start	end	text
8280	14800	Hello, it's nice to be here. Thank you for joining this session. I'd like to talk today
14800	21040	about a policy approach to resolving cyber security problems in the election process.
21240	27620	One thing's for sure, after the coronavirus is no longer dominating the news,
27620	35380	election security will come back to center stage, big time. It's not a complicated subject that
35380	41000	it is a complicated subject that few people really understand, even election officials.
41940	46580	So today, I want to talk about the role that private sector companies play in the voting
46580	53100	system, the vulnerabilities associated with their role, and discuss a path forward from the legal
53100	68320	and policy perspective. So election security, it's really a private sector problem.
69170	79340	Election security, so many aspects of it are performed by private sector companies.
79340	85600	There are many avenues for tampering with an election, including changing votes,
85600	89840	causing machines to malfunction, altering voter registration records,
89840	95260	and disrupting equipment to be used that's used to check in voters.
95960	102400	The private sector companies play a large role in these activities, which we call the election
102400	110300	process. The voter registration, the checking in, the voting, the polling, the tabulating of the
110300	118800	votes, all that is called the election process. And the private sector companies sell the voting
118800	125960	machines and program them for most elections. Yes, they program them for each individual election
125960	133400	in most jurisdictions. They register voters, they tally votes, and they report votes.
133400	139680	And there are vulnerabilities associated with their role that most people don't understand.
140220	145880	They think that this is all something controlled by state and local election officials, and it is
145880	156600	not. So today I want to talk about a path forward and how to solve this huge complicated problem.
158090	159200	There are
161310	169240	many avenues for tampering with an election, including changing votes, causing machines
169240	175620	to malfunction, altering voter registration records, and disrupting equipment used to check in voters.
177140	184380	Let's look at the vulnerabilities in the voting equipment. In 2005, Hari Hirstie performed the
184380	190520	famous Hirstie hack and successfully altered votes in a one-step hack that changed both
190520	198380	central tabulator results and the voting machine results tape. It was the digital equipment of
198380	205000	stuffing the ballot box. The election official who invited Hirstie to check the de-bolt acu-vote
205000	211520	optical scan voting machines said he wouldn't have been able to detect the change and would
211520	219340	have certified the election. De-bolt is now owned by Dominion Voting Systems. None of the
219340	226820	vulnerabilities found by Hirstie were ever fixed. And these same machines are planned for use in 20
226820	235980	states in the 2020 election. Think about that. It's 2020 and he discovered this in 2005,
235980	241980	15 years later. That's crazy. A later model of the same voting machines with the same
241980	249060	vulnerabilities was used in a hotly contested and disputed 2016 election between Stacey Abrams and
249060	258320	Brian Kemp in Georgia. So many of these systems that are using these machines are using machines
258320	266000	with these vulnerabilities. In recent elections, 99 percent of votes in the U.S. were cast or
266000	274000	counted on computers. And many of the core election systems, voter registration databases,
274000	282820	election management systems, voting machines, and vote counting systems are using aged computer
282820	289260	equipment. The systems employ software that can no longer be updated or patched.
289260	294520	They include databases that have known vulnerabilities and they're managed by
294520	301280	third-party vendors where supply chain risks exist. This is a big problem.
306560	311540	Let's look at the cyber attacks on these private vendors.
312360	322260	In 2016, Gresha's military intelligence service penetrated VR systems. VR systems is the vendor
322860	328360	that manages and handles all of the programming for the majority of the counties of Florida
329360	333340	and it handles all absentee ballots and early voting.
334300	344400	We know of this penetration because an NSA contractor, Reality Winner,
344400	352740	released a top-secret report about it. And we later found out the FBI briefed election officials
352740	362440	in Florida on a very secret basis. It was a year later that election officials around the country
363080	368280	realized that Gresha's military intelligence service had been penetrating
369240	376720	VR systems and that perhaps their systems might also be vulnerable. In the 2016 elections,
376720	382960	electronic voter ID systems in several states went down in certain precincts.
382960	387160	Now these are the systems that help identify a voter when they come in to vote.
387680	394680	And these technical glitches, they called them, in the machines called hours-long waits
394680	401960	for people who had come to the polls to vote. Hours-long waits. Some voters
403900	411140	were unable to wait and others could not vote before the polls closed.
412020	418840	On election day in 2019, federal officials from law enforcement, homeland security,
418840	425220	and the intelligence community issued a joint statement declaring that,
425220	432040	our adversaries want to undermine our democratic institutions, influence public sentiment,
432040	439240	and affect government policies. Russia, China, Iran, and other foreign malicious actors
439740	446680	all will seek to interfere in the voting process or influence voter perceptions.
449080	459160	Wow. And it's true. We have a serious problem. We have governments from outside the U.S.
460000	467900	trying to influence our democratic processes. And we have voting machines and voter ID systems
468120	477600	and private sector companies that have not presented any level of security and assurance
478080	483940	that their processes and systems have integrity and are confidential.
488250	501330	So we have a U.S. Election Assistance Commission. And this commission is supposed to,
501330	506450	but it's perhaps the weakest link in the nation's voting system.
506450	514690	The EAC is a bipartisan commission established by Congress in 2002. It maintains a national
514690	522310	mail voter registration form. It accredits testing laboratories and certifies voting systems.
522310	527810	And it serves as a national clearinghouse of information on election administration.
528810	536040	In December 2016, Recorded Future reported that a Russian-speaking hacker named Rasputin
536470	550370	was selling access to the EAC systems on the internet. Rasputin had full admin access to
550370	556890	the database and could upload any file he wanted. He had lists of voting machinery,
556890	563890	test reports of their software, and knew where they were deployed. An EAC employee,
563890	570150	whose credentials had been compromised, said if Rasputin had access to the database,
570150	574310	he could access the server where the proprietary information is kept.
575150	582410	The EAC keeps information about vulnerabilities in voting systems. Thus, a hacker who gets into
582410	590010	the EAC could find out where the weak links are in the voting systems all around the country.
599200	605500	So let's look at the voting machine companies and what role they have played in this.
606320	615540	They have been recalcitrant and arrogant. Researchers and cyber experts have found
615540	621700	multiple vulnerabilities in the most used voting machines that would enable an attacker
621700	626800	to gain full access to a system, change configurations, and install a modified
626800	635120	operating system without election officials knowing. These vulnerabilities can enable
635120	642300	hackers to change an election, shut the system down, enable remote execution of code,
642300	649520	and offline ballot tampering. There are three primary vendors for voting machines.
649560	657560	Electronic systems and software, known as ES&S, Dominion Voting Systems, and Hart InterCivic.
658140	662560	We know there are vulnerabilities in most of the voting machines,
663060	670600	but very little is known about the security of these companies' own IT systems.
671200	678700	The companies that produce these voting machines, that are supposed to maintain them and produce
678700	686340	them, and they are the underpinning of the core in our election process. Very little is known
686340	693320	about the security of the companies that even manufacture these machines. Some voting machines
693320	701020	are optical scanners, some have touchscreen voting, some use QR codes or barcodes,
701020	707700	and others send votes in clear text back to vendors to be tallied. They can all be hacked
707700	716460	or compromised. If almost all the voting precincts in our clunky system use equipment from these
716460	722100	vendors, an attacker only needs to hack the equipment to reach all of the voters.
723320	731040	Unlike major technology companies, such as Apple and Microsoft, these vendors do not allow
731040	738660	researchers to test their equipment and review their code to find vulnerabilities and bugs.
738720	745700	The symbiotic relationship between tech software and hardware vendors and researchers helps them
745700	750200	improve their products and keep them secure. But this is not happening
750860	759460	when it comes to voting machine manufacturers. They will not let the researchers have access
759460	766660	to their equipment. Voting equipment companies have been highly resistant to any review by the
766660	773680	research community, claiming their systems are safe and secure. Yet they have failed to fix
773680	781500	identified vulnerabilities in the voting equipment. They repeatedly claim everything
781500	787500	is fine, we're all secure, this is a priority, we take this seriously, America's voting is just
787500	795660	our basic concern, and they don't fix vulnerabilities that researchers have found
795660	805900	for 15 years. They let their voting machines be out front and used for voting knowing they
805900	811640	have vulnerabilities in them. I guess they think no one's going to exploit them.
812060	818480	But really, to cover that up and try to say they're all safe and sound, that's just wrong.
821310	826150	So during the three years of the voting village's existence, I think most of you are familiar with
826150	832150	voting village, none of the vendors have supported the effort, nor have they been willing
832150	842850	to donate or offer equipment. While the researchers in the voting village, they're dedicated to this
842850	849830	because one, they want to help develop a community of cybersecurity experts in election security.
849830	854770	There are not very many experts out there who know how to
855610	861430	deal with election voting machines and cybersecurity problems and how to solve
861430	868290	those vulnerabilities. And they also want to make the voting machines and equipment more
868290	877210	secure by letting these vulnerabilities be known. The problem is the vendors are doing nothing about
877210	886430	it. And apparently the election officials also are not requiring them to fix these vulnerabilities
886430	895690	before they have another election. So that's a big problem. So I want to put forth a proposal
896470	903030	to address this problem and achieve results. Certain actions can be taken at the federal level
903700	908310	that will push a standardized approach out to state and local election officials
909220	917670	and will require certain actions to be taken by private sector companies.
919170	926490	Article 1, section 4 of the U.S. Constitution grants Congress the power to regulate the times,
926490	934470	places, and manner of holding federal elections. Federal elections deal with elections of senators,
934470	941030	representatives, and the president. Now state and local election officials are responsible for
941030	947590	conducting all elections, but they depend on infusions of federal funding to supplement
947590	954530	their state and local funding. So state and local officials can't really afford to have
954530	959570	separate equipment and systems, one for state elections and one for federal elections.
959630	966830	So when federal election officials or federal election Congress mandates certain requirements
966830	972490	for federal elections, they pretty much have to go along with those because they only have one
972490	980770	system for voting. So therefore, if Congress sets requirements for federal elections
981270	986930	and restricts the funding that these state and local election officials need
987630	995630	to only those election agencies that adhere to federal requirements, we will begin to see
995630	1004430	consistent actions taken across the U.S. that will tighten cybersecurity in the election process.
1005610	1016330	So this proposal that I want to go over with you today is such a proposal to have
1017650	1025310	federal requirements set by Congress. The first would be to direct NIST, the National Institute
1025310	1034210	of Standards and Technology, to establish federal standards for cybersecurity. NIST is
1034510	1040170	the entity in the government that has established all the federal information processing standards.
1040170	1046370	It's established all of the cybersecurity best practices and standards that have been put forth
1046370	1054750	by NIST that federal agencies have to adhere to and certain federal contractors. So they have a
1054750	1062810	deep bench of expertise in not only standards and cybersecurity but in secure engineering practices.
1063200	1070090	And it would be appropriate to direct them to develop federal standards for cybersecurity of
1070090	1079710	our election system software, the infrastructure, and the hardware. All three levels that are used
1079710	1089010	in voter registration, vote tallying, voter polling, and in the manufacturing, servicing,
1089010	1093250	or writing of election parameters of voting machines and equipment.
1095530	1102070	The first covers the systems, the infrastructure, the hardware, the software, the hardware,
1102070	1108010	the network that they're using. What are the standards for that? Because that is used in
1108010	1114590	registration, in tallying, in voter polling. Again, this isn't just one thing of one machine
1114590	1120670	and go to the vote, the poll and vote. This is registering to vote. It's signing in and being
1120670	1129130	ID'd. It is voting. It's tallying the votes. It's polling the votes, the voters, and it's reporting
1129130	1137810	the votes. All of these actions are largely performed by private sector companies who we
1137810	1145610	don't have any idea how their cybersecurity program is, whether it's mature or not.
1146230	1152930	We suspect it's not very mature, but that's just a suspicion. But we should have a standard for
1152930	1158630	saying it must meet these standards. Our democracy depends on it. That's worth a standard.
1159730	1165250	And then we have in the manufacturing, the servicing of voting machines and equipment.
1165250	1172010	Absolutely. We want these vulnerabilities fixed. They need to be serviced and maintained and have
1172010	1177350	integrity. The writing of election parameters means the programming of these machines.
1177350	1184450	In most of the jurisdictions, the private sector companies program these machines for
1184450	1191510	every single election. We need standards to govern how that's done. Second is we should
1191510	1199770	direct NIST to establish a certification process for the security and integrity of election systems,
1199770	1205930	software, infrastructure, and hardware, and associated components and modules of the election
1205930	1213230	process. So there should be a certification process to make sure they're meeting the standards.
1213610	1219190	Next, we should direct NIST to analyze the private sector's role in the election process
1219630	1225370	and recommend any roles or functions that should be changed or restricted to public sector
1225370	1233190	election officials. There are some roles being undertaken by private sector companies that
1233190	1242990	perhaps should not be a private sector activity. Perhaps that role should be strictly a governmental
1242990	1250650	function. But let's NIST analyze that in all of their work in establishing the federal standards
1250650	1258850	in the certification process and recommend to Congress roles that should be perhaps reserved
1258850	1268950	to the public sector. Next, we want Congress to pass a law restricting federal funding
1269910	1275170	to election jurisdictions to only those jurisdictions that one
1275830	1282570	use such funding in a manner consistent with the NIST federal election standards.
1283150	1289890	And those jurisdictions that require annual cybersecurity assessments by an independent
1289890	1295910	third party of all the systems in the election process in accordance with the standards
1297450	1304390	that require annual cybersecurity assessments by a third party of all private sector companies
1304390	1309870	involved in the election process in accordance with the NIST standards. And to make these
1309870	1315670	assessments available to election officials contracting with them. A company may get a
1315670	1322590	cybersecurity assessment but it may not share it. We want them, we want these vendors to have to get
1322590	1331050	third-party assessments every year and share those assessments with the election officials
1331050	1336230	contracting with them. And we want the election officials to get third-party assessments of
1336230	1344170	their systems in accordance with the NIST standards. This is what private businesses do
1345010	1349450	every day. That's what's required of them. This is not asking too much
1350110	1353950	of election officials or private sector vendors that support the democracy that
1353950	1360910	this country has been built on. We also want federal funding restricted to those jurisdictions
1360910	1367510	that establish requirements for post-election auditing of votes, at least on the level of
1367510	1375190	risk-limiting audits and to make the findings public. So restricting federal funding to only
1375190	1380750	those jurisdictions that comply with the NIST standards, that conduct the risk assessments
1380750	1386930	themselves, that make their vendors get the assessments, and that have post-election auditing.
1386970	1395390	There's a precedent for this. Congress has passed laws in the past to restrict highway funds
1395390	1400230	to only those jurisdictions that lower the speed limit to 55 miles an hour.
1401190	1408170	Congress has restricted funds to only go to those school districts that would adjust their
1408170	1416360	cafeteria menus to comply with the new recommended federal menu. There are numerous other examples,
1417050	1425470	but the Congress has in the past, in several instances, tied its federal funding to meeting
1425470	1432130	certain requirements. There's nothing more important than having our federal funding tied
1432130	1438610	to meeting the requirements that our vote counts, that every vote should be counted and it should
1438610	1447370	be counted as cast. The American Bar Association, which represents over 400,000 attorneys, recently
1447370	1457850	adopted Resolution 118, which calls for these exact measures. Cybersecurity best practices and
1457850	1463850	standards can help, because election security is not going to get solved overnight. But standing
1463850	1471370	up a cybersecurity program for election systems that's in compliance with cybersecurity best
1471370	1478710	practices and standards will be a first big step. Congress may not pass a law right away,
1478710	1484750	but election officials should already be doing this. They should already be saying,
1484750	1490150	we have NIST standards for cybersecurity programs. There are ISO standards. There's
1490150	1494990	multiple standards out there for cybersecurity programs, and every single vendor should be
1494990	1500190	adhering to those. They're not only using equipment with vulnerabilities, their own
1500190	1506370	networks and systems are vulnerable as well. So it's time election officials step up and take
1506370	1513070	action, even before Congress does. They should require, election officials should require election
1513070	1518630	vendors to meet cybersecurity standards and best practices, conduct annual risk assessments of
1518630	1525610	their program's maturity, and do what every other business would do, manage its risk.
1525610	1530810	In addition, they need to follow the lead of California and other jurisdictions and hire
1530810	1536650	experts to test the security of their voting machines and equipment, and then demand that
1536650	1543990	vendors close any vulnerabilities found. Why are these officials letting machines with vulnerabilities
1543990	1550550	that have been known for 15 years be used in their jurisdictions? That's crazy. They need to demand
1550550	1557330	these vulnerabilities be fixed, and they need to join with each other nationally and ensure that
1557330	1564410	that those machines are not used in elections. So legislation and other reforms are needed, but
1564410	1569850	election officials can achieve these things through their own direction and in legal agreements with
1569850	1576700	their election vendors, and they should begin now and do as much as possible before November.
1577560	1579120	Thank you very much.