Good afternoon, Voting Village. My name is Forrest Senti. I'm the Director of Business
and Government Affairs at the National Cyber Security Center.
And I'm Maddie Gullickson, and I'm the Program Manager for Secure the Vote.
We'd like to thank all of you for having us here today. We're excited to have our presentation
accepted to the Voting Village. We look forward to future years and our work in elections.
So we're with the National Cyber Security Center. We're a 501c3 based out of Colorado Springs,
Colorado. We were founded in 2016, and a lot of our big focus has to do with cyber innovation
and awareness and solving world cyber problems. We work in areas like space, where we actually
have a presentation from one of our fellow colleagues in the Aerospace Village today,
as well as areas like smart city technology like ICS and K-12, so being the future of the cyber
workforce. Our presentation today is about the electronic ballot return standards and guidelines
titled The Future of Voting. I want to start off by talking a little bit about
who we are, what the program is, and kind of how we fit into this whole picture.
I want to start off by acknowledging that Secure the Vote is a nonpartisan, multi-agency,
multi-policy group that kind of goes after a layered challenge. A lot of the different things
out there with groups like EAC, CISA, CIS, the Election Security ISAC, even groups like Verify
Voting, MIT, the Alliance for Securing Democracy, all tackle different aspects of our election
security problem in the U.S. And the combination of all these has led to a brilliant ecosystem in
the United States that allows us for us to be able to publish and listen to and advocate for
different policy standards, guidelines, whether it be at the federal or state and local levels.
And a lot of our focus has primarily been on the ways that we can identify different gaps
in critical infrastructure related to elections. So the first gap that we've really identified,
that we really want to talk about, the reason why we're here again, is all about this gap
where security exists in the conversation of election technology. Security traditionally over
this past, you know, four or five years has become an even heightened level of focus in the world of
election security. So we're not going to say that we're going to become the new experts, but the
biggest thing for us is all about identifying the critical piece of the future of voting technology.
And what it means is that we've identified that security, cybersecurity specifically,
is a barrier to the future of election technology. And what that looks like is that if people with
disabilities, or overseas voters, or even the everyday person who might have an emergency come
up and they can't get to their mail-in ballot or in-person voting, that there's more and more calls,
especially after the pandemic, that people want to do this. But the biggest thing the community
agrees is that security is an issue and is a barrier to the future of where these technologies
can go. And that's why we're interested in the conversation today. A little more background on
us and how we've kind of learned more about this space and why. Our program was started in the
middle of 2018, specifically to work on helping address security issues for overseas voters.
Since then, we've participated in reviewing post-election logs and got feedback from jurisdictions
and 10 pilots involving the use of mobile and online voting between 2019 and 2020.
And like all critics of online and social voting, in every single pilot, we saw the need for
enhancing these technologies. We also saw that there was also increased demand. Of the pilots
we worked in, there was at least two to one, if in some cases three to one, and more demand for
more places to use it. But the number one reason people chose not to is because of security concerns.
So the more we try and understand these technologies and find and understand the different
things that address the gap between where we are today, where we are tomorrow, consistently between
election officials, the security community, and the academic community, we consistently see that
not only are these technologies not going away, but the desire for them is growing.
And to go back to the beginning, security is still a barrier.
And through those pilots, some of the things that we have seen that are part of that core
security problem are critical need for end-to-end verification of votes that maintains the secrecy
of the ballot, critical need for common standards around voter verification procedures and policies.
Again, there's really no federally mandated or even state mandated requirements around these
newer technologies. And so there is a need for common standards around voter information privacy
procedures as well. And also one of the biggest concerns is that vulnerability of the voters'
devices that may have problems on them that could hurt the system and interfere with the vote.
And so we really need to have a system in place and standards in place that these newer technologies
can be held accountable to. We need pre-election reviews and post-election reviews. We need the
same kind of a level of guidelines that are offered through the Voluntary Voting System
Guidelines, the EAC. And that's really where we are working with, we have a working group that
is looking at these different issues. We continue to look at these issues through the pilots.
But ultimately, again, we're really working on these questions because even in 2016, there were
about 3 million overseas voters who were eligible to vote, but only 6.9% of them actually submitted
a ballot, compared to a 72% rate of domestic voters who were eligible to vote. We're doing
this because if disabled voters had had the same access that voters without disabilities had in
the 2018 election, we would have seen a rate increase of about 2.35 million additional
voters participating in the system. Ultimately, we live in the 21st century, and we shouldn't
accept that people living overseas or with disabilities don't vote because they struggle
with access to voting centers or because they lack the privacy to do so. And this slide in
particular just demonstrates that technology is a part of voting, and it is part of our
infrastructure. We have email and fax are already continually used by over 31 states. We have web
portals that are allowing people to return a ballot via a web portal. So the technology exists,
it's moving in that direction. Again, we just believe that there needs to be a common set
of standards and guidelines that can be used to help provide those guardrails as this technology
develops. When we look back at our progress in voting, one of the biggest things, and this drives
home the point that Forrest was making, is we see that most of our legislation around voting has
had to do with undoing policy barriers that have actively kept people from voting.
For the 21st century, what is that going to look like? It's going to look like trying to undo the
barriers of technology and security as the things that prohibit people from voting.
And so as we look to that future, we want to participate with as many people as possible
and collaborate with as many people as possible to figure out what does that future state of
voting look like? What is the timeline going to look like in the next 10 to 30 years of legislation
that we see, of technological advancements that we see? These are some ideas, these are some of
the things that we'd love to see happen. And we understand the concern about these types of
technologies taking place today, but the point is that it isn't going away. And so how do we work
together? How do we come together to figure out how to make these things happen? Because we believe
that with the collective genius of the elections community and of the security community, we can
make end-to-end voter verification a reality. We can make full-scale citizen audits of these
a reality. And so this is what we envision when we see the timeline going forward and what gets
us excited about it. With the different organizations that we've worked with,
blockchain has been one of the ways that people have been able to... one of the technologies that
people have used. Is that the right way? Does it complicate things or does it make it safer?
AWS as the secure cloud service, is that the right way? These are the kinds of
conversations that we need to be having, not just the binary conversation of it shouldn't or it
should. The fact is that it is. And so we have to have that conversation about what this looks
like moving forward. And really, that's the full circle of where we wanted to come to the voting
village, which is really that we want feedback. We know so many of you have thought through these
things and we want to provide that place where you can offer your advice and your feedback on how we
can make these things the safest, the most secure, but ultimately the most accessible.
Because that's the whole point of this thing in the first place. And to get really sentimental
about voting, I mean, it is truly the bedrock of our representative democracy. If we still have
significant barriers to voting, that whole piece, the integrity of that institution in itself
is undermined. And so we want your feedback. And so if you have thoughts,
questions about it even, please email us at securethevote at cyber-center.org.
We also will have an RFI that's going to go live this month for solutions to some of these key
issues like we talked through that are associated with mobile or online voting. So please email
us to receive a notification when that goes live if you've got that next brilliant idea of how you
think you can tackle a piece of this. Excellent. Well, a big thanks again to the Voting Village
for having us. We want to thank you and just reaffirm that this issue is not just a security
community issue. This goes out to all the different election officials, government organizations,
nonprofits, and think tanks out there that are all working on this. Whether you're against it
or for it is a component of this that we'll be driving into the future. And if it's going
to happen, the best thing we can do is make it as secure as possible. So thank you.