[00:00.000 --> 00:06.800] Hello everyone, my name is Jack Cable. And I'm Alex Sahir. We are both election security [00:06.800 --> 00:11.720] technical advisors for the U.S. Cybersecurity and Infrastructure Security Agency, also known [00:11.720 --> 00:16.980] as CISA. CISA is essentially the nation's risk advisor. So in the case of elections, [00:16.980 --> 00:22.400] we advise state and local governments on how to conduct elections securely. We also provide [00:22.400 --> 00:28.840] cybersecurity services to assess their systems and ensure that they are secure. [00:29.470 --> 00:35.120] So our goal for this talk is essentially to explore how election security has changed since [00:35.120 --> 00:39.100] March with the pandemic. Because of course, elections are going to be looking a little [00:39.100 --> 00:45.520] different this year with an expansion of mail-in balloting across the country, a reduction in [00:45.520 --> 00:51.480] polling places due to poll worker shortages, with the same consolidated polling places. [00:51.660 --> 00:56.420] And of course, in-person voting is going to have to operate much differently. So that is safe with [00:56.420 --> 01:02.200] the pandemic. So all of this compiled together, we want to think about how election security [01:02.200 --> 01:09.660] changes. And that's what we're going to explore today. Great, thanks for the intro, Jack. So [01:10.420 --> 01:14.620] what we'll do first is sort of talk through specifically why this election looks different [01:14.620 --> 01:19.840] than any other election we've had before. So the first thing, and this has been publicized [01:19.840 --> 01:26.340] quite widely, is a lot of the country is moving towards mail-in balloting as a stable option [01:26.340 --> 01:32.100] for everyone. So you're going to see a large increase in the folks who decide to exercise [01:32.100 --> 01:38.260] their ability to do mail-in balloting. So what this means operationally is, well, some states [01:38.260 --> 01:44.640] already did a lot of mail-in balloting, like California or Washington. Some states, it's not [01:44.640 --> 01:50.160] part of their tradition for the most part. So that is changing with this pandemic. And so [01:50.160 --> 01:55.640] you're going to see a lot of states ramp up their capability to provide mail-in balloting [01:56.190 --> 02:01.040] quite quickly in the coming months. They already have the summer and also in the lead up to [02:01.040 --> 02:06.800] November. So there's a lot of specific infrastructure that's specific to mail-in balloting, [02:06.800 --> 02:11.280] and Jack's going to go into that later. And so these systems are being introduced quite quickly [02:11.790 --> 02:16.700] and potentially there are going to be some ramifications of that. A second component here [02:16.700 --> 02:21.980] is in-person voting. As Jack mentioned before, it's going to look quite different this year than [02:21.980 --> 02:30.560] it has in the past. And what that means is, for example, there's quite a shortage of polling [02:30.560 --> 02:36.120] place staff. And so the reason why there is a lot of the folks who staff the polls for the most part [02:36.120 --> 02:42.880] are elderly. And with COVID-19, there are heightened risks associated with that. So there [02:42.880 --> 02:48.680] are some estimates that 500,000 to 1 million new poll workers will be required to staff this [02:48.680 --> 02:55.020] election. In addition, shortages like that and other sort of research shortages because of the [02:55.020 --> 03:00.600] pandemic are going to require consolidating polling places significantly in some places. [03:00.600 --> 03:06.500] And what that means is a lot of places are moving to more of a super center model where sort of a [03:06.500 --> 03:12.120] city stadium or some similar large public place will be used to allow for social distancing and [03:12.120 --> 03:18.560] also just simplify logistics significantly. And so that looks quite different. So the big tagline [03:18.560 --> 03:23.040] here is, for the average voter, what this means is there's probably going to be quite a bit of [03:23.040 --> 03:28.960] confusion with regards to how this election will work, what is and is not safe, what is and is not [03:28.960 --> 03:34.900] valid. And so with that confusion we've seen in the past few years, what happens is disinformation, [03:34.900 --> 03:39.680] misinformation risk significantly increases. People are more likely to think something isn't [03:39.680 --> 03:45.020] valid or something that might be false is actually true or vice versa. So there's just [03:45.020 --> 03:49.720] going to be a lot of confusion going on. So we think that increases the risk to disinformation [03:49.720 --> 03:55.080] regarding the voting process. And so now Jack is going to go more into the specifics of these [03:55.080 --> 04:01.600] changes. Great. So yeah, as Alex said, just to explore some more of the specific areas of technology [04:01.600 --> 04:08.380] that are being extended out or, say, remain important in some specific manner. And in this [04:08.380 --> 04:12.680] slide we won't be talking directly to the risks. We'll get to those in a little later. But this is [04:12.680 --> 04:20.040] just to lay the groundwork for what types of technologies we can expect to be used for the 2020 [04:20.040 --> 04:24.580] election, recognizing that it is going to be conducted differently than other elections in [04:24.580 --> 04:29.920] the past. So the first area of technology is voter registration systems. They're used to track [04:29.920 --> 04:35.900] who's registered to vote, say their address of registration, other information associated with [04:35.900 --> 04:42.320] that. Of course these systems are nothing new. They've been used for years, play even a large [04:42.320 --> 04:47.820] role in in-person voting when you show up to the polling place or to check your name in the [04:47.820 --> 04:52.200] poll book in order to make sure that you're registered to vote. But the role that they [04:52.200 --> 04:58.320] play in mail-in elections is a little different because now they are used as a source to either [04:58.320 --> 05:03.580] determine where mail-in ballot applications are going to be sent or where mail-in ballots [05:03.580 --> 05:09.620] themselves are going to be sent. So the security of these systems is going to be integral into [05:09.620 --> 05:18.220] ensuring that the election can run smoothly. Other voter-facing online systems are also key. [05:18.220 --> 05:24.120] We're seeing expansions of different systems related specifically to absentee ballots. For [05:24.120 --> 05:30.000] instance, portals to request an absentee ballot or to track your ballot. A lot of these systems [05:30.000 --> 05:37.940] either didn't exist before this election or existed but were used in a lot smaller capacity. [05:37.940 --> 05:43.300] So we can expect all these to have increased load and as a result increased cybersecurity risk [05:43.860 --> 05:48.500] associated with them. And then of course there's other voter-facing systems such as election night [05:48.500 --> 05:55.380] reporting which will remain key throughout the election as they have in the past. Then the third [05:55.380 --> 06:01.600] point is talking specifically to the absentee ballot pipeline. So this isn't necessarily what [06:01.600 --> 06:06.820] is actually facing the voters but rather the technology that's going to be required to conduct [06:06.820 --> 06:14.560] primarily mail-in election which is what many states are shifting towards. And this will require [06:14.560 --> 06:20.420] anything from the ballot printing and distribution process and getting vendors in that in order to [06:20.420 --> 06:26.100] ensure that people actually get their ballots and that they are correctly [06:27.360 --> 06:33.800] coordinated along with processes for ballot return, verifying voters' signatures, tabulating ballots, [06:33.800 --> 06:39.100] scanning them. All this has to be conducted and for a lot of states this will be an additional [06:39.100 --> 06:44.720] challenge because like Alex said we're seeing perhaps in some 10 times as many mail-in ballots [06:44.720 --> 06:50.660] compared to previous years. And when this happens there's an increased risk say for technology [06:50.660 --> 06:58.580] strain just because in a lot of cases there's limited technology to process these ballots. [06:58.580 --> 07:05.360] So it increases the possibility that some technical error can occur. So that's just [07:06.180 --> 07:11.770] kind of laying out what is going to happen, what technologies we're seeing rolled out, [07:12.120 --> 07:15.860] and we'll get more to these specific risks in a bit. [07:18.440 --> 07:23.880] Thanks Jack. Yeah and so now talking more about the specific risks here. So obviously with [07:23.880 --> 07:29.280] any technology it could fail, right? Each of these technologies are meant to do a certain [07:29.280 --> 07:35.840] thing and they're part of a pipeline. Any of them might be hacked or fail. So you know [07:35.840 --> 07:40.460] traditionally when we think of election security we think of hackers. You know what can hackers do? [07:40.460 --> 07:46.320] How can they SQL inject a database or cross-site script or something like that? While those risks [07:46.320 --> 07:53.020] definitely still exist, one change that this rapid change in infrastructure is going to cause [07:53.020 --> 07:58.580] to the risk landscape is reliability is a significant concern now. A lot of these systems [07:58.580 --> 08:04.680] are going to see a usage pattern that they have not seen before. And anyone who deals in computer [08:04.680 --> 08:10.700] systems knows that when you have a system that is old or sort of has been used for a while and [08:10.700 --> 08:18.240] it sees a new usage pattern, the potential for operational failure is significant. So you know [08:18.660 --> 08:25.560] the hacking risk absolutely does still exist, but what we assess is that it just could fail as [08:25.560 --> 08:29.740] part of the operation of the system. A good example of this that isn't quite related to the [08:29.740 --> 08:37.680] 2020 election exactly is the Iowa caucus situation that happened in February. The Iowa caucus was [08:37.680 --> 08:41.920] run by the Iowa Democratic Party so it was not run by the state of Iowa. And so therefore you [08:41.920 --> 08:46.640] know those risks maybe don't directly translate. But you know this was an app that failed not [08:46.640 --> 08:52.640] because of a hacker but because of the use of the app. So there are reports that sort of the [08:52.640 --> 08:57.960] folks who were needing to operate this app were not properly trained. The user experience of the [08:57.960 --> 09:04.420] app did not quite work. The backup system that was in place in case the app failed was not [09:04.420 --> 09:10.000] thought through quite enough. So you know while there was not a hack of this app, it absolutely [09:10.000 --> 09:15.680] did fail at its job. And there's actually polls that suggest that voters to this day still don't [09:15.680 --> 09:22.060] really know who won the Democratic Iowa caucus because of what happened during the caucus night. [09:22.060 --> 09:26.480] So you know that sort of thing happening on election night is absolutely possible. And so [09:27.020 --> 09:30.660] you know thinking through the reliability concerns is really really important. [09:30.660 --> 09:36.020] Another point that Jack already made that sort of I'm just pointing out again here is you know [09:36.020 --> 09:41.100] voting registration databases have been important and paramount to running elections [09:41.100 --> 09:46.840] for a long time. But in particular with the increase of vote by mail, those systems, [09:46.840 --> 09:54.920] databases, are what decide where a mail-in ballot is sent. And so obviously ensuring the [09:54.920 --> 09:59.540] sanctity of those systems and the accuracy of those records is very very important to making [09:59.540 --> 10:08.700] sure that this election runs smoothly. So yeah. Great. Then just to get into some of the more [10:08.700 --> 10:13.600] specific risks to the infrastructure that we're seeing and to start with voter registration [10:13.600 --> 10:22.560] systems. Of course, as we saw in 2016, these systems are a ripe area for attack. We saw the [10:22.560 --> 10:28.260] successful compromise, for instance, of Illinois' State Board of Elections voter registration system [10:28.260 --> 10:35.720] in 2016 by Russian actors. And while there's no evidence that voter registration records were [10:35.720 --> 10:42.920] changed, we do know that voter registration records were exfiltrated. And we saw targeting [10:42.920 --> 10:51.640] of all 50 states in addition to that. So basing on what we've already seen and what we can expect [10:51.640 --> 10:58.240] for 2020, we certainly do think that there are heightened risks here, say, given both the [10:58.240 --> 11:03.940] confidentiality, integrity, and availability of these systems. For instance, modifying voter [11:03.940 --> 11:10.380] registration records would result in perhaps a mail-in ballot application or mail-in ballot itself [11:10.380 --> 11:17.480] being sent to the wrong address. And availability concerns as well could prevent certain people from [11:17.480 --> 11:22.900] getting their votes. Along with this, we also assess that there is risk with other voter-facing [11:22.900 --> 11:28.360] online systems. For instance, absentee ballot request, absentee ballot tracking systems can [11:28.360 --> 11:36.480] also be targeted. And then one other online-facing system that we've seen a bit of expansion, not [11:36.480 --> 11:41.480] too many states, but some have come forward with this, is electronic ballot return, also known as [11:41.480 --> 11:47.980] online voting. And for this, CISA does assess that online voting is higher risk than, say, [11:47.980 --> 11:54.860] in-person or mail-in voting, just because there is no paper trail. So you cannot achieve the same [11:54.860 --> 12:02.000] level of authorability. So that is CISA's risk assessment there. And all this is to [12:04.820 --> 12:09.680] highlight with voter registration systems, with other online-facing systems, that there is this [12:09.680 --> 12:15.340] shifted attack surface that attackers may be targeting. So it's important that we prioritize [12:15.340 --> 12:20.480] these when we're thinking about how best to secure the election before November, keeping in mind that [12:20.480 --> 12:25.720] election officials do face significant resource constraints. Running an election is incredibly [12:25.720 --> 12:30.920] difficult, and it is our role, it is the role of the public, to support election officials in that [12:30.920 --> 12:36.820] process. So we'll get to in a little what exactly both election officials can do, as well as what [12:36.820 --> 12:43.020] hackers in this audience can do to ensure that the election does run smoothly, safely, and securely. [12:43.260 --> 12:49.500] But kind of just to lay out that this is something that everyone can play a role in, [12:49.500 --> 12:57.420] and everyone can help with. And then the third component here is the mail-in ballot pipeline. [12:57.420 --> 13:03.000] So this is talking about everything from distribution of ballots, a wide range of [13:03.000 --> 13:08.480] vendors who are responsible, say, for compiling these records, for printing the ballots, for [13:08.480 --> 13:16.420] mailing them out. And really just to footstomp what Alex was saying before, that the biggest risk [13:16.420 --> 13:22.460] to this process is not necessarily the, say, an actual attack against these systems, but rather [13:22.700 --> 13:28.900] a routine technical failure, because these systems are going to be strained and operated at [13:28.900 --> 13:36.220] increased levels. So we assess that the biggest concern, especially for the mail-in ballot pipeline, [13:36.220 --> 13:40.520] where many of these systems are not internet connected, the bigger risk is just a routine [13:40.520 --> 13:46.320] technical failure, rather than, say, an actual attack. Although, of course, we do know that these [13:46.320 --> 13:52.280] systems are being targeted, continue to be vigilant in looking for and preventing these attacks. [13:55.260 --> 14:02.040] Great. And then the next slide, which we were talking about before, is the risk of disinformation. [14:02.040 --> 14:10.520] And this really just goes to show that the biggest risk towards an election outcome is not an actual [14:11.960 --> 14:18.880] attack, but rather distrust in the results. Because as we explored, operational hiccups are not [14:18.880 --> 14:24.120] unlikely. And in fact, we can probably expect that somewhere in the country on election day, [14:24.120 --> 14:29.220] some technical error will go wrong. But what is important to keep in mind here is that [14:29.220 --> 14:34.660] this does not mean that the results of the election are invalid. This does not mean that [14:35.300 --> 14:42.240] we, say, don't actually know what happened. There is a paper trail. In fact, compared to 2016, [14:42.240 --> 14:48.400] when 82% of votes were cast with a paper trail, we now expect 92% of votes to be cast with a [14:48.400 --> 14:53.380] paper trail in 2020, which is a significant improvement. And what that means is that votes [14:53.380 --> 15:00.840] are increasingly auditable, so we can actually ensure that the tabulated result is accurate. [15:00.920 --> 15:06.160] We recommend, for instance, risk-limiting audits, all of those procedures in order to [15:06.160 --> 15:11.340] ensure that election outcomes are valid. But the key thing to emphasize here is that [15:12.240 --> 15:16.360] we can expect some hiccups to occur, but that does not mean that something [15:17.020 --> 15:22.320] went wrong or that the results are invalid. But the bigger risk here is that the public [15:22.320 --> 15:27.600] perception of these hiccups. We saw, for instance, in the primaries in Georgia, [15:27.600 --> 15:35.240] that routine technical failures occurred with poll books, and this led to some public distrust [15:35.240 --> 15:42.020] in the election events. So this is kind of a case study in what can happen in November, [15:42.020 --> 15:49.080] that we can expect technology to go wrong. And, of course, it is possible that there [15:49.080 --> 15:54.500] has been a tech, but that's not the most likely case. What is most likely is that, rather, [15:54.500 --> 15:59.940] there's a routine error as all these technologies are being rapidly expanded, but something just [15:59.940 --> 16:08.800] went wrong. So the main takeaway here from a public perspective is that we need to be resilient, [16:08.800 --> 16:14.300] and we need to understand that there are controls in place, that it's actually incredibly difficult [16:14.300 --> 16:22.200] to actually change votes, because there's a wide range of election systems, and it's very [16:22.200 --> 16:28.100] difficult to actually change those, but the bigger risk is people's perception. So just kind of [16:28.100 --> 16:35.520] viewing that, we need to be thinking about how we can make people more resilient, because when [16:35.520 --> 16:40.940] something, say, when a routine technical error does go wrong, how are we going to respond and [16:40.940 --> 16:46.700] how are we going to get the point across that the election is still valid, that the results [16:46.700 --> 16:51.940] are accurate, even though some part of the election may have gone a little different than what we [16:51.940 --> 16:59.820] expected. So now we're going to get more into the concrete actions that we can take. I'll give it [16:59.820 --> 17:07.140] to Alex to introduce this. Great, thanks, Jack. Yeah, and so something that we think about at [17:07.260 --> 17:14.760] a lot is how can the election infrastructure community coordinate within itself to share [17:14.760 --> 17:21.620] best practices and sort of mitigate threats that they see on the horizon. So one of the main [17:21.620 --> 17:27.400] things that, as an election administrator, that you can do is join an information sharing and [17:27.400 --> 17:35.200] analysis center, or an ISAC. And so something that we have done in the past few years is stand up an [17:35.200 --> 17:40.940] EI-ISAC that is actually separate from CISA. However, it essentially coordinates between [17:41.680 --> 17:46.720] like-minded officials in government that administer election infrastructure and sort of [17:46.720 --> 17:53.660] share threats and do threat analysis. It's critical to sort of do this sort of information sharing, [17:53.660 --> 17:57.460] and, you know, if you're an election administrator, joining this community is quite beneficial to you [17:58.080 --> 18:02.120] because, you know, no one is doing this alone. Everyone faces the same threats around the [18:02.120 --> 18:07.080] country. And so communicating about that is just critical. And this is also part of the MS-ISAC, [18:07.080 --> 18:14.060] multi-state ISAC. And so the second point here is CISA, as the nation's risk manager, [18:14.060 --> 18:19.460] provides free services to those who administer critical infrastructure and election infrastructure [18:19.460 --> 18:25.260] as part of that. So we do things like remote penetration testing, vulnerability assessments, [18:25.260 --> 18:30.960] and other various services that often cost quite a lot on the private market. We will perform them [18:30.960 --> 18:37.080] for free for you. So we've seen a huge uptick in using these services in the past few years as the [18:37.080 --> 18:43.060] election threat has become more publicized. So we've made a lot of progress here, but there's [18:43.060 --> 18:49.120] always more that we can do. And so, you know, talking to us and enlisting these services is a [18:49.120 --> 18:55.620] big step that election officials can take. Great. And our third recommended action, [18:55.620 --> 19:01.660] acknowledging that there are many resource constraints, is just to accept outside help. [19:01.660 --> 19:06.140] For instance, the audience watching this today attending the Def Con Voting Village is full of [19:06.140 --> 19:12.000] cybersecurity professionals who want to help ensure that elections can run smoothly and securely. [19:12.460 --> 19:18.580] So we recommend states to take advantage of whatever volunteer resources there are. [19:18.580 --> 19:23.560] And the first one to highlight here is the election cyber surge, which was recently announced [19:23.560 --> 19:27.880] by the University of Chicago in coordination with the Def Con Voting Village, [19:28.180 --> 19:34.800] which is essentially establishing a volunteer core of cybersecurity professionals who want to [19:34.800 --> 19:40.380] help state and local election officials to better understand cybersecurity risks, to perform [19:40.380 --> 19:47.340] cybersecurity services all for free. So this is a really fantastic resource to take advantage of. [19:47.340 --> 19:52.620] And the second is to launch a vulnerability disclosure policy. And vulnerability disclosure [19:52.620 --> 19:59.160] policy essentially says how outside hackers, friendly hackers, of course, can report [19:59.160 --> 20:07.620] vulnerabilities to you so that you can fix them and accept their support. So the great thing is [20:07.620 --> 20:13.080] that there's already a community of people who want to help you. And all you have to do is tell [20:13.080 --> 20:18.380] them exactly how to do that. So we'll talk about this a little more when we discuss the product [20:18.380 --> 20:23.540] that CISA recently launched, which is guidance to election officials to launch a vulnerability [20:23.540 --> 20:28.940] disclosure policy. But we believe that this is a really great way to accept the free volunteer help [20:28.940 --> 20:36.780] that is out there. Great. And then probably more relevant for most of this audience is how [20:36.780 --> 20:45.240] actual hackers can help protect elections ahead of November. And one of the best ways you can do [20:45.240 --> 20:51.160] this is offer to help your local election officials just because they are quite constrained. [20:51.280 --> 20:58.260] Many operate with small budgets, even lower for IT or security. So any free help can really go a [20:58.260 --> 21:04.540] long way. So you can start perhaps by reaching out to your local election officials, see what areas [21:04.540 --> 21:09.620] might be able to help them. Volunteering for the election cyber surge is another great way to be [21:09.620 --> 21:15.180] paired with state and local election officials to answer questions, provide security services, [21:15.180 --> 21:21.720] as needed. So anything that you can go do on that front would go a really long way. The second [21:21.720 --> 21:28.760] point here is perhaps less of a security solution, but more just a way to help the overall election [21:28.760 --> 21:35.160] run smoothly. And that's serving as a poll worker, if you are healthy in a position to do so. [21:35.160 --> 21:40.040] Because as we mentioned, there are large poll worker shortages. So one of the most impactful [21:40.040 --> 21:46.940] things you can do is to serve on a local level as a poll worker, help ensure that elections are [21:46.940 --> 21:53.380] running smoothly, and helping people vote. So that's a really great way to be directly involved [21:53.380 --> 21:58.640] in the election process. And our third point here is to participate in vulnerability disclosure [21:58.640 --> 22:04.220] policies. Because we recently announced our guidance to state and local election officials. [22:04.220 --> 22:10.200] So some vulnerability disclosure policies may be rolling out in the future. [22:10.940 --> 22:16.040] So I would keep an eye out for any of these that do pop up and help election officials when they [22:16.040 --> 22:24.670] put these out there and are asking for your help. Great. And so, you know, as CISA employees, [22:24.670 --> 22:31.730] we'd be remiss to not mention the various services and resources that CISA provides [22:31.730 --> 22:40.550] in the space. So as mentioned before, CISA provides, you know, risk assessments for free. [22:40.550 --> 22:49.090] And so availing of those is really useful. Additionally, we have this Protect 2020 plan [22:49.090 --> 22:55.550] that CISA has released, outlining our strategy to sort of protect this election. There's a lot [22:55.550 --> 23:01.930] of great resources on there, including how to stand up vote-by-mail systems safely in the [23:01.930 --> 23:09.410] coronavirus age, how to conduct in-person polling safely. And this is in conjunction [23:09.410 --> 23:13.870] with the Election Assistance Commission. There's a lot of great resources on that page. [23:17.790 --> 23:22.590] And then in terms of some more specific areas that we think might be useful, [23:22.590 --> 23:27.970] the first is a vulnerability reporting guide, which I mentioned that CISA just recently released. [23:27.970 --> 23:32.610] This is a really great resource that discusses in depth, if you are an election official, [23:32.610 --> 23:38.730] how you can stand up a vulnerability disclosure policy and start receiving this volunteer help [23:38.730 --> 23:46.050] from security professionals. So it's a really great way to engage the outside community [23:46.050 --> 23:52.310] in order to help secure your systems. So we encourage anyone who's interested to follow [23:52.310 --> 23:58.530] this guidance. And please do reach out to us if you have any additional questions on how to [23:58.530 --> 24:02.710] smoothly allow people to report vulnerabilities to you. [24:03.470 --> 24:10.190] Great. And with that, that's the conclusion of our talk. We've listed here our Protect 2020 [24:10.190 --> 24:15.630] page. Again, that has some really great resources on some of the core details on conducting [24:15.630 --> 24:21.490] elections. Our emails are listed here if you are interested, if you have any questions, [24:21.490 --> 24:27.690] or just want to learn more. I believe there will also be a Q&A in Discord, so we'll be watching [24:27.690 --> 24:34.830] that. But overall, thank you to everyone for attending this talk. We're hopeful that together [24:35.650 --> 24:42.390] as the, say, election officials, as the federal government, as the hacker community, [24:42.390 --> 24:48.910] we can all work collectively to help ensure that we have a safe and secure 2020 election. [24:48.910 --> 24:52.530] So thank you, and please do reach out if you have any questions.