start	end	text
0	6800	Hello everyone, my name is Jack Cable. And I'm Alex Sahir. We are both election security
6800	11720	technical advisors for the U.S. Cybersecurity and Infrastructure Security Agency, also known
11720	16980	as CISA. CISA is essentially the nation's risk advisor. So in the case of elections,
16980	22400	we advise state and local governments on how to conduct elections securely. We also provide
22400	28840	cybersecurity services to assess their systems and ensure that they are secure.
29470	35120	So our goal for this talk is essentially to explore how election security has changed since
35120	39100	March with the pandemic. Because of course, elections are going to be looking a little
39100	45520	different this year with an expansion of mail-in balloting across the country, a reduction in
45520	51480	polling places due to poll worker shortages, with the same consolidated polling places.
51660	56420	And of course, in-person voting is going to have to operate much differently. So that is safe with
56420	62200	the pandemic. So all of this compiled together, we want to think about how election security
62200	69660	changes. And that's what we're going to explore today. Great, thanks for the intro, Jack. So
70420	74620	what we'll do first is sort of talk through specifically why this election looks different
74620	79840	than any other election we've had before. So the first thing, and this has been publicized
79840	86340	quite widely, is a lot of the country is moving towards mail-in balloting as a stable option
86340	92100	for everyone. So you're going to see a large increase in the folks who decide to exercise
92100	98260	their ability to do mail-in balloting. So what this means operationally is, well, some states
98260	104640	already did a lot of mail-in balloting, like California or Washington. Some states, it's not
104640	110160	part of their tradition for the most part. So that is changing with this pandemic. And so
110160	115640	you're going to see a lot of states ramp up their capability to provide mail-in balloting
116190	121040	quite quickly in the coming months. They already have the summer and also in the lead up to
121040	126800	November. So there's a lot of specific infrastructure that's specific to mail-in balloting,
126800	131280	and Jack's going to go into that later. And so these systems are being introduced quite quickly
131790	136700	and potentially there are going to be some ramifications of that. A second component here
136700	141980	is in-person voting. As Jack mentioned before, it's going to look quite different this year than
141980	150560	it has in the past. And what that means is, for example, there's quite a shortage of polling
150560	156120	place staff. And so the reason why there is a lot of the folks who staff the polls for the most part
156120	162880	are elderly. And with COVID-19, there are heightened risks associated with that. So there
162880	168680	are some estimates that 500,000 to 1 million new poll workers will be required to staff this
168680	175020	election. In addition, shortages like that and other sort of research shortages because of the
175020	180600	pandemic are going to require consolidating polling places significantly in some places.
180600	186500	And what that means is a lot of places are moving to more of a super center model where sort of a
186500	192120	city stadium or some similar large public place will be used to allow for social distancing and
192120	198560	also just simplify logistics significantly. And so that looks quite different. So the big tagline
198560	203040	here is, for the average voter, what this means is there's probably going to be quite a bit of
203040	208960	confusion with regards to how this election will work, what is and is not safe, what is and is not
208960	214900	valid. And so with that confusion we've seen in the past few years, what happens is disinformation,
214900	219680	misinformation risk significantly increases. People are more likely to think something isn't
219680	225020	valid or something that might be false is actually true or vice versa. So there's just
225020	229720	going to be a lot of confusion going on. So we think that increases the risk to disinformation
229720	235080	regarding the voting process. And so now Jack is going to go more into the specifics of these
235080	241600	changes. Great. So yeah, as Alex said, just to explore some more of the specific areas of technology
241600	248380	that are being extended out or, say, remain important in some specific manner. And in this
248380	252680	slide we won't be talking directly to the risks. We'll get to those in a little later. But this is
252680	260040	just to lay the groundwork for what types of technologies we can expect to be used for the 2020
260040	264580	election, recognizing that it is going to be conducted differently than other elections in
264580	269920	the past. So the first area of technology is voter registration systems. They're used to track
269920	275900	who's registered to vote, say their address of registration, other information associated with
275900	282320	that. Of course these systems are nothing new. They've been used for years, play even a large
282320	287820	role in in-person voting when you show up to the polling place or to check your name in the
287820	292200	poll book in order to make sure that you're registered to vote. But the role that they
292200	298320	play in mail-in elections is a little different because now they are used as a source to either
298320	303580	determine where mail-in ballot applications are going to be sent or where mail-in ballots
303580	309620	themselves are going to be sent. So the security of these systems is going to be integral into
309620	318220	ensuring that the election can run smoothly. Other voter-facing online systems are also key.
318220	324120	We're seeing expansions of different systems related specifically to absentee ballots. For
324120	330000	instance, portals to request an absentee ballot or to track your ballot. A lot of these systems
330000	337940	either didn't exist before this election or existed but were used in a lot smaller capacity.
337940	343300	So we can expect all these to have increased load and as a result increased cybersecurity risk
343860	348500	associated with them. And then of course there's other voter-facing systems such as election night
348500	355380	reporting which will remain key throughout the election as they have in the past. Then the third
355380	361600	point is talking specifically to the absentee ballot pipeline. So this isn't necessarily what
361600	366820	is actually facing the voters but rather the technology that's going to be required to conduct
366820	374560	primarily mail-in election which is what many states are shifting towards. And this will require
374560	380420	anything from the ballot printing and distribution process and getting vendors in that in order to
380420	386100	ensure that people actually get their ballots and that they are correctly
387360	393800	coordinated along with processes for ballot return, verifying voters' signatures, tabulating ballots,
393800	399100	scanning them. All this has to be conducted and for a lot of states this will be an additional
399100	404720	challenge because like Alex said we're seeing perhaps in some 10 times as many mail-in ballots
404720	410660	compared to previous years. And when this happens there's an increased risk say for technology
410660	418580	strain just because in a lot of cases there's limited technology to process these ballots.
418580	425360	So it increases the possibility that some technical error can occur. So that's just
426180	431770	kind of laying out what is going to happen, what technologies we're seeing rolled out,
432120	435860	and we'll get more to these specific risks in a bit.
438440	443880	Thanks Jack. Yeah and so now talking more about the specific risks here. So obviously with
443880	449280	any technology it could fail, right? Each of these technologies are meant to do a certain
449280	455840	thing and they're part of a pipeline. Any of them might be hacked or fail. So you know
455840	460460	traditionally when we think of election security we think of hackers. You know what can hackers do?
460460	466320	How can they SQL inject a database or cross-site script or something like that? While those risks
466320	473020	definitely still exist, one change that this rapid change in infrastructure is going to cause
473020	478580	to the risk landscape is reliability is a significant concern now. A lot of these systems
478580	484680	are going to see a usage pattern that they have not seen before. And anyone who deals in computer
484680	490700	systems knows that when you have a system that is old or sort of has been used for a while and
490700	498240	it sees a new usage pattern, the potential for operational failure is significant. So you know
498660	505560	the hacking risk absolutely does still exist, but what we assess is that it just could fail as
505560	509740	part of the operation of the system. A good example of this that isn't quite related to the
509740	517680	2020 election exactly is the Iowa caucus situation that happened in February. The Iowa caucus was
517680	521920	run by the Iowa Democratic Party so it was not run by the state of Iowa. And so therefore you
521920	526640	know those risks maybe don't directly translate. But you know this was an app that failed not
526640	532640	because of a hacker but because of the use of the app. So there are reports that sort of the
532640	537960	folks who were needing to operate this app were not properly trained. The user experience of the
537960	544420	app did not quite work. The backup system that was in place in case the app failed was not
544420	550000	thought through quite enough. So you know while there was not a hack of this app, it absolutely
550000	555680	did fail at its job. And there's actually polls that suggest that voters to this day still don't
555680	562060	really know who won the Democratic Iowa caucus because of what happened during the caucus night.
562060	566480	So you know that sort of thing happening on election night is absolutely possible. And so
567020	570660	you know thinking through the reliability concerns is really really important.
570660	576020	Another point that Jack already made that sort of I'm just pointing out again here is you know
576020	581100	voting registration databases have been important and paramount to running elections
581100	586840	for a long time. But in particular with the increase of vote by mail, those systems,
586840	594920	databases, are what decide where a mail-in ballot is sent. And so obviously ensuring the
594920	599540	sanctity of those systems and the accuracy of those records is very very important to making
599540	608700	sure that this election runs smoothly. So yeah. Great. Then just to get into some of the more
608700	613600	specific risks to the infrastructure that we're seeing and to start with voter registration
613600	622560	systems. Of course, as we saw in 2016, these systems are a ripe area for attack. We saw the
622560	628260	successful compromise, for instance, of Illinois' State Board of Elections voter registration system
628260	635720	in 2016 by Russian actors. And while there's no evidence that voter registration records were
635720	642920	changed, we do know that voter registration records were exfiltrated. And we saw targeting
642920	651640	of all 50 states in addition to that. So basing on what we've already seen and what we can expect
651640	658240	for 2020, we certainly do think that there are heightened risks here, say, given both the
658240	663940	confidentiality, integrity, and availability of these systems. For instance, modifying voter
663940	670380	registration records would result in perhaps a mail-in ballot application or mail-in ballot itself
670380	677480	being sent to the wrong address. And availability concerns as well could prevent certain people from
677480	682900	getting their votes. Along with this, we also assess that there is risk with other voter-facing
682900	688360	online systems. For instance, absentee ballot request, absentee ballot tracking systems can
688360	696480	also be targeted. And then one other online-facing system that we've seen a bit of expansion, not
696480	701480	too many states, but some have come forward with this, is electronic ballot return, also known as
701480	707980	online voting. And for this, CISA does assess that online voting is higher risk than, say,
707980	714860	in-person or mail-in voting, just because there is no paper trail. So you cannot achieve the same
714860	722000	level of authorability. So that is CISA's risk assessment there. And all this is to
724820	729680	highlight with voter registration systems, with other online-facing systems, that there is this
729680	735340	shifted attack surface that attackers may be targeting. So it's important that we prioritize
735340	740480	these when we're thinking about how best to secure the election before November, keeping in mind that
740480	745720	election officials do face significant resource constraints. Running an election is incredibly
745720	750920	difficult, and it is our role, it is the role of the public, to support election officials in that
750920	756820	process. So we'll get to in a little what exactly both election officials can do, as well as what
756820	763020	hackers in this audience can do to ensure that the election does run smoothly, safely, and securely.
763260	769500	But kind of just to lay out that this is something that everyone can play a role in,
769500	777420	and everyone can help with. And then the third component here is the mail-in ballot pipeline.
777420	783000	So this is talking about everything from distribution of ballots, a wide range of
783000	788480	vendors who are responsible, say, for compiling these records, for printing the ballots, for
788480	796420	mailing them out. And really just to footstomp what Alex was saying before, that the biggest risk
796420	802460	to this process is not necessarily the, say, an actual attack against these systems, but rather
802700	808900	a routine technical failure, because these systems are going to be strained and operated at
808900	816220	increased levels. So we assess that the biggest concern, especially for the mail-in ballot pipeline,
816220	820520	where many of these systems are not internet connected, the bigger risk is just a routine
820520	826320	technical failure, rather than, say, an actual attack. Although, of course, we do know that these
826320	832280	systems are being targeted, continue to be vigilant in looking for and preventing these attacks.
835260	842040	Great. And then the next slide, which we were talking about before, is the risk of disinformation.
842040	850520	And this really just goes to show that the biggest risk towards an election outcome is not an actual
851960	858880	attack, but rather distrust in the results. Because as we explored, operational hiccups are not
858880	864120	unlikely. And in fact, we can probably expect that somewhere in the country on election day,
864120	869220	some technical error will go wrong. But what is important to keep in mind here is that
869220	874660	this does not mean that the results of the election are invalid. This does not mean that
875300	882240	we, say, don't actually know what happened. There is a paper trail. In fact, compared to 2016,
882240	888400	when 82% of votes were cast with a paper trail, we now expect 92% of votes to be cast with a
888400	893380	paper trail in 2020, which is a significant improvement. And what that means is that votes
893380	900840	are increasingly auditable, so we can actually ensure that the tabulated result is accurate.
900920	906160	We recommend, for instance, risk-limiting audits, all of those procedures in order to
906160	911340	ensure that election outcomes are valid. But the key thing to emphasize here is that
912240	916360	we can expect some hiccups to occur, but that does not mean that something
917020	922320	went wrong or that the results are invalid. But the bigger risk here is that the public
922320	927600	perception of these hiccups. We saw, for instance, in the primaries in Georgia,
927600	935240	that routine technical failures occurred with poll books, and this led to some public distrust
935240	942020	in the election events. So this is kind of a case study in what can happen in November,
942020	949080	that we can expect technology to go wrong. And, of course, it is possible that there
949080	954500	has been a tech, but that's not the most likely case. What is most likely is that, rather,
954500	959940	there's a routine error as all these technologies are being rapidly expanded, but something just
959940	968800	went wrong. So the main takeaway here from a public perspective is that we need to be resilient,
968800	974300	and we need to understand that there are controls in place, that it's actually incredibly difficult
974300	982200	to actually change votes, because there's a wide range of election systems, and it's very
982200	988100	difficult to actually change those, but the bigger risk is people's perception. So just kind of
988100	995520	viewing that, we need to be thinking about how we can make people more resilient, because when
995520	1000940	something, say, when a routine technical error does go wrong, how are we going to respond and
1000940	1006700	how are we going to get the point across that the election is still valid, that the results
1006700	1011940	are accurate, even though some part of the election may have gone a little different than what we
1011940	1019820	expected. So now we're going to get more into the concrete actions that we can take. I'll give it
1019820	1027140	to Alex to introduce this. Great, thanks, Jack. Yeah, and so something that we think about at
1027260	1034760	a lot is how can the election infrastructure community coordinate within itself to share
1034760	1041620	best practices and sort of mitigate threats that they see on the horizon. So one of the main
1041620	1047400	things that, as an election administrator, that you can do is join an information sharing and
1047400	1055200	analysis center, or an ISAC. And so something that we have done in the past few years is stand up an
1055200	1060940	EI-ISAC that is actually separate from CISA. However, it essentially coordinates between
1061680	1066720	like-minded officials in government that administer election infrastructure and sort of
1066720	1073660	share threats and do threat analysis. It's critical to sort of do this sort of information sharing,
1073660	1077460	and, you know, if you're an election administrator, joining this community is quite beneficial to you
1078080	1082120	because, you know, no one is doing this alone. Everyone faces the same threats around the
1082120	1087080	country. And so communicating about that is just critical. And this is also part of the MS-ISAC,
1087080	1094060	multi-state ISAC. And so the second point here is CISA, as the nation's risk manager,
1094060	1099460	provides free services to those who administer critical infrastructure and election infrastructure
1099460	1105260	as part of that. So we do things like remote penetration testing, vulnerability assessments,
1105260	1110960	and other various services that often cost quite a lot on the private market. We will perform them
1110960	1117080	for free for you. So we've seen a huge uptick in using these services in the past few years as the
1117080	1123060	election threat has become more publicized. So we've made a lot of progress here, but there's
1123060	1129120	always more that we can do. And so, you know, talking to us and enlisting these services is a
1129120	1135620	big step that election officials can take. Great. And our third recommended action,
1135620	1141660	acknowledging that there are many resource constraints, is just to accept outside help.
1141660	1146140	For instance, the audience watching this today attending the Def Con Voting Village is full of
1146140	1152000	cybersecurity professionals who want to help ensure that elections can run smoothly and securely.
1152460	1158580	So we recommend states to take advantage of whatever volunteer resources there are.
1158580	1163560	And the first one to highlight here is the election cyber surge, which was recently announced
1163560	1167880	by the University of Chicago in coordination with the Def Con Voting Village,
1168180	1174800	which is essentially establishing a volunteer core of cybersecurity professionals who want to
1174800	1180380	help state and local election officials to better understand cybersecurity risks, to perform
1180380	1187340	cybersecurity services all for free. So this is a really fantastic resource to take advantage of.
1187340	1192620	And the second is to launch a vulnerability disclosure policy. And vulnerability disclosure
1192620	1199160	policy essentially says how outside hackers, friendly hackers, of course, can report
1199160	1207620	vulnerabilities to you so that you can fix them and accept their support. So the great thing is
1207620	1213080	that there's already a community of people who want to help you. And all you have to do is tell
1213080	1218380	them exactly how to do that. So we'll talk about this a little more when we discuss the product
1218380	1223540	that CISA recently launched, which is guidance to election officials to launch a vulnerability
1223540	1228940	disclosure policy. But we believe that this is a really great way to accept the free volunteer help
1228940	1236780	that is out there. Great. And then probably more relevant for most of this audience is how
1236780	1245240	actual hackers can help protect elections ahead of November. And one of the best ways you can do
1245240	1251160	this is offer to help your local election officials just because they are quite constrained.
1251280	1258260	Many operate with small budgets, even lower for IT or security. So any free help can really go a
1258260	1264540	long way. So you can start perhaps by reaching out to your local election officials, see what areas
1264540	1269620	might be able to help them. Volunteering for the election cyber surge is another great way to be
1269620	1275180	paired with state and local election officials to answer questions, provide security services,
1275180	1281720	as needed. So anything that you can go do on that front would go a really long way. The second
1281720	1288760	point here is perhaps less of a security solution, but more just a way to help the overall election
1288760	1295160	run smoothly. And that's serving as a poll worker, if you are healthy in a position to do so.
1295160	1300040	Because as we mentioned, there are large poll worker shortages. So one of the most impactful
1300040	1306940	things you can do is to serve on a local level as a poll worker, help ensure that elections are
1306940	1313380	running smoothly, and helping people vote. So that's a really great way to be directly involved
1313380	1318640	in the election process. And our third point here is to participate in vulnerability disclosure
1318640	1324220	policies. Because we recently announced our guidance to state and local election officials.
1324220	1330200	So some vulnerability disclosure policies may be rolling out in the future.
1330940	1336040	So I would keep an eye out for any of these that do pop up and help election officials when they
1336040	1344670	put these out there and are asking for your help. Great. And so, you know, as CISA employees,
1344670	1351730	we'd be remiss to not mention the various services and resources that CISA provides
1351730	1360550	in the space. So as mentioned before, CISA provides, you know, risk assessments for free.
1360550	1369090	And so availing of those is really useful. Additionally, we have this Protect 2020 plan
1369090	1375550	that CISA has released, outlining our strategy to sort of protect this election. There's a lot
1375550	1381930	of great resources on there, including how to stand up vote-by-mail systems safely in the
1381930	1389410	coronavirus age, how to conduct in-person polling safely. And this is in conjunction
1389410	1393870	with the Election Assistance Commission. There's a lot of great resources on that page.
1397790	1402590	And then in terms of some more specific areas that we think might be useful,
1402590	1407970	the first is a vulnerability reporting guide, which I mentioned that CISA just recently released.
1407970	1412610	This is a really great resource that discusses in depth, if you are an election official,
1412610	1418730	how you can stand up a vulnerability disclosure policy and start receiving this volunteer help
1418730	1426050	from security professionals. So it's a really great way to engage the outside community
1426050	1432310	in order to help secure your systems. So we encourage anyone who's interested to follow
1432310	1438530	this guidance. And please do reach out to us if you have any additional questions on how to
1438530	1442710	smoothly allow people to report vulnerabilities to you.
1443470	1450190	Great. And with that, that's the conclusion of our talk. We've listed here our Protect 2020
1450190	1455630	page. Again, that has some really great resources on some of the core details on conducting
1455630	1461490	elections. Our emails are listed here if you are interested, if you have any questions,
1461490	1467690	or just want to learn more. I believe there will also be a Q&A in Discord, so we'll be watching
1467690	1474830	that. But overall, thank you to everyone for attending this talk. We're hopeful that together
1475650	1482390	as the, say, election officials, as the federal government, as the hacker community,
1482390	1488910	we can all work collectively to help ensure that we have a safe and secure 2020 election.
1488910	1492530	So thank you, and please do reach out if you have any questions.