WEBVTT 00:02.540 --> 00:06.500 Hello, I'm Secretary of State Kim Wyman from Washington State. 00:06.500 --> 00:29.700 And I want to first say thank you for inviting me to be part of DEF CON 2020 and share a little bit about Washington's experience with vote by mail and the challenges that we have with election security and how we've tried to overcome them and how we're preparing for the upcoming August primary and November general elections here in Washington State. 00:29.700 --> 00:49.360 So I'm going to real quick share my screen and walk you through kind of what Washington State has done to prepare for the 2020 election cycle and how we are dealing with all of the things that are coming at us in 2020. 00:49.720 --> 01:00.700 So first and foremost, I'm pretty certain each one of you has been very aware of Russians trying to hack into the election system in the 2016 elections. 01:00.700 --> 01:11.600 And I've been an election official for many years and have watched this kind of progression that we've had in the election community for election security. 01:11.600 --> 01:23.460 And in the 1990s, we instituted cutting-edge technology like using the driver's license information to register voters and put election night results online. 01:23.480 --> 01:32.500 And from that moment to today, election security has been something we've been aware of and have worked really hard to try to make sure our systems are secure. 01:32.500 --> 01:42.160 And I think right up until 2016, most election officials felt pretty good about the level of security that we had in our industry. 01:43.160 --> 02:05.480 And today what I want to do is share with you kind of what Washington State's election system looks like, how we inspire public confidence in our process, and what our kind of triad of election security is, and then talk a little bit about the impacts of COVID-19 on our election system and quite frankly the nation's election system. 02:06.060 --> 02:26.420 So I got into election administration in the 1990s, early 1990s, and I can tell you when I started in this field, my goal was to become an elections expert, to learn and understand how the election process works, and to be able to conduct elections in a secure and accessible manner. 02:26.460 --> 02:43.460 And then the 2000s, that evolved because suddenly the demands on our system were so great that we had to rely on technology to be able to produce election results quickly and to serve our voters well by providing a lot of information on the internet. 02:43.460 --> 02:56.920 So we now suddenly not only had to become an elections expert, but also had to be an IT expert and understand at least how systems work and how to use technology in a way to help us oversee our election systems. 02:57.140 --> 03:11.740 And about the time I started feeling like I knew what I was doing in the IT world, and I say that because I'm just dangerous enough to know how to use technology, but certainly not to any of the levels that any of you are. 03:11.740 --> 03:21.760 But by 2016, it became very apparent that not only did we need to be election experts and understand IT systems, but we needed to know how to secure them. 03:21.760 --> 03:27.960 And cybersecurity for the last four years has certainly been front and center in election administration. 03:27.960 --> 03:41.520 So let me start kind of with the basics of why I think the United States election system is very secure just because of the decentralized nature of it. 03:41.520 --> 03:56.840 So when people think of elections, I think oftentimes they think of the national, that there's some sort of national election administration, when in fact it's a really decentralized network made up of 10,000 election officials nationwide who, like me, 03:56.840 --> 04:01.400 are either appointed or are elected to office. 04:01.640 --> 04:06.980 They take an oath to uphold the Constitution and the Constitution and laws in their state. 04:06.980 --> 04:14.920 And I think the overall strength of this system is that no single person or group has total control of the overall operation. 04:16.280 --> 04:29.540 And so when you get down to election systems in each individual state, and bear with me here, I'm having a challenge operating my own PowerPoint system, you have the same similar threads. 04:29.540 --> 04:35.520 We have a decentralized system here in Washington, and each state is going to be different and unique. 04:35.740 --> 04:50.080 And Washington is certainly one of five vote-by-mail states, but I think you can look at the individual makeup of each state and know that this decentralization is actually happening within the states as well. 04:50.080 --> 05:00.880 So here in Washington, we have the Secretary of State, myself, my office is the overseer of elections in Washington, and I'm the chief election officer. 05:00.880 --> 05:09.360 I have the rulemaking authority to put into effect rules that adapt our laws that our legislature passes. 05:09.360 --> 05:14.880 So this is how counties implement the day-to-day operations on the ground. 05:14.880 --> 05:35.880 We manage a statewide voter registration database and oversee the election initiative and referendum process, as well as do election night reporting, we do voter outreach and education, and we certify and train our election officials, as well as the election tabulation systems that are used in each of our 39 counties. 05:35.940 --> 05:45.760 Our system is decentralized in that 39 county election officials are the chief election officials in their county, and they are elected. 05:45.760 --> 05:51.100 They oversee the voter registration processing and the management of elections in their counties. 05:51.100 --> 06:04.700 So they're the ones who are actually issuing ballots and operating the tabulation systems and any kind of other tech like ballot sorting equipment or the actual facilities that process ballots. 06:04.700 --> 06:13.740 They also provide voter outreach and education to their voters and manage all of that information usually through social media and their web pages. 06:13.760 --> 06:31.180 Now I imagine most of you are aware that in 2016 the federal government designated elections as critical infrastructure, and this is significant because it put us on the same national security level as the power grid or the banking system. 06:31.180 --> 06:42.600 And so what it has done in our state is really helped us reinforce what I like to think of as our triad of security for Washington and our vote-by-mail system. 06:42.600 --> 06:44.580 I forgot to mention that earlier. 06:44.580 --> 06:58.560 In 2011, Washington state became a vote-by-mail state, and at that point every single one of our counties had to conduct elections entirely by mail and mail out a ballot to each of their voters. 06:58.560 --> 07:01.560 So this process didn't happen overnight. 07:01.560 --> 07:11.680 We really started back in the 1990s in allowing any voter to be a permanent absentee voter, which meant they received a ballot every election. 07:11.720 --> 07:19.060 And that evolved to the early 2000s when we had the closest governor's race in the country's history. 07:19.060 --> 07:34.700 And following that and following a lot things that went wrong, both at the polling place and in the absentee balloting, we determined that we couldn't do both elections well, and the legislature allowed counties to move to vote-by- mail voluntarily. 07:34.960 --> 07:44.280 In 2005, many of the counties in the state did move to vote-by-mail, but it still took our state five years to completely become a vote-by-mail state. 07:44.280 --> 07:54.020 And that's because it took time to get the equipment and facilities to really provide for processes and procedures that we could conduct elections well. 07:54.020 --> 07:59.760 So, which is what leads us to the triad of security for Washington vote-by-mail elections. 07:59.760 --> 08:04.160 So there's three real pieces to this election model. 08:04.160 --> 08:12.100 It's the physical security, the logical security, things you would just do innately, and the digital security that we provide. 08:12.100 --> 08:20.000 So let me start by just talking through kind of the physical security elements that are inherent in a vote-by-mail election. 08:20.000 --> 08:25.200 First and foremost, I think the strength is that we rely on paper ballots. 08:25.200 --> 08:41.840 Even the ballots that are issued in a vote center and voters use to use an assistive device to vote them, all of those ballots are paper ballots that are printed by those machines that the voter actually does mark and are processed. 08:41.840 --> 08:55.220 So we can always go back to those paper ballots and do a risk limiting audit or a full recount if we need to, to really inspire that confidence that voters need to have in the election results. 08:55.220 --> 09:02.860 We have ballot drop boxes here in Washington state in addition to the blue mailboxes provided by the USPS. 09:02.940 --> 09:09.380 These ballot drop boxes are throughout the state and they're managed by our county election officials. 09:09.500 --> 09:18.780 We have about 470 of them statewide, and they open at the beginning of the voting period, which is 20 days before election day. 09:18.780 --> 09:40.340 Anytime they are emptied, they are emptied by two employees of the county, and I know that sometimes they try to have that be a Democrat and a possible, but they are staff that are employed by the county and take an oath to uphold the laws and the procedures and policies for the county. 09:40.340 --> 09:43.380 So they are held accountable for that processing. 09:43.380 --> 09:52.260 They lock and seal those boxes, and they do that with individual numbered seals that are actually logged and kept track of too. 09:52.260 --> 10:07.560 So pretty much all of the steps I'm going to talk about are what we use to build an electronic and physical audit trail that we have in place in case we ever get into a recount or a situation where anyone is calling into question our processes. 10:07.560 --> 10:18.200 We can go back and show which employees had access to which ballots at any given time, and we have dual control environments throughout this. 10:18.200 --> 10:25.240 So it's just really important that those audit logs and dual controls are in place to inspire confidence again. 10:25.240 --> 10:29.640 This is true throughout all of our election processing facilities as well. 10:29.640 --> 10:35.400 We have secured storage for ballots and ballot materials that involve physical locks. 10:35.400 --> 10:38.520 In some of our counties, it may be key card access. 10:39.060 --> 10:49.440 The server room, for example, for ballot tabulation equipment is in a secured room and has very limited access and, again, is log or key card controlled. 10:49.440 --> 10:52.620 So we have a record of anyone who has access to it. 10:52.620 --> 11:04.560 And then we have security systems and key card access throughout these facilities as well to just have that physical layer of security on top of any cybersecurity elements that we have in place. 11:04.700 --> 11:12.420 The second, I guess, group of security measures are those sort of logical ones, things that just make sense. 11:12.420 --> 11:17.320 Of course, the first one would be that our tabulation systems aren't connected to the internet. 11:17.320 --> 11:44.000 And I know this is something that came under fire in the last few years nationally, but our county election officials have made sure that their tabulation systems not only are air-gapped from the internet in every way, but there's no modems operating or even installed in those systems and that any connection that needs to be made with the vendor or with election officials is done on-site in that air-gapped environment. 11:44.040 --> 11:59.200 We have a real love of transparency in elections, and certainly that holds true in any processing facilities or courthouses across our state, that all of the activities are observable. 11:59.380 --> 12:05.300 We like it when it's bipartisan, when we have Democrats and Republicans overseeing that process. 12:05.300 --> 12:13.180 We actually ask the local county parties to appoint observers to come in and represent each of the parties. 12:13.180 --> 12:21.420 If that can't happen, and of course in the COVID-19 environment, that's becoming a bit of a problem for just space reasons. 12:21.420 --> 12:39.760 Our county courthouses oftentimes do not have a lot of extra space in the smaller counties, so a lot of counties have used their security money to install cameras that run 24-7 during the voting period, during that entire 20 days, and then the 20 days or so after when we're certifying the election, 12:39.760 --> 12:53.120 so that people can watch it online from a safety and comfort environment, but also have that transparency, so you can show that we're not trying to hide anything or do anything kind of under the table. 12:54.180 --> 12:57.520 Ballot reconciliation is a really important part as well. 12:57.760 --> 13:12.560 This would be, you know, counting the number of ballots that are received each day in the mail, and then through the process, reconciling them and being able to show whether a ballot was counted that was issued to a voter or not, and if it wasn't counted, 13:12.560 --> 13:13.480 why it wasn't. 13:13.480 --> 13:18.820 And the only people that can reject a ballot are our bipartisan canvassing boards. 13:19.020 --> 13:30.960 We also have election night reporting, and we have fail-safe measures and checks and balances that my CISO told me to say is out-of-band communication verification. 13:31.180 --> 13:46.580 And what we do on election night is counties are uploading their results to our state election night reporting system, and we compile those results for offices that go across county lines. 13:46.580 --> 14:03.760 And we take that initial file that they send us, and then we verify it by a fax or an email that is sent by the county as well, separately, to just make sure that the information that we're putting up online is accurate and is the way that the counties reported it in the first place. 14:03.760 --> 14:26.590 So all of these systems, you know, this logical element of our election security is really just trying to create that sense of transparency and provide a lot of checks and balances, both physical and electronic, that make sense and are easy to explain to the voters so that they can understand what it is we're doing. 14:26.750 --> 14:32.610 Of course, the final leg of that stool would be the digital security. 14:32.610 --> 14:40.990 And for us, we really started working on this probably five, ten years ago by modernizing our election system. 14:40.990 --> 14:48.290 And now we have a highly segmented network system that employs multi-factor authentication for all of our users. 14:48.290 --> 15:04.970 We have really tried to increase and expand our user training and outreach to just make them aware of cybersecurity issues and the things that they need to do to make sure our overall system is secure. 15:04.970 --> 15:09.770 And we've done robust testing, and that happens on an ongoing basis. 15:09.770 --> 15:17.210 And as all of you are aware, you know, it's a constant battle to stay ahead of hackers and people trying to get into our system. 15:17.210 --> 15:27.370 So I think just that user awareness has increased in the last four years on a level and a scale that we just weren't doing before 2016. 15:27.650 --> 15:36.830 We're currently part of the National Censor Network, and this is not only the state system, but counties across the state are part of it as well. 15:36.830 --> 15:56.770 And we built and have created a dedicated election security operation center that is in my office, but it also supports the 39 county election offices, because what we found is that many of the smaller and medium-sized counties are lucky if they have an IT professional for their entire county, 15:56.770 --> 16:01.730 let alone in their elections division and let alone a cybersecurity expert. 16:01.730 --> 16:11.410 So this partnership has also helped us have good communication and training with those election officials and do assessments in their counties that help them strengthen their system as well. 16:11.410 --> 16:16.770 We also played an active role in the critical infrastructure buildout of the election sector. 16:16.770 --> 16:37.030 So these are all kind of the key parts of our system, and I think that critical infrastructure designation also allowed us to create partnerships with our own state CISO and CIO, but also our Washington National Guard, who is a very strong cybersecurity team, 16:37.030 --> 16:44.050 and they've come in and done assessments and monitor our system and give us feedback and ways to improve our system. 16:44.050 --> 16:56.030 They've also helped us do tabletop exercises and trainings for our users, which, again, just continues to raise the awareness level and preparedness level of our election officials. 16:56.030 --> 17:11.690 We've worked with them also to build out our continuity of operation plans, which have obviously a digital component to in the security of our system, but also how are we going to not only detect and defend our system or protect and defend our system, 17:11.690 --> 17:17.670 but how are we going to detect an intrusion and recover and respond in case that does happen. 17:17.950 --> 17:26.710 We've also worked with the State Auditor's Office, Department of Homeland Security, and the FBI with similar threads to those activities. 17:26.710 --> 17:31.750 So we've been focusing on all of this for the last four years pretty intently. 17:31.750 --> 17:39.690 And as if that wasn't enough, in the early part of this year, we had to throw in a global pandemic because, you know, why not? 17:40.130 --> 17:50.470 So Washington was in the middle of our presidential primary when COVID-19 began to spike and we started having the first deaths in the country, actually, for COVID-19. 17:50.470 --> 17:55.470 And it did affect and impact our March 10th presidential primary. 17:55.570 --> 18:06.110 We were on track to have turnout of about 60% and the weekend right before election day was when COVID really started spiking and the governor started to issue stay-at-home orders. 18:06.110 --> 18:08.990 So we ended up with a turnout of 49%. 18:08.990 --> 18:14.090 And I think we're running about the third highest in the country for presidential primary turnout. 18:14.090 --> 18:23.750 And a lot of that has to do with vote by mail because our voters were still able to drop ballots off and didn't have to go into a polling place or vote center on election day. 18:23.890 --> 18:28.930 We've seen, of course, across the country, presidential primaries canceled or postponed. 18:29.030 --> 18:41.440 There has been incredible interest nationally on vote by mail and I've given many, many talks and been on panels and talked to media about our experience here in Washington. 18:41.890 --> 18:48.110 And what I can tell you is that our state is, well, we're implementing a primary right now. 18:48.110 --> 18:58.110 Our regular primary is on August 4th, so we'll be in the middle of... we're right in the middle of processing ballots for that election and certifying it. 18:58.110 --> 19:00.910 And, of course, we're gearing up for the general election. 19:00.910 --> 19:11.490 And my colleagues across the country are doing the same in their states, trying to expand absentee voting or vote by mail as best they can because Congress hasn't allocated money. 19:11.850 --> 19:22.670 And as if that wasn't enough, you know, the USPS is in financial distress and Congress has just allocated an additional 10 billion dollars of potential loans. 19:22.670 --> 19:27.490 So we're hoping that they remain stable between now and November. 19:27.490 --> 19:39.930 I think they're going to, but the USPS is a critical element for elections this year across the country because so many elections offices are expanding voting by mail. 19:39.930 --> 19:54.710 To give you kind of perspective of how significant this is, if you look at this map, the states in blue are the states that at the end of 2019 were already vote by mail, including Washington, Oregon, Utah, Colorado, and Hawaii. 19:55.050 --> 20:03.530 As you can see, as you move east in the country, fewer and fewer states either are vote by mail or even have access to absentee voting. 20:03.530 --> 20:20.470 And so the grayer or the whiter the states as you move east, those are going to be the states that have the hardest time moving to expanded absentee usage and vote by mail because they don't have the systems in place, high speed ballot sorters, envelope openers, 20:20.470 --> 20:29.910 even just the physical space to socially distance and process those ballots as efficiently as we can here in Washington or the other four states that do vote by mail elections. 20:29.910 --> 20:37.230 So we're trying to help those states gear up and they're working very hard to expand that capacity and capability. 20:37.230 --> 20:52.510 And I think you're going to see a hybrid model across the country, including my state here in Washington, of voting at home and voting in person, because even here in Washington, one to two percent of our voters will vote in person. 20:52.610 --> 20:59.510 So it's going to be a heavy lift, but election officials are working hard to make sure it's going to happen. 20:59.730 --> 21:05.670 And in that environment, of course, we introduce the politics and it's bipartisan. 21:05.670 --> 21:17.730 I like to talk about these things in terms of bipartisanship, but we have Republicans on the right, certainly the president and Senator McConnell and some of their associates who are concerned about voter fraud. 21:17.730 --> 21:28.750 And on the left, we have members of Congress, like Senator Wyden and Senator Klobuchar, who are really trying to expand vote by mail access and voting at home. 21:29.210 --> 21:43.490 And unfortunately, out of the White House and Department of Justice, we're hearing about voter fraud on a level that is implying, and he's point blank said, that there's going to be rampant fraud and vote rigging. 21:43.490 --> 21:50.030 And this is the environment that election officials are operating in and trying to inspire confidence in. 21:50.030 --> 21:57.430 And so I say that because we're seeing success stories already in the primaries that have been held in the last month or so. 21:57.430 --> 22:07.830 I think Kentucky is a great example of the innovation that that election officials are trying to bring to the COVID environment and make voting a safe experience. 22:09.030 --> 22:15.290 So you can see in these pictures, these are things that happened on election day in Kentucky. 22:15.470 --> 22:26.550 We had a huge shortage as we have seen across the country of election workers because many of our election workers are senior citizens who are the highest risk for COVID-19. 22:26.550 --> 22:30.130 So they have walked a lot just making these megaphone centers. 22:30.130 --> 22:35.670 And I think this was right in Washington. 22:36.850 --> 22:38.830 I believe it's where these pictures are. 22:38.830 --> 22:44.770 And they made massive phone centers where people could come and social distance and see their dogs. 22:44.770 --> 22:48.210 And they were able to process those dogs well. 22:48.410 --> 23:02.930 The other thing of course is, as I was talking about, is election officials in our state who are in all offices throughout the state that are secured, that are serviced daily by the USPS mailboxes. 23:02.930 --> 23:20.290 So you know, what we're really trying to do, I think, here in Washington, I know we're doing here in Washington state, I think what we're trying to do across the country is provide voters options and make sure that those are secure options that they can believe in and try to inspire confidence in the elections. 23:20.290 --> 23:38.990 And so I'll leave you with the biggest thing that I'm concerned with, with all of your hearts in shattered about voter suppression, if we don't have universal vote by mail or voter fraud, if we don't have complete poll site voting, is really dealing with the misinformation and disinformation that are out there, 23:39.870 --> 23:47.350 not only from the president or from members of Congress or whoever, but you know, foreign actors like Russia. 23:47.350 --> 23:54.790 We have a national movement or a national movement, national hashtag trustedinfo2020. 23:55.110 --> 24:10.010 And what we're really trying to do is drive voters to trusted sources like secretaries of state offices or county election departments or local election departments that are going to provide info that you can believe in and know is true. 24:10.010 --> 24:25.310 And, you know, different jurisdictions have different other hashtags and taglines like ours is the vote starts with you and really trying to empower voters to know where to go to get information on social media and online. 24:25.310 --> 24:39.330 So that is my point and I hope that that gives you a good overview of some of the security measures and practices we've implemented here in Washington state. 24:39.330 --> 24:57.770 I'm sorry that we can't be together in person, but I guess I want to leave you all with a word of thanks for all of the work that you're doing to try to help find the vulnerabilities in election cybersecurity and giving us feedback so we can make the system better. 24:57.770 --> 25:17.010 I think as I look back a few years ago to a few early DEFCON voting villages where, you know, we all pointed out some green hand truths and I think that it was difficult for election officials like myself to hear and our immediate reaction was to push back and say you're wrong. 25:17.010 --> 25:35.810 And what I love about DEFCON now and what I understand more is that we need to work together and we need to help us find those vulnerabilities and give us tips on how we can better secure our election system because at the end of all of this, no matter where we are on the political spectrum, 25:35.810 --> 25:47.110 no matter what job we have in this process, we need to inspire confidence in the public that our elections are accessible and secure and that the election results are fair and accurate. 25:47.110 --> 25:50.650 And we look forward to working with you in the future. 25:50.650 --> 26:04.750 I hope in 2021 that you'll invite me back to DEFCON and we can have these conversations in person, but feel free to reach out to me at the Secretary of State's office and I'm here in Baltimore. 26:04.970 --> 26:21.590 My email address, because this is so unfashionable to misscript, is Kim.Wyman, that's K-I-M dot W-Y-M-A-N, M-A-N at S-O-S dot WA.gov, S-O-S dot W-A dot G-O-V. 26:21.590 --> 26:24.430 So thank you so much for giving me time at the conference. 26:24.430 --> 26:30.530 I hope you have a great conference remotely and we hopefully can be all together next year. 26:30.530 --> 26:31.390 So take care.