1
00:00:00,000 --> 00:00:02,560
Hello everyone, my name is Jack Cable.

2
00:00:03,040 --> 00:00:04,580
And I'm Alex Sahir.

3
00:00:04,780 --> 00:00:08,920
We are both election security technical advisors for the U.S.

4
00:00:08,920 --> 00:00:12,660
Cybersecurity and Infrastructure Security Agency, also known as CISA.

5
00:00:12,660 --> 00:00:15,820
CISA is essentially the nation's risk advisor.

6
00:00:15,820 --> 00:00:21,660
So in the case of elections, we advise state and local governments on how to conduct elections securely.

7
00:00:21,660 --> 00:00:28,840
We also provide cybersecurity services to assess their systems and ensure that they are secure.

8
00:00:29,470 --> 00:00:36,460
So our goal for this talk is essentially to explore how election security has changed since March with the pandemic.

9
00:00:36,460 --> 00:00:51,480
Because of course, elections are going to be looking a little different this year with an expansion of mail-in balloting across the country, a reduction in polling places due to poll worker shortages, with the same consolidated polling places.

10
00:00:51,660 --> 00:00:55,300
And of course, in-person voting is going to have to operate much differently.

11
00:00:55,300 --> 00:00:57,560
So that is safe with the pandemic.

12
00:00:57,720 --> 00:01:03,000
So all of this compiled together, we want to think about how election security changes.

13
00:01:03,000 --> 00:01:05,980
And that's what we're going to explore today.

14
00:01:07,260 --> 00:01:09,180
Great, thanks for the intro, Jack.

15
00:01:09,180 --> 00:01:16,780
So what we'll do first is sort of talk through specifically why this election looks different than any other election we've had before.

16
00:01:17,000 --> 00:01:27,480
So the first thing, and this has been publicized quite widely, is a lot of the country is moving towards mail-in balloting as a stable option for everyone.

17
00:01:27,580 --> 00:01:34,040
So you're going to see a large increase in the folks who decide to exercise their ability to do mail-in balloting.

18
00:01:34,040 --> 00:01:42,340
So what this means operationally is, well, some states already did a lot of mail-in balloting, like California or Washington.

19
00:01:42,760 --> 00:01:46,640
Some states, it's not part of their tradition for the most part.

20
00:01:46,640 --> 00:01:49,420
So that is changing with this pandemic.

21
00:01:49,500 --> 00:01:58,940
And so you're going to see a lot of states ramp up their capability to provide mail-in balloting quite quickly in the coming months.

22
00:01:59,080 --> 00:02:01,880
They already have the summer and also in the lead up to November.

23
00:02:01,980 --> 00:02:08,640
So there's a lot of specific infrastructure that's specific to mail-in balloting, and Jack's going to go into that later.

24
00:02:09,040 --> 00:02:14,660
And so these systems are being introduced quite quickly and potentially there are going to be some ramifications of that.

25
00:02:14,980 --> 00:02:18,460
A second component here is in-person voting.

26
00:02:18,460 --> 00:02:23,480
As Jack mentioned before, it's going to look quite different this year than it has in the past.

27
00:02:23,620 --> 00:02:31,740
And what that means is, for example, there's quite a shortage of polling place staff.

28
00:02:31,740 --> 00:02:37,180
And so the reason why there is a lot of the folks who staff the polls for the most part are elderly.

29
00:02:37,180 --> 00:02:42,180
And with COVID-19, there are heightened risks associated with that.

30
00:02:42,180 --> 00:02:49,500
So there are some estimates that 500,000 to 1 million new poll workers will be required to staff this election.

31
00:02:49,500 --> 00:03:00,600
In addition, shortages like that and other sort of research shortages because of the pandemic are going to require consolidating polling places significantly in some places.

32
00:03:00,600 --> 00:03:15,640
And what that means is a lot of places are moving to more of a super center model where sort of a city stadium or some similar large public place will be used to allow for social distancing and also just simplify logistics significantly.

33
00:03:15,640 --> 00:03:16,920
And so that looks quite different.

34
00:03:16,920 --> 00:03:29,860
So the big tagline here is, for the average voter, what this means is there's probably going to be quite a bit of confusion with regards to how this election will work, what is and is not safe, what is and is not valid.

35
00:03:30,100 --> 00:03:37,740
And so with that confusion we've seen in the past few years, what happens is disinformation, misinformation risk significantly increases.

36
00:03:37,740 --> 00:03:44,580
People are more likely to think something isn't valid or something that might be false is actually true or vice versa.

37
00:03:44,580 --> 00:03:46,680
So there's just going to be a lot of confusion going on.

38
00:03:46,680 --> 00:03:51,420
So we think that increases the risk to disinformation regarding the voting process.

39
00:03:51,420 --> 00:03:55,820
And so now Jack is going to go more into the specifics of these changes.

40
00:03:56,620 --> 00:03:57,220
Great.

41
00:03:57,220 --> 00:04:07,580
So yeah, as Alex said, just to explore some more of the specific areas of technology that are being extended out or, say, remain important in some specific manner.

42
00:04:07,880 --> 00:04:11,000
And in this slide we won't be talking directly to the risks.

43
00:04:11,000 --> 00:04:12,200
We'll get to those in a little later.

44
00:04:12,200 --> 00:04:25,660
But this is just to lay the groundwork for what types of technologies we can expect to be used for the 2020 election, recognizing that it is going to be conducted differently than other elections in the past.

45
00:04:25,780 --> 00:04:28,940
So the first area of technology is voter registration systems.

46
00:04:28,940 --> 00:04:36,840
They're used to track who's registered to vote, say their address of registration, other information associated with that.

47
00:04:36,840 --> 00:04:39,080
Of course these systems are nothing new.

48
00:04:39,080 --> 00:04:51,020
They've been used for years, play even a large role in in-person voting when you show up to the polling place or to check your name in the poll book in order to make sure that you're registered to vote.

49
00:04:51,220 --> 00:05:05,600
But the role that they play in mail-in elections is a little different because now they are used as a source to either determine where mail-in ballot applications are going to be sent or where mail-in ballots themselves are going to be sent.

50
00:05:05,820 --> 00:05:13,840
So the security of these systems is going to be integral into ensuring that the election can run smoothly.

51
00:05:14,380 --> 00:05:18,220
Other voter-facing online systems are also key.

52
00:05:18,220 --> 00:05:23,820
We're seeing expansions of different systems related specifically to absentee ballots.

53
00:05:23,820 --> 00:05:28,980
For instance, portals to request an absentee ballot or to track your ballot.

54
00:05:28,980 --> 00:05:37,940
A lot of these systems either didn't exist before this election or existed but were used in a lot smaller capacity.

55
00:05:37,940 --> 00:05:45,140
So we can expect all these to have increased load and as a result increased cybersecurity risk associated with them.

56
00:05:45,140 --> 00:05:54,220
And then of course there's other voter-facing systems such as election night reporting which will remain key throughout the election as they have in the past.

57
00:05:54,440 --> 00:06:00,220
Then the third point is talking specifically to the absentee ballot pipeline.

58
00:06:00,220 --> 00:06:13,160
So this isn't necessarily what is actually facing the voters but rather the technology that's going to be required to conduct primarily mail-in election which is what many states are shifting towards.

59
00:06:13,160 --> 00:06:32,800
And this will require anything from the ballot printing and distribution process and getting vendors in that in order to ensure that people actually get their ballots and that they are correctly coordinated along with processes for ballot return, verifying voters' signatures,

60
00:06:32,800 --> 00:06:34,680
tabulating ballots, scanning them.

61
00:06:34,680 --> 00:06:47,100
All this has to be conducted and for a lot of states this will be an additional challenge because like Alex said we're seeing perhaps in some 10 times as many mail-in ballots compared to previous years.

62
00:06:47,240 --> 00:06:58,580
And when this happens there's an increased risk say for technology strain just because in a lot of cases there's limited technology to process these ballots.

63
00:06:58,580 --> 00:07:04,000
So it increases the possibility that some technical error can occur.

64
00:07:04,440 --> 00:07:15,860
So that's just kind of laying out what is going to happen, what technologies we're seeing rolled out, and we'll get more to these specific risks in a bit.

65
00:07:18,440 --> 00:07:19,400
Thanks Jack.

66
00:07:19,400 --> 00:07:22,860
Yeah and so now talking more about the specific risks here.

67
00:07:22,860 --> 00:07:26,320
So obviously with any technology it could fail, right?

68
00:07:26,320 --> 00:07:32,240
Each of these technologies are meant to do a certain thing and they're part of a pipeline.

69
00:07:32,240 --> 00:07:35,040
Any of them might be hacked or fail.

70
00:07:35,040 --> 00:07:39,580
So you know traditionally when we think of election security we think of hackers.

71
00:07:39,580 --> 00:07:40,460
You know what can hackers do?

72
00:07:40,460 --> 00:07:45,320
How can they SQL inject a database or cross-site script or something like that?

73
00:07:45,320 --> 00:07:57,420
While those risks definitely still exist, one change that this rapid change in infrastructure is going to cause to the risk landscape is reliability is a significant concern now.

74
00:07:57,420 --> 00:08:02,580
A lot of these systems are going to see a usage pattern that they have not seen before.

75
00:08:02,580 --> 00:08:17,080
And anyone who deals in computer systems knows that when you have a system that is old or sort of has been used for a while and it sees a new usage pattern, the potential for operational failure is significant.

76
00:08:17,080 --> 00:08:27,360
So you know the hacking risk absolutely does still exist, but what we assess is that it just could fail as part of the operation of the system.

77
00:08:27,360 --> 00:08:35,860
A good example of this that isn't quite related to the 2020 election exactly is the Iowa caucus situation that happened in February.

78
00:08:36,240 --> 00:08:40,800
The Iowa caucus was run by the Iowa Democratic Party so it was not run by the state of Iowa.

79
00:08:40,900 --> 00:08:43,960
And so therefore you know those risks maybe don't directly translate.

80
00:08:43,960 --> 00:08:50,300
But you know this was an app that failed not because of a hacker but because of the use of the app.

81
00:08:50,300 --> 00:08:56,580
So there are reports that sort of the folks who were needing to operate this app were not properly trained.

82
00:08:56,580 --> 00:08:59,860
The user experience of the app did not quite work.

83
00:08:59,860 --> 00:09:06,440
The backup system that was in place in case the app failed was not thought through quite enough.

84
00:09:06,440 --> 00:09:11,400
So you know while there was not a hack of this app, it absolutely did fail at its job.

85
00:09:11,400 --> 00:09:22,060
And there's actually polls that suggest that voters to this day still don't really know who won the Democratic Iowa caucus because of what happened during the caucus night.

86
00:09:22,060 --> 00:09:26,240
So you know that sort of thing happening on election night is absolutely possible.

87
00:09:26,240 --> 00:09:30,660
And so you know thinking through the reliability concerns is really really important.

88
00:09:30,660 --> 00:09:42,580
Another point that Jack already made that sort of I'm just pointing out again here is you know voting registration databases have been important and paramount to running elections for a long time.

89
00:09:42,580 --> 00:09:52,620
But in particular with the increase of vote by mail, those systems, databases, are what decide where a mail-in ballot is sent.

90
00:09:52,620 --> 00:10:02,380
And so obviously ensuring the sanctity of those systems and the accuracy of those records is very very important to making sure that this election runs smoothly.

91
00:10:02,440 --> 00:10:03,660
So yeah.

92
00:10:05,740 --> 00:10:06,500
Great.

93
00:10:06,500 --> 00:10:14,580
Then just to get into some of the more specific risks to the infrastructure that we're seeing and to start with voter registration systems.

94
00:10:14,700 --> 00:10:22,040
Of course, as we saw in 2016, these systems are a ripe area for attack.

95
00:10:22,040 --> 00:10:31,040
We saw the successful compromise, for instance, of Illinois' State Board of Elections voter registration system in 2016 by Russian actors.

96
00:10:31,040 --> 00:10:41,380
And while there's no evidence that voter registration records were changed, we do know that voter registration records were exfiltrated.

97
00:10:41,420 --> 00:10:46,660
And we saw targeting of all 50 states in addition to that.

98
00:10:46,840 --> 00:11:02,360
So basing on what we've already seen and what we can expect for 2020, we certainly do think that there are heightened risks here, say, given both the confidentiality, integrity, and availability of these systems.

99
00:11:02,360 --> 00:11:12,800
For instance, modifying voter registration records would result in perhaps a mail-in ballot application or mail-in ballot itself being sent to the wrong address.

100
00:11:12,840 --> 00:11:19,080
And availability concerns as well could prevent certain people from getting their votes.

101
00:11:19,080 --> 00:11:24,500
Along with this, we also assess that there is risk with other voter-facing online systems.

102
00:11:24,500 --> 00:11:29,760
For instance, absentee ballot request, absentee ballot tracking systems can also be targeted.

103
00:11:30,180 --> 00:11:42,860
And then one other online-facing system that we've seen a bit of expansion, not too many states, but some have come forward with this, is electronic ballot return, also known as online voting.

104
00:11:42,980 --> 00:11:52,480
And for this, CISA does assess that online voting is higher risk than, say, in-person or mail-in voting, just because there is no paper trail.

105
00:11:52,480 --> 00:11:56,920
So you cannot achieve the same level of authorability.

106
00:11:56,920 --> 00:12:00,640
So that is CISA's risk assessment there.

107
00:12:00,740 --> 00:12:13,740
And all this is to highlight with voter registration systems, with other online-facing systems, that there is this shifted attack surface that attackers may be targeting.

108
00:12:13,740 --> 00:12:24,300
So it's important that we prioritize these when we're thinking about how best to secure the election before November, keeping in mind that election officials do face significant resource constraints.

109
00:12:24,300 --> 00:12:31,900
Running an election is incredibly difficult, and it is our role, it is the role of the public, to support election officials in that process.

110
00:12:32,000 --> 00:12:43,020
So we'll get to in a little what exactly both election officials can do, as well as what hackers in this audience can do to ensure that the election does run smoothly, safely, and securely.

111
00:12:43,260 --> 00:12:52,480
But kind of just to lay out that this is something that everyone can play a role in, and everyone can help with.

112
00:12:52,480 --> 00:12:57,420
And then the third component here is the mail-in ballot pipeline.

113
00:12:57,420 --> 00:13:10,020
So this is talking about everything from distribution of ballots, a wide range of vendors who are responsible, say, for compiling these records, for printing the ballots, for mailing them out.

114
00:13:10,780 --> 00:13:30,760
And really just to footstomp what Alex was saying before, that the biggest risk to this process is not necessarily the, say, an actual attack against these systems, but rather a routine technical failure, because these systems are going to be strained and operated at increased levels.

115
00:13:30,760 --> 00:13:44,720
So we assess that the biggest concern, especially for the mail-in ballot pipeline, where many of these systems are not internet connected, the bigger risk is just a routine technical failure, rather than, say, an actual attack.

116
00:13:44,720 --> 00:13:52,280
Although, of course, we do know that these systems are being targeted, continue to be vigilant in looking for and preventing these attacks.

117
00:13:55,260 --> 00:13:56,080
Great.

118
00:13:56,080 --> 00:14:02,040
And then the next slide, which we were talking about before, is the risk of disinformation.

119
00:14:02,040 --> 00:14:15,500
And this really just goes to show that the biggest risk towards an election outcome is not an actual attack, but rather distrust in the results.

120
00:14:15,500 --> 00:14:19,980
Because as we explored, operational hiccups are not unlikely.

121
00:14:19,980 --> 00:14:26,700
And in fact, we can probably expect that somewhere in the country on election day, some technical error will go wrong.

122
00:14:26,740 --> 00:14:33,280
But what is important to keep in mind here is that this does not mean that the results of the election are invalid.

123
00:14:33,280 --> 00:14:37,880
This does not mean that we, say, don't actually know what happened.

124
00:14:37,880 --> 00:14:39,940
There is a paper trail.

125
00:14:39,940 --> 00:14:52,080
In fact, compared to 2016, when 82% of votes were cast with a paper trail, we now expect 92% of votes to be cast with a paper trail in 2020, which is a significant improvement.

126
00:14:52,080 --> 00:15:00,840
And what that means is that votes are increasingly auditable, so we can actually ensure that the tabulated result is accurate.

127
00:15:00,920 --> 00:15:08,800
We recommend, for instance, risk-limiting audits, all of those procedures in order to ensure that election outcomes are valid.

128
00:15:08,800 --> 00:15:19,720
But the key thing to emphasize here is that we can expect some hiccups to occur, but that does not mean that something went wrong or that the results are invalid.

129
00:15:19,720 --> 00:15:24,400
But the bigger risk here is that the public perception of these hiccups.

130
00:15:24,400 --> 00:15:37,460
We saw, for instance, in the primaries in Georgia, that routine technical failures occurred with poll books, and this led to some public distrust in the election events.

131
00:15:37,480 --> 00:15:45,720
So this is kind of a case study in what can happen in November, that we can expect technology to go wrong.

132
00:15:45,720 --> 00:15:52,020
And, of course, it is possible that there has been a tech, but that's not the most likely case.

133
00:15:52,020 --> 00:16:01,220
What is most likely is that, rather, there's a routine error as all these technologies are being rapidly expanded, but something just went wrong.

134
00:16:01,640 --> 00:16:21,160
So the main takeaway here from a public perspective is that we need to be resilient, and we need to understand that there are controls in place, that it's actually incredibly difficult to actually change votes, because there's a wide range of election systems,

135
00:16:21,160 --> 00:16:26,720
and it's very difficult to actually change those, but the bigger risk is people's perception.

136
00:16:27,120 --> 00:16:45,560
So just kind of viewing that, we need to be thinking about how we can make people more resilient, because when something, say, when a routine technical error does go wrong, how are we going to respond and how are we going to get the point across that the election is still valid,

137
00:16:45,560 --> 00:16:52,800
that the results are accurate, even though some part of the election may have gone a little different than what we expected.

138
00:16:54,300 --> 00:16:59,380
So now we're going to get more into the concrete actions that we can take.

139
00:16:59,380 --> 00:17:02,040
I'll give it to Alex to introduce this.

140
00:17:02,680 --> 00:17:03,640
Great, thanks, Jack.

141
00:17:03,640 --> 00:17:19,660
Yeah, and so something that we think about at a lot is how can the election infrastructure community coordinate within itself to share best practices and sort of mitigate threats that they see on the horizon.

142
00:17:19,840 --> 00:17:29,740
So one of the main things that, as an election administrator, that you can do is join an information sharing and analysis center, or an ISAC.

143
00:17:29,740 --> 00:17:37,460
And so something that we have done in the past few years is stand up an EI-ISAC that is actually separate from CISA.

144
00:17:37,460 --> 00:17:49,380
However, it essentially coordinates between like-minded officials in government that administer election infrastructure and sort of share threats and do threat analysis.

145
00:17:50,160 --> 00:18:00,240
It's critical to sort of do this sort of information sharing, and, you know, if you're an election administrator, joining this community is quite beneficial to you because, you know, no one is doing this alone.

146
00:18:00,240 --> 00:18:02,780
Everyone faces the same threats around the country.

147
00:18:02,780 --> 00:18:05,220
And so communicating about that is just critical.

148
00:18:05,220 --> 00:18:08,720
And this is also part of the MS-ISAC, multi-state ISAC.

149
00:18:08,720 --> 00:18:20,660
And so the second point here is CISA, as the nation's risk manager, provides free services to those who administer critical infrastructure and election infrastructure as part of that.

150
00:18:20,660 --> 00:18:29,340
So we do things like remote penetration testing, vulnerability assessments, and other various services that often cost quite a lot on the private market.

151
00:18:29,380 --> 00:18:32,380
We will perform them for free for you.

152
00:18:32,420 --> 00:18:40,400
So we've seen a huge uptick in using these services in the past few years as the election threat has become more publicized.

153
00:18:40,400 --> 00:18:44,880
So we've made a lot of progress here, but there's always more that we can do.

154
00:18:44,880 --> 00:18:51,900
And so, you know, talking to us and enlisting these services is a big step that election officials can take.

155
00:18:52,780 --> 00:18:53,480
Great.

156
00:18:53,480 --> 00:19:01,660
And our third recommended action, acknowledging that there are many resource constraints, is just to accept outside help.

157
00:19:01,660 --> 00:19:12,000
For instance, the audience watching this today attending the Def Con Voting Village is full of cybersecurity professionals who want to help ensure that elections can run smoothly and securely.

158
00:19:12,460 --> 00:19:18,580
So we recommend states to take advantage of whatever volunteer resources there are.

159
00:19:18,580 --> 00:19:39,020
And the first one to highlight here is the election cyber surge, which was recently announced by the University of Chicago in coordination with the Def Con Voting Village, which is essentially establishing a volunteer core of cybersecurity professionals who want to help state and local election officials to better understand cybersecurity risks,

160
00:19:39,020 --> 00:19:43,400
to perform cybersecurity services all for free.

161
00:19:43,400 --> 00:19:47,340
So this is a really fantastic resource to take advantage of.

162
00:19:47,340 --> 00:19:51,340
And the second is to launch a vulnerability disclosure policy.

163
00:19:51,340 --> 00:20:06,440
And vulnerability disclosure policy essentially says how outside hackers, friendly hackers, of course, can report vulnerabilities to you so that you can fix them and accept their support.

164
00:20:06,580 --> 00:20:11,660
So the great thing is that there's already a community of people who want to help you.

165
00:20:11,820 --> 00:20:14,900
And all you have to do is tell them exactly how to do that.

166
00:20:14,900 --> 00:20:24,740
So we'll talk about this a little more when we discuss the product that CISA recently launched, which is guidance to election officials to launch a vulnerability disclosure policy.

167
00:20:24,740 --> 00:20:30,660
But we believe that this is a really great way to accept the free volunteer help that is out there.

168
00:20:31,960 --> 00:20:32,680
Great.

169
00:20:32,680 --> 00:20:41,840
And then probably more relevant for most of this audience is how actual hackers can help protect elections ahead of November.

170
00:20:42,020 --> 00:20:51,160
And one of the best ways you can do this is offer to help your local election officials just because they are quite constrained.

171
00:20:51,280 --> 00:20:56,240
Many operate with small budgets, even lower for IT or security.

172
00:20:56,320 --> 00:20:59,160
So any free help can really go a long way.

173
00:20:59,200 --> 00:21:06,000
So you can start perhaps by reaching out to your local election officials, see what areas might be able to help them.

174
00:21:06,140 --> 00:21:16,300
Volunteering for the election cyber surge is another great way to be paired with state and local election officials to answer questions, provide security services, as needed.

175
00:21:16,460 --> 00:21:21,320
So anything that you can go do on that front would go a really long way.

176
00:21:21,320 --> 00:21:30,040
The second point here is perhaps less of a security solution, but more just a way to help the overall election run smoothly.

177
00:21:30,040 --> 00:21:35,160
And that's serving as a poll worker, if you are healthy in a position to do so.

178
00:21:35,160 --> 00:21:38,880
Because as we mentioned, there are large poll worker shortages.

179
00:21:38,880 --> 00:21:50,700
So one of the most impactful things you can do is to serve on a local level as a poll worker, help ensure that elections are running smoothly, and helping people vote.

180
00:21:50,740 --> 00:21:55,380
So that's a really great way to be directly involved in the election process.

181
00:21:55,380 --> 00:21:59,760
And our third point here is to participate in vulnerability disclosure policies.

182
00:21:59,760 --> 00:22:04,220
Because we recently announced our guidance to state and local election officials.

183
00:22:04,220 --> 00:22:10,200
So some vulnerability disclosure policies may be rolling out in the future.

184
00:22:10,940 --> 00:22:18,880
So I would keep an eye out for any of these that do pop up and help election officials when they put these out there and are asking for your help.

185
00:22:21,190 --> 00:22:21,910
Great.

186
00:22:21,910 --> 00:22:33,010
And so, you know, as CISA employees, we'd be remiss to not mention the various services and resources that CISA provides in the space.

187
00:22:33,010 --> 00:22:40,550
So as mentioned before, CISA provides, you know, risk assessments for free.

188
00:22:40,550 --> 00:22:44,630
And so availing of those is really useful.

189
00:22:44,630 --> 00:22:54,950
Additionally, we have this Protect 2020 plan that CISA has released, outlining our strategy to sort of protect this election.

190
00:22:54,950 --> 00:23:08,010
There's a lot of great resources on there, including how to stand up vote-by-mail systems safely in the coronavirus age, how to conduct in-person polling safely.

191
00:23:08,150 --> 00:23:10,950
And this is in conjunction with the Election Assistance Commission.

192
00:23:10,950 --> 00:23:13,870
There's a lot of great resources on that page.

193
00:23:17,790 --> 00:23:27,970
And then in terms of some more specific areas that we think might be useful, the first is a vulnerability reporting guide, which I mentioned that CISA just recently released.

194
00:23:27,970 --> 00:23:41,730
This is a really great resource that discusses in depth, if you are an election official, how you can stand up a vulnerability disclosure policy and start receiving this volunteer help from security professionals.

195
00:23:42,470 --> 00:23:49,110
So it's a really great way to engage the outside community in order to help secure your systems.

196
00:23:49,110 --> 00:23:53,590
So we encourage anyone who's interested to follow this guidance.

197
00:23:53,670 --> 00:24:02,710
And please do reach out to us if you have any additional questions on how to smoothly allow people to report vulnerabilities to you.

198
00:24:03,470 --> 00:24:04,230
Great.

199
00:24:04,230 --> 00:24:07,610
And with that, that's the conclusion of our talk.

200
00:24:07,610 --> 00:24:10,730
We've listed here our Protect 2020 page.

201
00:24:10,730 --> 00:24:16,790
Again, that has some really great resources on some of the core details on conducting elections.

202
00:24:16,970 --> 00:24:23,650
Our emails are listed here if you are interested, if you have any questions, or just want to learn more.

203
00:24:23,710 --> 00:24:28,710
I believe there will also be a Q&A in Discord, so we'll be watching that.

204
00:24:28,850 --> 00:24:33,150
But overall, thank you to everyone for attending this talk.

205
00:24:33,150 --> 00:24:48,910
We're hopeful that together as the, say, election officials, as the federal government, as the hacker community, we can all work collectively to help ensure that we have a safe and secure 2020 election.

206
00:24:48,910 --> 00:24:52,530
So thank you, and please do reach out if you have any questions.