Hello everyone, my name is Jack Cable. And I'm Alex Sahir. We are both election security
technical advisors for the U.S. Cybersecurity and Infrastructure Security Agency, also known
as CISA. CISA is essentially the nation's risk advisor. So in the case of elections,
we advise state and local governments on how to conduct elections securely. We also provide
cybersecurity services to assess their systems and ensure that they are secure.
So our goal for this talk is essentially to explore how election security has changed since
March with the pandemic. Because of course, elections are going to be looking a little
different this year with an expansion of mail-in balloting across the country, a reduction in
polling places due to poll worker shortages, with the same consolidated polling places.
And of course, in-person voting is going to have to operate much differently. So that is safe with
the pandemic. So all of this compiled together, we want to think about how election security
changes. And that's what we're going to explore today. Great, thanks for the intro, Jack. So
what we'll do first is sort of talk through specifically why this election looks different
than any other election we've had before. So the first thing, and this has been publicized
quite widely, is a lot of the country is moving towards mail-in balloting as a stable option
for everyone. So you're going to see a large increase in the folks who decide to exercise
their ability to do mail-in balloting. So what this means operationally is, well, some states
already did a lot of mail-in balloting, like California or Washington. Some states, it's not
part of their tradition for the most part. So that is changing with this pandemic. And so
you're going to see a lot of states ramp up their capability to provide mail-in balloting
quite quickly in the coming months. They already have the summer and also in the lead up to
November. So there's a lot of specific infrastructure that's specific to mail-in balloting,
and Jack's going to go into that later. And so these systems are being introduced quite quickly
and potentially there are going to be some ramifications of that. A second component here
is in-person voting. As Jack mentioned before, it's going to look quite different this year than
it has in the past. And what that means is, for example, there's quite a shortage of polling
place staff. And so the reason why there is a lot of the folks who staff the polls for the most part
are elderly. And with COVID-19, there are heightened risks associated with that. So there
are some estimates that 500,000 to 1 million new poll workers will be required to staff this
election. In addition, shortages like that and other sort of research shortages because of the
pandemic are going to require consolidating polling places significantly in some places.
And what that means is a lot of places are moving to more of a super center model where sort of a
city stadium or some similar large public place will be used to allow for social distancing and
also just simplify logistics significantly. And so that looks quite different. So the big tagline
here is, for the average voter, what this means is there's probably going to be quite a bit of
confusion with regards to how this election will work, what is and is not safe, what is and is not
valid. And so with that confusion we've seen in the past few years, what happens is disinformation,
misinformation risk significantly increases. People are more likely to think something isn't
valid or something that might be false is actually true or vice versa. So there's just
going to be a lot of confusion going on. So we think that increases the risk to disinformation
regarding the voting process. And so now Jack is going to go more into the specifics of these
changes. Great. So yeah, as Alex said, just to explore some more of the specific areas of technology
that are being extended out or, say, remain important in some specific manner. And in this
slide we won't be talking directly to the risks. We'll get to those in a little later. But this is
just to lay the groundwork for what types of technologies we can expect to be used for the 2020
election, recognizing that it is going to be conducted differently than other elections in
the past. So the first area of technology is voter registration systems. They're used to track
who's registered to vote, say their address of registration, other information associated with
that. Of course these systems are nothing new. They've been used for years, play even a large
role in in-person voting when you show up to the polling place or to check your name in the
poll book in order to make sure that you're registered to vote. But the role that they
play in mail-in elections is a little different because now they are used as a source to either
determine where mail-in ballot applications are going to be sent or where mail-in ballots
themselves are going to be sent. So the security of these systems is going to be integral into
ensuring that the election can run smoothly. Other voter-facing online systems are also key.
We're seeing expansions of different systems related specifically to absentee ballots. For
instance, portals to request an absentee ballot or to track your ballot. A lot of these systems
either didn't exist before this election or existed but were used in a lot smaller capacity.
So we can expect all these to have increased load and as a result increased cybersecurity risk
associated with them. And then of course there's other voter-facing systems such as election night
reporting which will remain key throughout the election as they have in the past. Then the third
point is talking specifically to the absentee ballot pipeline. So this isn't necessarily what
is actually facing the voters but rather the technology that's going to be required to conduct
primarily mail-in election which is what many states are shifting towards. And this will require
anything from the ballot printing and distribution process and getting vendors in that in order to
ensure that people actually get their ballots and that they are correctly
coordinated along with processes for ballot return, verifying voters' signatures, tabulating ballots,
scanning them. All this has to be conducted and for a lot of states this will be an additional
challenge because like Alex said we're seeing perhaps in some 10 times as many mail-in ballots
compared to previous years. And when this happens there's an increased risk say for technology
strain just because in a lot of cases there's limited technology to process these ballots.
So it increases the possibility that some technical error can occur. So that's just
kind of laying out what is going to happen, what technologies we're seeing rolled out,
and we'll get more to these specific risks in a bit.
Thanks Jack. Yeah and so now talking more about the specific risks here. So obviously with
any technology it could fail, right? Each of these technologies are meant to do a certain
thing and they're part of a pipeline. Any of them might be hacked or fail. So you know
traditionally when we think of election security we think of hackers. You know what can hackers do?
How can they SQL inject a database or cross-site script or something like that? While those risks
definitely still exist, one change that this rapid change in infrastructure is going to cause
to the risk landscape is reliability is a significant concern now. A lot of these systems
are going to see a usage pattern that they have not seen before. And anyone who deals in computer
systems knows that when you have a system that is old or sort of has been used for a while and
it sees a new usage pattern, the potential for operational failure is significant. So you know
the hacking risk absolutely does still exist, but what we assess is that it just could fail as
part of the operation of the system. A good example of this that isn't quite related to the
2020 election exactly is the Iowa caucus situation that happened in February. The Iowa caucus was
run by the Iowa Democratic Party so it was not run by the state of Iowa. And so therefore you
know those risks maybe don't directly translate. But you know this was an app that failed not
because of a hacker but because of the use of the app. So there are reports that sort of the
folks who were needing to operate this app were not properly trained. The user experience of the
app did not quite work. The backup system that was in place in case the app failed was not
thought through quite enough. So you know while there was not a hack of this app, it absolutely
did fail at its job. And there's actually polls that suggest that voters to this day still don't
really know who won the Democratic Iowa caucus because of what happened during the caucus night.
So you know that sort of thing happening on election night is absolutely possible. And so
you know thinking through the reliability concerns is really really important.
Another point that Jack already made that sort of I'm just pointing out again here is you know
voting registration databases have been important and paramount to running elections
for a long time. But in particular with the increase of vote by mail, those systems,
databases, are what decide where a mail-in ballot is sent. And so obviously ensuring the
sanctity of those systems and the accuracy of those records is very very important to making
sure that this election runs smoothly. So yeah. Great. Then just to get into some of the more
specific risks to the infrastructure that we're seeing and to start with voter registration
systems. Of course, as we saw in 2016, these systems are a ripe area for attack. We saw the
successful compromise, for instance, of Illinois' State Board of Elections voter registration system
in 2016 by Russian actors. And while there's no evidence that voter registration records were
changed, we do know that voter registration records were exfiltrated. And we saw targeting
of all 50 states in addition to that. So basing on what we've already seen and what we can expect
for 2020, we certainly do think that there are heightened risks here, say, given both the
confidentiality, integrity, and availability of these systems. For instance, modifying voter
registration records would result in perhaps a mail-in ballot application or mail-in ballot itself
being sent to the wrong address. And availability concerns as well could prevent certain people from
getting their votes. Along with this, we also assess that there is risk with other voter-facing
online systems. For instance, absentee ballot request, absentee ballot tracking systems can
also be targeted. And then one other online-facing system that we've seen a bit of expansion, not
too many states, but some have come forward with this, is electronic ballot return, also known as
online voting. And for this, CISA does assess that online voting is higher risk than, say,
in-person or mail-in voting, just because there is no paper trail. So you cannot achieve the same
level of authorability. So that is CISA's risk assessment there. And all this is to
highlight with voter registration systems, with other online-facing systems, that there is this
shifted attack surface that attackers may be targeting. So it's important that we prioritize
these when we're thinking about how best to secure the election before November, keeping in mind that
election officials do face significant resource constraints. Running an election is incredibly
difficult, and it is our role, it is the role of the public, to support election officials in that
process. So we'll get to in a little what exactly both election officials can do, as well as what
hackers in this audience can do to ensure that the election does run smoothly, safely, and securely.
But kind of just to lay out that this is something that everyone can play a role in,
and everyone can help with. And then the third component here is the mail-in ballot pipeline.
So this is talking about everything from distribution of ballots, a wide range of
vendors who are responsible, say, for compiling these records, for printing the ballots, for
mailing them out. And really just to footstomp what Alex was saying before, that the biggest risk
to this process is not necessarily the, say, an actual attack against these systems, but rather
a routine technical failure, because these systems are going to be strained and operated at
increased levels. So we assess that the biggest concern, especially for the mail-in ballot pipeline,
where many of these systems are not internet connected, the bigger risk is just a routine
technical failure, rather than, say, an actual attack. Although, of course, we do know that these
systems are being targeted, continue to be vigilant in looking for and preventing these attacks.
Great. And then the next slide, which we were talking about before, is the risk of disinformation.
And this really just goes to show that the biggest risk towards an election outcome is not an actual
attack, but rather distrust in the results. Because as we explored, operational hiccups are not
unlikely. And in fact, we can probably expect that somewhere in the country on election day,
some technical error will go wrong. But what is important to keep in mind here is that
this does not mean that the results of the election are invalid. This does not mean that
we, say, don't actually know what happened. There is a paper trail. In fact, compared to 2016,
when 82% of votes were cast with a paper trail, we now expect 92% of votes to be cast with a
paper trail in 2020, which is a significant improvement. And what that means is that votes
are increasingly auditable, so we can actually ensure that the tabulated result is accurate.
We recommend, for instance, risk-limiting audits, all of those procedures in order to
ensure that election outcomes are valid. But the key thing to emphasize here is that
we can expect some hiccups to occur, but that does not mean that something
went wrong or that the results are invalid. But the bigger risk here is that the public
perception of these hiccups. We saw, for instance, in the primaries in Georgia,
that routine technical failures occurred with poll books, and this led to some public distrust
in the election events. So this is kind of a case study in what can happen in November,
that we can expect technology to go wrong. And, of course, it is possible that there
has been a tech, but that's not the most likely case. What is most likely is that, rather,
there's a routine error as all these technologies are being rapidly expanded, but something just
went wrong. So the main takeaway here from a public perspective is that we need to be resilient,
and we need to understand that there are controls in place, that it's actually incredibly difficult
to actually change votes, because there's a wide range of election systems, and it's very
difficult to actually change those, but the bigger risk is people's perception. So just kind of
viewing that, we need to be thinking about how we can make people more resilient, because when
something, say, when a routine technical error does go wrong, how are we going to respond and
how are we going to get the point across that the election is still valid, that the results
are accurate, even though some part of the election may have gone a little different than what we
expected. So now we're going to get more into the concrete actions that we can take. I'll give it
to Alex to introduce this. Great, thanks, Jack. Yeah, and so something that we think about at
a lot is how can the election infrastructure community coordinate within itself to share
best practices and sort of mitigate threats that they see on the horizon. So one of the main
things that, as an election administrator, that you can do is join an information sharing and
analysis center, or an ISAC. And so something that we have done in the past few years is stand up an
EI-ISAC that is actually separate from CISA. However, it essentially coordinates between
like-minded officials in government that administer election infrastructure and sort of
share threats and do threat analysis. It's critical to sort of do this sort of information sharing,
and, you know, if you're an election administrator, joining this community is quite beneficial to you
because, you know, no one is doing this alone. Everyone faces the same threats around the
country. And so communicating about that is just critical. And this is also part of the MS-ISAC,
multi-state ISAC. And so the second point here is CISA, as the nation's risk manager,
provides free services to those who administer critical infrastructure and election infrastructure
as part of that. So we do things like remote penetration testing, vulnerability assessments,
and other various services that often cost quite a lot on the private market. We will perform them
for free for you. So we've seen a huge uptick in using these services in the past few years as the
election threat has become more publicized. So we've made a lot of progress here, but there's
always more that we can do. And so, you know, talking to us and enlisting these services is a
big step that election officials can take. Great. And our third recommended action,
acknowledging that there are many resource constraints, is just to accept outside help.
For instance, the audience watching this today attending the Def Con Voting Village is full of
cybersecurity professionals who want to help ensure that elections can run smoothly and securely.
So we recommend states to take advantage of whatever volunteer resources there are.
And the first one to highlight here is the election cyber surge, which was recently announced
by the University of Chicago in coordination with the Def Con Voting Village,
which is essentially establishing a volunteer core of cybersecurity professionals who want to
help state and local election officials to better understand cybersecurity risks, to perform
cybersecurity services all for free. So this is a really fantastic resource to take advantage of.
And the second is to launch a vulnerability disclosure policy. And vulnerability disclosure
policy essentially says how outside hackers, friendly hackers, of course, can report
vulnerabilities to you so that you can fix them and accept their support. So the great thing is
that there's already a community of people who want to help you. And all you have to do is tell
them exactly how to do that. So we'll talk about this a little more when we discuss the product
that CISA recently launched, which is guidance to election officials to launch a vulnerability
disclosure policy. But we believe that this is a really great way to accept the free volunteer help
that is out there. Great. And then probably more relevant for most of this audience is how
actual hackers can help protect elections ahead of November. And one of the best ways you can do
this is offer to help your local election officials just because they are quite constrained.
Many operate with small budgets, even lower for IT or security. So any free help can really go a
long way. So you can start perhaps by reaching out to your local election officials, see what areas
might be able to help them. Volunteering for the election cyber surge is another great way to be
paired with state and local election officials to answer questions, provide security services,
as needed. So anything that you can go do on that front would go a really long way. The second
point here is perhaps less of a security solution, but more just a way to help the overall election
run smoothly. And that's serving as a poll worker, if you are healthy in a position to do so.
Because as we mentioned, there are large poll worker shortages. So one of the most impactful
things you can do is to serve on a local level as a poll worker, help ensure that elections are
running smoothly, and helping people vote. So that's a really great way to be directly involved
in the election process. And our third point here is to participate in vulnerability disclosure
policies. Because we recently announced our guidance to state and local election officials.
So some vulnerability disclosure policies may be rolling out in the future.
So I would keep an eye out for any of these that do pop up and help election officials when they
put these out there and are asking for your help. Great. And so, you know, as CISA employees,
we'd be remiss to not mention the various services and resources that CISA provides
in the space. So as mentioned before, CISA provides, you know, risk assessments for free.
And so availing of those is really useful. Additionally, we have this Protect 2020 plan
that CISA has released, outlining our strategy to sort of protect this election. There's a lot
of great resources on there, including how to stand up vote-by-mail systems safely in the
coronavirus age, how to conduct in-person polling safely. And this is in conjunction
with the Election Assistance Commission. There's a lot of great resources on that page.
And then in terms of some more specific areas that we think might be useful,
the first is a vulnerability reporting guide, which I mentioned that CISA just recently released.
This is a really great resource that discusses in depth, if you are an election official,
how you can stand up a vulnerability disclosure policy and start receiving this volunteer help
from security professionals. So it's a really great way to engage the outside community
in order to help secure your systems. So we encourage anyone who's interested to follow
this guidance. And please do reach out to us if you have any additional questions on how to
smoothly allow people to report vulnerabilities to you.
Great. And with that, that's the conclusion of our talk. We've listed here our Protect 2020
page. Again, that has some really great resources on some of the core details on conducting
elections. Our emails are listed here if you are interested, if you have any questions,
or just want to learn more. I believe there will also be a Q&A in Discord, so we'll be watching
that. But overall, thank you to everyone for attending this talk. We're hopeful that together
as the, say, election officials, as the federal government, as the hacker community,
we can all work collectively to help ensure that we have a safe and secure 2020 election.
So thank you, and please do reach out if you have any questions.