming from election officials and so on, individuals

233
00:15:31,130 --> 00:15:34,670
involved with verified voting might be getting those questions, but typically we don't get

234
00:15:34,670 --> 00:15:36,270
questions sent to the organization itself.

235
00:15:37,170 --> 00:15:37,570
So...

236
00:15:39,670 --> 00:15:40,290
Okay, good.

237
00:15:40,330 --> 00:15:40,510
So...

238
00:15:40,530 --> 00:15:41,250
So I wanted to...

239
00:15:41,250 --> 00:15:44,210
So that's the end of my questions, but I wanted to get questions from folks in the audience

240
00:15:44,690 --> 00:15:45,450
for the group here.

241
00:15:45,610 --> 00:15:45,890
So...

242
00:15:46,790 --> 00:15:47,070
Sure.

243
00:15:47,430 --> 00:15:47,710
Yes.

244
00:15:47,870 --> 00:15:49,830
And if you can just yell...

245
00:15:49,830 --> 00:15:50,250
Yeah.

246
00:15:50,350 --> 00:15:51,790
I have a question for you about the...

247
00:15:55,770 --> 00:15:56,330
I will.

248
00:15:56,670 --> 00:15:57,150
I will.

249
00:16:37,610 --> 00:16:42,630
So I think it's, first of all, important to know that, oh, so I believe your question

250
00:16:42,630 --> 00:16:49,330
is what I'm saying makes it sound like we're speaking out of both sides of our mouth, and

251
00:16:49,330 --> 00:16:54,810
that you're saying that in the past, secretaries of state and governors, this is not a statement

252
00:16:54,810 --> 00:16:55,890
from me, I'm repeating the question.

253
00:16:56,330 --> 00:16:58,050
Have said that everything's fine.

254
00:16:58,630 --> 00:17:04,310
I think it's, first of all, important to remember that awareness of cybersecurity as a problem

255
00:17:04,310 --> 00:17:11,650
is relatively new at the higher rungs of government in many cases, and I think it's important

256
00:17:11,650 --> 00:17:17,610
to acknowledge that the National Governors Association rarely makes a policy statement

257
00:17:17,610 --> 00:17:23,250
as a single voice of the governors, so I don't speak for governors' offices.

258
00:17:23,470 --> 00:17:24,530
I can't speak for them.

259
00:17:24,530 --> 00:17:31,710
I do know that the, many of the cabinet officials who are in, who run state agencies, think this is a huge

260
00:17:31,710 --> 00:17:35,370
problem, and they want resources to deal with it.

261
00:17:35,590 --> 00:17:36,630
That is what I can tell you.

262
00:17:36,870 --> 00:17:43,650
And it is up to us to, going forward, you know, I came here to DEFCON to see for myself just how

263
00:17:43,650 --> 00:17:48,290
vulnerable the systems are, and it's clear that they're vulnerable, so it is now up to the Center

264
00:17:48,290 --> 00:17:54,470
for Best Practices to do our best job to educate everybody at the state level that this is a serious problem.

265
00:17:54,470 --> 00:18:00,550
And then identifying key practical recommendations that we can implement before 2018 and 2020.

266
00:18:00,850 --> 00:18:01,730
That's my job.

267
00:18:01,850 --> 00:18:05,390
But I cannot speak to what governors' offices say.

268
00:18:07,790 --> 00:18:10,190
Here, you're close enough, I'll just give you a mic.

269
00:18:13,110 --> 00:18:15,270
An ancillary question to that.

270
00:18:15,370 --> 00:18:23,190
As I was covering this past election, I experienced, I felt the closer we got to the election,

271
00:18:23,310 --> 00:18:24,450
the more frequent the number of people that were in the election, and the more frequent the number of people that were in the election, and the more frequent the number of people that were in the election,

272
00:18:24,470 --> 00:18:32,070
and the response I got from people I was asking about the security of the election was we can't question it because if we do, people won't vote,

273
00:18:32,250 --> 00:18:38,790
and I'm concerned as we come to next November and in 2018, it feels like when

274
00:18:39,350 --> 00:18:43,970
we get into those final couple of months, everybody clams up because there's this fear that

275
00:18:44,570 --> 00:18:47,390
somehow the electorate will stay home if they don't trust it.

276
00:18:47,470 --> 00:18:48,750
Do you think that's going to happen?

277
00:18:48,830 --> 00:18:51,290
How can we get past that?

278
00:18:51,530 --> 00:18:52,610
Yeah, yeah.

279
00:18:55,150 --> 00:18:59,250
So I'll actually take a crack at the first part of that answer, if that's okay.

280
00:19:00,210 --> 00:19:06,410
So in a previous life, I did political campaigns for a living, and in fact, I was President

281
00:19:06,410 --> 00:19:14,410
Obama's national deputy field director in 2008, and we spent an enormous amount of time

282
00:19:14,410 --> 00:19:20,490
researching why people turn out to vote, why people don't turn out to vote, what makes

283
00:19:20,490 --> 00:19:23,250
people stay home, and so on.

284
00:19:23,550 --> 00:19:31,470
And we never, ever once saw any research that indicated that lack of cybersecurity or something

285
00:19:31,470 --> 00:19:34,430
like that would make people stay home to vote, ever.

286
00:19:34,590 --> 00:19:36,210
No research, not once.

287
00:19:37,090 --> 00:19:43,290
And I will say, though, that it is often Democrats, the party that I'm a part of, who make these

288
00:19:43,290 --> 00:19:48,210
asinine claims that, oh, if you say that there's a security issue, people will stay home to

289
00:19:48,210 --> 00:19:48,370
vote.

290
00:19:48,510 --> 00:19:50,370
I will say a group of people.

291
00:19:50,370 --> 00:19:55,690
People that I'm not a group of, which is attorneys, are usually the people making that

292
00:19:55,690 --> 00:19:57,150
claim on the Democratic side.

293
00:19:57,290 --> 00:20:01,930
It's our voter protection attorneys who make these ridiculous points, and there's just

294
00:20:01,930 --> 00:20:03,710
no evidence to back it up.

295
00:20:04,270 --> 00:20:06,170
But I'm happy to let somebody else jump in.

296
00:20:08,230 --> 00:20:16,930
I've also heard that claim, and my response is we should be truthful with people, and

297
00:20:16,930 --> 00:20:18,070
we should fix the problem.

298
00:20:18,430 --> 00:20:20,350
And if we fix the problem, then we can do it.

299
00:20:20,350 --> 00:20:24,230
We can say truthfully that you can vote because your vote will be counted correctly.

300
00:20:24,530 --> 00:20:29,950
What we need are paper ballots and mandatory post-election manual ballot audits.

301
00:20:30,170 --> 00:20:34,990
If we put those two things in place throughout the country, there's no way to hack our elections

302
00:20:34,990 --> 00:20:36,270
because you can't hack the paper.

303
00:20:37,790 --> 00:20:38,590
It's a great question.

304
00:20:38,910 --> 00:20:39,630
Three points.

305
00:20:39,830 --> 00:20:41,330
And I wrote them down to make sure I get them right.

306
00:20:41,670 --> 00:20:46,950
So the stories, the narrative is already out there, so I don't know how pretending, I mean,

307
00:20:47,010 --> 00:20:47,810
that's done.

308
00:20:48,010 --> 00:20:48,650
Cat's out of the bag.

309
00:20:48,650 --> 00:20:52,910
A lot of voters are reading news stories on this every day, so we might as well talk

310
00:20:52,910 --> 00:20:54,290
about it reasonably and rationally.

311
00:20:54,370 --> 00:20:56,950
There's no reason to bury our heads in the sand.

312
00:20:57,870 --> 00:21:02,930
The concern that, I know that there's a lack of data on that, but I think it's a legitimate

313
00:21:02,930 --> 00:21:05,110
concern that people won't vote because of this.

314
00:21:05,430 --> 00:21:09,130
I think that is all the more reason to plan ahead now.

315
00:21:09,590 --> 00:21:16,970
A lot of the, right before 2016, there were so many questions that were raised and not

316
00:21:16,970 --> 00:21:17,610
enough answers.

317
00:21:18,650 --> 00:21:23,030
And I think the best thing that states can do is to plan ahead, have a publicly released

318
00:21:23,030 --> 00:21:26,270
plan that shows this is how we are going to deal with any problems that arise.

319
00:21:26,510 --> 00:21:33,450
And then you're not forced to make up answers that you might not have questions to right

320
00:21:33,450 --> 00:21:34,530
before an election, right?

321
00:21:35,250 --> 00:21:40,790
But I do think that's a good question, but I don't see why we would pretend like people

322
00:21:40,790 --> 00:21:43,650
are not already listening to the message, right?

323
00:21:44,190 --> 00:21:45,050
That's my answer to that.

324
00:21:45,190 --> 00:21:45,730
Do you want to say?

325
00:21:45,830 --> 00:21:45,990
No.

326
00:21:46,670 --> 00:21:47,610
Did that answer your question?

327
00:21:49,850 --> 00:21:50,890
Go ahead.

328
00:21:52,210 --> 00:21:56,710
I've been involved in a lot of advocacy issues in California around environmental issues

329
00:21:56,710 --> 00:21:57,070
primarily.

330
00:21:57,590 --> 00:22:02,970
But we've often been successful by getting some experts to write model legislation language

331
00:22:02,970 --> 00:22:06,970
and then getting people to sponsor that moving forward.

332
00:22:07,410 --> 00:22:12,250
Has anybody written model language for the ideal regulations that need to be in place

333
00:22:12,250 --> 00:22:16,950
state by state that we can take and start promoting on a local and state level?

334
00:22:17,270 --> 00:22:18,370
Is that legislative?

335
00:22:18,450 --> 00:22:18,630
No.

336
00:22:19,330 --> 00:22:19,990
I don't know.

337
00:22:20,010 --> 00:22:20,670
Does anybody have a?

338
00:22:21,110 --> 00:22:21,950
We can go first.

339
00:22:23,750 --> 00:22:26,910
Verified voting has done that sort of thing in the past at the state level.

340
00:22:27,110 --> 00:22:31,370
For example, well, one of the things we've been very involved with is fighting internet

341
00:22:31,370 --> 00:22:32,370
voting at the state level.

342
00:22:32,430 --> 00:22:36,770
Maybe that's a negative, but we've also worked on model language for voting.

343
00:22:38,010 --> 00:22:39,170
But, indeed, you're right.

344
00:22:39,230 --> 00:22:40,310
We do need model language.

345
00:22:41,370 --> 00:22:45,470
But one of the things that sometimes happens is that there's a piece of legislation that

346
00:22:45,470 --> 00:22:48,570
comes along and you think you can stick something in it that will help your cause.

347
00:22:48,570 --> 00:22:50,650
I'm sure that happens with the environmental movement, too.

348
00:22:50,870 --> 00:22:52,710
So that's something else that we do.

349
00:22:52,890 --> 00:22:57,150
Like, hopefully, there will be some cyber security legislation coming along and we can

350
00:22:57,150 --> 00:23:00,650
say, give some money for voting machines because that's a cyber security threat.

351
00:23:01,050 --> 00:23:01,450
Hopefully.

352
00:23:02,130 --> 00:23:04,610
Is that a resource that you can find on your website there?

353
00:23:05,010 --> 00:23:05,690
Model language?

354
00:23:05,870 --> 00:23:06,110
No.

355
00:23:06,250 --> 00:23:07,370
We should have it there.

356
00:23:08,150 --> 00:23:09,570
That's a very good suggestion.

357
00:23:09,850 --> 00:23:12,110
We should have model language on our website for legislation.

358
00:23:12,430 --> 00:23:12,590
I'm sorry.

359
00:23:12,650 --> 00:23:13,430
I didn't repeat the question.

360
00:23:13,490 --> 00:23:14,690
The question was, is there model language?

361
00:23:17,010 --> 00:23:18,550
As I work at F501C.

362
00:23:18,570 --> 00:23:20,410
3, we have to be very careful with lobbying.

363
00:23:20,610 --> 00:23:23,250
So my particular body doesn't write model legislation.

364
00:23:23,470 --> 00:23:26,510
However, we certainly give policy recommendations on a regular basis.

365
00:23:26,910 --> 00:23:28,350
There are two things you can check out.

366
00:23:28,550 --> 00:23:29,810
You can go to Meet the Threat.

367
00:23:30,310 --> 00:23:31,750
You can just Google Meet the Threat.

368
00:23:32,010 --> 00:23:37,230
States Confront the Cyber Challenge, which was Governor Terry McAuliffe's cyber security

369
00:23:37,230 --> 00:23:40,210
initiative that just ended recently, but we're not going anywhere.

370
00:23:40,470 --> 00:23:45,270
And then we recently released a governor's guide to cyber security, which is also available

371
00:23:45,270 --> 00:23:47,710
online, should be accessible through Google by now.

372
00:23:47,710 --> 00:23:52,870
And we have a whole one pager on election security that includes recommendations that

373
00:23:52,870 --> 00:23:55,050
someone might decide to include legislation.

374
00:23:55,310 --> 00:23:56,710
But we don't have model legislation.

375
00:23:56,830 --> 00:23:57,110
No.

376
00:23:59,330 --> 00:23:59,850
Great.

377
00:24:00,590 --> 00:24:00,950
Go ahead.

378
00:24:02,230 --> 00:24:03,010
Actually, probably.

379
00:24:03,250 --> 00:24:03,690
Okay.

380
00:24:03,830 --> 00:24:04,050
Great.

381
00:24:04,190 --> 00:24:08,930
With the census coming up in 2020, has there been any discussion about securing

382
00:24:08,930 --> 00:24:13,310
that aspect that would have a direct impact on voting with respect to?

383
00:24:13,390 --> 00:24:13,890
Sounds like you.

384
00:24:16,110 --> 00:24:17,150
That's the first time I've heard.

385
00:24:17,270 --> 00:24:17,690
That's the first time I've heard.

386
00:24:18,270 --> 00:24:18,990
Very interesting.

387
00:24:20,990 --> 00:24:22,170
I have not thought of that.

388
00:24:22,250 --> 00:24:23,270
I'm sure somebody has.

389
00:24:23,450 --> 00:24:24,370
But it's a very good point.

390
00:24:24,470 --> 00:24:27,290
And I'm writing it down because I'm going to go make sure that we think more about it.

391
00:24:28,430 --> 00:24:28,970
All right.

392
00:24:29,110 --> 00:24:29,590
Oh, yeah.

393
00:24:29,590 --> 00:24:30,290
Can you repeat the question?

394
00:24:30,630 --> 00:24:30,950
Oh.

395
00:24:31,090 --> 00:24:34,850
The question, I think, so your question was, have we, in the context of this discussion,

396
00:24:34,930 --> 00:24:36,210
have we considered about the census?

397
00:24:36,350 --> 00:24:41,690
And are you saying that, are you saying that the census could be, the integrity of the

398
00:24:41,690 --> 00:24:42,510
census could be corrupted?

399
00:24:42,890 --> 00:24:46,950
Just as we're examining the security of the election process, are we also examining

400
00:24:46,950 --> 00:24:47,690
the security of the election process?

401
00:24:52,130 --> 00:24:56,050
I have heard nor read no one talk about that, so I don't know.

402
00:24:56,150 --> 00:24:57,430
But I certainly want to look into it.

403
00:24:58,750 --> 00:24:59,150
Great.

404
00:25:00,530 --> 00:25:02,250
I've heard of that show that day.

405
00:25:02,790 --> 00:25:06,970
It's going to be very myopic on the next election as opposed to the next, next election.

406
00:25:07,090 --> 00:25:09,710
Or do you have a little bit of milestones like on that one, between you and the Senate?

407
00:25:09,710 --> 00:25:09,930
Mm hmm.

408
00:25:10,570 --> 00:25:10,970
Agreed.

409
00:25:11,050 --> 00:25:11,450
Agreed.

410
00:25:12,030 --> 00:25:12,590
Go ahead.

411
00:25:12,730 --> 00:25:13,450
In the plan.

412
00:25:13,590 --> 00:25:14,390
I have a question for David.

413
00:25:15,370 --> 00:25:17,670
You and Justin said that 21 states would be able to vote on the census.

414
00:25:19,870 --> 00:25:20,470
Thank you.

415
00:25:53,070 --> 00:25:54,750
I'm not answering that question.

416
00:25:56,910 --> 00:25:59,230
It's up to states whether they want to.

417
00:26:00,850 --> 00:26:14,430
So the question is, does the National Governors Association believe that states who have not come forward publicly after being breached, whatever breach even means, let's recall that often people misuse the term.

418
00:26:14,470 --> 00:26:17,590
Sometimes they're just talking about a port scan, and that's not necessarily a breach.

419
00:26:17,670 --> 00:26:18,710
Should they come forward?

420
00:26:19,550 --> 00:26:30,250
I'm not aware of any law that requires them to do so, and National Governors Association would never ask states to do something they don't want to do, so that's up to each particular governor.

421
00:26:36,570 --> 00:26:37,810
Not about disclosure.

422
00:26:37,930 --> 00:26:43,690
States talk about election security with each other and state officials all the time, but not about this particular issue, and I wouldn't know that.

423
00:26:46,570 --> 00:26:47,570
So I can.

424
00:26:47,670 --> 00:26:55,510
Actually, to speak to that a little bit as well, from the MSISAC standpoint, since I said MSISAC acts as almost like a cybersecurity proxy in many ways, right?

425
00:26:55,630 --> 00:27:00,930
We facilitate communication amongst states and so forth, and so you mentioned a figure that the DHS had let out.

426
00:27:01,170 --> 00:27:10,150
I can tell you this, from the MSISAC standpoint and also from the state standpoint, we take the privacy regulations and so forth of each state very, very seriously.

427
00:27:10,310 --> 00:27:15,410
In fact, our entire constituency and everybody who's collaborating with us, it's done on trust.

428
00:27:15,690 --> 00:27:17,050
And so we couldn't.

429
00:27:17,050 --> 00:27:22,930
The MSISAC could never release that type of information because each state trusts us as an organization to not do that, right?

430
00:27:23,510 --> 00:27:37,350
But so I don't know if that helps lend some information to your question or not, but at least from the MSISAC standpoint and from the standpoint of how the states collaborate with each other from a cybersecurity standpoint, I wouldn't keep your fingers crossed in terms of that kind of stuff coming out.

431
00:27:37,510 --> 00:27:38,710
Not sure if that helps, but.

432
00:27:39,170 --> 00:27:46,250
I don't know if that's an interesting thing, but I know you mentioned that, you know, trust is important in this process.

433
00:27:47,050 --> 00:28:07,150
It seems as though voters in the states want to know if their system hasn't been marketed in a different way, and there's five parts of the Senate and the Congress, and there's a letter from the Senate asking for it, and it's interesting that there hasn't been, other than Arizona and Illinois, we don't know what the states were targeting.

434
00:28:07,330 --> 00:28:15,470
We don't know how important they were in the election, but it's very important to have a jellyfish in every position.

435
00:28:15,570 --> 00:28:16,970
So I think it's important all the way.

436
00:28:19,270 --> 00:28:37,630
Yeah, and so the last thing I can say about that is that that avenue that you just outlined where the people are writing letters to their, let's say, you know, secretaries of state or something requesting public information, that would be, I think, the suggested path that MSISAC would say regular, everyday citizens should take, because an organization like ours couldn't disclose that information.

437
00:28:37,950 --> 00:28:40,910
Just by the nature of what we do, we can't disclose that publicly, so.

438
00:28:41,690 --> 00:28:46,770
Real quickly, Texas did just pass a law that is going to.

439
00:28:47,050 --> 00:28:52,150
It requires the secretary of state to do a post-mortem on the 2016 election, so you might want to look into that.

440
00:28:54,470 --> 00:28:55,110
Who's next?

441
00:28:55,210 --> 00:28:55,430
Go ahead.

442
00:28:55,950 --> 00:29:04,650
Has there been any movement at the federal level in Congress to require breach disclosure like happened in the corporate world?

443
00:29:04,750 --> 00:29:12,530
Because in the corporate world, there was no movement whatsoever against cybersecurity until we started to hold companies and force them to disclose.

444
00:29:17,050 --> 00:29:20,330
So I don't think that there's anything right now.

445
00:29:20,610 --> 00:29:34,390
I think that there's a lot of folks who've been talking about this, about how do we compel states to disclose this, and I think there's going to be a lot more conversation about it in the future, so.

446
00:29:36,450 --> 00:29:43,650
I'm almost positive that there is legislation that has been introduced for a federal data breach notification law.

447
00:29:44,230 --> 00:29:45,110
Almost positive.

448
00:29:45,430 --> 00:29:46,350
Don't quote me on that.

449
00:29:46,410 --> 00:29:46,650
But.

450
00:29:47,050 --> 00:29:52,930
So if that's movement, I don't think there's any chance it's going to pass, but if that answers your question.

451
00:29:55,050 --> 00:29:56,270
Okay, so we have one minute.

452
00:29:56,350 --> 00:30:03,450
So I did want to just give some final wrap-up notes on what's been going on in the village since today.

453
00:30:03,550 --> 00:30:14,090
So for anybody who wasn't in the room when I announced it earlier, within an hour and 40 minutes, the group in there were able to remotely gain access to a win-vote machine.

454
00:30:15,590 --> 00:30:16,390
And with.

455
00:30:16,390 --> 00:30:28,190
And another group with no prior knowledge of the device at all was able to hack an express poll book and get in and start messing around with a database in there that would contain a list of voters.

456
00:30:28,530 --> 00:30:36,750
Since then, since I made that announcement around noon today, they've gained access to hardware and firmware of a TSX machine.

457
00:30:37,510 --> 00:30:43,630
And they're currently in the process of reverse engineering the infrared communication protocol of an IVATronic.

458
00:30:43,630 --> 00:30:52,730
And so they've moved a bunch of the, our friends in the voting village are, have become a little bit manic about this whole thing.

459
00:30:52,830 --> 00:30:57,590
And so they've moved the machines upstairs so that they can start working on them tonight, actually.

460
00:30:57,790 --> 00:31:06,610
I think there'll be some people with a lot of jolt, cola, and no sleep messing around with voting machines tonight.

461
00:31:06,750 --> 00:31:08,090
So we're excited about that.

462
00:31:08,410 --> 00:31:09,330
They are upstairs.

463
00:31:09,950 --> 00:31:10,730
I don't know.

464
00:31:10,790 --> 00:31:11,390
It just says upstairs.

465
00:31:11,390 --> 00:31:14,250
It probably didn't tell me on purpose.

466
00:31:15,350 --> 00:31:15,830
Okay.

467
00:31:15,890 --> 00:31:19,210
So with that, thank you, everybody, who came to this today.

468
00:31:19,370 --> 00:31:21,370
And we look forward to seeing folks tomorrow.

469
00:31:21,610 --> 00:31:22,790
Thank you.