1
00:00:08,280 --> 00:00:10,980
Hello, it's nice to be here.

2
00:00:10,980 --> 00:00:13,700
Thank you for joining this session.

3
00:00:13,700 --> 00:00:21,040
I'd like to talk today about a policy approach to resolving cyber security problems in the election process.

4
00:00:21,240 --> 00:00:33,020
One thing's for sure, after the coronavirus is no longer dominating the news, election security will come back to center stage, big time.

5
00:00:33,280 --> 00:00:41,000
It's not a complicated subject that it is a complicated subject that few people really understand, even election officials.

6
00:00:41,940 --> 00:00:55,240
So today, I want to talk about the role that private sector companies play in the voting system, the vulnerabilities associated with their role, and discuss a path forward from the legal and policy perspective.

7
00:01:02,400 --> 00:01:08,320
So election security, it's really a private sector problem.

8
00:01:09,170 --> 00:01:19,340
Election security, so many aspects of it are performed by private sector companies.

9
00:01:19,340 --> 00:01:35,260
There are many avenues for tampering with an election, including changing votes, causing machines to malfunction, altering voter registration records, and disrupting equipment to be used that's used to check in voters.

10
00:01:35,960 --> 00:01:43,680
The private sector companies play a large role in these activities, which we call the election process.

11
00:01:43,680 --> 00:01:53,480
The voter registration, the checking in, the voting, the polling, the tabulating of the votes, all that is called the election process.

12
00:01:54,320 --> 00:02:02,560
And the private sector companies sell the voting machines and program them for most elections.

13
00:02:02,560 --> 00:02:07,960
Yes, they program them for each individual election in most jurisdictions.

14
00:02:07,960 --> 00:02:13,400
They register voters, they tally votes, and they report votes.

15
00:02:13,400 --> 00:02:19,680
And there are vulnerabilities associated with their role that most people don't understand.

16
00:02:20,220 --> 00:02:27,240
They think that this is all something controlled by state and local election officials, and it is not.

17
00:02:27,260 --> 00:02:36,600
So today I want to talk about a path forward and how to solve this huge complicated problem.

18
00:02:38,090 --> 00:02:55,620
There are many avenues for tampering with an election, including changing votes, causing machines to malfunction, altering voter registration records, and disrupting equipment used to check in voters.

19
00:02:57,140 --> 00:03:01,080
Let's look at the vulnerabilities in the voting equipment.

20
00:03:01,360 --> 00:03:16,160
In 2005, Hari Hirstie performed the famous Hirstie hack and successfully altered votes in a one-step hack that changed both central tabulator results and the voting machine results tape.

21
00:03:16,160 --> 00:03:20,360
It was the digital equipment of stuffing the ballot box.

22
00:03:20,440 --> 00:03:33,580
The election official who invited Hirstie to check the de-bolt acu-vote optical scan voting machines said he wouldn't have been able to detect the change and would have certified the election.

23
00:03:34,280 --> 00:03:37,680
De-bolt is now owned by Dominion Voting Systems.

24
00:03:38,300 --> 00:03:42,760
None of the vulnerabilities found by Hirstie were ever fixed.

25
00:03:42,880 --> 00:03:49,480
And these same machines are planned for use in 20 states in the 2020 election.

26
00:03:50,240 --> 00:03:51,660
Think about that.

27
00:03:51,660 --> 00:03:57,160
It's 2020 and he discovered this in 2005, 15 years later.

28
00:03:57,160 --> 00:03:58,660
That's crazy.

29
00:03:58,920 --> 00:04:10,940
A later model of the same voting machines with the same vulnerabilities was used in a hotly contested and disputed 2016 election between Stacey Abrams and Brian Kemp in Georgia.

30
00:04:12,420 --> 00:04:20,320
So many of these systems that are using these machines are using machines with these vulnerabilities.

31
00:04:20,680 --> 00:04:24,940
In recent elections, 99 percent of votes in the U.S.

32
00:04:24,940 --> 00:04:27,940
were cast or counted on computers.

33
00:04:28,320 --> 00:04:44,240
And many of the core election systems, voter registration databases, election management systems, voting machines, and vote counting systems are using aged computer equipment.

34
00:04:44,240 --> 00:04:49,260
The systems employ software that can no longer be updated or patched.

35
00:04:49,260 --> 00:04:58,540
They include databases that have known vulnerabilities and they're managed by third-party vendors where supply chain risks exist.

36
00:04:58,580 --> 00:05:01,280
This is a big problem.

37
00:05:06,560 --> 00:05:11,540
Let's look at the cyber attacks on these private vendors.

38
00:05:12,360 --> 00:05:20,140
In 2016, Gresha's military intelligence service penetrated VR systems.

39
00:05:20,420 --> 00:05:33,340
VR systems is the vendor that manages and handles all of the programming for the majority of the counties of Florida and it handles all absentee ballots and early voting.

40
00:05:34,300 --> 00:05:48,400
We know of this penetration because an NSA contractor, Reality Winner, released a top-secret report about it.

41
00:05:48,540 --> 00:05:57,220
And we later found out the FBI briefed election officials in Florida on a very secret basis.

42
00:05:57,360 --> 00:06:13,800
It was a year later that election officials around the country realized that Gresha's military intelligence service had been penetrating VR systems and that perhaps their systems might also be vulnerable.

43
00:06:14,500 --> 00:06:22,960
In the 2016 elections, electronic voter ID systems in several states went down in certain precincts.

44
00:06:22,960 --> 00:06:27,160
Now these are the systems that help identify a voter when they come in to vote.

45
00:06:27,680 --> 00:06:38,380
And these technical glitches, they called them, in the machines called hours-long waits for people who had come to the polls to vote.

46
00:06:38,520 --> 00:06:40,900
Hours-long waits.

47
00:06:41,040 --> 00:06:51,140
Some voters were unable to wait and others could not vote before the polls closed.

48
00:06:52,020 --> 00:07:14,760
On election day in 2019, federal officials from law enforcement, homeland security, and the intelligence community issued a joint statement declaring that, our adversaries want to undermine our democratic institutions, influence public sentiment, and affect government policies.

49
00:07:14,860 --> 00:07:26,680
Russia, China, Iran, and other foreign malicious actors all will seek to interfere in the voting process or influence voter perceptions.

50
00:07:29,080 --> 00:07:30,120
Wow.

51
00:07:30,360 --> 00:07:32,620
And it's true.

52
00:07:32,800 --> 00:07:35,780
We have a serious problem.

53
00:07:35,780 --> 00:07:39,160
We have governments from outside the U.S.

54
00:07:40,000 --> 00:07:43,760
trying to influence our democratic processes.

55
00:07:43,760 --> 00:08:03,940
And we have voting machines and voter ID systems and private sector companies that have not presented any level of security and assurance that their processes and systems have integrity and are confidential.

56
00:08:08,250 --> 00:08:10,830
So we have a U.S.

57
00:08:10,830 --> 00:08:13,410
Election Assistance Commission.

58
00:08:13,410 --> 00:08:26,450
And this commission is supposed to, but it's perhaps the weakest link in the nation's voting system.

59
00:08:26,450 --> 00:08:32,750
The EAC is a bipartisan commission established by Congress in 2002.

60
00:08:32,750 --> 00:08:37,310
It maintains a national mail voter registration form.

61
00:08:37,310 --> 00:08:42,310
It accredits testing laboratories and certifies voting systems.

62
00:08:42,310 --> 00:08:47,810
And it serves as a national clearinghouse of information on election administration.

63
00:08:48,810 --> 00:09:05,730
In December 2016, Recorded Future reported that a Russian-speaking hacker named Rasputin was selling access to the EAC systems on the internet.

64
00:09:07,650 --> 00:09:14,490
Rasputin had full admin access to the database and could upload any file he wanted.

65
00:09:14,490 --> 00:09:21,150
He had lists of voting machinery, test reports of their software, and knew where they were deployed.

66
00:09:22,190 --> 00:09:34,310
An EAC employee, whose credentials had been compromised, said if Rasputin had access to the database, he could access the server where the proprietary information is kept.

67
00:09:35,150 --> 00:09:40,050
The EAC keeps information about vulnerabilities in voting systems.

68
00:09:40,770 --> 00:09:50,010
Thus, a hacker who gets into the EAC could find out where the weak links are in the voting systems all around the country.

69
00:09:59,200 --> 00:10:05,500
So let's look at the voting machine companies and what role they have played in this.

70
00:10:06,320 --> 00:10:11,340
They have been recalcitrant and arrogant.

71
00:10:12,320 --> 00:10:31,680
Researchers and cyber experts have found multiple vulnerabilities in the most used voting machines that would enable an attacker to gain full access to a system, change configurations, and install a modified operating system without election officials knowing.

72
00:10:32,460 --> 00:10:44,980
These vulnerabilities can enable hackers to change an election, shut the system down, enable remote execution of code, and offline ballot tampering.

73
00:10:45,180 --> 00:10:49,520
There are three primary vendors for voting machines.

74
00:10:49,560 --> 00:10:57,560
Electronic systems and software, known as ES&S, Dominion Voting Systems, and Hart InterCivic.

75
00:10:58,140 --> 00:11:10,600
We know there are vulnerabilities in most of the voting machines, but very little is known about the security of these companies' own IT systems.

76
00:11:11,200 --> 00:11:24,960
The companies that produce these voting machines, that are supposed to maintain them and produce them, and they are the underpinning of the core in our election process.

77
00:11:24,960 --> 00:11:31,520
Very little is known about the security of the companies that even manufacture these machines.

78
00:11:31,760 --> 00:11:45,960
Some voting machines are optical scanners, some have touchscreen voting, some use QR codes or barcodes, and others send votes in clear text back to vendors to be tallied.

79
00:11:45,960 --> 00:11:49,340
They can all be hacked or compromised.

80
00:11:49,500 --> 00:12:02,100
If almost all the voting precincts in our clunky system use equipment from these vendors, an attacker only needs to hack the equipment to reach all of the voters.

81
00:12:03,320 --> 00:12:18,660
Unlike major technology companies, such as Apple and Microsoft, these vendors do not allow researchers to test their equipment and review their code to find vulnerabilities and bugs.

82
00:12:18,720 --> 00:12:28,500
The symbiotic relationship between tech software and hardware vendors and researchers helps them improve their products and keep them secure.

83
00:12:28,500 --> 00:12:35,680
But this is not happening when it comes to voting machine manufacturers.

84
00:12:35,680 --> 00:12:41,440
They will not let the researchers have access to their equipment.

85
00:12:41,940 --> 00:12:51,280
Voting equipment companies have been highly resistant to any review by the research community, claiming their systems are safe and secure.

86
00:12:51,340 --> 00:12:57,600
Yet they have failed to fix identified vulnerabilities in the voting equipment.

87
00:12:58,300 --> 00:13:19,160
They repeatedly claim everything is fine, we're all secure, this is a priority, we take this seriously, America's voting is just our basic concern, and they don't fix vulnerabilities that researchers have found for 15 years.

88
00:13:19,400 --> 00:13:27,720
They let their voting machines be out front and used for voting knowing they have vulnerabilities in them.

89
00:13:27,720 --> 00:13:31,640
I guess they think no one's going to exploit them.

90
00:13:32,060 --> 00:13:38,480
But really, to cover that up and try to say they're all safe and sound, that's just wrong.

91
00:13:41,310 --> 00:13:55,370
So during the three years of the voting village's existence, I think most of you are familiar with voting village, none of the vendors have supported the effort, nor have they been willing to donate or offer equipment.

92
00:13:56,490 --> 00:14:09,830
While the researchers in the voting village, they're dedicated to this because one, they want to help develop a community of cybersecurity experts in election security.

93
00:14:09,830 --> 00:14:22,990
There are not very many experts out there who know how to deal with election voting machines and cybersecurity problems and how to solve those vulnerabilities.

94
00:14:23,070 --> 00:14:31,910
And they also want to make the voting machines and equipment more secure by letting these vulnerabilities be known.

95
00:14:32,110 --> 00:14:38,150
The problem is the vendors are doing nothing about it.

96
00:14:38,730 --> 00:14:48,230
And apparently the election officials also are not requiring them to fix these vulnerabilities before they have another election.

97
00:14:49,130 --> 00:14:51,530
So that's a big problem.

98
00:14:53,130 --> 00:14:59,710
So I want to put forth a proposal to address this problem and achieve results.

99
00:15:00,050 --> 00:15:17,670
Certain actions can be taken at the federal level that will push a standardized approach out to state and local election officials and will require certain actions to be taken by private sector companies.

100
00:15:19,170 --> 00:15:22,290
Article 1, section 4 of the U.S.

101
00:15:22,290 --> 00:15:31,110
Constitution grants Congress the power to regulate the times, places, and manner of holding federal elections.

102
00:15:31,370 --> 00:15:36,670
Federal elections deal with elections of senators, representatives, and the president.

103
00:15:37,910 --> 00:15:49,830
Now state and local election officials are responsible for conducting all elections, but they depend on infusions of federal funding to supplement their state and local funding.

104
00:15:51,350 --> 00:15:59,570
So state and local officials can't really afford to have separate equipment and systems, one for state elections and one for federal elections.

105
00:15:59,630 --> 00:16:14,090
So when federal election officials or federal election Congress mandates certain requirements for federal elections, they pretty much have to go along with those because they only have one system for voting.

106
00:16:14,890 --> 00:16:39,610
So therefore, if Congress sets requirements for federal elections and restricts the funding that these state and local election officials need to only those election agencies that adhere to federal requirements, we will begin to see consistent actions taken across the U.S.

107
00:16:39,610 --> 00:16:44,430
that will tighten cybersecurity in the election process.

108
00:16:45,610 --> 00:17:01,410
So this proposal that I want to go over with you today is such a proposal to have federal requirements set by Congress.

109
00:17:01,410 --> 00:17:12,110
The first would be to direct NIST, the National Institute of Standards and Technology, to establish federal standards for cybersecurity.

110
00:17:13,250 --> 00:17:20,170
NIST is the entity in the government that has established all the federal information processing standards.

111
00:17:20,170 --> 00:17:32,890
It's established all of the cybersecurity best practices and standards that have been put forth by NIST that federal agencies have to adhere to and certain federal contractors.

112
00:17:33,030 --> 00:17:42,810
So they have a deep bench of expertise in not only standards and cybersecurity but in secure engineering practices.

113
00:17:43,200 --> 00:17:55,490
And it would be appropriate to direct them to develop federal standards for cybersecurity of our election system software, the infrastructure, and the hardware.

114
00:17:55,490 --> 00:18:13,250
All three levels that are used in voter registration, vote tallying, voter polling, and in the manufacturing, servicing, or writing of election parameters of voting machines and equipment.

115
00:18:15,530 --> 00:18:23,790
The first covers the systems, the infrastructure, the hardware, the software, the hardware, the network that they're using.

116
00:18:23,790 --> 00:18:25,670
What are the standards for that?

117
00:18:26,230 --> 00:18:31,510
Because that is used in registration, in tallying, in voter polling.

118
00:18:31,510 --> 00:18:37,090
Again, this isn't just one thing of one machine and go to the vote, the poll and vote.

119
00:18:37,090 --> 00:18:39,150
This is registering to vote.

120
00:18:39,150 --> 00:18:41,650
It's signing in and being ID'd.

121
00:18:41,650 --> 00:18:42,930
It is voting.

122
00:18:42,930 --> 00:18:45,070
It's tallying the votes.

123
00:18:45,070 --> 00:18:50,250
It's polling the votes, the voters, and it's reporting the votes.

124
00:18:50,250 --> 00:19:05,610
All of these actions are largely performed by private sector companies who we don't have any idea how their cybersecurity program is, whether it's mature or not.

125
00:19:06,230 --> 00:19:11,310
We suspect it's not very mature, but that's just a suspicion.

126
00:19:11,310 --> 00:19:15,150
But we should have a standard for saying it must meet these standards.

127
00:19:15,290 --> 00:19:17,210
Our democracy depends on it.

128
00:19:17,210 --> 00:19:18,630
That's worth a standard.

129
00:19:19,730 --> 00:19:25,250
And then we have in the manufacturing, the servicing of voting machines and equipment.

130
00:19:25,250 --> 00:19:26,490
Absolutely.

131
00:19:26,590 --> 00:19:29,130
We want these vulnerabilities fixed.

132
00:19:29,130 --> 00:19:33,110
They need to be serviced and maintained and have integrity.

133
00:19:33,110 --> 00:19:37,350
The writing of election parameters means the programming of these machines.

134
00:19:37,350 --> 00:19:45,970
In most of the jurisdictions, the private sector companies program these machines for every single election.

135
00:19:45,970 --> 00:19:49,630
We need standards to govern how that's done.

136
00:19:50,270 --> 00:20:06,910
Second is we should direct NIST to establish a certification process for the security and integrity of election systems, software, infrastructure, and hardware, and associated components and modules of the election process.

137
00:20:06,910 --> 00:20:13,230
So there should be a certification process to make sure they're meeting the standards.

138
00:20:13,610 --> 00:20:27,430
Next, we should direct NIST to analyze the private sector's role in the election process and recommend any roles or functions that should be changed or restricted to public sector election officials.

139
00:20:27,710 --> 00:20:39,190
There are some roles being undertaken by private sector companies that perhaps should not be a private sector activity.

140
00:20:39,190 --> 00:20:44,170
Perhaps that role should be strictly a governmental function.

141
00:20:44,170 --> 00:21:01,450
But let's NIST analyze that in all of their work in establishing the federal standards in the certification process and recommend to Congress roles that should be perhaps reserved to the public sector.

142
00:21:02,030 --> 00:21:22,570
Next, we want Congress to pass a law restricting federal funding to election jurisdictions to only those jurisdictions that one use such funding in a manner consistent with the NIST federal election standards.

143
00:21:23,150 --> 00:21:48,590
And those jurisdictions that require annual cybersecurity assessments by an independent third party of all the systems in the election process in accordance with the standards that require annual cybersecurity assessments by a third party of all private sector companies involved in the election process in accordance with the NIST standards.

144
00:21:48,630 --> 00:21:53,590
And to make these assessments available to election officials contracting with them.

145
00:21:54,010 --> 00:21:58,170
A company may get a cybersecurity assessment but it may not share it.

146
00:21:58,170 --> 00:22:12,350
We want them, we want these vendors to have to get third-party assessments every year and share those assessments with the election officials contracting with them.

147
00:22:12,350 --> 00:22:20,370
And we want the election officials to get third-party assessments of their systems in accordance with the NIST standards.

148
00:22:21,670 --> 00:22:26,050
This is what private businesses do every day.

149
00:22:26,050 --> 00:22:27,670
That's what's required of them.

150
00:22:27,670 --> 00:22:36,070
This is not asking too much of election officials or private sector vendors that support the democracy that this country has been built on.

151
00:22:36,890 --> 00:22:50,830
We also want federal funding restricted to those jurisdictions that establish requirements for post-election auditing of votes, at least on the level of risk-limiting audits and to make the findings public.

152
00:22:52,190 --> 00:23:06,930
So restricting federal funding to only those jurisdictions that comply with the NIST standards, that conduct the risk assessments themselves, that make their vendors get the assessments, and that have post-election auditing.

153
00:23:06,970 --> 00:23:09,830
There's a precedent for this.

154
00:23:10,210 --> 00:23:20,230
Congress has passed laws in the past to restrict highway funds to only those jurisdictions that lower the speed limit to 55 miles an hour.

155
00:23:21,190 --> 00:23:33,950
Congress has restricted funds to only go to those school districts that would adjust their cafeteria menus to comply with the new recommended federal menu.

156
00:23:34,050 --> 00:23:47,530
There are numerous other examples, but the Congress has in the past, in several instances, tied its federal funding to meeting certain requirements.

157
00:23:47,650 --> 00:24:00,790
There's nothing more important than having our federal funding tied to meeting the requirements that our vote counts, that every vote should be counted and it should be counted as cast.

158
00:24:00,850 --> 00:24:14,630
The American Bar Association, which represents over 400,000 attorneys, recently adopted Resolution 118, which calls for these exact measures.

159
00:24:15,910 --> 00:24:23,190
Cybersecurity best practices and standards can help, because election security is not going to get solved overnight.

160
00:24:23,210 --> 00:24:35,530
But standing up a cybersecurity program for election systems that's in compliance with cybersecurity best practices and standards will be a first big step.

161
00:24:35,530 --> 00:24:42,610
Congress may not pass a law right away, but election officials should already be doing this.

162
00:24:42,610 --> 00:24:48,530
They should already be saying, we have NIST standards for cybersecurity programs.

163
00:24:48,530 --> 00:24:49,970
There are ISO standards.

164
00:24:49,970 --> 00:24:56,630
There's multiple standards out there for cybersecurity programs, and every single vendor should be adhering to those.

165
00:24:56,850 --> 00:25:02,450
They're not only using equipment with vulnerabilities, their own networks and systems are vulnerable as well.

166
00:25:02,450 --> 00:25:10,170
So it's time election officials step up and take action, even before Congress does.

167
00:25:10,210 --> 00:25:25,610
They should require, election officials should require election vendors to meet cybersecurity standards and best practices, conduct annual risk assessments of their program's maturity, and do what every other business would do, manage its risk.

168
00:25:25,610 --> 00:25:39,490
In addition, they need to follow the lead of California and other jurisdictions and hire experts to test the security of their voting machines and equipment, and then demand that vendors close any vulnerabilities found.

169
00:25:39,490 --> 00:25:47,410
Why are these officials letting machines with vulnerabilities that have been known for 15 years be used in their jurisdictions?

170
00:25:47,410 --> 00:25:48,870
That's crazy.

171
00:25:48,870 --> 00:26:01,030
They need to demand these vulnerabilities be fixed, and they need to join with each other nationally and ensure that that those machines are not used in elections.

172
00:26:01,230 --> 00:26:16,700
So legislation and other reforms are needed, but election officials can achieve these things through their own direction and in legal agreements with their election vendors, and they should begin now and do as much as possible before November.

173
00:26:17,560 --> 00:26:19,120
Thank you very much.