start	end	text
2540	8700	Hello, I'm Secretary of State Kim Wyman from Washington State. And I want to first say thank
8700	15460	you for inviting me to be part of DEF CON 2020 and share a little bit about Washington's
15460	21440	experience with vote by mail and the challenges that we have with election security and how we've
21440	27100	tried to overcome them and how we're preparing for the upcoming August primary and November
27100	34940	general elections here in Washington State. So I'm going to real quick share my screen and
35820	43760	walk you through kind of what Washington State has done to prepare for the 2020 election cycle
43760	51460	and how we are dealing with all of the things that are coming at us in 2020. So first and foremost,
51460	57160	I'm pretty certain each one of you has been very aware of Russians trying to hack into
57160	65200	the election system in the 2016 elections. And I've been an election official for many years
65200	69540	and have watched this kind of progression that we've had in the election community
69540	76540	for election security. And in the 1990s, we instituted cutting-edge technology like
77040	83460	using the driver's license information to register voters and put election night results online.
83480	87900	And from that moment to today, election security has been something we've been aware of
87900	93020	and have worked really hard to try to make sure our systems are secure. And I think
93020	99520	right up until 2016, most election officials felt pretty good about the level of security that we
99520	107380	had in our industry. And today what I want to do is share with you kind of what Washington
107380	114160	State's election system looks like, how we inspire public confidence in our process, and what our
114160	119920	kind of triad of election security is, and then talk a little bit about the impacts of COVID-19
119920	128380	on our election system and quite frankly the nation's election system. So I got into election
128380	134600	administration in the 1990s, early 1990s, and I can tell you when I started in this field, my goal
134600	140440	was to become an elections expert, to learn and understand how the election process works, and to
140440	148580	be able to conduct elections in a secure and accessible manner. And then the 2000s, that
148580	154800	evolved because suddenly the demands on our system were so great that we had to rely on technology
154800	161120	to be able to produce election results quickly and to serve our voters well by providing a lot
161120	167060	of information on the internet. So we now suddenly not only had to become an elections expert, but
167060	172880	also had to be an IT expert and understand at least how systems work and how to use technology
172880	179580	in a way to help us oversee our election systems. And about the time I started feeling like I knew
179580	186400	what I was doing in the IT world, and I say that because I'm just dangerous enough to know
186400	193080	how to use technology, but certainly not to any of the levels that any of you are. But by 2016, it
193080	199740	became very apparent that not only did we need to be election experts and understand IT systems, but
199740	205120	we needed to know how to secure them. And cybersecurity for the last four years has certainly been front
205120	211780	and center in election administration. So let me start kind of with the basics of why
211780	220360	I think the United States election system is very secure just because of the decentralized
220360	226720	nature of it. So when people think of elections, I think oftentimes they think of the national,
226720	231020	that there's some sort of national election administration, when in fact it's a really
231020	237280	decentralized network made up of 10,000 election officials nationwide who, like me, are either
237280	245360	appointed or are elected to office. They take an oath to uphold the Constitution and the Constitution
245360	250560	and laws in their state. And I think the overall strength of this system is that no single person
250560	259720	or group has total control of the overall operation. And so when you get down to election
259720	266060	systems in each individual state, and bear with me here, I'm having a challenge operating my own
266060	271340	PowerPoint system, you have the same similar threads. We have a decentralized system here in
271340	277820	Washington, and each state is going to be different and unique. And Washington is certainly one of
277820	284980	five vote-by-mail states, but I think you can look at the individual makeup of each state and know
284980	291560	that this decentralization is actually happening within the states as well. So here in Washington,
291560	298840	we have the Secretary of State, myself, my office is the overseer of elections in Washington,
298840	305900	and I'm the chief election officer. I have the rulemaking authority to put into effect rules
305900	312980	that adapt our laws that our legislature passes. So this is how counties implement the day-to-day
312980	318860	operations on the ground. We manage a statewide voter registration database and oversee the
318860	325640	election initiative and referendum process, as well as do election night reporting, we do voter
325640	331680	outreach and education, and we certify and train our election officials, as well as the election
331680	338480	tabulation systems that are used in each of our 39 counties. Our system is decentralized in that
338480	344240	39 county election officials are the chief election officials in their county, and they
344240	350700	are elected. They oversee the voter registration processing and the management of elections in their
350700	356060	counties. So they're the ones who are actually issuing ballots and operating the tabulation
356060	362940	systems and any kind of other tech like ballot sorting equipment or the actual facilities that
362940	369640	process ballots. They also provide voter outreach and education to their voters and manage all of
369640	375980	that information usually through social media and their web pages. Now I imagine most of you are
375980	383200	aware that in 2016 the federal government designated elections as critical infrastructure,
383200	389620	and this is significant because it put us on the same national security level as the power grid
389620	396840	or the banking system. And so what it has done in our state is really helped us reinforce what
396840	402600	I like to think of as our triad of security for Washington and our vote-by-mail system.
402600	408920	I forgot to mention that earlier. In 2011, Washington state became a vote-by-mail state,
408920	415820	and at that point every single one of our counties had to conduct elections entirely by mail
415820	421940	and mail out a ballot to each of their voters. So this process didn't happen overnight. We
422460	428780	really started back in the 1990s in allowing any voter to be a permanent absentee voter,
428780	435980	which meant they received a ballot every election. And that evolved to the early 2000s when we had
435980	441000	the closest governor's race in the country's history. And following that and following a lot
441000	447800	things that went wrong, both at the polling place and in the absentee balloting, we determined that
447800	453540	we couldn't do both elections well, and the legislature allowed counties to move to vote-by-
453540	460280	mail voluntarily. In 2005, many of the counties in the state did move to vote-by-mail, but it still
460280	465360	took our state five years to completely become a vote-by-mail state. And that's because it took
465360	472120	time to get the equipment and facilities to really provide for processes and procedures
472120	478120	that we could conduct elections well. So, which is what leads us to the triad of security for
478120	484160	Washington vote-by-mail elections. So there's three real pieces to this election model.
484160	490160	It's the physical security, the logical security, things you would just do innately, and the digital
490160	496440	security that we provide. So let me start by just talking through kind of the physical security
496440	501860	elements that are inherent in a vote-by-mail election. First and foremost, I think the strength
501860	509560	is that we rely on paper ballots. Even the ballots that are issued in a vote center and voters use
509560	515640	to use an assistive device to vote them, all of those ballots are paper ballots that
515640	522700	are printed by those machines that the voter actually does mark and are processed. So we can
522700	529540	always go back to those paper ballots and do a risk limiting audit or a full recount if we need to,
529540	536060	to really inspire that confidence that voters need to have in the election results. We have
536060	542020	ballot drop boxes here in Washington state in addition to the blue mailboxes provided by the
542020	548240	USPS. These ballot drop boxes are throughout the state and they're managed by our county election
548240	555700	officials. We have about 470 of them statewide, and they open at the beginning of the voting
555700	561980	period, which is 20 days before election day. Anytime they are emptied, they are emptied by two
561980	569700	employees of the county, and I know that sometimes they try to have that be a Democrat and a
569700	575040	possible, but they are staff that are employed by the county and
575040	581120	take an oath to uphold the laws and the procedures and policies for the county. So they are held
581120	586940	accountable for that processing. They lock and seal those boxes, and they do that
586940	593100	with individual numbered seals that are actually logged and kept track of too. So pretty
593100	599100	much all of the steps I'm going to talk about are what we use to build an electronic and physical
599100	604640	audit trail that we have in place in case we ever get into a recount or a situation where
604640	612120	anyone is calling into question our processes. We can go back and show which employees had access
612120	618400	to which ballots at any given time, and we have dual control environments throughout this. So
618400	623720	it's just really important that those audit logs and dual controls are in place to inspire
623720	629640	confidence again. This is true throughout all of our election processing facilities as well.
629640	635720	We have secured storage for ballots and ballot materials that involve physical locks. In some
635720	641400	of our counties, it may be key card access. The server room, for example, for ballot
641400	648640	tabulation equipment is in a secured room and has very limited access and, again, is log or key card
648640	654540	controlled. So we have a record of anyone who has access to it. And then we have security systems
654540	660580	and key card access throughout these facilities as well to just have that physical layer of security
660580	667600	on top of any cybersecurity elements that we have in place. The second, I guess, group of security
667600	673560	measures are those sort of logical ones, things that just make sense. Of course, the first one
673560	678600	would be that our tabulation systems aren't connected to the internet. And I know this is
678600	684520	something that came under fire in the last few years nationally, but our county election officials
684520	691480	have made sure that their tabulation systems not only are air-gapped from the internet in every way,
691480	696940	but there's no modems operating or even installed in those systems and that any connection that
696940	702820	needs to be made with the vendor or with election officials is done on-site in that air-gapped
702820	710640	environment. We have a real love of transparency in elections, and certainly that holds true
710640	717660	in any processing facilities or courthouses across our state, that all of the activities are
717660	724340	observable. We like it when it's bipartisan, when we have Democrats and Republicans overseeing that
724340	731180	process. We actually ask the local county parties to appoint observers to come in and represent
731180	736900	each of the parties. If that can't happen, and of course in the COVID-19 environment, that's
736900	744360	becoming a bit of a problem for just space reasons. Our county courthouses oftentimes do not have a
744360	750200	lot of extra space in the smaller counties, so a lot of counties have used their security money
750200	756080	to install cameras that run 24-7 during the voting period, during that entire 20 days,
756080	760640	and then the 20 days or so after when we're certifying the election, so that people can
760640	766940	watch it online from a safety and comfort environment, but also have that transparency,
766940	773120	so you can show that we're not trying to hide anything or do anything kind of under the table.
774180	780520	Ballot reconciliation is a really important part as well. This would be, you know, counting the
780520	785220	number of ballots that are received each day in the mail, and then through the process,
785220	790300	reconciling them and being able to show whether a ballot was counted that was issued to a voter
790300	795620	or not, and if it wasn't counted, why it wasn't. And the only people that can reject a ballot
795620	803900	are our bipartisan canvassing boards. We also have election night reporting, and we have fail-safe
803900	809960	measures and checks and balances that my CISO told me to say is out-of-band communication
809960	817200	verification. And what we do on election night is counties are uploading their results to our
817800	825200	state election night reporting system, and we compile those results for offices that go across
825200	831420	county lines. And we take that initial file that they send us, and then we verify it by
831980	837300	a fax or an email that is sent by the county as well, separately, to just make sure that the
837300	841380	information that we're putting up online is accurate and is the way that the counties
841940	847980	reported it in the first place. So all of these systems, you know, this logical element of our
847980	856300	election security is really just trying to create that sense of transparency and provide a lot of
856300	862690	checks and balances, both physical and electronic, that make sense and are easy to explain to the
862690	868590	voters so that they can understand what it is we're doing. Of course, the final leg of that
869730	876330	stool would be the digital security. And for us, we really started working on this
876330	882350	probably five, ten years ago by modernizing our election system. And now we have a highly
882350	888290	segmented network system that employs multi-factor authentication for all of our users.
888290	897830	We have really tried to increase and expand our user training and outreach to just make them aware
897830	904250	of cybersecurity issues and the things that they need to do to make sure our overall system is
904250	911370	secure. And we've done robust testing, and that happens on an ongoing basis. And as all of you
911370	916290	are aware, you know, it's a constant battle to stay ahead of hackers and people trying to get
916290	922510	into our system. So I think just that user awareness has increased in the last four years
922510	929630	on a level and a scale that we just weren't doing before 2016. We're currently part of the National
929630	935690	Censor Network, and this is not only the state system, but counties across the state are part
935690	943070	of it as well. And we built and have created a dedicated election security operation center that
943070	949710	is in my office, but it also supports the 39 county election offices, because what we found
949710	955090	is that many of the smaller and medium-sized counties are lucky if they have an IT professional
955090	960930	for their entire county, let alone in their elections division and let alone a cybersecurity
960930	966070	expert. So this partnership has also helped us have good communication and training with those
966070	970430	election officials and do assessments in their counties that help them strengthen their system
970430	976010	as well. We also played an active role in the critical infrastructure buildout of the election
976010	983930	sector. So these are all kind of the key parts of our system, and I think that critical infrastructure
983930	992650	designation also allowed us to create partnerships with our own state CISO and CIO, but also our
992650	998130	Washington National Guard, who is a very strong cybersecurity team, and they've come in and done
998130	1004270	assessments and monitor our system and give us feedback and ways to improve our system. They've
1004270	1011190	also helped us do tabletop exercises and trainings for our users, which, again, just continues to
1011190	1016910	raise the awareness level and preparedness level of our election officials. We've worked with them
1016910	1022730	also to build out our continuity of operation plans, which have obviously a digital component
1022730	1029950	to in the security of our system, but also how are we going to not only detect and defend our system
1029950	1034910	or protect and defend our system, but how are we going to detect an intrusion and recover and
1034910	1041150	respond in case that does happen. We've also worked with the State Auditor's Office, Department of
1041150	1048430	Homeland Security, and the FBI with similar threads to those activities. So we've been focusing on all
1048430	1055650	of this for the last four years pretty intently. And as if that wasn't enough, in the early
1055650	1061150	part of this year, we had to throw in a global pandemic because, you know, why not? So Washington
1061150	1066890	was in the middle of our presidential primary when COVID-19 began to spike and we started having the
1066890	1074150	first deaths in the country, actually, for COVID-19. And it did affect and impact our March 10th
1074150	1080090	presidential primary. We were on track to have turnout of about 60% and the weekend right before
1080090	1085530	election day was when COVID really started spiking and the governor started to issue stay-at-home
1085530	1091810	orders. So we ended up with a turnout of 49%. And I think we're running about the third highest in
1091810	1096010	the country for presidential primary turnout. And a lot of that has to do with vote by mail
1096010	1101050	because our voters were still able to drop ballots off and didn't have to go into a polling place
1101050	1107250	or vote center on election day. We've seen, of course, across the country, presidential primaries
1107250	1114210	canceled or postponed. There has been incredible interest nationally on vote by mail and I've given
1114210	1121440	many, many talks and been on panels and talked to media about our experience here in Washington.
1121890	1128110	And what I can tell you is that our state is, well, we're implementing a primary right now.
1128110	1134510	Our regular primary is on August 4th, so we'll be in the middle of... we're right in the middle
1134510	1139090	of processing ballots for that election and certifying it. And, of course, we're gearing
1139090	1144390	up for the general election. And my colleagues across the country are doing the same in their
1144390	1150050	states, trying to expand absentee voting or vote by mail as best they can because Congress hasn't
1150050	1157050	allocated money. And as if that wasn't enough, you know, the USPS is in financial distress and
1157050	1163090	Congress has just allocated an additional 10 billion dollars of potential loans. So we're
1163090	1170490	hoping that they remain stable between now and November. I think they're going to, but the USPS
1170490	1175870	is a critical element for elections this year across the country because so many elections
1175870	1183330	offices are expanding voting by mail. To give you kind of perspective of how significant this is,
1183330	1188670	if you look at this map, the states in blue are the states that at the end of 2019 were already
1188670	1196030	vote by mail, including Washington, Oregon, Utah, Colorado, and Hawaii. As you can see,
1196030	1201410	as you move east in the country, fewer and fewer states either are vote by mail or even have
1201410	1208130	access to absentee voting. And so the grayer or the whiter the states as you move east,
1208130	1212970	those are going to be the states that have the hardest time moving to expanded absentee usage
1212970	1218690	and vote by mail because they don't have the systems in place, high speed ballot sorters,
1218690	1224510	envelope openers, even just the physical space to socially distance and process those ballots
1224510	1229210	as efficiently as we can here in Washington or the other four states that do vote by mail
1229210	1235310	elections. So we're trying to help those states gear up and they're working very hard to expand
1235310	1241490	that capacity and capability. And I think you're going to see a hybrid model across the country,
1241490	1247610	including my state here in Washington, of voting at home and voting in person,
1247610	1252510	because even here in Washington, one to two percent of our voters will vote in person.
1252610	1258450	So it's going to be a heavy lift, but election officials are working hard to make sure it's
1258450	1264150	going to happen. And in that environment, of course, we introduce the politics and
1264770	1269090	it's bipartisan. I like to talk about these things in terms of bipartisanship, but we have
1269090	1275710	Republicans on the right, certainly the president and Senator McConnell and some of their associates
1275710	1280910	who are concerned about voter fraud. And on the left, we have members of Congress,
1280910	1286310	like Senator Wyden and Senator Klobuchar, who are really trying to expand vote by mail access
1286310	1293030	and voting at home. And unfortunately, out of the White House and Department of Justice,
1293030	1299070	we're hearing about voter fraud on a level that is implying, and he's point blank said,
1299070	1306130	that there's going to be rampant fraud and vote rigging. And this is the environment that election
1306130	1312170	officials are operating in and trying to inspire confidence in. And so I say that because we're
1312170	1317430	seeing success stories already in the primaries that have been held in the last month or so.
1317430	1323610	I think Kentucky is a great example of the innovation that that election officials are
1323610	1331530	trying to bring to the COVID environment and make voting a safe experience. So you can see in these
1331530	1336630	pictures, these are things that happened on election day in Kentucky. We had a huge
1336630	1342090	shortage as we have seen across the country of election workers because many of our election
1342090	1347690	workers are senior citizens who are the highest risk for COVID-19. So they have walked a lot
1347690	1357230	just making these megaphone centers. And I think this was right in Washington. I believe it's
1357230	1362630	where these pictures are. And they made massive phone centers where people could come and social
1362630	1369170	distance and see their dogs. And they were able to process those dogs well. The other thing of
1369170	1374510	course is, as I was talking about, is election officials in our state who are in all offices
1374510	1382930	throughout the state that are secured, that are serviced daily by the USPS mailboxes. So
1383530	1387090	you know, what we're really trying to do, I think, here in Washington, I know we're doing
1387090	1391130	here in Washington state, I think what we're trying to do across the country is provide
1391130	1395910	voters options and make sure that those are secure options that they can believe in
1395910	1402850	and try to inspire confidence in the elections. And so I'll leave you with the biggest thing
1402850	1407610	that I'm concerned with, with all of your hearts in shattered about voter suppression,
1407610	1413310	if we don't have universal vote by mail or voter fraud, if we don't have complete poll site voting,
1413830	1418990	is really dealing with the misinformation and disinformation that are out there,
1419870	1425450	not only from the president or from members of Congress or whoever, but you know,
1425450	1431670	foreign actors like Russia. We have a national movement or a national movement, national
1431670	1439530	hashtag trustedinfo2020. And what we're really trying to do is drive voters to trusted sources
1439530	1445610	like secretaries of state offices or county election departments or local election departments
1445610	1451030	that are going to provide info that you can believe in and know is true. And, you know,
1451030	1455650	different jurisdictions have different other hashtags and taglines like ours is the vote
1455650	1461490	starts with you and really trying to empower voters to know where to go to get information
1461490	1474450	on social media and online. So that is my point and I hope that that gives you a good overview
1474450	1479330	of some of the security measures and practices we've implemented here in Washington state.
1479330	1486030	I'm sorry that we can't be together in person, but I guess I want to leave you all with a word
1486030	1492390	of thanks for all of the work that you're doing to try to help find the vulnerabilities in election
1492390	1499710	cybersecurity and giving us feedback so we can make the system better. I think as I look back
1499810	1506930	a few years ago to a few early DEFCON voting villages where, you know, we all pointed out
1506930	1512350	some green hand truths and I think that it was difficult for election officials like myself to
1512350	1518670	hear and our immediate reaction was to push back and say you're wrong. And what I love about DEFCON
1518670	1526290	now and what I understand more is that we need to work together and we need to help us find
1526290	1531270	those vulnerabilities and give us tips on how we can better secure our election system because
1531270	1536350	at the end of all of this, no matter where we are on the political spectrum, no matter what
1536350	1542110	job we have in this process, we need to inspire confidence in the public that our elections are
1542110	1549110	accessible and secure and that the election results are fair and accurate. And we look forward to
1549110	1555830	working with you in the future. I hope in 2021 that you'll invite me back to DEFCON and we can
1555830	1562090	have these conversations in person, but feel free to reach out to me at the Secretary of State's
1562090	1568750	office and I'm here in Baltimore. My email address, because this is so unfashionable to
1568750	1581590	misscript, is Kim.Wyman, that's K-I-M dot W-Y-M-A-N, M-A-N at S-O-S dot WA.gov, S-O-S dot W-A dot G-O-V.
1581590	1584870	So thank you so much for giving me time at the conference. I hope you
1584870	1591390	have a great conference remotely and we hopefully can be all together next year. So take care.