WEBVTT 00:08.280 --> 00:10.980 Hello, it's nice to be here. 00:10.980 --> 00:13.700 Thank you for joining this session. 00:13.700 --> 00:21.040 I'd like to talk today about a policy approach to resolving cyber security problems in the election process. 00:21.240 --> 00:33.020 One thing's for sure, after the coronavirus is no longer dominating the news, election security will come back to center stage, big time. 00:33.280 --> 00:41.000 It's not a complicated subject that it is a complicated subject that few people really understand, even election officials. 00:41.940 --> 00:55.240 So today, I want to talk about the role that private sector companies play in the voting system, the vulnerabilities associated with their role, and discuss a path forward from the legal and policy perspective. 01:02.400 --> 01:08.320 So election security, it's really a private sector problem. 01:09.170 --> 01:19.340 Election security, so many aspects of it are performed by private sector companies. 01:19.340 --> 01:35.260 There are many avenues for tampering with an election, including changing votes, causing machines to malfunction, altering voter registration records, and disrupting equipment to be used that's used to check in voters. 01:35.960 --> 01:43.680 The private sector companies play a large role in these activities, which we call the election process. 01:43.680 --> 01:53.480 The voter registration, the checking in, the voting, the polling, the tabulating of the votes, all that is called the election process. 01:54.320 --> 02:02.560 And the private sector companies sell the voting machines and program them for most elections. 02:02.560 --> 02:07.960 Yes, they program them for each individual election in most jurisdictions. 02:07.960 --> 02:13.400 They register voters, they tally votes, and they report votes. 02:13.400 --> 02:19.680 And there are vulnerabilities associated with their role that most people don't understand. 02:20.220 --> 02:27.240 They think that this is all something controlled by state and local election officials, and it is not. 02:27.260 --> 02:36.600 So today I want to talk about a path forward and how to solve this huge complicated problem. 02:38.090 --> 02:55.620 There are many avenues for tampering with an election, including changing votes, causing machines to malfunction, altering voter registration records, and disrupting equipment used to check in voters. 02:57.140 --> 03:01.080 Let's look at the vulnerabilities in the voting equipment. 03:01.360 --> 03:16.160 In 2005, Hari Hirstie performed the famous Hirstie hack and successfully altered votes in a one-step hack that changed both central tabulator results and the voting machine results tape. 03:16.160 --> 03:20.360 It was the digital equipment of stuffing the ballot box. 03:20.440 --> 03:33.580 The election official who invited Hirstie to check the de-bolt acu-vote optical scan voting machines said he wouldn't have been able to detect the change and would have certified the election. 03:34.280 --> 03:37.680 De-bolt is now owned by Dominion Voting Systems. 03:38.300 --> 03:42.760 None of the vulnerabilities found by Hirstie were ever fixed. 03:42.880 --> 03:49.480 And these same machines are planned for use in 20 states in the 2020 election. 03:50.240 --> 03:51.660 Think about that. 03:51.660 --> 03:57.160 It's 2020 and he discovered this in 2005, 15 years later. 03:57.160 --> 03:58.660 That's crazy. 03:58.920 --> 04:10.940 A later model of the same voting machines with the same vulnerabilities was used in a hotly contested and disputed 2016 election between Stacey Abrams and Brian Kemp in Georgia. 04:12.420 --> 04:20.320 So many of these systems that are using these machines are using machines with these vulnerabilities. 04:20.680 --> 04:24.940 In recent elections, 99 percent of votes in the U.S. 04:24.940 --> 04:27.940 were cast or counted on computers. 04:28.320 --> 04:44.240 And many of the core election systems, voter registration databases, election management systems, voting machines, and vote counting systems are using aged computer equipment. 04:44.240 --> 04:49.260 The systems employ software that can no longer be updated or patched. 04:49.260 --> 04:58.540 They include databases that have known vulnerabilities and they're managed by third-party vendors where supply chain risks exist. 04:58.580 --> 05:01.280 This is a big problem. 05:06.560 --> 05:11.540 Let's look at the cyber attacks on these private vendors. 05:12.360 --> 05:20.140 In 2016, Gresha's military intelligence service penetrated VR systems. 05:20.420 --> 05:33.340 VR systems is the vendor that manages and handles all of the programming for the majority of the counties of Florida and it handles all absentee ballots and early voting. 05:34.300 --> 05:48.400 We know of this penetration because an NSA contractor, Reality Winner, released a top-secret report about it. 05:48.540 --> 05:57.220 And we later found out the FBI briefed election officials in Florida on a very secret basis. 05:57.360 --> 06:13.800 It was a year later that election officials around the country realized that Gresha's military intelligence service had been penetrating VR systems and that perhaps their systems might also be vulnerable. 06:14.500 --> 06:22.960 In the 2016 elections, electronic voter ID systems in several states went down in certain precincts. 06:22.960 --> 06:27.160 Now these are the systems that help identify a voter when they come in to vote. 06:27.680 --> 06:38.380 And these technical glitches, they called them, in the machines called hours-long waits for people who had come to the polls to vote. 06:38.520 --> 06:40.900 Hours-long waits. 06:41.040 --> 06:51.140 Some voters were unable to wait and others could not vote before the polls closed. 06:52.020 --> 07:14.760 On election day in 2019, federal officials from law enforcement, homeland security, and the intelligence community issued a joint statement declaring that, our adversaries want to undermine our democratic institutions, influence public sentiment, and affect government policies. 07:14.860 --> 07:26.680 Russia, China, Iran, and other foreign malicious actors all will seek to interfere in the voting process or influence voter perceptions. 07:29.080 --> 07:30.120 Wow. 07:30.360 --> 07:32.620 And it's true. 07:32.800 --> 07:35.780 We have a serious problem. 07:35.780 --> 07:39.160 We have governments from outside the U.S. 07:40.000 --> 07:43.760 trying to influence our democratic processes. 07:43.760 --> 08:03.940 And we have voting machines and voter ID systems and private sector companies that have not presented any level of security and assurance that their processes and systems have integrity and are confidential. 08:08.250 --> 08:10.830 So we have a U.S. 08:10.830 --> 08:13.410 Election Assistance Commission. 08:13.410 --> 08:26.450 And this commission is supposed to, but it's perhaps the weakest link in the nation's voting system. 08:26.450 --> 08:32.750 The EAC is a bipartisan commission established by Congress in 2002. 08:32.750 --> 08:37.310 It maintains a national mail voter registration form. 08:37.310 --> 08:42.310 It accredits testing laboratories and certifies voting systems. 08:42.310 --> 08:47.810 And it serves as a national clearinghouse of information on election administration. 08:48.810 --> 09:05.730 In December 2016, Recorded Future reported that a Russian-speaking hacker named Rasputin was selling access to the EAC systems on the internet. 09:07.650 --> 09:14.490 Rasputin had full admin access to the database and could upload any file he wanted. 09:14.490 --> 09:21.150 He had lists of voting machinery, test reports of their software, and knew where they were deployed. 09:22.190 --> 09:34.310 An EAC employee, whose credentials had been compromised, said if Rasputin had access to the database, he could access the server where the proprietary information is kept. 09:35.150 --> 09:40.050 The EAC keeps information about vulnerabilities in voting systems. 09:40.770 --> 09:50.010 Thus, a hacker who gets into the EAC could find out where the weak links are in the voting systems all around the country. 09:59.200 --> 10:05.500 So let's look at the voting machine companies and what role they have played in this. 10:06.320 --> 10:11.340 They have been recalcitrant and arrogant. 10:12.320 --> 10:31.680 Researchers and cyber experts have found multiple vulnerabilities in the most used voting machines that would enable an attacker to gain full access to a system, change configurations, and install a modified operating system without election officials knowing. 10:32.460 --> 10:44.980 These vulnerabilities can enable hackers to change an election, shut the system down, enable remote execution of code, and offline ballot tampering. 10:45.180 --> 10:49.520 There are three primary vendors for voting machines. 10:49.560 --> 10:57.560 Electronic systems and software, known as ES&S, Dominion Voting Systems, and Hart InterCivic. 10:58.140 --> 11:10.600 We know there are vulnerabilities in most of the voting machines, but very little is known about the security of these companies' own IT systems. 11:11.200 --> 11:24.960 The companies that produce these voting machines, that are supposed to maintain them and produce them, and they are the underpinning of the core in our election process. 11:24.960 --> 11:31.520 Very little is known about the security of the companies that even manufacture these machines. 11:31.760 --> 11:45.960 Some voting machines are optical scanners, some have touchscreen voting, some use QR codes or barcodes, and others send votes in clear text back to vendors to be tallied. 11:45.960 --> 11:49.340 They can all be hacked or compromised. 11:49.500 --> 12:02.100 If almost all the voting precincts in our clunky system use equipment from these vendors, an attacker only needs to hack the equipment to reach all of the voters. 12:03.320 --> 12:18.660 Unlike major technology companies, such as Apple and Microsoft, these vendors do not allow researchers to test their equipment and review their code to find vulnerabilities and bugs. 12:18.720 --> 12:28.500 The symbiotic relationship between tech software and hardware vendors and researchers helps them improve their products and keep them secure. 12:28.500 --> 12:35.680 But this is not happening when it comes to voting machine manufacturers. 12:35.680 --> 12:41.440 They will not let the researchers have access to their equipment. 12:41.940 --> 12:51.280 Voting equipment companies have been highly resistant to any review by the research community, claiming their systems are safe and secure. 12:51.340 --> 12:57.600 Yet they have failed to fix identified vulnerabilities in the voting equipment. 12:58.300 --> 13:19.160 They repeatedly claim everything is fine, we're all secure, this is a priority, we take this seriously, America's voting is just our basic concern, and they don't fix vulnerabilities that researchers have found for 15 years. 13:19.400 --> 13:27.720 They let their voting machines be out front and used for voting knowing they have vulnerabilities in them. 13:27.720 --> 13:31.640 I guess they think no one's going to exploit them. 13:32.060 --> 13:38.480 But really, to cover that up and try to say they're all safe and sound, that's just wrong. 13:41.310 --> 13:55.370 So during the three years of the voting village's existence, I think most of you are familiar with voting village, none of the vendors have supported the effort, nor have they been willing to donate or offer equipment. 13:56.490 --> 14:09.830 While the researchers in the voting village, they're dedicated to this because one, they want to help develop a community of cybersecurity experts in election security. 14:09.830 --> 14:22.990 There are not very many experts out there who know how to deal with election voting machines and cybersecurity problems and how to solve those vulnerabilities. 14:23.070 --> 14:31.910 And they also want to make the voting machines and equipment more secure by letting these vulnerabilities be known. 14:32.110 --> 14:38.150 The problem is the vendors are doing nothing about it. 14:38.730 --> 14:48.230 And apparently the election officials also are not requiring them to fix these vulnerabilities before they have another election. 14:49.130 --> 14:51.530 So that's a big problem. 14:53.130 --> 14:59.710 So I want to put forth a proposal to address this problem and achieve results. 15:00.050 --> 15:17.670 Certain actions can be taken at the federal level that will push a standardized approach out to state and local election officials and will require certain actions to be taken by private sector companies. 15:19.170 --> 15:22.290 Article 1, section 4 of the U.S. 15:22.290 --> 15:31.110 Constitution grants Congress the power to regulate the times, places, and manner of holding federal elections. 15:31.370 --> 15:36.670 Federal elections deal with elections of senators, representatives, and the president. 15:37.910 --> 15:49.830 Now state and local election officials are responsible for conducting all elections, but they depend on infusions of federal funding to supplement their state and local funding. 15:51.350 --> 15:59.570 So state and local officials can't really afford to have separate equipment and systems, one for state elections and one for federal elections. 15:59.630 --> 16:14.090 So when federal election officials or federal election Congress mandates certain requirements for federal elections, they pretty much have to go along with those because they only have one system for voting. 16:14.890 --> 16:39.610 So therefore, if Congress sets requirements for federal elections and restricts the funding that these state and local election officials need to only those election agencies that adhere to federal requirements, we will begin to see consistent actions taken across the U.S. 16:39.610 --> 16:44.430 that will tighten cybersecurity in the election process. 16:45.610 --> 17:01.410 So this proposal that I want to go over with you today is such a proposal to have federal requirements set by Congress. 17:01.410 --> 17:12.110 The first would be to direct NIST, the National Institute of Standards and Technology, to establish federal standards for cybersecurity. 17:13.250 --> 17:20.170 NIST is the entity in the government that has established all the federal information processing standards. 17:20.170 --> 17:32.890 It's established all of the cybersecurity best practices and standards that have been put forth by NIST that federal agencies have to adhere to and certain federal contractors. 17:33.030 --> 17:42.810 So they have a deep bench of expertise in not only standards and cybersecurity but in secure engineering practices. 17:43.200 --> 17:55.490 And it would be appropriate to direct them to develop federal standards for cybersecurity of our election system software, the infrastructure, and the hardware. 17:55.490 --> 18:13.250 All three levels that are used in voter registration, vote tallying, voter polling, and in the manufacturing, servicing, or writing of election parameters of voting machines and equipment. 18:15.530 --> 18:23.790 The first covers the systems, the infrastructure, the hardware, the software, the hardware, the network that they're using. 18:23.790 --> 18:25.670 What are the standards for that? 18:26.230 --> 18:31.510 Because that is used in registration, in tallying, in voter polling. 18:31.510 --> 18:37.090 Again, this isn't just one thing of one machine and go to the vote, the poll and vote. 18:37.090 --> 18:39.150 This is registering to vote. 18:39.150 --> 18:41.650 It's signing in and being ID'd. 18:41.650 --> 18:42.930 It is voting. 18:42.930 --> 18:45.070 It's tallying the votes. 18:45.070 --> 18:50.250 It's polling the votes, the voters, and it's reporting the votes. 18:50.250 --> 19:05.610 All of these actions are largely performed by private sector companies who we don't have any idea how their cybersecurity program is, whether it's mature or not. 19:06.230 --> 19:11.310 We suspect it's not very mature, but that's just a suspicion. 19:11.310 --> 19:15.150 But we should have a standard for saying it must meet these standards. 19:15.290 --> 19:17.210 Our democracy depends on it. 19:17.210 --> 19:18.630 That's worth a standard. 19:19.730 --> 19:25.250 And then we have in the manufacturing, the servicing of voting machines and equipment. 19:25.250 --> 19:26.490 Absolutely. 19:26.590 --> 19:29.130 We want these vulnerabilities fixed. 19:29.130 --> 19:33.110 They need to be serviced and maintained and have integrity. 19:33.110 --> 19:37.350 The writing of election parameters means the programming of these machines. 19:37.350 --> 19:45.970 In most of the jurisdictions, the private sector companies program these machines for every single election. 19:45.970 --> 19:49.630 We need standards to govern how that's done. 19:50.270 --> 20:06.910 Second is we should direct NIST to establish a certification process for the security and integrity of election systems, software, infrastructure, and hardware, and associated components and modules of the election process. 20:06.910 --> 20:13.230 So there should be a certification process to make sure they're meeting the standards. 20:13.610 --> 20:27.430 Next, we should direct NIST to analyze the private sector's role in the election process and recommend any roles or functions that should be changed or restricted to public sector election officials. 20:27.710 --> 20:39.190 There are some roles being undertaken by private sector companies that perhaps should not be a private sector activity. 20:39.190 --> 20:44.170 Perhaps that role should be strictly a governmental function. 20:44.170 --> 21:01.450 But let's NIST analyze that in all of their work in establishing the federal standards in the certification process and recommend to Congress roles that should be perhaps reserved to the public sector. 21:02.030 --> 21:22.570 Next, we want Congress to pass a law restricting federal funding to election jurisdictions to only those jurisdictions that one use such funding in a manner consistent with the NIST federal election standards. 21:23.150 --> 21:48.590 And those jurisdictions that require annual cybersecurity assessments by an independent third party of all the systems in the election process in accordance with the standards that require annual cybersecurity assessments by a third party of all private sector companies involved in the election process in accordance with the NIST standards. 21:48.630 --> 21:53.590 And to make these assessments available to election officials contracting with them. 21:54.010 --> 21:58.170 A company may get a cybersecurity assessment but it may not share it. 21:58.170 --> 22:12.350 We want them, we want these vendors to have to get third-party assessments every year and share those assessments with the election officials contracting with them. 22:12.350 --> 22:20.370 And we want the election officials to get third-party assessments of their systems in accordance with the NIST standards. 22:21.670 --> 22:26.050 This is what private businesses do every day. 22:26.050 --> 22:27.670 That's what's required of them. 22:27.670 --> 22:36.070 This is not asking too much of election officials or private sector vendors that support the democracy that this country has been built on. 22:36.890 --> 22:50.830 We also want federal funding restricted to those jurisdictions that establish requirements for post-election auditing of votes, at least on the level of risk-limiting audits and to make the findings public. 22:52.190 --> 23:06.930 So restricting federal funding to only those jurisdictions that comply with the NIST standards, that conduct the risk assessments themselves, that make their vendors get the assessments, and that have post-election auditing. 23:06.970 --> 23:09.830 There's a precedent for this. 23:10.210 --> 23:20.230 Congress has passed laws in the past to restrict highway funds to only those jurisdictions that lower the speed limit to 55 miles an hour. 23:21.190 --> 23:33.950 Congress has restricted funds to only go to those school districts that would adjust their cafeteria menus to comply with the new recommended federal menu. 23:34.050 --> 23:47.530 There are numerous other examples, but the Congress has in the past, in several instances, tied its federal funding to meeting certain requirements. 23:47.650 --> 24:00.790 There's nothing more important than having our federal funding tied to meeting the requirements that our vote counts, that every vote should be counted and it should be counted as cast. 24:00.850 --> 24:14.630 The American Bar Association, which represents over 400,000 attorneys, recently adopted Resolution 118, which calls for these exact measures. 24:15.910 --> 24:23.190 Cybersecurity best practices and standards can help, because election security is not going to get solved overnight. 24:23.210 --> 24:35.530 But standing up a cybersecurity program for election systems that's in compliance with cybersecurity best practices and standards will be a first big step. 24:35.530 --> 24:42.610 Congress may not pass a law right away, but election officials should already be doing this. 24:42.610 --> 24:48.530 They should already be saying, we have NIST standards for cybersecurity programs. 24:48.530 --> 24:49.970 There are ISO standards. 24:49.970 --> 24:56.630 There's multiple standards out there for cybersecurity programs, and every single vendor should be adhering to those. 24:56.850 --> 25:02.450 They're not only using equipment with vulnerabilities, their own networks and systems are vulnerable as well. 25:02.450 --> 25:10.170 So it's time election officials step up and take action, even before Congress does. 25:10.210 --> 25:25.610 They should require, election officials should require election vendors to meet cybersecurity standards and best practices, conduct annual risk assessments of their program's maturity, and do what every other business would do, manage its risk. 25:25.610 --> 25:39.490 In addition, they need to follow the lead of California and other jurisdictions and hire experts to test the security of their voting machines and equipment, and then demand that vendors close any vulnerabilities found. 25:39.490 --> 25:47.410 Why are these officials letting machines with vulnerabilities that have been known for 15 years be used in their jurisdictions? 25:47.410 --> 25:48.870 That's crazy. 25:48.870 --> 26:01.030 They need to demand these vulnerabilities be fixed, and they need to join with each other nationally and ensure that that those machines are not used in elections. 26:01.230 --> 26:16.700 So legislation and other reforms are needed, but election officials can achieve these things through their own direction and in legal agreements with their election vendors, and they should begin now and do as much as possible before November. 26:17.560 --> 26:19.120 Thank you very much.