1
00:00:00,000 --> 00:00:02,320
So I'm glad to be able to join you all today.

2
00:00:02,320 --> 00:00:03,680
My name is Steve Newell.

3
00:00:03,680 --> 00:00:16,140
I'm from the American Association for the Advancement of Science, which is the world's largest multidisciplinary scientific society, where I'm project director at the Center for Scientific Evidence and Public Issues, usually referred to as the EPI Center.

4
00:00:16,140 --> 00:00:26,540
The EPI Center works to provide accurate, concise, and actionable scientific information to everyone from policymakers to parents to help ensure that science is a part of the decision-making process.

5
00:00:26,640 --> 00:00:30,420
Election security has been one of our major initiatives since founding of the Center.

6
00:00:30,780 --> 00:00:37,460
I'm sure many of you are already familiar with her, but Susan Greenhalgh is currently a senior advisor on election security at Free Speech for People.

7
00:00:37,520 --> 00:00:45,980
She's well known in the election security space for tireless work advocating for secure election protocols, paper ballot voting systems, and post- election audits.

8
00:00:46,380 --> 00:00:52,640
Susan and I are here today to talk about leveraging electronic ballot options safely and securely during the COVID-19 pandemic.

9
00:00:52,680 --> 00:00:58,060
This presentation is based on a white paper with additional detail on these issues that will also be available.

10
00:00:58,060 --> 00:01:07,480
As I'm sure all of you here are well aware, COVID has scrambled existing policies and procedures in every area of the country, and election security is, of course, no exception.

11
00:01:07,660 --> 00:01:13,340
COVID has provided an additional challenge to ensuring election security and ballot access during this critical time.

12
00:01:13,340 --> 00:01:16,260
Currently, five states vote primarily by mail.

13
00:01:16,260 --> 00:01:25,060
However, during the past few months, we've seen states across the country working to scale up their vote-by-mail options and capabilities as we head towards the November elections.

14
00:01:25,060 --> 00:01:29,100
These steps have taken a variety of different forms between states.

15
00:01:29,100 --> 00:01:39,100
For example, an emergency executive order in Delaware includes a measure that allows voters concerned about COVID to qualify as sick or physically disabled, allowing them to vote absentee.

16
00:01:39,100 --> 00:01:52,740
Just to make sure the evidence is known, researchers have found that universal vote-by-mail has no impact on partisan turnout or vote share, so vote-by-mail is really a non-partisan solution to ballot access concerns.

17
00:01:52,840 --> 00:02:04,140
Work by Amber McReynolds and Charles Stewart highlighted 204 cases of absentee ballot-related fraud in a quarter of a billion votes cast over the past two decades.

18
00:02:04,140 --> 00:02:09,740
As is the case across the election space, fraud is exceedingly rare with vote -by-mail.

19
00:02:10,060 --> 00:02:25,060
Alongside this expansion of vote-by-mail, states are examining various solutions for remote voting, such as remote accessible ballot marking, which allows voters to receive and , if necessary, mark their ballots electronically before printing the ballot and returning it to their local office.

20
00:02:25,060 --> 00:02:35,240
UOCAVA was expanded significantly in 2009 when Congress passed the MOVE Act to provide greater protections for service members, their families, and other overseas citizens.

21
00:02:35,360 --> 00:02:45,420
Among other provisions, the MOVE Act requires states to transmit validly requested absentee ballots to UOCAVA voters no later than 45 days before a federal election.

22
00:02:45,420 --> 00:02:53,960
However, remote accessible ballot marking is also essential for individuals with disabilities or those who encounter barriers to marking a paper ballot by hand.

23
00:02:53,960 --> 00:03:08,960
We know that there is still a disability gap in voting, with roughly five percent lower turnout in the 2018 midterm election, equivalent to roughly 2.4 million votes from individuals with disabilities, according to research by the Rutgers School of Management and Labor Relations.

24
00:03:08,960 --> 00:03:14,020
So we know that there's an ongoing equity gap in ballot access, which is essential to address.

25
00:03:14,020 --> 00:03:20,060
Further, electronic ballot delivery can help fill in the gaps for when traditional mail-in voting is either not possible or appropriate.

26
00:03:20,060 --> 00:03:25,180
However, it's important to remember that electronic return of marked ballots is an incredibly risky endeavor.

27
00:03:25,180 --> 00:03:29,960
The National Academy has warned against it in its 2018 Systematic Review of Voting Security.

28
00:03:30,100 --> 00:03:36,020
Also in 2018, our report Susan co-authored with the Common Cause Education Fund, the R Street Institute, and the U.S.

29
00:03:36,020 --> 00:03:42,920
Technology Policy Committee of the Association for Computing Machinery provided additional warnings against internet voting.

30
00:03:42,920 --> 00:04:00,500
In April, from the EPI Center, we sent an open letter to state voting officials signed by more than 70 internet pioneers, scientists, security experts, and voting groups urging those officials not to allow electronic return of marked ballots due to the scientific evidence demonstrating these votes cannot be secured.

31
00:04:00,500 --> 00:04:10,060
Importantly, there is no way to conduct a valid audit of the results due to the lack of meaningful voter-verified paper records for electronically returned marked ballots.

32
00:04:10,100 --> 00:04:17,760
In May, the Department of Homeland Security, the Federal Bureau of Investigation, the National Institute of Standards and Technology, and the U.S.

33
00:04:17,760 --> 00:04:21,960
Election Assistance Commission shared similar guidance echoing these concerns.

34
00:04:22,040 --> 00:04:26,180
Even with the tools and applications available, this activity is still high risk.

35
00:04:26,180 --> 00:04:31,600
To be clear to the state, there's still no known technology that can secure electronic ballot return.

36
00:04:31,600 --> 00:04:34,720
So with that background, this brings us to remote ballot marking.

37
00:04:34,720 --> 00:04:42,400
Specifically, what factors should election officials keep in mind about these systems, particularly in terms of safeguarding voters' privacy and security?

38
00:04:42,400 --> 00:04:46,460
At this point, I'll go ahead and hand things off to Susan to tell you a little more about these systems.

39
00:04:47,760 --> 00:04:49,000
Thank you, Steve.

40
00:04:49,100 --> 00:05:05,240
And I just have to say it's great to be presenting here at DEFCON, but it's certainly bittersweet to not be able to be in Las Vegas with everybody and at the Voting Village and seeing all the great work firsthand.

41
00:05:05,240 --> 00:05:17,340
So I'm really pleased to be able to present what Steve and I have worked on together with this paper and the findings, even though it's unfortunate that we're not actually there in person.

42
00:05:17,340 --> 00:05:25,420
And I just want to preface this by saying that this paper is really geared towards all the election officials that are participating more and more in DEFCON.

43
00:05:25,680 --> 00:05:38,560
We're trying to highlight some of the known security and privacy risks of these systems and how election officials can become aware of them and then make choices to mitigate those risks.

44
00:05:38,560 --> 00:06:01,060
So back into the presentation, as we're seeing these states expand their vote-by-mail options, it's really important that there also be an option for disabled voters to mark a ballot privately and independently if they're choosing vote-by-mail and that they have assistive technology if they need it.

45
00:06:01,520 --> 00:06:15,740
So what we're seeing is that there are several systems available in the commercial market which will deliver a blank ballot to the voter online and then allow the voter to mark that ballot using the assistive tech that they're familiar with on their own device,

46
00:06:15,740 --> 00:06:19,820
print the ballot for the voter to return either by mail or a dropbox.

47
00:06:19,820 --> 00:06:22,660
So we're not talking about online voting here.

48
00:06:22,660 --> 00:06:26,480
We're talking about a way to assistively mark that paper ballot.

49
00:06:26,800 --> 00:06:38,520
But what we're seeing is that there's architecture, even though you might assume that it doesn't do this, it actually sends the vote choices back over the internet.

50
00:06:38,540 --> 00:06:42,480
The devil is in the details and the way these systems are designed and created.

51
00:06:42,480 --> 00:06:57,480
Many of the commercially available systems keep all of the information resident on a remote server so that each time the voter makes the selections on their own computer, that vote choice is transmitted back to the remote server.

52
00:06:57,480 --> 00:07:08,140
Now that remote server has already identified who the voter is because they've had to authenticate the voter when the ballot was pulled up and given to the voter.

53
00:07:08,140 --> 00:07:27,320
So this creates a set of records on that remote server of both the voter's identity and their vote selections, which now can enable all sorts of secrecy and privacy vulnerabilities or compromises if anyone gains access to that server, either the state,

54
00:07:27,320 --> 00:07:31,040
the vendor, or somebody who compromises it remotely.

55
00:07:31,420 --> 00:07:37,940
Furthermore, each time those choices are going back and forth over the internet, they're vulnerable to eavesdropping and spyware.

56
00:07:38,600 --> 00:07:44,940
So it's really not advisable from a security and privacy standpoint.

57
00:07:45,500 --> 00:07:59,740
And even if that remote ballot marking system isn't designed to send these vote choices back over the internet, the ballot secrecy and the vote choice secrecy can still be compromised when marked online.

58
00:07:59,740 --> 00:08:16,760
So we really want to minimize the number of voters that are marking their ballots online to minimize these security risks, because those vote selections are going to be recorded temporarily in memory on the on the voter's device as well as their printer.

59
00:08:17,140 --> 00:08:33,840
And for these reasons, we want to highlight that issue and encourage election officials to speak to vendors and require that the systems zero out the vote data upon closing the application when they're making these systems.

60
00:08:33,840 --> 00:08:50,600
Furthermore, voters should be encouraged to mark their ballots on their own devices, if at all possible, and to not use their work computers or any publicly available computers, which could also invite other opportunities for secrecy violations.

61
00:08:52,320 --> 00:08:59,120
Furthermore, it's also always important to know that there's a risk that the ballot marking system might not record the votes correctly.

62
00:08:59,180 --> 00:09:01,300
There can be bugs, there can be malware.

63
00:09:01,320 --> 00:09:10,780
For these reasons, voters should always be instructed that if they can, to mark the ballot by hand to mitigate these privacy and integrity risks.

64
00:09:11,620 --> 00:09:24,560
And if they need to use the accessible technology and mark the ballot by their device, that they should always be encouraged to check the vote choices carefully.

65
00:09:24,680 --> 00:09:41,480
And election officials are encouraged to disable the barcode feature on the ballot marking system and remake the ballots directly from the voter selection, so that you don't have any issues that maybe the barcode is reporting vote choices incorrectly.

66
00:09:42,260 --> 00:09:56,700
This issue has been looked at years ago by National Institute of Standards and Technology and the Center for Civic Design, which does a lot of work with voters with disabilities and providing accessibility.

67
00:09:56,780 --> 00:10:15,660
Both have provided clear recommendations that any remote accessible ballot marking system should not transmit the vote choices back over the internet to a remote server, and they should be designed so that all the vote data remains local to the voter's computer in a stateless state,

68
00:10:15,660 --> 00:10:16,460
I guess.

69
00:10:16,720 --> 00:10:39,740
It's important to note that the accessibility of these remote accessible ballot marking devices isn't not impacted by the configuration in either way, meaning you're not giving up any accessibility to provide a more secure and private remote accessible ballot marking system that keeps all the information local to the voter's computer.

70
00:10:39,740 --> 00:10:44,660
So there's no advantage to introducing these security and privacy risks.

71
00:10:44,660 --> 00:10:55,420
It's only upside to to look for these devices that make these, that are adhere to this design best practice.

72
00:10:56,080 --> 00:11:04,180
So California is a good state to look at that looked at these issues and put the policy into practice.

73
00:11:04,520 --> 00:11:27,920
In 2012, when California was moving to largely a vote-by-mail state, it wanted to make sure that there was accessible remote ballot marking options, looked at these recommendations from NIST and others, and passed a law that prohibited the use of any remote ballot marking device that or system that transmitted the vote choices over the internet.

74
00:11:28,220 --> 00:11:37,000
And as a result, they have certified three systems that are currently commercially available and that meet this design best practice.

75
00:11:37,000 --> 00:11:45,000
So there are systems out there right now today that can be adopted and will protect the voter's secrecy.

76
00:11:45,000 --> 00:12:04,720
So just to give a quick summary of what we've just covered, states should be encouraged to adopt offline accessible remote ballot marking systems for all voters as they expand, or for voters that need it, that they need it when expanding vote-by-mail.

77
00:12:04,720 --> 00:12:10,840
The voters should also be instructed to carefully check printed ballots for errors.

78
00:12:11,620 --> 00:12:22,740
States should be required, states should require the vendors to offer systems that delete vote choices from all the memory when the application is closed.

79
00:12:22,780 --> 00:12:40,120
Voters should be encouraged to avoid using networked or public devices if possible, and election officials should consider disabling the barcode feature and remaking ballots directly from the voter's choices.

80
00:12:40,760 --> 00:12:47,920
So now we're going to look at the risks of online blank ballot delivery, and I'm turning it back over to Steve.

81
00:12:49,000 --> 00:12:50,280
Thanks, Susan.

82
00:12:50,280 --> 00:12:54,660
So as Susan mentioned, how do we minimize risk with online blank ballot delivery?

83
00:12:54,660 --> 00:13:03,460
The National Academy's report in 2018 described online blank ballot delivery as acceptable, and the recent DHS guidance described it as low risk.

84
00:13:03,460 --> 00:13:06,880
However, it's important to remember that low risk is not no risk.

85
00:13:07,000 --> 00:13:15,640
So the risk with blank ballot delivery systems are those that would impact the integrity and or availability of the ballots, such as altering or removing vote choices.

86
00:13:15,700 --> 00:13:22,260
Some electronic ballot delivery systems perform functions to verify a voter's identity before presenting them their assigned ballot.

87
00:13:22,260 --> 00:13:29,260
The identification process can use personal identifying information, such as name and driver's license number, or biometrics.

88
00:13:29,260 --> 00:13:42,880
When this verification is improperly configured, remote electronic ballot delivery systems can present additional privacy risk, such as the loss or theft of the voter's personal and or biometric identity information.

89
00:13:42,940 --> 00:13:49,740
Voters who have had their information stolen or harvested previously could have their ballots at risk, especially automated attacks.

90
00:13:49,740 --> 00:13:54,760
Speed and efficiency of automated attacks can increase the impact of these attacks considerably.

91
00:13:54,920 --> 00:14:01,860
Further, many ballot scanners cannot read ballots printed from voters' home printers because the paper weight and size are incompatible.

92
00:14:01,860 --> 00:14:08,200
So the voter selections must be hand copied onto traditional paper ballot stock that can be read by those scanners.

93
00:14:08,200 --> 00:14:14,360
This can be a time and resource consuming process that burdens already limited election staff and volunteers.

94
00:14:14,600 --> 00:14:24,960
The copying process also presents a potential source of inaccuracy, as even an incredibly low copying error rate can impact elections if the volume of copied ballots is sufficiently high.

95
00:14:24,980 --> 00:14:29,240
Importantly, the original returned ballots should be kept for auditing purposes.

96
00:14:29,380 --> 00:14:36,580
Finally, this may also create a health risk for election workers who are typically directed to sit in pairs in order to prevent manipulation or fraud.

97
00:14:36,580 --> 00:14:42,900
Without transparent oversight or strict security protocols, this process introduces opportunities for error or tampering.

98
00:14:43,040 --> 00:14:51,120
So here I'll go ahead and turn things back over to Susan to go through some of the best practices and recommendations to keep in mind as officials prepare for the upcoming election.

99
00:14:51,840 --> 00:14:53,200
Thanks, Steve.

100
00:14:53,320 --> 00:14:57,400
So we're just going to summarize the takeaways.

101
00:14:58,060 --> 00:15:17,520
We urge election officials to follow the best practices of NIST and to only adopt and certify remote accessible ballot marking systems that confine the vote selections data to the voters' devices and remove the choices from all memory when the application is closed.

102
00:15:17,720 --> 00:15:46,300
To limit the use of electronic ballot delivery only to the voters that can't get a mailed pre-printed ballot, so that you're limiting the risks of that online blank ballot delivery that Steve just talked about, or limit it to voters that may need an electronic ballot to mark the ballot with a remote accessible system.

103
00:15:46,520 --> 00:16:00,300
To urge election officials to make printing the blank ballot the default action of any ballot downloaded to encourage the voters to fill out the blank ballot with a pen before mailing it.

104
00:16:01,320 --> 00:16:23,980
We also encourage voters who must use a accessible remote ballot marking system to use their own personal devices, networks, and printers, if at all possible, rather than others, infrastructure, unless they may have some privacy concerns at home.

105
00:16:24,160 --> 00:16:39,360
Recommend that no voter should ever enter vote choices into a device that's connected to the internet, and maybe we skipped over that, but it's ideal that the device should be disconnected from the internet once the ballot is downloaded when the marking process is being executed.

106
00:16:40,440 --> 00:16:51,860
Instruct voters who do not mark their ballot with a computer or device to carefully... I'm sorry, who do mark their ballot with a computer device to carefully check and verify that their vote choices were recorded correctly.

107
00:16:53,560 --> 00:16:57,460
To election officials, we also encourage that they...

108
00:16:57,460 --> 00:17:14,960
them to disable the barcode feature and to remake the ballots directly from the voter selections, retain that original ballot, and use the human readable part for all audits and recounts so that you have the original record of voter intent when doing an auditor recount,

109
00:17:14,960 --> 00:17:17,580
not from the remade ballot.

110
00:17:17,900 --> 00:17:32,480
And consider electronically delivered ballots to be at higher risk for unauthorized duplication, and consider authentication of the voter's identity and eligibility when looking at those ballots.

111
00:17:32,860 --> 00:17:36,940
So I think we can wrap up with that.

112
00:17:37,040 --> 00:17:39,400
Any final words, Steve?

113
00:17:39,860 --> 00:17:42,200
No, I think you've covered it all, Susan.

114
00:17:42,200 --> 00:17:43,980
Great, thank you all so much.

115
00:17:43,980 --> 00:17:47,860
It was great to be able to present this information.

116
00:17:48,440 --> 00:17:56,060
The paper is on both of our websites if you're looking to to get more information.

117
00:17:56,060 --> 00:17:58,540
And thank you very much.

118
00:17:58,540 --> 00:17:59,320
Thank you all.

119
00:17:59,320 --> 00:18:01,160
Hope to see you in Vegas next year.