WEBVTT 00:00.000 --> 00:02.560 Hello everyone, my name is Jack Cable. 00:03.040 --> 00:04.580 And I'm Alex Sahir. 00:04.780 --> 00:08.920 We are both election security technical advisors for the U.S. 00:08.920 --> 00:12.660 Cybersecurity and Infrastructure Security Agency, also known as CISA. 00:12.660 --> 00:15.820 CISA is essentially the nation's risk advisor. 00:15.820 --> 00:21.660 So in the case of elections, we advise state and local governments on how to conduct elections securely. 00:21.660 --> 00:28.840 We also provide cybersecurity services to assess their systems and ensure that they are secure. 00:29.470 --> 00:36.460 So our goal for this talk is essentially to explore how election security has changed since March with the pandemic. 00:36.460 --> 00:51.480 Because of course, elections are going to be looking a little different this year with an expansion of mail-in balloting across the country, a reduction in polling places due to poll worker shortages, with the same consolidated polling places. 00:51.660 --> 00:55.300 And of course, in-person voting is going to have to operate much differently. 00:55.300 --> 00:57.560 So that is safe with the pandemic. 00:57.720 --> 01:03.000 So all of this compiled together, we want to think about how election security changes. 01:03.000 --> 01:05.980 And that's what we're going to explore today. 01:07.260 --> 01:09.180 Great, thanks for the intro, Jack. 01:09.180 --> 01:16.780 So what we'll do first is sort of talk through specifically why this election looks different than any other election we've had before. 01:17.000 --> 01:27.480 So the first thing, and this has been publicized quite widely, is a lot of the country is moving towards mail-in balloting as a stable option for everyone. 01:27.580 --> 01:34.040 So you're going to see a large increase in the folks who decide to exercise their ability to do mail-in balloting. 01:34.040 --> 01:42.340 So what this means operationally is, well, some states already did a lot of mail-in balloting, like California or Washington. 01:42.760 --> 01:46.640 Some states, it's not part of their tradition for the most part. 01:46.640 --> 01:49.420 So that is changing with this pandemic. 01:49.500 --> 01:58.940 And so you're going to see a lot of states ramp up their capability to provide mail-in balloting quite quickly in the coming months. 01:59.080 --> 02:01.880 They already have the summer and also in the lead up to November. 02:01.980 --> 02:08.640 So there's a lot of specific infrastructure that's specific to mail-in balloting, and Jack's going to go into that later. 02:09.040 --> 02:14.660 And so these systems are being introduced quite quickly and potentially there are going to be some ramifications of that. 02:14.980 --> 02:18.460 A second component here is in-person voting. 02:18.460 --> 02:23.480 As Jack mentioned before, it's going to look quite different this year than it has in the past. 02:23.620 --> 02:31.740 And what that means is, for example, there's quite a shortage of polling place staff. 02:31.740 --> 02:37.180 And so the reason why there is a lot of the folks who staff the polls for the most part are elderly. 02:37.180 --> 02:42.180 And with COVID-19, there are heightened risks associated with that. 02:42.180 --> 02:49.500 So there are some estimates that 500,000 to 1 million new poll workers will be required to staff this election. 02:49.500 --> 03:00.600 In addition, shortages like that and other sort of research shortages because of the pandemic are going to require consolidating polling places significantly in some places. 03:00.600 --> 03:15.640 And what that means is a lot of places are moving to more of a super center model where sort of a city stadium or some similar large public place will be used to allow for social distancing and also just simplify logistics significantly. 03:15.640 --> 03:16.920 And so that looks quite different. 03:16.920 --> 03:29.860 So the big tagline here is, for the average voter, what this means is there's probably going to be quite a bit of confusion with regards to how this election will work, what is and is not safe, what is and is not valid. 03:30.100 --> 03:37.740 And so with that confusion we've seen in the past few years, what happens is disinformation, misinformation risk significantly increases. 03:37.740 --> 03:44.580 People are more likely to think something isn't valid or something that might be false is actually true or vice versa. 03:44.580 --> 03:46.680 So there's just going to be a lot of confusion going on. 03:46.680 --> 03:51.420 So we think that increases the risk to disinformation regarding the voting process. 03:51.420 --> 03:55.820 And so now Jack is going to go more into the specifics of these changes. 03:56.620 --> 03:57.220 Great. 03:57.220 --> 04:07.580 So yeah, as Alex said, just to explore some more of the specific areas of technology that are being extended out or, say, remain important in some specific manner. 04:07.880 --> 04:11.000 And in this slide we won't be talking directly to the risks. 04:11.000 --> 04:12.200 We'll get to those in a little later. 04:12.200 --> 04:25.660 But this is just to lay the groundwork for what types of technologies we can expect to be used for the 2020 election, recognizing that it is going to be conducted differently than other elections in the past. 04:25.780 --> 04:28.940 So the first area of technology is voter registration systems. 04:28.940 --> 04:36.840 They're used to track who's registered to vote, say their address of registration, other information associated with that. 04:36.840 --> 04:39.080 Of course these systems are nothing new. 04:39.080 --> 04:51.020 They've been used for years, play even a large role in in-person voting when you show up to the polling place or to check your name in the poll book in order to make sure that you're registered to vote. 04:51.220 --> 05:05.600 But the role that they play in mail-in elections is a little different because now they are used as a source to either determine where mail-in ballot applications are going to be sent or where mail-in ballots themselves are going to be sent. 05:05.820 --> 05:13.840 So the security of these systems is going to be integral into ensuring that the election can run smoothly. 05:14.380 --> 05:18.220 Other voter-facing online systems are also key. 05:18.220 --> 05:23.820 We're seeing expansions of different systems related specifically to absentee ballots. 05:23.820 --> 05:28.980 For instance, portals to request an absentee ballot or to track your ballot. 05:28.980 --> 05:37.940 A lot of these systems either didn't exist before this election or existed but were used in a lot smaller capacity. 05:37.940 --> 05:45.140 So we can expect all these to have increased load and as a result increased cybersecurity risk associated with them. 05:45.140 --> 05:54.220 And then of course there's other voter-facing systems such as election night reporting which will remain key throughout the election as they have in the past. 05:54.440 --> 06:00.220 Then the third point is talking specifically to the absentee ballot pipeline. 06:00.220 --> 06:13.160 So this isn't necessarily what is actually facing the voters but rather the technology that's going to be required to conduct primarily mail-in election which is what many states are shifting towards. 06:13.160 --> 06:32.800 And this will require anything from the ballot printing and distribution process and getting vendors in that in order to ensure that people actually get their ballots and that they are correctly coordinated along with processes for ballot return, verifying voters' signatures, 06:32.800 --> 06:34.680 tabulating ballots, scanning them. 06:34.680 --> 06:47.100 All this has to be conducted and for a lot of states this will be an additional challenge because like Alex said we're seeing perhaps in some 10 times as many mail-in ballots compared to previous years. 06:47.240 --> 06:58.580 And when this happens there's an increased risk say for technology strain just because in a lot of cases there's limited technology to process these ballots. 06:58.580 --> 07:04.000 So it increases the possibility that some technical error can occur. 07:04.440 --> 07:15.860 So that's just kind of laying out what is going to happen, what technologies we're seeing rolled out, and we'll get more to these specific risks in a bit. 07:18.440 --> 07:19.400 Thanks Jack. 07:19.400 --> 07:22.860 Yeah and so now talking more about the specific risks here. 07:22.860 --> 07:26.320 So obviously with any technology it could fail, right? 07:26.320 --> 07:32.240 Each of these technologies are meant to do a certain thing and they're part of a pipeline. 07:32.240 --> 07:35.040 Any of them might be hacked or fail. 07:35.040 --> 07:39.580 So you know traditionally when we think of election security we think of hackers. 07:39.580 --> 07:40.460 You know what can hackers do? 07:40.460 --> 07:45.320 How can they SQL inject a database or cross-site script or something like that? 07:45.320 --> 07:57.420 While those risks definitely still exist, one change that this rapid change in infrastructure is going to cause to the risk landscape is reliability is a significant concern now. 07:57.420 --> 08:02.580 A lot of these systems are going to see a usage pattern that they have not seen before. 08:02.580 --> 08:17.080 And anyone who deals in computer systems knows that when you have a system that is old or sort of has been used for a while and it sees a new usage pattern, the potential for operational failure is significant. 08:17.080 --> 08:27.360 So you know the hacking risk absolutely does still exist, but what we assess is that it just could fail as part of the operation of the system. 08:27.360 --> 08:35.860 A good example of this that isn't quite related to the 2020 election exactly is the Iowa caucus situation that happened in February. 08:36.240 --> 08:40.800 The Iowa caucus was run by the Iowa Democratic Party so it was not run by the state of Iowa. 08:40.900 --> 08:43.960 And so therefore you know those risks maybe don't directly translate. 08:43.960 --> 08:50.300 But you know this was an app that failed not because of a hacker but because of the use of the app. 08:50.300 --> 08:56.580 So there are reports that sort of the folks who were needing to operate this app were not properly trained. 08:56.580 --> 08:59.860 The user experience of the app did not quite work. 08:59.860 --> 09:06.440 The backup system that was in place in case the app failed was not thought through quite enough. 09:06.440 --> 09:11.400 So you know while there was not a hack of this app, it absolutely did fail at its job. 09:11.400 --> 09:22.060 And there's actually polls that suggest that voters to this day still don't really know who won the Democratic Iowa caucus because of what happened during the caucus night. 09:22.060 --> 09:26.240 So you know that sort of thing happening on election night is absolutely possible. 09:26.240 --> 09:30.660 And so you know thinking through the reliability concerns is really really important. 09:30.660 --> 09:42.580 Another point that Jack already made that sort of I'm just pointing out again here is you know voting registration databases have been important and paramount to running elections for a long time. 09:42.580 --> 09:52.620 But in particular with the increase of vote by mail, those systems, databases, are what decide where a mail-in ballot is sent. 09:52.620 --> 10:02.380 And so obviously ensuring the sanctity of those systems and the accuracy of those records is very very important to making sure that this election runs smoothly. 10:02.440 --> 10:03.660 So yeah. 10:05.740 --> 10:06.500 Great. 10:06.500 --> 10:14.580 Then just to get into some of the more specific risks to the infrastructure that we're seeing and to start with voter registration systems. 10:14.700 --> 10:22.040 Of course, as we saw in 2016, these systems are a ripe area for attack. 10:22.040 --> 10:31.040 We saw the successful compromise, for instance, of Illinois' State Board of Elections voter registration system in 2016 by Russian actors. 10:31.040 --> 10:41.380 And while there's no evidence that voter registration records were changed, we do know that voter registration records were exfiltrated. 10:41.420 --> 10:46.660 And we saw targeting of all 50 states in addition to that. 10:46.840 --> 11:02.360 So basing on what we've already seen and what we can expect for 2020, we certainly do think that there are heightened risks here, say, given both the confidentiality, integrity, and availability of these systems. 11:02.360 --> 11:12.800 For instance, modifying voter registration records would result in perhaps a mail-in ballot application or mail-in ballot itself being sent to the wrong address. 11:12.840 --> 11:19.080 And availability concerns as well could prevent certain people from getting their votes. 11:19.080 --> 11:24.500 Along with this, we also assess that there is risk with other voter-facing online systems. 11:24.500 --> 11:29.760 For instance, absentee ballot request, absentee ballot tracking systems can also be targeted. 11:30.180 --> 11:42.860 And then one other online-facing system that we've seen a bit of expansion, not too many states, but some have come forward with this, is electronic ballot return, also known as online voting. 11:42.980 --> 11:52.480 And for this, CISA does assess that online voting is higher risk than, say, in-person or mail-in voting, just because there is no paper trail. 11:52.480 --> 11:56.920 So you cannot achieve the same level of authorability. 11:56.920 --> 12:00.640 So that is CISA's risk assessment there. 12:00.740 --> 12:13.740 And all this is to highlight with voter registration systems, with other online-facing systems, that there is this shifted attack surface that attackers may be targeting. 12:13.740 --> 12:24.300 So it's important that we prioritize these when we're thinking about how best to secure the election before November, keeping in mind that election officials do face significant resource constraints. 12:24.300 --> 12:31.900 Running an election is incredibly difficult, and it is our role, it is the role of the public, to support election officials in that process. 12:32.000 --> 12:43.020 So we'll get to in a little what exactly both election officials can do, as well as what hackers in this audience can do to ensure that the election does run smoothly, safely, and securely. 12:43.260 --> 12:52.480 But kind of just to lay out that this is something that everyone can play a role in, and everyone can help with. 12:52.480 --> 12:57.420 And then the third component here is the mail-in ballot pipeline. 12:57.420 --> 13:10.020 So this is talking about everything from distribution of ballots, a wide range of vendors who are responsible, say, for compiling these records, for printing the ballots, for mailing them out. 13:10.780 --> 13:30.760 And really just to footstomp what Alex was saying before, that the biggest risk to this process is not necessarily the, say, an actual attack against these systems, but rather a routine technical failure, because these systems are going to be strained and operated at increased levels. 13:30.760 --> 13:44.720 So we assess that the biggest concern, especially for the mail-in ballot pipeline, where many of these systems are not internet connected, the bigger risk is just a routine technical failure, rather than, say, an actual attack. 13:44.720 --> 13:52.280 Although, of course, we do know that these systems are being targeted, continue to be vigilant in looking for and preventing these attacks. 13:55.260 --> 13:56.080 Great. 13:56.080 --> 14:02.040 And then the next slide, which we were talking about before, is the risk of disinformation. 14:02.040 --> 14:15.500 And this really just goes to show that the biggest risk towards an election outcome is not an actual attack, but rather distrust in the results. 14:15.500 --> 14:19.980 Because as we explored, operational hiccups are not unlikely. 14:19.980 --> 14:26.700 And in fact, we can probably expect that somewhere in the country on election day, some technical error will go wrong. 14:26.740 --> 14:33.280 But what is important to keep in mind here is that this does not mean that the results of the election are invalid. 14:33.280 --> 14:37.880 This does not mean that we, say, don't actually know what happened. 14:37.880 --> 14:39.940 There is a paper trail. 14:39.940 --> 14:52.080 In fact, compared to 2016, when 82% of votes were cast with a paper trail, we now expect 92% of votes to be cast with a paper trail in 2020, which is a significant improvement. 14:52.080 --> 15:00.840 And what that means is that votes are increasingly auditable, so we can actually ensure that the tabulated result is accurate. 15:00.920 --> 15:08.800 We recommend, for instance, risk-limiting audits, all of those procedures in order to ensure that election outcomes are valid. 15:08.800 --> 15:19.720 But the key thing to emphasize here is that we can expect some hiccups to occur, but that does not mean that something went wrong or that the results are invalid. 15:19.720 --> 15:24.400 But the bigger risk here is that the public perception of these hiccups. 15:24.400 --> 15:37.460 We saw, for instance, in the primaries in Georgia, that routine technical failures occurred with poll books, and this led to some public distrust in the election events. 15:37.480 --> 15:45.720 So this is kind of a case study in what can happen in November, that we can expect technology to go wrong. 15:45.720 --> 15:52.020 And, of course, it is possible that there has been a tech, but that's not the most likely case. 15:52.020 --> 16:01.220 What is most likely is that, rather, there's a routine error as all these technologies are being rapidly expanded, but something just went wrong. 16:01.640 --> 16:21.160 So the main takeaway here from a public perspective is that we need to be resilient, and we need to understand that there are controls in place, that it's actually incredibly difficult to actually change votes, because there's a wide range of election systems, 16:21.160 --> 16:26.720 and it's very difficult to actually change those, but the bigger risk is people's perception. 16:27.120 --> 16:45.560 So just kind of viewing that, we need to be thinking about how we can make people more resilient, because when something, say, when a routine technical error does go wrong, how are we going to respond and how are we going to get the point across that the election is still valid, 16:45.560 --> 16:52.800 that the results are accurate, even though some part of the election may have gone a little different than what we expected. 16:54.300 --> 16:59.380 So now we're going to get more into the concrete actions that we can take. 16:59.380 --> 17:02.040 I'll give it to Alex to introduce this. 17:02.680 --> 17:03.640 Great, thanks, Jack. 17:03.640 --> 17:19.660 Yeah, and so something that we think about at a lot is how can the election infrastructure community coordinate within itself to share best practices and sort of mitigate threats that they see on the horizon. 17:19.840 --> 17:29.740 So one of the main things that, as an election administrator, that you can do is join an information sharing and analysis center, or an ISAC. 17:29.740 --> 17:37.460 And so something that we have done in the past few years is stand up an EI-ISAC that is actually separate from CISA. 17:37.460 --> 17:49.380 However, it essentially coordinates between like-minded officials in government that administer election infrastructure and sort of share threats and do threat analysis. 17:50.160 --> 18:00.240 It's critical to sort of do this sort of information sharing, and, you know, if you're an election administrator, joining this community is quite beneficial to you because, you know, no one is doing this alone. 18:00.240 --> 18:02.780 Everyone faces the same threats around the country. 18:02.780 --> 18:05.220 And so communicating about that is just critical. 18:05.220 --> 18:08.720 And this is also part of the MS-ISAC, multi-state ISAC. 18:08.720 --> 18:20.660 And so the second point here is CISA, as the nation's risk manager, provides free services to those who administer critical infrastructure and election infrastructure as part of that. 18:20.660 --> 18:29.340 So we do things like remote penetration testing, vulnerability assessments, and other various services that often cost quite a lot on the private market. 18:29.380 --> 18:32.380 We will perform them for free for you. 18:32.420 --> 18:40.400 So we've seen a huge uptick in using these services in the past few years as the election threat has become more publicized. 18:40.400 --> 18:44.880 So we've made a lot of progress here, but there's always more that we can do. 18:44.880 --> 18:51.900 And so, you know, talking to us and enlisting these services is a big step that election officials can take. 18:52.780 --> 18:53.480 Great. 18:53.480 --> 19:01.660 And our third recommended action, acknowledging that there are many resource constraints, is just to accept outside help. 19:01.660 --> 19:12.000 For instance, the audience watching this today attending the Def Con Voting Village is full of cybersecurity professionals who want to help ensure that elections can run smoothly and securely. 19:12.460 --> 19:18.580 So we recommend states to take advantage of whatever volunteer resources there are. 19:18.580 --> 19:39.020 And the first one to highlight here is the election cyber surge, which was recently announced by the University of Chicago in coordination with the Def Con Voting Village, which is essentially establishing a volunteer core of cybersecurity professionals who want to help state and local election officials to better understand cybersecurity risks, 19:39.020 --> 19:43.400 to perform cybersecurity services all for free. 19:43.400 --> 19:47.340 So this is a really fantastic resource to take advantage of. 19:47.340 --> 19:51.340 And the second is to launch a vulnerability disclosure policy. 19:51.340 --> 20:06.440 And vulnerability disclosure policy essentially says how outside hackers, friendly hackers, of course, can report vulnerabilities to you so that you can fix them and accept their support. 20:06.580 --> 20:11.660 So the great thing is that there's already a community of people who want to help you. 20:11.820 --> 20:14.900 And all you have to do is tell them exactly how to do that. 20:14.900 --> 20:24.740 So we'll talk about this a little more when we discuss the product that CISA recently launched, which is guidance to election officials to launch a vulnerability disclosure policy. 20:24.740 --> 20:30.660 But we believe that this is a really great way to accept the free volunteer help that is out there. 20:31.960 --> 20:32.680 Great. 20:32.680 --> 20:41.840 And then probably more relevant for most of this audience is how actual hackers can help protect elections ahead of November. 20:42.020 --> 20:51.160 And one of the best ways you can do this is offer to help your local election officials just because they are quite constrained. 20:51.280 --> 20:56.240 Many operate with small budgets, even lower for IT or security. 20:56.320 --> 20:59.160 So any free help can really go a long way. 20:59.200 --> 21:06.000 So you can start perhaps by reaching out to your local election officials, see what areas might be able to help them. 21:06.140 --> 21:16.300 Volunteering for the election cyber surge is another great way to be paired with state and local election officials to answer questions, provide security services, as needed. 21:16.460 --> 21:21.320 So anything that you can go do on that front would go a really long way. 21:21.320 --> 21:30.040 The second point here is perhaps less of a security solution, but more just a way to help the overall election run smoothly. 21:30.040 --> 21:35.160 And that's serving as a poll worker, if you are healthy in a position to do so. 21:35.160 --> 21:38.880 Because as we mentioned, there are large poll worker shortages. 21:38.880 --> 21:50.700 So one of the most impactful things you can do is to serve on a local level as a poll worker, help ensure that elections are running smoothly, and helping people vote. 21:50.740 --> 21:55.380 So that's a really great way to be directly involved in the election process. 21:55.380 --> 21:59.760 And our third point here is to participate in vulnerability disclosure policies. 21:59.760 --> 22:04.220 Because we recently announced our guidance to state and local election officials. 22:04.220 --> 22:10.200 So some vulnerability disclosure policies may be rolling out in the future. 22:10.940 --> 22:18.880 So I would keep an eye out for any of these that do pop up and help election officials when they put these out there and are asking for your help. 22:21.190 --> 22:21.910 Great. 22:21.910 --> 22:33.010 And so, you know, as CISA employees, we'd be remiss to not mention the various services and resources that CISA provides in the space. 22:33.010 --> 22:40.550 So as mentioned before, CISA provides, you know, risk assessments for free. 22:40.550 --> 22:44.630 And so availing of those is really useful. 22:44.630 --> 22:54.950 Additionally, we have this Protect 2020 plan that CISA has released, outlining our strategy to sort of protect this election. 22:54.950 --> 23:08.010 There's a lot of great resources on there, including how to stand up vote-by-mail systems safely in the coronavirus age, how to conduct in-person polling safely. 23:08.150 --> 23:10.950 And this is in conjunction with the Election Assistance Commission. 23:10.950 --> 23:13.870 There's a lot of great resources on that page. 23:17.790 --> 23:27.970 And then in terms of some more specific areas that we think might be useful, the first is a vulnerability reporting guide, which I mentioned that CISA just recently released. 23:27.970 --> 23:41.730 This is a really great resource that discusses in depth, if you are an election official, how you can stand up a vulnerability disclosure policy and start receiving this volunteer help from security professionals. 23:42.470 --> 23:49.110 So it's a really great way to engage the outside community in order to help secure your systems. 23:49.110 --> 23:53.590 So we encourage anyone who's interested to follow this guidance. 23:53.670 --> 24:02.710 And please do reach out to us if you have any additional questions on how to smoothly allow people to report vulnerabilities to you. 24:03.470 --> 24:04.230 Great. 24:04.230 --> 24:07.610 And with that, that's the conclusion of our talk. 24:07.610 --> 24:10.730 We've listed here our Protect 2020 page. 24:10.730 --> 24:16.790 Again, that has some really great resources on some of the core details on conducting elections. 24:16.970 --> 24:23.650 Our emails are listed here if you are interested, if you have any questions, or just want to learn more. 24:23.710 --> 24:28.710 I believe there will also be a Q&A in Discord, so we'll be watching that. 24:28.850 --> 24:33.150 But overall, thank you to everyone for attending this talk. 24:33.150 --> 24:48.910 We're hopeful that together as the, say, election officials, as the federal government, as the hacker community, we can all work collectively to help ensure that we have a safe and secure 2020 election. 24:48.910 --> 24:52.530 So thank you, and please do reach out if you have any questions.