start	end	text
21540	28260	Hi, I'm Bryson Bort, and thank you for joining us today with the Election Security Panel with the Feds.
28260	35240	This is a really momentous occasion, bringing this many federal agencies all together on one hand.
35240	40400	The timing is perfect. There is a huge election coming up here in the United States in 2020.
40440	42280	There are elections happening around the world.
42280	48400	And I think that's a key thing for us to understand, is that while this panel is talking about the U.S. federal government,
48400	55440	how we are responding to our American election, when we look at the broader forces that are aligned against democracy in the world,
55940	59940	that all comes down to trust in the system for the democracy to work.
60020	62980	And those forces are working against places more than the U.S.
62980	66080	And so while this is going to be the U.S. government discussing this,
66080	71580	I think citizens all over the world and hackers all over the world will be able to take something away from that.
72360	77660	Just quick logistics. Q&A will be available through the DEF CON Discord.
77660	81880	So if you put your questions in the Voting Village DEF CON Discord,
81880	88120	those will make it their way up here to me on the stage and we will answer them as best as we can.
88120	90380	Starting off, we have Cynthia Kaiser.
90800	96640	Hello, I'm Cynthia Kaiser. I'm an assistant section chief with the FBI Cyber Division.
96640	103640	And what that really means is I lead analysis among multiple threat groups for the FBI.
103640	109260	That includes election threats, mostly in the cyber arena.
109340	115400	And that's by design. I saw what happened in 2016 and I knew that there was nowhere else I wanted to be.
115400	118140	And then working this threat as we came into 2020.
118180	122680	And I'm really excited to be here with people that I get to see all the time anyways.
123320	130220	And so for the FBI in the election space, a good way to think about it is that we're really focused on the threat.
130220	136700	So we work hand in hand with our DHS counterparts and they're really focused on the risk to the systems,
136700	138320	the remuneration on those systems.
138320	145280	But when it comes to the threat response of incidents or looking at investigations into malign foreign influence
145280	152360	or investigations into election crimes like ballot fraud, that's where the FBI really plays in the space.
153360	157940	David Mordino from the National Security Agency. It's great to be with you here today.
157940	164980	I'm an NSA election security lead. Most of you are familiar with NSA's mission, really divided up into two components.
164980	170120	Our foreign signals intelligence mission, which is all about figuring out what the adversaries are up to.
170120	176020	And then we have the cybersecurity component, which is all about preventing and eradicating threats to national security systems
176020	180220	and figuring out how we can protect DOD networks and the like.
180420	184560	Really a lot of power from NSA comes with combining those missions.
184560	188960	Knowing what the threat is and combining that with a technical analysis and mitigations
188960	193100	in order for us to be able to deploy those into unclassified space.
193260	200820	From an election security standpoint, I oversee all the activities and partnerships that NSA has on election security.
200820	205700	I also co-lead something called the Election Security Group, along with Brigadier General Hartman here,
205700	213180	which we'll get into, I'm sure, on the panel. And that's a joint NSA Cyber Command Task Force for protecting the elections.
213180	218320	A little bit about me. I grew up in Chicago. That's what I'm representing here in the Comiskey Park shirt, no white socks.
218700	225580	And I'm also into craft cocktails. I supplied, in the typical DEF CON tradition, a cocktail of Black Manhattan for everybody.
225720	231140	And I'd like to give a shout out to Johnny and Carl for hosting me at Cocktail Con this Tuesday.
231140	237580	Really great event and a community in terms of getting the InfoSec community together to talk about cocktails, talk about security.
237580	242120	So I appreciate it. I appreciate DEF CON folks for having us here today.
243420	249560	Hey, I'm Joe Hartman. I command the Cyber National Mission Force, so part of U.S. Cyber Command.
249560	253700	As Dave said, I co-lead the Election Security Group with him.
253860	261980	And, you know, the Election Security Group is really partnered with all the agencies you see represented here and others in defense of the 2020 election.
261980	265220	We're the part of the U.S. government that focuses on the away game.
265220	273220	So we are looking at foreign adversaries, Russia, China, Iran, any other foreign adversary who's attempting to interfere with our elections.
273540	284580	We're looking for them in foreign space, and we're partnering with DHS and FBI in order to ensure that we share information that we find abroad that makes us safer here in the United States.
284580	287160	I'm really glad to be here today and looking forward to your questions.
287880	293780	My name is Maurice Turner. I'm Senior Advisor for the Executive Director at the U.S. Election Assistance Commission.
293780	299520	We're a relatively small agency compared to the ones you've heard from earlier today, but our mission is focused.
299520	306820	We help make sure that Americans all across the country and all across the world have the ability to participate in elections,
306820	313660	whether they're going to be in any one of the 50 states, six territories, or stationed overseas.
313660	323380	So our focus is really, how do we make sure that those voters have access to the polls and that they can vote safely, securely, and make sure that their vote counts?
327060	332420	And I'm Matt Masterson. I'm the designated survivor that was held back from the federal panel.
332420	338440	So if anything happens, we can maintain federal continuity of operations on election security.
338440	342740	I'm in a secret skiff out in the Midwest somewhere.
342740	347820	I appreciate the voting village for inviting me and the feds to participate.
347820	351440	So thankful to Bryson for organizing.
351440	358060	And I know we're going to address the question of what's the greatest area of progress since 2016, where have we improved?
358060	369460	I mean, the fact that you have a unified federal effort working to help support state and local election officials on this mission space, I think, speaks volumes.
369460	376020	I work for the Cybersecurity and Infrastructure Security Agency, or CISA. I'm the election security lead there.
376020	379700	Prior to that, I was a commissioner at the EAC, where Maurice now sits.
379960	382640	And before that, I was an election official in the state of Ohio.
382640	390640	So come from an election administration background, have had to learn the intricacies of both CISA and the IC.
390640	408600	And I'm so thankful to everyone sitting up on that stage for their patience with me and working with me and CISA to make sure we're supporting the almost 8,800 state and local election officials across this country, let alone the private sector that we work very closely with and members of academia and nonpartisan organization.
408600	423820	Our focus at CISA is to get information, support, services, everything from penetration testing to routine cyber hygiene scans to incident response out to the state and local election officials to help support them and engaging with their voters.
423820	427720	The reality is American elections are run at the state and local level.
428040	438360	And we want to do everything we can so that those state and local officials can talk to their voters about why the process is secure and why they should have confidence that their vote was counted as cast.
438360	442900	So really thankful for this panel and super excited to have this discussion today.
443520	450400	Matt, that's a great segue. Trust is key to the infrastructure, right?
450400	465500	The process for collecting the votes to determine our democracy starts with that trust and that begins with transparency and accountability, which is why I thought it was so critical to have this panel here for the government to talk about, okay, what's happened and what have we done?
465500	472040	So 2016 is when I think this really grew into the consciousness as a significant issue that everybody understood.
472040	475540	What exactly happened in 2016 and 2018?
477540	486020	Well, on the cyber side, in 2016, Russia compromised multiple different election networks.
486020	489500	That included the state network, that included two counties.
489500	502700	And as a part of that, we've assessed that they really sought to at least conduct reconnaissance against all 50 states.
502700	507000	To try to figure out where it was most vulnerable and where they could get in.
507060	511860	Now, we don't think that had any effect on election. We have no information that that did.
511860	518140	And really, where they were focused on, really couldn't have.
518140	523940	But within that, it's obviously troubling because that's an attack on our election systems.
523940	525700	It's attacking critical infrastructure.
525700	533700	And it's something that now, looking at that and moving forward, that's why we partnered with everybody here to focus on,
533700	536560	how do we, A, harden the networks so that can't happen?
536560	540540	And how do we work to counter adversaries so they don't want to do it?
540540	545680	And how do we ensure that we can be as transparent as possible?
545680	554400	And that's included some various measures like both FBI and CISA will now tell a chief state election official
554400	557240	if anything happens on a local election network.
557480	562520	That's a change from 2016, and it's a necessary change for the transparency that you noted.
564300	567940	Yeah, I mean, I think Cynthia covered the cyber side pretty well.
567940	572920	From an influence side, I think most folks are tracking the infamous Internet Research Agency, Troll Farm.
572920	578400	So in terms of the social media operations that they were conducting in 2016 and 2018,
579260	584720	also hack and leak operations could be very damaging.
584720	592400	When we look at it in terms of evolution between 2016, 2018, and 2020,
594120	600940	it was mostly focused on Russia in 2016, but we know that the threat is broader than that.
601100	605320	For 2020, we're looking at the spectrum of all of our adversaries.
605320	611820	Russia, China, Iran, ransomware actors. There's more people in the game.
612860	618620	They're learning from each other. Influence is a cheap game to get into now with social media.
618920	625940	It doesn't cost a lot of money. You can try to launder your narratives online through different media outlets.
625940	628500	So that's something we're laser focused on.
630220	638480	For us, in 2016, election security really wasn't a priority mission for the Department of Defense.
638580	643740	It just wasn't something that we had previously focused on, heavily involved in other operations.
644420	650960	And so while we were focused on other operations, the Russians obviously focused on our elections.
650960	658680	We learned from that in 2018, between Cybercom and NSA, we formed what was called the Russia Small Group,
658680	663180	really laser focused on Russian interference in the 2018 election.
663220	668900	For us, that never stopped. I got back to the command about a year ago in 2019,
668900	673900	and we didn't start up this thing called the Election Security Group that was already working.
673900	679120	And it never stopped working from 2018, and we think we're in a much better position now,
679120	682080	certainly, than we were in 2016 or 2018.
682900	689580	The big change from 2016 to 2018 and now into 2020 really started with the critical infrastructure designation
689580	696900	that allowed all these federal partners to come together in a way that we'd be able to better protect our election infrastructure.
696900	701680	And I think that that really is the key to all of this, which is information sharing,
701680	709540	making sure that information is shared amongst agencies, but also to the state and local partners as well.
709540	714580	The folks are actually running their own networks, their own infrastructure. And so that's where EAC comes in.
714580	720260	We have relationships, we're building those relationships with the state and locals to make sure that they understand the information
720260	725600	that's coming to them from their federal partners, and that they realize that they're part of the solution too.
727520	735380	It's how this all works. It's not just keeping those information notices in a silo and keeping them at the local level.
735380	739440	It's a sharing up and down the stack to make sure that the infrastructure is protected,
739440	744640	because it may not just be an attack that happens on a single state or a single county.
744640	751060	That might be happening other places. And if we're not sharing information, then the partners don't know that that coordination is going on.
752200	755880	Yeah, just to build off on what some of the other panelists have said.
755880	763540	For me, the biggest change has really been that level of coordination and support with state and local election officials.
763540	768380	As many people know, when the critical infrastructure designation was made in 2017,
768380	773800	there was a lot of resistance, understandably, from state and local election officials and skepticism.
774180	780620	And we sat there in 2018 and had relationships with all 50 states, had information flowing,
780620	784560	we're deploying Albert sensors. We sit here now on the brink of 2020.
784560	790260	We not only have Albert sensors, so intrusion detection sensors deployed across networks in all 50 states.
790280	800380	We have an ISAC, an information sharing analysis center with close to 3,000 state and local partners receiving information, pushing information back to us.
800380	806260	We're now deploying endpoint protection in many of the states and across localities to have additional insight.
806260	812920	But really, that ability to coordinate across the federal government and push information back down to the state and locals has improved so much.
813220	822740	The federal government, I think, is working in a way around election threat information that I don't know that it did around other issues.
822740	828480	We are able now to take information, and state and locals are sharing all kinds of reporting with us,
828480	832620	and push it across the interagency, the folks that you see sitting up on the stage here,
832620	836900	and then push out alerts and warnings through the ISAC broadly to the community.
836900	846680	And that's just a function that wasn't there certainly in 2016 and is really being honed and improved upon from 2018 to 2020, and that broad reach.
846680	851900	And so that ability to really work with the election officials to understand risk,
851900	856900	our risk understanding is much deeper than it was 2016 or 2018,
856900	863620	to the point where as COVID has developed and kind of changed operations within elections offices,
863620	867520	we've been able to be responsive and understand where the risk is shifting,
867520	873480	and try to help gear our support, our information sharing, to understand that risk shift,
873480	878080	so that they can take appropriate steps to mitigate that risk and really ensure the integrity of the election,
878080	879900	and then turn around and message it to voters.
879900	883240	And I think that's a theme you're going to hear throughout this conversation,
883240	891500	really reach in that last step of talking to voters about their options, about how they can vote,
891500	898460	about the process and security is really critical in an environment when we know adversaries are trying to undermine confidence in the process.
899400	904640	So part of what we've learned, which stems from the problem, and a lot of what the solution has been,
904640	909480	has been the designation of this as critical infrastructure, the federal collaboration,
911280	916580	where this isn't the first time you're all meeting each other. You all know each other pretty well, right?
916580	923540	I was talking to Bryson earlier that I've been on panels before with people from the government who are all working the same issue,
923540	926180	and then you're meeting the person right before the panel starts.
926420	929540	So when Bryson reached out and said, we're going to have a panel on election security.
929540	932980	And I asked, OK, who's going to be on it? And he started to tick it off names.
932980	938560	And I'm like, OK, I talk to these people multiple times per week or sometimes every single day or multiple times a day.
938560	945100	So it really just shows how deep the collaboration is. I spent a lot of time in counterterrorism.
945100	950480	You think that's a mission that, you know, and it is a mission that the government rallies around.
950480	956140	But election security, I don't get it out of the water in terms of how much we all talk to each other.
956780	960900	Right. I mean, there's no better example than that.
960900	967140	This panel is a representation of what's already happening. This panel is not the thing that is driving it.
967140	970560	Right. We are capturing a moment in time of what's been accomplished.
970660	976080	If we had tried to do this in 2016, we would have been spending the last 30 minutes all shaking each other.
976080	981540	So what do you do? What do you do? What exactly is that?
981940	986580	Tell us about the Midwest, Matt. Like, we've never heard of these things. Sorry, that's a Chicago thing.
987660	991600	OK. And how information sharing isn't just sharing information. Right.
991600	996280	But it's the fact that the information is being shared so that missions are being executed.
996280	999960	Things are happening with it. Right. Those risks are being assessed.
1000380	1003920	Those actions are being taken. And I really like the way you phrased it, Joe. Right.
1003920	1007100	We're playing the away game. I'll translate that for everybody.
1007100	1009560	Actually, why don't you translate what the away game is?
1009560	1013100	Yeah. So. So let me translate the away game at the end.
1013100	1016040	I mean, if I could just talk about the collaboration, the relationships.
1016120	1020100	You know, a good example is like the rehearsal that we did on Super Tuesday.
1020320	1024180	And so, look, I'm in the Army. I've been in the Army a long time, just like Dave.
1024180	1030160	You know, I spent a lot of time in the CT fight and, you know, a lot of times in panel rooms and places like Afghanistan.
1030160	1033420	And, you know, we operate out of these joint operations centers. Right.
1033460	1040360	And in the joint operations centers, we're sitting in there, as you can imagine, we love flat screen TVs, a lot of flat screen TVs on the wall.
1040360	1045540	And, you know, unmanned aerial vehicles are flying around and other collection assets.
1045600	1051420	All that data is being pumped into the room where you're immediately able to make sense of it and then make decisions.
1051420	1054540	You know, allocating resources, sending forces, doing what.
1054580	1063600	And, you know, Super Tuesday, if you walked into the to the room that we were using as a mission center, you know, you would have seen cybercom personnel.
1063600	1067840	You would have seen NSA personnel and you would have looked in a chat room.
1067840	1074040	And almost every organization that you could imagine involved in the federal government is in a chat room.
1074040	1077720	OK, and they are talking about in almost real time.
1077720	1088800	If something goes on on state election infrastructure in North Carolina, you know, there is an unclassified chat going up to DHS drops it in a classified chat room.
1088800	1103400	You've got analysts from NSA and cybercom and other government agencies immediately combing their databases and then almost instantaneously providing information back that says, hey, this is something you should be concerned about.
1103400	1106660	Or this is just normal traffic that we see on any day on the Internet.
1106660	1112480	It looks anomalous because we're paying a lot more attention to it right now because there's this thing called Super Tuesday going on.
1112480	1119940	You know, at the same time, I've got defensive cyber elements that are sitting in things we call war rooms and they are waiting on a call.
1119960	1125340	You know, if there is something that happens that DHS needs help with, you know, they are trained.
1125520	1129500	They have collaborated in the past and we're ready to kick a team out.
1129500	1133400	Additionally, we have elements that are that are sitting over in other off centers.
1133500	1139260	Okay, and they are prepared if we see an adversary that's attempting to do something to interfere with that election.
1139260	1142000	You know, we have the ability to play the away game.
1142000	1145820	And so we have the ability to go out in foreign space and look at what you're doing.
1145880	1148500	And we have the ability to make you stop doing that.
1148500	1160280	And that's really the focus of what I think the federal government looks like from the local and state level all the way up through the national level to the Department of Defense.
1160280	1164840	And, you know, for me as American, honestly, that was a pretty impressive experience.
1165380	1173300	If I could take a slight turn from that, I think it is important to call out the collaboration that we have in the government.
1173300	1179740	But I think the other evolution that's occurred is the engagement with industry here, right?
1179920	1184720	I'm sure we have a lot of people who are, you know, working for the federal government all that year.
1184720	1190820	And I think that's been a major component of the shift in posture we have for election security.
1191020	1195060	I mean, it's awesome when you're reading about, you know, disinformation networks being pulled out.
1195820	1203880	Obviously, the cybersecurity companies really focused on election threats and trying to hunt down, you know, adversaries and what they're up to.
1203880	1216200	You know, we can't do this mission without them and without industry help from state and local election officials, but also the cybersecurity companies and how we can feed off each other.
1216200	1222620	We learn from what industry is putting out and what we're providing value at and what we're putting out.
1222880	1227220	So people can leverage that in the systems and insights they have, right?
1227280	1230840	Industry has a lot better insights than the government does in a lot of these cases.
1230840	1234180	So they're a critical partner in this partnership.
1234980	1245140	And I think that taking that a step further, even the individual level collaboration, you know, not just a big corporate or a company collaboration with the federal government,
1245140	1251800	but people who call in suspicious information because they're worried about it.
1251920	1256320	And they call DHS, they call FBI, they call any of us.
1256320	1261920	And they are calling because they're worried and they want to do the right thing.
1261920	1271920	And because those people call, the majority of the information that really we're able to get to state and locals since 2016, it's been because people called us.
1271920	1275880	They said they were concerned about something, we looked at it, and we said, you're right, and we got it out to everybody.
1275880	1281400	So there's this element of that corporate industry responsibility and collaboration.
1281400	1288580	There's a federal government collaboration, but there's that individual collaboration too with all of us that it really is working well together.
1289560	1293180	Yeah, Bryson, if I can just really quick on that.
1293300	1296700	I think Cynthia raises a really good point and it's appropriate here.
1296700	1302820	Just the fact that there's now a guide for coordinated vulnerability disclosure for state and local election officials.
1302820	1311540	In 2016, as a member of the election community, I can tell you that was not a known commodity or something that they were even considering.
1311540	1317800	And now we're progressed where folks like Jack Cable, who I know was on before, have built relationships with election officials,
1317800	1327180	to help them understand the value of vulnerability disclosure and working with independent researchers and security experts in that way.
1327180	1335020	The fact that private industry within the elections community is rolling out vulnerability disclosure policies and engaging in that conversation,
1335020	1338060	not something that was going on in 2016.
1338060	1343820	And so the multiple avenues of information, the multiple avenues of collaboration are really encouraging.
1343820	1345680	I think we have a ways to go.
1345680	1349920	I think there's lots of room for improvement, certainly on the federal side to help coordinate on that.
1349920	1356460	At the state and local level, increasing capacity, the ability to intake and resolve and mitigate those vulnerabilities.
1356620	1361560	But it's a drastic improvement from where we were even four years ago,
1361560	1366520	and really speaks to the professionalism of state and local election officials in particular,
1366520	1376400	who care deeply about the security of this process in their systems and want to find ways to improve and talk to their voters about the steps they've taken to secure it.
1377540	1382560	This industry and this community has really matured very quickly compared to some others.
1382560	1390760	And I think it's part due to events like this, like DEF CON, where researchers are coming together, talking about what's going on,
1390760	1401220	where are their vulnerabilities, what are some ways we can fix it, taking a look at other industries like telecoms, aviation, things like that, and getting those best practices out of the way kind of quickly.
1401620	1405000	And as Matt was saying, it's because individuals care.
1405000	1411480	And I think that's probably the biggest part of this that I want people to take away from this is that elections happen in communities.
1411480	1417760	And I think that's really what it comes down to is everyone gets a sense of how important it is at the very local level.
1417760	1423580	And all that builds up to build a sense of national urgency and importance about the issue.
1423660	1435100	And to see the election officials really get on board with this idea that they are part of the defense network to make sure that we don't have interference playing
1435560	1447440	in our elections and to see them, you know, get educated on the issues and really try to convey their own sense of confidence in their systems, because they know what goes into running an election.
1447560	1453480	It's not all just about cybersecurity. There are administrative tasks they need to do. There are other tasks that some of them are even
1454280	1459280	responsible for. And so, you know, they care deeply about elections. They want to make sure that everyone who votes
1459280	1466880	has a level of confidence that they can feel when they go into the polling place or when they mail in their ballot.
1467160	1474620	So a follow-up question to Maurice and to Matt. This follows from a question from Neil McKernan.
1474920	1484240	And it is, we're talking to a very unique audience today, right? They are citizens of the world. They're American citizens, but they're hackers, right?
1484240	1490940	This is the new system of the Internet that's there to figure out what works best. And here's the thing.
1491340	1497320	They're doing it today in the voting village. They're doing it on the technology. We talked about industry involvement.
1497320	1504940	We have individuals willing to take their time to actually dig into the technology itself to understand what works and what doesn't,
1504940	1508880	because that gives us better trust in that technical implementation of the system.
1508880	1518920	And so the full question here is, when would we start potentially having a prerequisite for entrance to the VVSG certification process
1518920	1525200	that election system vendors adopt good vulnerability disclosure policies, as called out today,
1525200	1528480	to make them widely available for penetration testing?
1529160	1535580	I'll take that since EAC is in charge of the development and the approval of the VVSG.
1535580	1543040	So those are guidelines that are used by states, and it directs the manufacturers to meet certain requirements
1543040	1547820	so that they build their systems in a way that is accessible and secure and usable.
1548100	1557140	And so I think the idea of a vulnerability disclosure policy being part of that would really just be the codification of industry best practices.
1557140	1567520	Now, the manufacturers know that they are in competition to help bring a better level of security to these systems that are in use.
1567520	1571720	And so I think that that's already happening. We've seen the fruits of that labor already.
1571720	1577740	It didn't need to come from a federal agency to help the process along.
1578340	1582060	So to answer Neil's question, it's already happening.
1582060	1588580	And so as the industry continues to mature, I think that we'll see more and more vulnerability disclosure policies.
1588580	1593640	And I'm hoping that you folks out there get interested in this sector and actually use them.
1593640	1600520	Find that legal way of doing the research and then reporting it responsibly to make sure that the problems actually get fixed.
1600520	1606520	This isn't about a big bug bounty that you're going after. This isn't about trying to embarrass anyone.
1606520	1610820	This is about strengthening our democracy, literally through strengthening our systems.
1612000	1617080	Yeah, Bryson, just to just add a little bit, Maurice really tackled the meat of the issue.
1617080	1630600	But I agree. I mean, we have had several vendors, election system vendors, come through our penetration testing process, what we call our critical product evaluation process up in Idaho.
1630700	1633360	We have seen the private sector embrace that.
1633360	1640920	And now we're starting to see, I think, the fruits of the work of not just the voting village, but the private sector companies to understand the value.
1640920	1651400	And frankly, the marketplace dictating that improves security steps towards coordinated vulnerability disclosure processes are going to be good for business.
1651400	1655220	And that's why you see a reflection in progress being made.
1655220	1664520	The private sector is hearing from customers, is responding, and I think we'll continue to see progress made on that level.
1664520	1670320	I think one step we need to take, and I know the EAC takes this very seriously and states need to be thinking about it too,
1670320	1675280	but to the extent it involves equipment, whether e-poll books or voting systems that they certify,
1675280	1683260	you have to be ready to respond and adjust certification quickly, adapt to those type of processes.
1683260	1697620	So I think we have a maturing to do sort of in the bureaucratic lane to make sure that we can support the private sector as they're changing and evolving and accepting this approach,
1697620	1704260	that we support them in our certification processes and the way that systems need to be fielded.
1707370	1715050	So that all ties back to that, what is the threat? China, Iran, Russia have been mentioned. How are they a threat?
1715050	1718950	What are they doing? And are they the only threat that we need to be worried about?
1720970	1725730	So I'll start with that one. I would say those are the main threats we're facing.
1725730	1736050	Again, I think ransomware is like one of those wild cards out there that could be fielded by anyone, in theory, criminal actors, etc.
1736050	1746510	So they could probably say more to that. So for Russia, I think in terms of an evolution, what we've seen, we talked about the Internet Research Agency,
1746510	1749950	what they did in kind of social media accounts and the troll farms.
1750290	1755250	In terms of 2020, we've seen a shift more towards the use of proxies.
1755250	1761350	I guess I should maybe say intermediaries when we're in a technology crowd instead of saying proxies.
1762210	1771190	So using, again, I mentioned before, laundering information through other individuals into the media space.
1771190	1781170	The IRA, you've seen that shift tactics. They had set up something in Africa, in Ghana, in terms of trying to have people there,
1781170	1793110	trying to put stuff online, posting things about socially divisive issues, using covert influence websites to be able to get their narrative out.
1793410	1796910	So that's kind of a shift of tactic we've seen from the Russia side.
1796910	1807410	China, I think scale is something that is a bit unmatched in terms of them as a threat, both from a cyber standpoint and from an influence standpoint.
1807410	1813650	Certainly on influence, they've been very active in that region, Taiwan, Hong Kong.
1813870	1820950	Then becoming potentially more aggressive in the U.S. space is something that we need to monitor and be prepared for.
1820950	1829230	But in cyber, for the China cyber threat, they're a little bit different in terms of the scale and breadth of the targets they go after.
1829230	1837470	It's like every U.S. citizen is a target of China, just because of the big data, PII that they're interested in collecting.
1837650	1843270	Obviously, everyone's familiar with IP threat, besides just the standard intelligence-type targets.
1843450	1846410	So I think that sets them uniquely apart.
1846410	1856210	And Iran, just getting into the game, too, in terms of them trying to do social media influence and learning from what the other adversaries are doing.
1858450	1866250	Yeah, so Russia, I would offer everyone you should read the report that came out from the State Department a couple of days ago.
1866290	1873370	77 pages called the Pillars of Disinformation about the various sites operated by Russia.
1873370	1888470	Just ask yourself, why in Russia, a country where few people read or write English, do they continue to put out a tremendous amount of English language news on these French news outlets?
1888470	1892450	That really involved divisive issues that are U.S.-based.
1892450	1899190	And so, again, a tremendous amount of platforms that the Russians invest in.
1899190	1908950	CNN ran a great news exposé in April of 2020 about an organization that Dave referenced.
1908950	1921230	So 18 Trolls in Ghana, led by a guy named Seth Wierdo, who grew up in Ghana, educated in Russia, and appears to have been on the payroll of the Purgosian network.
1921230	1924830	So, again, it's about a seven-minute watch.
1925510	1930790	And that can just provide you some insight into what the Russians are doing there.
1930790	1950310	And then, you know, when we talk about private industry, you know, whether it's Facebook, Google, Microsoft, you know, there are dozens of articles about how these technology companies have identified this malicious behavior on their platforms that they're able to link back to the nation-state adversaries, Russia, China, and Iran.
1950310	1954970	So, you know, I would tell everybody that there's a ton of stuff out there.
1954970	1960410	You know, I know when we talk to CyberComm and NSA, we want to focus on that classified cyber box.
1960410	1967450	But I'll tell you, there is a tremendous amount of great information already out there on the Internet that can provide you a lot of insight.
1968150	1979750	You know, as Cynthia talked about, you know, we, you know, the U.S. government, you know, for you experts that are out there, you know, if you see suspicious activity, tell DHS.
1979750	1983750	Tell the FBI. You know, we, the government, will do something about it.
1983830	1987350	You know, if it's a domestic threat, those organizations will address it.
1987350	1991890	If it's a foreign threat, they'll tell us. And I don't mean they'll tell us like six months from now.
1991890	1995710	They'll tell us that day. They'll tell us early the next morning.
1996010	2001070	You know, we had an incident the other night that, you know, occurred at 1.42 in the morning.
2001230	2004950	And, you know, about 6 o'clock in the morning, we had cyber teams looking at the activity.
2004950	2013850	So, again, for you experts out there, you know, you know better than anybody else if something weird is going on on the Internet.
2013910	2018050	And I would just ask you to share that and we, the government, will take action.
2018150	2029450	And I'd say, too, just from a cyber aspect, because I know we're talking to a lot of the hacker community, you know, leveraging trust relationships, you know, it's a common technique.
2029450	2035750	Right. So, you know, some of these networks that they might be interested in are very well defended, just like the DoD.
2035750	2039570	Right. But, you know, companies sometimes outsource their marketing departments.
2039570	2046350	There's other other soft targets out there, think tanks, that could be lucrative even from an Intel perspective.
2046350	2052090	You know, think tanks do policy work for politicians. They have contacts with elected officials.
2052110	2054810	So, you know, sometimes going outside the bullseye.
2055370	2064170	And again, a lot of this is common techniques, exploiting publicly known CVEs, you know, password spraying, spear phishing, you name it.
2064310	2068690	You know, they're using Shodan, they're using Burp Suite, they're using those tools.
2068690	2077770	They can get access to a network that maybe isn't inside the bullseye, leverage that, leverage an account, leverage a network connection to get into the target they're going after.
2077770	2085710	And that's an important point. And that type of targeting hasn't really stopped from 2016 on.
2085730	2093890	So spear phishing or looking for those networks that might be connected to the targets that they more desire.
2094210	2099050	That's been continuing the pace. And I mean, we're tracking a lot of incidents even right now.
2099330	2106030	And the good news with all those incidents is we haven't really seen any widespread impacts from those.
2106030	2113330	But it's interesting because tracking a lot of incidents can feel scary.
2113330	2121890	But it also gives me a lot of... it makes me feel better almost because I know that we're detecting every tremor.
2122070	2127870	And that means we have a lot of false positives that we follow up on.
2128170	2131710	I'd much rather that than not knowing things are out there.
2131710	2134290	But it also means we have a fuller picture.
2134290	2141470	And part of that fuller picture, as Dave mentioned, is on cyber criminals and not just ransomware.
2142270	2148010	Other types of incidents as well and actors as well.
2148010	2154590	And we really have to be on guard, not just if it's coming from Russia or China or Iran or a host of other groups,
2154590	2159170	but a threat to an election network or a campaign network is a threat.
2159170	2164310	And we need to be able to be really flexible in addressing that.
2164310	2173410	And getting in front of that head on so that we can't make sure that come election day we're not dealing with a lot of pop-up threats
2173410	2177450	and we're spending a lot of time trying to figure out really what happened.
2177490	2183510	Yeah, I think that the nexus of cyber and the cyber threats and influence threats is a dangerous space.
2183510	2192150	We know about Hackenleak and how that could impact potentially the voter populace and their opinions.
2192590	2204570	But we were just talking before this panel, I think, in terms of using influence to make people distrust either the electoral outcomes.
2204570	2211610	So you could have a ransomware incident in a local network that actually doesn't even impact.
2211610	2216050	The elections counting or any of that.
2216050	2224810	But someone could then spin an influence campaign when that gets reported to make people think it has had an impact and then not trust the results.
2224810	2228370	Right. So that's one of those things that I think is worrisome.
2228370	2236630	Even if a cyber attack doesn't actually have a measurable impact in terms of the conduct of the election or voting tallies.
2237570	2243650	But, you know, if someone's able to take that and then try to spin off an information operations campaign from it.
2246010	2253930	That point, I'd just like to drive home is that it's not just about, you know, what actually happened, where votes actually change.
2253930	2257570	That's incredibly difficult to do at scale in a way that's undetectable.
2258310	2265690	But if you can put that message out there that causes people to question and their local election official picks up that phone call and they don't have a good response for it.
2265690	2267410	That can be just as damaging.
2267450	2274650	So that's why at EAC we feel so strongly about making sure that local election officials have the tools, have the training that they need.
2274650	2282390	So we partner with the Center for Tech and Civic Life to actually provide that basic intermediate level of cybersecurity training.
2282390	2285810	So that they understand, you know, why is it important to have two-factor authentication?
2285810	2290430	You know, what does it mean to actually have a password manager so you're not reusing your passwords?
2290430	2297210	These are all basics that most folks that are watching us right now are thinking, how can anybody not know how to do that?
2297210	2303710	But if you've never been taught that or if you don't have an understanding of the impact of that, then it might be too much work.
2303770	2309290	But once you understand how much bad stuff that can actually prevent you recognize, it's actually not that difficult.
2309290	2312750	It's actually pretty easy to use it if you are familiar with the tools.
2312970	2316170	And then it gives you the confidence to stand up and say, you know what?
2316190	2319010	Yeah, we heard about the ransomware or maybe we got hit with some ransomware.
2319370	2324090	You know, the town down the street, but we're ready. These are the things that we're doing.
2324090	2325550	We're also doing some other things we're not going to talk about.
2325550	2332090	But here are some of the big things, the high-level things that we're doing to be prepared so that if we do get a phishing email, we know how to spot it.
2332090	2337510	We know how to stop it. We can recover, you know, from those backups if we actually do get hit with it.
2337590	2347170	And so I think that's why it's so important that the local election officials have a level of confidence that they can then reflect back on to their voters when it comes to elections.
2347950	2352370	Yeah, just real quick on that. Maurice raises some really good points.
2352370	2365350	And it's why we spent a lot of time at CISA on something we call the Last Mile Project, which is literally a poster project offering both risk assessment and then mitigation advice to the local level,
2365350	2371930	almost 6,000 local jurisdictions specific to their state and their jurisdiction so that they can not only take the steps,
2371930	2381310	whether it's multi-factor authentication or penetration testing or phishing campaign resilience or creating incident response plans, which we really focused on,
2381310	2385530	but then can go and talk to their voters. And we've seen some cool approaches to this.
2385530	2393530	We saw one state, the state of Iowa, take their posters out to the state fair so that they could talk to their voters directly about steps that they were taking.
2393530	2401910	We saw the state of Rhode Island work with their libraries to put it up in the library system so that they could talk to voters through the libraries about this.
2401910	2411130	And in the end, and I think Dave raises a really important point, there's resilience to cyber intrusion, resilience, and the ability to recover from incidents.
2411130	2416510	But then there's the resilience that we need to install in talking to the American voter.
2416510	2423090	We need voters that are prepared, that understand their registry. Am I registered? What's on my ballot?
2423090	2429230	What are my voting options, particularly amongst COVID, so that they can have confidence on how they're going to engage the process?
2429230	2438290	We need a voter that is patient, that understands that perhaps election night results won't be as complete as what we're used to in a given jurisdiction,
2438290	2443850	and that the accuracy of the vote count is the most important thing, regardless of the time it takes.
2443890	2447070	And then we need a voter that participates, that engages.
2447070	2461770	We need, you know, 250,000 or more poll workers across this country in preparation for November in the midst of COVID when we have poll workers that, you know, are going to be unwilling to work, either because their age or high-risk nature.
2462130	2470790	And so having people engaged and participating, the reality for those folks that are listening, no one told me anyone would be listening to this, so now I'm a little worried.
2470790	2475970	But anyone that is listening, go sign up to be a poll worker if you want to understand the process.
2475970	2479070	Matt Blaze hits this every time, and he's exactly right.
2479070	2485970	If you have questions, if you have concerns, if you want to help secure the process, start off by being an election worker.
2485970	2488650	You're not going to get turned down. We need you.
2488810	2495770	And it's the best way to learn where the resiliency exists in the process, where improvements can be made in order to get involved.
2495770	2501830	If you can't be a poll worker, if you can't take on that risk, there are opportunities to watch pre-election testing of systems.
2501830	2507150	We run elections at the local level so you can participate directly with those who run the process.
2507150	2514170	So go get your questions answered. Go engage with them and see what kind of support they're in need of, in particular serving as an election worker.
2514170	2519010	It really is the best path to doing this and the best way to learn the process.
2519010	2523950	But if we can have voters, voters are our last line of resilience, as Director Krebs says.
2523950	2531690	They're the ones that can really ensure a responsive, resilient process when attempts to undermine confidence are there.
2532770	2538870	There is no such thing as a secure system, right? We never hit the plateau where it's like, oh, we're good.
2538870	2542110	We can all pack up, go home and take the next year off.
2542110	2549330	So quick question from a lot of interested citizens who want to get involved.
2549330	2554050	Ties to the fact around, OK, so you talk about detection being a key part of that secure system.
2554430	2557590	Where exactly are they supposed to go to figure out where to say something?
2559010	2561810	Well, you can go to your local FBI field office.
2562590	2572230	You can go on to FBI.gov and find out contacts or contact our FBI CyWatch directly.
2572570	2580070	And you can go to multiple other agencies as well, because what we've really said is a call to one is a call to all.
2580070	2588110	And that's how we are ensuring that there's that kind of information sharing across the board here.
2591450	2595070	I was just going to say, Cynthia is exactly right.
2596010	2603350	First of all, if you know something within your community, engaging directly with the local election officials is really critical to help understand.
2603350	2607310	Did you actually find something or is this something they're aware of?
2607310	2612350	Otherwise, the second part is engaging with your state officials.
2612350	2617410	They're prepared to take it on. They're the ones that know the process, know their systems, can talk to the vendors.
2617410	2622170	And then the ISAC exists for exactly this reason as well.
2622230	2630730	There's an avenue, and it happens fairly commonly, that if you report to the Election Infrastructure Information Sharing Analysis Center or directly into CISA,
2630730	2641430	we now have the points of contact that we didn't have in 2016 to be able to get valuable information to state and local election officials so that they can take action on something that's identified.
2641430	2649290	There are avenues. Again, the state and local officials know their systems. They're the best prepared to mitigate a problem.
2649290	2656510	But if you're not finding success that route, the ISAC, CISA, FBI field office are available to help you get there.
2656670	2663670	And understandably, some folks may not want to go to the federal government, which is why the ISAC really offers a nice safe place to begin that reporting.
2663830	2668690	I'll offer up EAC as well. You can send an email to security at EAC.gov.
2668690	2676210	Obviously, we have connections with all the manufacturers. If you're having trouble with a particular manufacturer or having trouble with a particular agency or your local official,
2676210	2680310	or just not getting the response you want, we're happy to help facilitate that conversation.
2681190	2689350	And just from a cyber count standpoint, one of the big changes for us is, you know, we historically had been focused, you know, working inside SCIFs.
2689350	2695970	And one of the things that we've really done in support of 2020 is, you know, we have organizations now that live outside SCIFs.
2695970	2703410	They're on NIPRNet or unclassified internet. You know, they're in Slack channels. They're talking to FBI. They're talking to DHS.
2703410	2713230	They're talking to private industry partners. And they're, you know, they're living in that same ecosystem that many of the folks that are listening to this presentation are.
2713230	2725270	And so we have really tried to adapt some of our behavior so we're able to, you know, in real time collaborate with our partners across government, you know, on a little different time schedule than would be a traditional military one.
2725270	2729950	Because I know most of you are probably not up at 530 in the morning doing just the same.
2731530	2741490	So Bill Evanina, the director of the National Counterintelligence Security Center, just recently put out an official statement today talking about the very threat that we're covering here.
2741750	2748770	But all of the threats were basically laid out in an equal manner. Would you say the threats are equal? Which one would you say is the biggest and why?
2750210	2764170	Well, I don't think we need to take any of the threats lightly, right? I think the statement in terms of what you saw out there, it lays out how each adversary is approaching the problem.
2764170	2776890	Certainly, you know, Russia, China, Iran, they all have intent and they all do activities that they think are advancing their best interests here.
2776890	2796570	So, you know, I don't think I would say like one is scarier than the other, per se. Certainly, some of these adversaries are a bit more experienced at this in terms of the amount of time they've been working, you know, doing operations.
2796570	2814110	But, you know, from our perspective, you know, I care about all those threats. I take them all seriously because, you know, again, some of the stuff is very cheap to get into and to execute. So, you know, I wouldn't do a value judgment on those.
2814690	2828970	I totally agree more on that. And I think that it's really important to remember that our threat picture is always informed by what we collect, what we know. And, you know, we don't have perfect pictures.
2828970	2848810	And how we really have to approach all of this is what could be the effect from these various groups? What could happen closer to September, October? Because, you know, it still is a few months away. And we need to be prepared for a lot of different things happening within that.
2848810	2866270	You know, I'm going to flip stop again. You know, it doesn't just have to be the big three. It can be other non-state actors or criminal groups and the like that are going to undermine people's confidence in our system.
2866270	2878470	And really, if you ask me what the biggest threat is, it's these constant drumbeat or influence campaigns that are going to make people feel like they're less confident in our system.
2878470	2883990	And that could be people who vote less. And that's really where, you know, I stand tonight.
2885430	2894830	Hey, Bryson, just real quick. Everyone in the Fed room actually has to take a drink because the Fed said foot stomp. So that's actually one sip for everyone in the Fed room.
2896690	2897470	Thanks.
2899230	2904650	Matt, I can't help but feel like you're cheating the system a little bit because you don't have a drink.
2904650	2908630	I've been drinking this whole panel. Don't worry. I'm good.
2911470	2913630	Hey, put up or shut up. Show us your drink.
2914770	2916950	It's in a water bottle, but it's vodka.
2918950	2926990	So we're coming close to our end of time. So I want to ask a final sort of grab bag questions to each of you.
2927650	2929830	And you have about a minute to respond.
2930530	2937510	So you get a non-internet connected wand, magic wand that you can wave.
2937510	2940410	Is that the magic wand?
2940750	2943490	Yes, that is how it is. Wireless, but wired.
2944530	2949410	And with this magic wand, you can have one thing happen for your agency instantaneously.
2950290	2955450	This isn't reality, right? This isn't, oh, if only I could get that $20 million to fund that.
2955450	2958530	This is, what do you wish from a process perspective?
2959910	2967990	So 2020 is almost written. The mail-in ballots start in a month. People start voting. Those start happening.
2968250	2976370	2024 is our next big one. What is one good thing and one thing we really need to worry about in the future in 2024?
2977750	2981550	See, I feel like I'm the shortstop being right next to you.
2982210	2983830	I like you the most.
2983830	2985050	Okay.
2987870	3008750	So thinking about what I really wish we had more of is I wish we had more people right now with the cyber skillset that we could hire quickly and get them on.
3008750	3016550	So that we could just expand our scope and scale and speed in which we're addressing threats.
3016770	3021570	And I think that that goes towards, you know, we're putting in so much of what we have against the election.
3021570	3023850	And I feel really good about where we're at on it.
3023850	3026910	But what does that take away from some of the other work?
3027190	3028910	And that, you know, that worries me.
3028910	3036890	And I'd like us to know that we have the people coming to us that want to do the right thing.
3036950	3045110	That want to protect America and have those skills necessary to be able to help us in that.
3045110	3047670	As it looks towards 2024, what do I want to keep?
3048490	3053180	So I hope we keep the collaboration and the focus alive.
3053180	3057340	In my opening remarks, I gave a real quick overview of what the FBI does.
3057440	3063660	Part of it is focused on cyber investigations, looking at influence.
3063660	3066820	We developed the Foreign Influence Task Force.
3067260	3074200	And that effort, I think, has really helped us focus on it's not just a cyber issue.
3074200	3075960	It's not just a criminal issue.
3075960	3077300	It's not just an influence issue.
3077300	3079400	It's seeing how it all works together.
3079420	3083620	Internal, getting the China people to talk to the Russian people to talk to the cyber crime people.
3083620	3086620	And looking at it as one threat.
3087600	3093100	That's new within the federal government to really consider it in that space.
3093100	3096180	And I want to keep that moving forward.
3096180	3100300	I think that, yeah, that's...
3100920	3101680	Did I get all your questions?
3101680	3105060	You asked a spectrum of a few of them here.
3106260	3107360	But yeah.
3107360	3112800	And I hope we all stay in touch after we put this in our rear view mirror.
3113540	3116640	If you don't stay in touch, then the next panel is going to be more awkward.
3118740	3123040	I think the one answer is pretty easy for me.
3123180	3128120	Perfect insight into adversary intents and operations is obviously a great thing to have.
3128960	3131080	Dave, you're not supposed to say that you don't have that.
3134380	3138540	So, I mean, that's just going to inform our activities moving forward.
3139380	3141580	Hitting a little bit on Cynthia's point.
3141580	3145540	And going back a bit to a comment I made before in terms of working counterterrorism.
3145540	3148020	A lot of times you're fighting the last war, right?
3148240	3151720	Someone tries to blow up a plane with printer cartridges.
3151840	3154420	The government swarms to figure out how to stop that.
3154420	3156000	But then the adversary moves on.
3156000	3161580	The same thing here. We've seen adversaries evolve.
3161580	3164420	We've seen new adversaries come in.
3164920	3169040	So there's always worry about what you don't know.
3169040	3175080	But what I'm confident in is that we are positioned, a lot better positioned now, for agility.
3175080	3180700	In terms of responding to these threats because of the systems we've set up, the partnerships we have.
3180700	3185220	That is certainly something for 2024 we need to keep building on.
3185220	3188660	And not losing sight of it when new problems come up.
3188760	3190840	Not making sure this remains a focus.
3190840	3194480	I think the DEFCON voting village is very important to keep this running.
3194480	3195840	We need people's help.
3196300	3199380	From NSA specifically, we have a much...
3199380	3203580	We're investing a lot more in the White Hat brand.
3204820	3207620	NSA cyber Twitter account, please go follow it.
3207620	3209820	You're going to see more good stuff coming out of that.
3210680	3214820	But continuing to build upon that is going to be a critical thing we're going to invest in.
3214820	3220500	Moving forward, I can't tell you how excited some of the people were in our building.
3220500	3224540	Like late May, the cybersecurity advisory on the GRU.
3224540	3226880	On the mail vulnerability.
3227120	3231480	Seeing at least five different cybersecurity companies take that information.
3231480	3234700	Pivot on the indicators in their own data sets.
3234700	3238260	Figuring out new things that we didn't even know about.
3238300	3242620	To uncover more of an adversary operation.
3242620	3245420	That got people excited in the building.
3245800	3248860	And that's something we do want to do more of.
3248860	3251080	And again, just hitting on that critical partnership.
3251080	3254780	And that dynamic of us using each other's information.
3254780	3257620	And building the security of the enterprise.
3257620	3259880	Raising all those. It sounds kind of Pollyanna-ish.
3259880	3262040	But I think it's really important.
3263840	3267640	Hey, Bryce. If I could wave a magic wand, I would wave it.
3267640	3270140	And we would get COVID-19 under control.
3270860	3273460	I just got to tell you, there's great collaboration.
3273460	3275320	But we could do so much more.
3275640	3278560	We could do so much more with our partners here.
3278600	3280820	We could do so much more overseas.
3281300	3283760	If we could get the pandemic under control.
3283760	3286200	So please wear your mask and help us do that.
3286200	3289780	The second piece, where do we see this in 2024?
3290100	3292980	You do get asked questions, but I get to answer the question a lot.
3293220	3295820	I would rather focus on 2020.
3295820	3298640	2020 is not a foregone conclusion.
3298640	3301960	We can have a safe, secure, and credible election.
3301980	3305140	As an American people, we need to mobilize.
3305480	3307920	There are thousands of smart people.
3308320	3312900	Extraordinarily technically capable that are watching this session right now.
3312900	3315940	Please go work at polling stations.
3315940	3319760	Please talk to DHS. Please talk to the FBI.
3320080	3322540	Again, we are all in.
3322540	3324840	We have thousands of people that are going to work every day
3324840	3328420	in order to support a safe, secure, and credible election.
3328600	3331000	And I would just ask for everybody's help.
3332240	3335060	I like your magic wand answer. I really appreciate that.
3335060	3338060	It gives a greater sense of where we all are in the world today.
3338220	3340780	If I could wave my magic wand on EAC,
3340780	3343020	I would say that we would be doing better
3343540	3347620	to get the VBSG more flexible
3348280	3349980	and faster responding.
3349980	3353340	So this idea that if we can get you researchers interested
3353340	3357220	in election infrastructure and discover those vulnerabilities,
3357220	3359740	report them responsibly, and then we can get the manufacturers
3359740	3361860	to patch and get those out in the field
3362300	3363860	in a much faster turnaround,
3363860	3366920	I think we'd be in a much better position.
3366920	3370980	We're working toward that. It's still a process that takes some time,
3370980	3373080	but I think we can get there by 2024.
3373560	3376480	And just to recognize that federal elections are every two years,
3376480	3379520	but locals are running elections every few weeks.
3379560	3382060	And so there's a bigger stake at play,
3382060	3384480	because every election that's run is a chance to show
3384480	3387460	that we can do democracy right. We're going to keep doing it.
3387460	3389880	And it's done very well most of the time.
3389880	3391640	It's just those few times where there's those hiccups
3392460	3395440	that we have some trouble and it starts to erode that confidence.
3395440	3398580	So the better we can get at getting those patches,
3398580	3400340	the much better off the whole system will run.
3402040	3404600	Yeah, so the magic wand,
3404600	3407980	I got two answers, I think, and I had the advantage of time,
3407980	3411100	which is useful. The first is,
3411100	3417120	if there is a way for CISA to push out service agreements
3417120	3420920	or whatever the case may be to upgrade election systems,
3420920	3424400	not just voting systems, where most of the focus goes,
3424400	3426600	but election systems, including workstations,
3426600	3429760	off of outdated and unsupported software,
3429760	3432520	I absolutely want to do that.
3432660	3435240	It's not just Windows 7. We're talking older.
3436040	3439100	It's not that the local election officials or state officials
3439100	3442280	don't want to upgrade. It's that they lack either the
3442280	3445500	IT support or resources, and I'd love to be able to give that to them.
3445500	3448000	The second is getting to 100% auditability
3448840	3451260	across the nation and having efficient,
3451260	3454420	effective audits for 2020. We're going to be
3454420	3456820	upwards of 92 plus percent of
3456820	3460540	auditable records, but we need good, efficient, effective audits
3460540	3463220	that are transparent. I mean,
3463220	3466360	Neil McBurnett asked a question earlier. He's making it his mission in life
3466360	3468800	to get to this, and I so appreciate it.
3468800	3472600	If we can provide that public, that transparent auditing process,
3472600	3474700	efficient and effective, I think
3474700	3478320	it would be a real success. Looking forward,
3478320	3480920	there's something in elections called the election wall, where you
3480920	3483980	literally lack the ability to look past the next election.
3483980	3487700	You don't even know what life looks like beyond that,
3487700	3489620	but if I had to really
3491300	3493100	push myself through that,
3493100	3496420	it would be increasing the amount of support resources
3496420	3499420	and I don't just mean money, to state and local
3499420	3502380	officials to help them meaningfully manage the risk to their
3502380	3505440	systems and really take some of the innovative
3505440	3508460	steps that they want to take that they're unable
3508460	3511700	to, either because of a lack of IT support
3511700	3514380	or resourcing that otherwise would allow them to
3514380	3517700	serve voters. And then finally, I know I'm cheating,
3518220	3520620	but a more resilient American public,
3520800	3523600	a deeper understanding of how elections work, a deeper
3523600	3526820	understanding of what their options are, how ballots
3528000	3529840	reach them, or how they can
3529840	3532480	interact with the process, and then how
3532480	3535880	we reach our final certified elections.
3535880	3538700	Again, that prepared, patient, and participating
3538700	3540940	voter is everything as we look at 2020.
3542300	3545460	I feel the same way, Matt, as a village
3545460	3548160	organizer for DEF CON that I can't look past this weekend.
3549020	3551380	So, thank you to all of the
3551380	3554860	panelists for sharing what your organization is doing.
3555000	3556180	I have to say it is
3556820	3560160	making me feel a lot better, understanding the level of collaboration,
3560160	3563160	the transparency on the fallibility and the improvement,
3563160	3566140	and very much looking forward to what we can do. We are all
3566140	3569520	citizens and our voices should be heard. Thank you.
3569520	3570920	Thank you.