Barbara Simons, who's the president of Verified Voting.
I'll let everybody get seated really quick.
And I'll let you guys do just a couple minutes each on who you are and your organization and so on.
And then Dave Forsey with the National Governor's Association.
And Eric with the Center for Internet Security, which is the group that runs the MSISAC,
as well as the 20 critical cybersecurity controls.
So with that, I'll actually turn it over to you guys to be able to talk a little bit about your organization and yourself.
Okay. All right. So hi, everybody. I'm Eric Kammerling. I'll start out, I guess.
I'm from the Center for Internet Security and CIS. I'm going to refer to it as CIS.
CIS produces a number of free things for the larger cybersecurity.
Among them being the top 20 security controls, which are a set of technical controls that any organization can use for free
to enhance the cybersecurity stance of their organization, be it private, educational, government, you name it.
Everyone's free to use them.
And so that's one half of CIS, secure benchmarks, top 20 controls, a community that we run for the benefit of everybody.
And the other half of CIS is the MSISAC, which is a DHS-funded program.
MSISAC standing for Multi-State Information Sharing and Analysis Center.
And the MSISAC has built a relationship with all of the 56 states and territories throughout the U.S.
And we run a network called Albert.
And Albert is closely related to the federal network called Einstein, which is used to monitor .gov space.
Albert monitors state, local, tribal, and territorial space.
And we have sensors throughout the United States in almost every single,
state and territory in the U.S.
So you can think of us, one half of CIS, as an intrusion detection system that covers the entire continental U.S.
So that's my intro to what I do.
And over to you.
There you go.
Thank you very much.
I help lead our cybersecurity work at the National Governors Association.
For those who don't know, the National Governors Association is a special snowflake.
Half of it was actually created by statute.
So it's not a 501c3.
It's not a corporation.
It's not a corporation.
It is a statutory entity.
It's called the instrumentality of the states.
So every state that's a member, which is virtually every state and territory,
pays in dues, and it pays for certain services for governor's offices.
I work at the other arm, which is called the Center for Best Practices, which is a 501c3.
So we get money from foundations, corporate donors, and federal grants to help states with policy problems.
Specifically, I help states with cybersecurity strategy.
Cybersecurity governance and cybersecurity disruption response.
We like to say that, as everyone in this room knows, we have in many ways figured out the technical methods needed to stop cyberattacks.
A lot of the state CIOs and CISOs who run the state systems know this.
The hard part is actually getting people to do it, and that's where governance comes in.
We have become much more involved in the election issue, and I'm here to talk more about that, but I'll let you ask questions, and I'll leave it to you.
Barbara.
I'm Barbara Simons.
I'm president of Verified Voting.
I'm a computer scientist by training, and I got into the whole voting issue around 2003,
and because several of us computer scientists were kind of appalled that Silicon Valley was about to buy paperless voting machines.
And despite our best efforts, they went ahead and bought them.
But we got sucked into this, and like many of my colleagues,
who,
I've observed over the years, the more they get, the more they learn, the more they get, have to get involved because they just can't believe what's going on.
And I hope that will happen to all of you here, if it hasn't already, because we need all the help we can get.
I'm very concerned, and I know many of you are, too, about what will happen to our democracy if we don't fix our badly broken voting systems.
That's what Verified Voting has worked on for years.
We've worked on making voting secure.
We've focused on the technology.
We're basically mainly a bunch of geeks.
We have some attorneys and election officials.
Also, who are involved on our board and advisory board.
But our main focus has been on making voting technology more secure.
We know how to do it.
We know it needs to be done.
We just have to get it done.
All right.
Thank you, everybody.
So I guess my first question, I'll go to Eric.
You mentioned a little bit about the 20 critical cybersecurity controls.
And I know several of the speakers today have talked about the need for state and locals,
to implement basic cyber hygiene, I think, that on their networks and their databases most people in this space
would consider basic cyber hygiene to be at least doing the top five critical cybersecurity controls.
Do you mind just kind of telling folks what those are?
You have to do all of them and even that's not even a four-word answer.
Okay.
Oh, sorry.
So, well, let's start by talking about what cyber hygiene is, right?
Hygiene meaning trying to raise the bar for some sort of a system or system that's going to be able to do all of these things.
And so we're talking about a system of systems to a level where, you know, it's generally resistant or at least more resistant to epidemiological type threats.
That's why I think of hygiene, cyber hygiene.
And so what are the top five?
I mentioned the top 20 security controls that CIS produces, but what are the top five?
We often tout the top five as the easiest way for any organization to get to that sort of hygienic stance, right, where you know that you're taking care of the low-hanging fruit.
So the top five CIS controls are asset inventory of old assets.
Asset inventory over what is known or authorized or unauthorized hardware in your environment.
Asset inventory over what is known or authorized or unauthorized software in your environment.
Secure configuration of that software and that hardware.
Continual and cyclical vulnerability assessment of that hardware and software, of said hardware and software.
And lastly, figuring out who should have administrative control and what does administrative control mean in your environment over that hardware and software.
So those five topics.
If everybody, let's use it, since we're talking about elections, those five topics.
If all election networks or if all election systems were to implement those top five pieces of guidance, then the overall hygienic stance of the election system would be enhanced thusly.
Right?
So that's cyber hygiene or that's the top five for you.
Great.
Back.
So I guess, and Barbara, I'll put this to you.
You know, as I think we know, you know, most state and local governments, for various reasons,
many of which are out of their control, aren't able today, at least, to implement those top five controls.
But a lot of those controls are the actual sensors and so on on the network that can tell you when the bad guys got in, what did the bad guys do, and so on.
And so what I think we've seen reported to Congress and in the media by a lot of folks is like, is this term of, oh, we haven't seen any evidence that this,
you know, we haven't seen any evidence that votes were tampered with or that the voting registration databases had deletions or changes or so on.
But I guess the question is, if they're not doing even these basic five controls and the sensors aren't there to really understand what's going on, isn't the more appropriate,
isn't the more accurate answer, well, we really don't know what happened in the election and have no way of telling what happened until those sensors and so on are in place?
So, Barbara, I know you guys have been working on this.
What do you think?
A couple of different thoughts.
And by the way, anybody else who wants to jump in?
Yeah.
First of all, obviously these top five requirements need to be in place, but frankly, they're not adequate.
I mean, they certainly will not protect against a nation state attack.
In fact, the top 20 won't.
It's much more serious than that.
I mean, the fact that we are here talking about trying to get the top five in place I think is a very sorry reflection on the state of the security of our voting systems in this country.
I mean, I don't mean to take away from what you're doing.
It's very important.
I don't disagree with you.
Yeah.
So, we need much more.
We need a sense of urgency.
We need sort of like, what was it, the Chicago project?
Well, the bomb, what was the project for building the bomb?
Was it Chicago?
Manhattan.
Manhattan, yes.
But it was at Chicago, but it was called the Manhattan Project.
Right.
We need a Manhattan Project for our voting systems.
That's really what we need.
Now, in terms of the 2016 election, I don't think we're going to be able to do that.
We do know that at least one voter registration database, one vendor for voter registration databases was hacked, and we know, for example, that that vendor was what was used in Durham, North Carolina, where there were major problems on election day.
As far as I know, nobody has gone back to do an analysis of the voter registration database in Durham, North Carolina, to see if there were a lot of changes made to people's names or addresses or various information that would send them off to the wrong address.
There's no way that a voter registration database would be in the wrong place to vote and create chaos.
So we don't know, even in that case, where we know that the vendor had been hacked.
In the case of throughout the country on the voting machines, even where there are paper ballots in most cases, we did not do an adequate check to see if any hacking had occurred there.
And of course, where there is no paper, it's almost impossible to check.
I mean, we could try impounding the machines and doing a forensic analysis, but it's very hard, as I'm sure you guys know, it's very hard to do a forensic analysis.
analysis of a computer, and even if you do it and don't find something, it doesn't mean
something wasn't there.
So the bottom line is we do not know if the 2016 election, the votes themselves were hacked
or not.
We don't know if the voter registration databases were hacked or not.
And it's unacceptable to be in that state of ignorance.
We need to make our election such that we know that the correct candidates, the candidates
who were declared the winners, were in fact the winners.
We do know how to do that, but we're not doing it now.
So did you want to defend?
Although you were right to hand it to Dave because my next question is for him.
But so, you know, some of this is kind of really technical, like the stuff CIS does.
I think some of the auditing and so on that verified voting talks about is obviously really
important.
But, you know, oftentimes we hear about what secretaries of state want or county clerks,
you know, suggesting to do this, that, or the other thing.
But it seems to me that governors are actually really important to this conversation.
And I'd really love to hear how NGA or you, Dave, specifically are thinking about this
in terms of the role of governors and so on.
Okay, so a few caveats.
Nothing I say here today is in any way articulating an official position of the National Governors'
Association or any governor's office.
Okay.
Period.
Period.
That being said, my team at NGA, we're not, we don't have technical backgrounds, right?
We're engineers at heart, but we do not have degrees in computer science.
We're lawyers.
We think this is a huge problem.
We know that governors have a role because while under many state constitutions the
secretary of state is a constitutionally separate branch from the governor, the fact is that
a lot of the deployable assets and a lot of the assets that the governor has, they're
actually expertise relevant to cybersecurity, resides in state agencies that are under the
purview of the governor.
In many cases, a lot of the back end systems that are used to run elections, like voting
registration databases, are actually part of the services that the CIO's office manages.
So there's no question that when it comes to actually preventing attacks and responding
to attacks, that governors have a role.
I'd also point out that if you want to make any changes to election law, governors have
a role, not necessarily policy, but law, you'll need to sign legislation.
And governors are the ones that sign legislation, and if you want them to sign it, they need
to have buy-in.
I'd also say that the bully pulpit that governors have is incredibly valuable in terms of raising
the profile of this issue at the county level, state level, and federal level.
If you want a HAVA 2.0, you're going to need governors on your side.
So that's why we definitely deserve to be in the conversation.
So in the same vein, I'm wondering from the MSISAC's perspective, if you're seeing, if
you're seeing governors or other state executives bringing their CIO or CISO into the conversation
on how to better secure our voting systems, both from the back-end database and network
perspective, as well as kind of the front-end stuff that Verified Voting talks about, which
is the machines themselves and the ballots.
So Eric, what is MSISAC seeing on a CIO and CISO participation in this?
MR.
Thank you.
So that's actually an interesting question for myself and for my organization, because
the MSISAC interacts daily, I would have to say daily, with CISOs from all of the states
in the U.S., right?
So what are we seeing?
Well, we've been seeing since the advent of basically the news cycle with election hacking
an uptick in communication from CISOs from state cybersecurity departments and so forth.
We're seeing a lot of activity coming from the DHS side at us, right, regarding setting
up committees and so forth.
And councils and meetings, a lot of activity coming at us from the National Association
of Secretaries of State, right?
So we're interacting with election officials left and right.
MSISAC really plays a middleman role in a lot of this in terms of we're watching the
wire, right?
We're watching what's happening over the Internet that's bound for the states.
And so when stuff like this happens with election cyber hacking, our communication, I'm not
sure if this answers your question, but our communication volume basically skyrocketed,
right, regarding this.
We have been facilitating this.
We've been facilitating some meetings.
I can't necessarily tell you between who, but we've been facilitating meetings.
We're seeing a big uptick.
So hopefully that answers your question.
So then on top of that, I guess my question back to Barbara.
So you know, if governors are, you know, showing interest in this, and the CIO and CISO and
the state are, are you guys getting more traffic from clerks and secretaries of state?
Asking you guys, you know, about best practices and so on.
And if so, you know, what are you hearing?
Are you hearing good questions?
Are you hearing very technical questions or people trying to figure out the right answers
to this stuff?
Or what is the nature of the conversation?
Well, I don't know about traffic to our website, and I don't know if we keep tabs on that or
not.
I mean, one of the things that we have on our website is a map of the United States
which shows what types of machines are used in every state.
And breaking it down to every county, and we're really the only resource that provides
that.
So incidentally, if you want to know what's going on around where you live, just check
verified voting, click on the verifier, and you can get that information.
As far as technical questions coming from election officials and so on, individuals
involved with verified voting might be getting those questions, but typically we don't get
questions sent to the organization itself.
So...
Okay, good.
So...
So I wanted to...
So that's the end of my questions, but I wanted to get questions from folks in the audience
for the group here.
So...
Sure.
Yes.
And if you can just yell...
Yeah.
I have a question for you about the...
I will.
I will.
So I think it's, first of all, important to know that, oh, so I believe your question
is what I'm saying makes it sound like we're speaking out of both sides of our mouth, and
that you're saying that in the past, secretaries of state and governors, this is not a statement
from me, I'm repeating the question.
Have said that everything's fine.
I think it's, first of all, important to remember that awareness of cybersecurity as a problem
is relatively new at the higher rungs of government in many cases, and I think it's important
to acknowledge that the National Governors Association rarely makes a policy statement
as a single voice of the governors, so I don't speak for governors' offices.
I can't speak for them.
I do know that the, many of the cabinet officials who are in, who run state agencies, think this is a huge
problem, and they want resources to deal with it.
That is what I can tell you.
And it is up to us to, going forward, you know, I came here to DEFCON to see for myself just how
vulnerable the systems are, and it's clear that they're vulnerable, so it is now up to the Center
for Best Practices to do our best job to educate everybody at the state level that this is a serious problem.
And then identifying key practical recommendations that we can implement before 2018 and 2020.
That's my job.
But I cannot speak to what governors' offices say.
Here, you're close enough, I'll just give you a mic.
An ancillary question to that.
As I was covering this past election, I experienced, I felt the closer we got to the election,
the more frequent the number of people that were in the election, and the more frequent the number of people that were in the election, and the more frequent the number of people that were in the election,
and the response I got from people I was asking about the security of the election was we can't question it because if we do, people won't vote,
and I'm concerned as we come to next November and in 2018, it feels like when
we get into those final couple of months, everybody clams up because there's this fear that
somehow the electorate will stay home if they don't trust it.
Do you think that's going to happen?
How can we get past that?
Yeah, yeah.
So I'll actually take a crack at the first part of that answer, if that's okay.
So in a previous life, I did political campaigns for a living, and in fact, I was President
Obama's national deputy field director in 2008, and we spent an enormous amount of time
researching why people turn out to vote, why people don't turn out to vote, what makes
people stay home, and so on.
And we never, ever once saw any research that indicated that lack of cybersecurity or something
like that would make people stay home to vote, ever.
No research, not once.
And I will say, though, that it is often Democrats, the party that I'm a part of, who make these
asinine claims that, oh, if you say that there's a security issue, people will stay home to
vote.
I will say a group of people.
People that I'm not a group of, which is attorneys, are usually the people making that
claim on the Democratic side.
It's our voter protection attorneys who make these ridiculous points, and there's just
no evidence to back it up.
But I'm happy to let somebody else jump in.
I've also heard that claim, and my response is we should be truthful with people, and
we should fix the problem.
And if we fix the problem, then we can do it.
We can say truthfully that you can vote because your vote will be counted correctly.
What we need are paper ballots and mandatory post-election manual ballot audits.
If we put those two things in place throughout the country, there's no way to hack our elections
because you can't hack the paper.
It's a great question.
Three points.
And I wrote them down to make sure I get them right.
So the stories, the narrative is already out there, so I don't know how pretending, I mean,
that's done.
Cat's out of the bag.
A lot of voters are reading news stories on this every day, so we might as well talk
about it reasonably and rationally.
There's no reason to bury our heads in the sand.
The concern that, I know that there's a lack of data on that, but I think it's a legitimate
concern that people won't vote because of this.
I think that is all the more reason to plan ahead now.
A lot of the, right before 2016, there were so many questions that were raised and not
enough answers.
And I think the best thing that states can do is to plan ahead, have a publicly released
plan that shows this is how we are going to deal with any problems that arise.
And then you're not forced to make up answers that you might not have questions to right
before an election, right?
But I do think that's a good question, but I don't see why we would pretend like people
are not already listening to the message, right?
That's my answer to that.
Do you want to say?
No.
Did that answer your question?
Go ahead.
I've been involved in a lot of advocacy issues in California around environmental issues
primarily.
But we've often been successful by getting some experts to write model legislation language
and then getting people to sponsor that moving forward.
Has anybody written model language for the ideal regulations that need to be in place
state by state that we can take and start promoting on a local and state level?
Is that legislative?
No.
I don't know.
Does anybody have a?
We can go first.
Verified voting has done that sort of thing in the past at the state level.
For example, well, one of the things we've been very involved with is fighting internet
voting at the state level.
Maybe that's a negative, but we've also worked on model language for voting.
But, indeed, you're right.
We do need model language.
But one of the things that sometimes happens is that there's a piece of legislation that
comes along and you think you can stick something in it that will help your cause.
I'm sure that happens with the environmental movement, too.
So that's something else that we do.
Like, hopefully, there will be some cyber security legislation coming along and we can
say, give some money for voting machines because that's a cyber security threat.
Hopefully.
Is that a resource that you can find on your website there?
Model language?
No.
We should have it there.
That's a very good suggestion.
We should have model language on our website for legislation.
I'm sorry.
I didn't repeat the question.
The question was, is there model language?
As I work at F501C.
3, we have to be very careful with lobbying.
So my particular body doesn't write model legislation.
However, we certainly give policy recommendations on a regular basis.
There are two things you can check out.
You can go to Meet the Threat.
You can just Google Meet the Threat.
States Confront the Cyber Challenge, which was Governor Terry McAuliffe's cyber security
initiative that just ended recently, but we're not going anywhere.
And then we recently released a governor's guide to cyber security, which is also available
online, should be accessible through Google by now.
And we have a whole one pager on election security that includes recommendations that
someone might decide to include legislation.
But we don't have model legislation.
No.
Great.
Go ahead.
Actually, probably.
Okay.
Great.
With the census coming up in 2020, has there been any discussion about securing
that aspect that would have a direct impact on voting with respect to?
Sounds like you.
That's the first time I've heard.
That's the first time I've heard.
Very interesting.
I have not thought of that.
I'm sure somebody has.
But it's a very good point.
And I'm writing it down because I'm going to go make sure that we think more about it.
All right.
Oh, yeah.
Can you repeat the question?
Oh.
The question, I think, so your question was, have we, in the context of this discussion,
have we considered about the census?
And are you saying that, are you saying that the census could be, the integrity of the
census could be corrupted?
Just as we're examining the security of the election process, are we also examining
the security of the election process?
I have heard nor read no one talk about that, so I don't know.
But I certainly want to look into it.
Great.
I've heard of that show that day.
It's going to be very myopic on the next election as opposed to the next, next election.
Or do you have a little bit of milestones like on that one, between you and the Senate?
Mm hmm.
Agreed.
Agreed.
Go ahead.
In the plan.
I have a question for David.
You and Justin said that 21 states would be able to vote on the census.
Thank you.
I'm not answering that question.
It's up to states whether they want to.
So the question is, does the National Governors Association believe that states who have not come forward publicly after being breached, whatever breach even means, let's recall that often people misuse the term.
Sometimes they're just talking about a port scan, and that's not necessarily a breach.
Should they come forward?
I'm not aware of any law that requires them to do so, and National Governors Association would never ask states to do something they don't want to do, so that's up to each particular governor.
Not about disclosure.
States talk about election security with each other and state officials all the time, but not about this particular issue, and I wouldn't know that.
So I can.
Actually, to speak to that a little bit as well, from the MSISAC standpoint, since I said MSISAC acts as almost like a cybersecurity proxy in many ways, right?
We facilitate communication amongst states and so forth, and so you mentioned a figure that the DHS had let out.
I can tell you this, from the MSISAC standpoint and also from the state standpoint, we take the privacy regulations and so forth of each state very, very seriously.
In fact, our entire constituency and everybody who's collaborating with us, it's done on trust.
And so we couldn't.
The MSISAC could never release that type of information because each state trusts us as an organization to not do that, right?
But so I don't know if that helps lend some information to your question or not, but at least from the MSISAC standpoint and from the standpoint of how the states collaborate with each other from a cybersecurity standpoint, I wouldn't keep your fingers crossed in terms of that kind of stuff coming out.
Not sure if that helps, but.
I don't know if that's an interesting thing, but I know you mentioned that, you know, trust is important in this process.
It seems as though voters in the states want to know if their system hasn't been marketed in a different way, and there's five parts of the Senate and the Congress, and there's a letter from the Senate asking for it, and it's interesting that there hasn't been, other than Arizona and Illinois, we don't know what the states were targeting.
We don't know how important they were in the election, but it's very important to have a jellyfish in every position.
So I think it's important all the way.
Yeah, and so the last thing I can say about that is that that avenue that you just outlined where the people are writing letters to their, let's say, you know, secretaries of state or something requesting public information, that would be, I think, the suggested path that MSISAC would say regular, everyday citizens should take, because an organization like ours couldn't disclose that information.
Just by the nature of what we do, we can't disclose that publicly, so.
Real quickly, Texas did just pass a law that is going to.
It requires the secretary of state to do a post-mortem on the 2016 election, so you might want to look into that.
Who's next?
Go ahead.
Has there been any movement at the federal level in Congress to require breach disclosure like happened in the corporate world?
Because in the corporate world, there was no movement whatsoever against cybersecurity until we started to hold companies and force them to disclose.
So I don't think that there's anything right now.
I think that there's a lot of folks who've been talking about this, about how do we compel states to disclose this, and I think there's going to be a lot more conversation about it in the future, so.
I'm almost positive that there is legislation that has been introduced for a federal data breach notification law.
Almost positive.
Don't quote me on that.
But.
So if that's movement, I don't think there's any chance it's going to pass, but if that answers your question.
Okay, so we have one minute.
So I did want to just give some final wrap-up notes on what's been going on in the village since today.
So for anybody who wasn't in the room when I announced it earlier, within an hour and 40 minutes, the group in there were able to remotely gain access to a win-vote machine.
And with.
And another group with no prior knowledge of the device at all was able to hack an express poll book and get in and start messing around with a database in there that would contain a list of voters.
Since then, since I made that announcement around noon today, they've gained access to hardware and firmware of a TSX machine.
And they're currently in the process of reverse engineering the infrared communication protocol of an IVATronic.
And so they've moved a bunch of the, our friends in the voting village are, have become a little bit manic about this whole thing.
And so they've moved the machines upstairs so that they can start working on them tonight, actually.
I think there'll be some people with a lot of jolt, cola, and no sleep messing around with voting machines tonight.
So we're excited about that.
They are upstairs.
I don't know.
It just says upstairs.
It probably didn't tell me on purpose.
Okay.
So with that, thank you, everybody, who came to this today.
And we look forward to seeing folks tomorrow.
Thank you.