start	end	text
0	3960	So I'm glad to be able to join you all today. My name is Steve Newell. I'm from
3960	6400	the American Association for the Advancement of Science,
6400	9760	which is the world's largest multidisciplinary scientific society,
9760	13180	where I'm project director at the Center for Scientific Evidence and
13180	16140	Public Issues, usually referred to as the EPI Center.
16140	19960	The EPI Center works to provide accurate, concise, and actionable scientific
19960	23300	information to everyone from policymakers to parents to help ensure
23300	26540	that science is a part of the decision-making process.
26640	29800	Election security has been one of our major initiatives since founding of the
29800	32000	Center. I'm sure many of you are already
32000	33780	familiar with her, but Susan Greenhalgh is
33780	37460	currently a senior advisor on election security at Free Speech for People.
37520	40160	She's well known in the election security space for tireless work
40160	44840	advocating for secure election protocols, paper ballot voting systems, and post-
44840	48140	election audits. Susan and I are here today to talk about
48140	51840	leveraging electronic ballot options safely and securely during the COVID-19
51840	54580	pandemic. This presentation is based on a white
54580	58060	paper with additional detail on these issues that will also be available.
58060	61960	As I'm sure all of you here are well aware, COVID has scrambled existing
61960	65920	policies and procedures in every area of the country, and election security is, of
65920	68740	course, no exception. COVID has provided an
68740	71580	additional challenge to ensuring election security and ballot access
71580	75760	during this critical time. Currently, five states vote primarily by
75760	79140	mail. However, during the past few months, we've seen states across the country
79140	81400	working to scale up their vote-by-mail options
81400	85060	and capabilities as we head towards the November elections.
85060	88000	These steps have taken a variety of different forms
88000	92680	between states. For example, an emergency executive order in Delaware includes a
92680	95000	measure that allows voters concerned about COVID
95000	99280	to qualify as sick or physically disabled, allowing them to vote absentee.
99280	102800	Just to make sure the evidence is known, researchers have found
102800	106340	that universal vote-by-mail has no impact on partisan
106340	111480	turnout or vote share, so vote-by-mail is really a non-partisan solution to ballot
111480	114800	access concerns. Work by Amber McReynolds and Charles
114800	120660	Stewart highlighted 204 cases of absentee ballot-related fraud in a
120660	124700	quarter of a billion votes cast over the past two decades.
124700	128620	As is the case across the election space, fraud is exceedingly rare with
128620	132580	vote-by-mail. Alongside this expansion of vote-by-mail,
132580	135520	states are examining various solutions for remote voting,
135520	139000	such as remote accessible ballot marking, which allows voters to receive
139000	142400	and, if necessary, mark their ballots electronically before printing the
142400	145060	ballot and returning it to their local office.
145060	149720	UOCAVA was expanded significantly in 2009 when Congress passed the MOVE Act
149720	153240	to provide greater protections for service members, their families, and
153240	157180	other overseas citizens. Among other provisions, the MOVE Act
157180	161000	requires states to transmit validly requested absentee ballots to
161000	164500	UOCAVA voters no later than 45 days before a federal
164500	167280	election. However, remote accessible ballot marking
167280	169860	is also essential for individuals with disabilities
169860	173960	or those who encounter barriers to marking a paper ballot by hand.
173960	177600	We know that there is still a disability gap in voting, with roughly five percent
177600	180320	lower turnout in the 2018 midterm election,
180320	185220	equivalent to roughly 2.4 million votes from individuals with disabilities,
185220	188960	according to research by the Rutgers School of Management and Labor Relations.
188960	192520	So we know that there's an ongoing equity gap in ballot access, which is
192520	195720	essential to address. Further, electronic ballot delivery can
195720	198540	help fill in the gaps for when traditional mail-in voting is either not
198540	201660	possible or appropriate. However, it's important to remember that
201660	205180	electronic return of marked ballots is an incredibly risky endeavor.
205180	208740	The National Academy has warned against it in its 2018 Systematic Review of
208740	212420	Voting Security. Also in 2018, our report Susan co-authored
212420	216020	with the Common Cause Education Fund, the R Street Institute, and the U.S.
216020	219200	Technology Policy Committee of the Association for Computing
219200	222920	Machinery provided additional warnings against internet voting.
222920	226660	In April, from the EPI Center, we sent an open letter to state voting officials
226660	231020	signed by more than 70 internet pioneers, scientists, security
231020	234280	experts, and voting groups urging those officials not to allow
234280	237680	electronic return of marked ballots due to the scientific evidence
237680	240500	demonstrating these votes cannot be secured.
240500	244460	Importantly, there is no way to conduct a valid audit of the results due to the
244460	247220	lack of meaningful voter-verified paper records
247220	250060	for electronically returned marked ballots.
250100	253660	In May, the Department of Homeland Security, the Federal Bureau of
253660	256820	Investigation, the National Institute of Standards and Technology,
256820	260200	and the U.S. Election Assistance Commission shared similar guidance
260200	264200	echoing these concerns. Even with the tools and applications available,
264200	267860	this activity is still high risk. To be clear to the state,
267860	271600	there's still no known technology that can secure electronic ballot return.
271600	274720	So with that background, this brings us to remote ballot marking.
274720	277900	Specifically, what factors should election officials keep in mind about
277900	280520	these systems, particularly in terms of safeguarding
280520	283600	voters' privacy and security? At this point, I'll go ahead and hand
283600	286460	things off to Susan to tell you a little more about these systems.
287760	290420	Thank you, Steve. And I just have to say
291700	295880	it's great to be presenting here at DEFCON,
295880	299320	but it's certainly bittersweet to not be able to be
299320	303120	in Las Vegas with everybody and at the Voting Village
303120	306740	and seeing all the great work firsthand. So I'm
306740	310200	really pleased to be able to present what Steve and I have worked on together
310200	313960	with this paper and the findings, even though
313960	317680	it's unfortunate that we're not actually there in person. And I just
317680	321280	want to preface this by saying that this paper is really geared towards all the
321280	324360	election officials that are participating more and more in
324360	327880	DEFCON. We're trying to highlight some of the
327880	330440	known security and privacy risks of these systems
330980	336200	and how election officials can become aware of them and then make choices
336200	341800	to mitigate those risks. So back into the
343720	348040	presentation, as we're seeing these states expand their vote-by-mail options,
348040	352920	it's really important that there also be an option for disabled voters to mark a
353840	356640	ballot privately and independently if they're
356640	359520	choosing vote-by-mail and that they have assistive
359520	363800	technology if they need it. So what we're seeing is that there are
363800	366020	several systems available in the commercial market
366020	370000	which will deliver a blank ballot to the voter online and then allow the
370000	372220	voter to mark that ballot using the
372220	375740	assistive tech that they're familiar with on their own device,
375740	380140	print the ballot for the voter to return either by mail or a dropbox. So we're not
380140	383500	talking about online voting here. We're talking about
383680	386480	a way to assistively mark that paper ballot.
386800	390220	But what we're seeing is that there's
390220	394340	architecture, even though you might assume that it
394340	398520	doesn't do this, it actually sends the vote choices back over the internet.
398540	402480	The devil is in the details and the way these systems are designed and created.
402480	406240	Many of the commercially available systems keep all of the information
406860	411200	resident on a remote server so that each time the voter makes the selections
411200	414820	on their own computer, that vote choice is transmitted
415500	418800	back to the remote server. Now that remote server has
418800	423620	already identified who the voter is because they've had to authenticate the
423620	426900	voter when the ballot was pulled up and given
426900	431820	to the voter. So this creates a set of records on
431820	435040	that remote server of both the voter's identity and their vote selections,
435680	442060	which now can enable all sorts of secrecy and privacy vulnerabilities
442060	445820	or compromises if anyone gains access to that
445820	448700	server, either the state, the vendor, or somebody who
448700	453880	compromises it remotely. Furthermore, each time those choices are going back and
453880	457940	forth over the internet, they're vulnerable to eavesdropping and spyware.
458600	463800	So it's really not advisable from a security and privacy
463800	468500	standpoint. And even if that remote ballot
468500	472420	marking system isn't designed to send these vote
472420	476620	choices back over the internet, the ballot secrecy and the vote choice
476620	479740	secrecy can still be compromised when marked online.
479740	483340	So we really want to minimize the number of voters that are marking their ballots
483340	487380	online to minimize these security risks, because
487380	489180	those vote selections are going to be recorded
489180	493520	temporarily in memory on the
493520	496760	on the voter's device as well as their printer.
497140	501040	And for these reasons, we want to highlight that issue and encourage
501040	507040	election officials to speak to vendors and require that the systems zero out
507040	509400	the vote data upon closing the application
510080	513840	when they're making these systems.
513840	516840	Furthermore, voters should be encouraged to mark their ballots
516840	521800	on their own devices, if at all possible, and to not use their work computers or
521800	526820	any publicly available computers, which could also invite other
526820	530600	opportunities for secrecy violations.
532320	535500	Furthermore, it's also always important to know that there's a risk
535500	539120	that the ballot marking system might not record the votes correctly.
539180	542480	There can be bugs, there can be malware. For these reasons, voters
542480	547480	should always be instructed that if they can, to mark the ballot by hand
547480	550780	to mitigate these privacy and integrity risks.
551620	556700	And if they need to use the accessible technology and
556700	560920	mark the ballot by their device, that they should
560920	564560	always be encouraged to check the vote choices carefully.
564680	568800	And election officials are encouraged to disable the barcode feature
569480	573540	on the ballot marking system and remake the ballots directly from the voter
573540	576680	selection, so that you don't have any issues that
576680	581480	maybe the barcode is reporting vote choices incorrectly.
582260	585840	This issue has been looked at years ago by
585840	588040	National Institute of Standards and Technology
589100	592600	and the Center for Civic Design, which does a lot of work with
593380	596700	voters with disabilities and providing accessibility.
596780	600040	Both have provided clear recommendations that
600040	604200	any remote accessible ballot marking system should not transmit the vote
604200	607380	choices back over the internet to a remote server,
607380	611320	and they should be designed so that all the vote data remains local to the
611320	616460	voter's computer in a stateless state, I guess.
616720	620320	It's important to note that the accessibility
620920	624820	of these remote accessible ballot marking devices isn't not impacted
625370	628800	by the configuration in either way, meaning you're not giving up
628800	635360	any accessibility to provide a more secure and private remote accessible
635360	638900	ballot marking system that keeps all the information local to the voter's
638900	641800	computer. So there's no advantage to introducing
641800	646920	these security and privacy risks. It's only upside to
646920	650920	to look for these devices that make these,
650920	655420	that are adhere to this design best practice.
656080	659320	So California is a good state to look at
659320	662320	that looked at these issues and put the policy
662320	666760	into practice. In 2012, when California was
666760	671180	moving to largely a vote-by-mail state, it wanted to make sure that there was
671180	674520	accessible remote ballot marking options, looked at
674520	679180	these recommendations from NIST and others, and passed a law that
679180	682340	prohibited the use of any remote ballot marking
682340	685600	device that or system that transmitted the vote
685600	691140	choices over the internet. And as a result, they have certified
691140	693940	three systems that are currently commercially available
694800	698740	and that meet this design best practice. So there are systems out there right now
698740	703340	today that can be adopted and will protect
703340	709560	the voter's secrecy. So just to give a quick summary of what
709560	712500	we've just covered, states should be
713480	717520	encouraged to adopt offline accessible remote ballot marking systems
717520	721620	for all voters as they expand, or for voters that need it,
721620	724720	that they need it when expanding vote-by-mail.
724720	728260	The voters should also be instructed to carefully check
728260	734240	printed ballots for errors. States should be required, states should
734240	738700	require the vendors to offer systems that delete vote
738700	742740	choices from all the memory when the application is closed.
742780	745960	Voters should be encouraged to avoid using
745960	749920	networked or public devices if possible, and
749920	755040	election officials should consider disabling the barcode feature
755420	760120	and remaking ballots directly from the voter's choices.
760760	763860	So now we're going to look at the risks of online blank
763860	767920	ballot delivery, and I'm turning it back over to Steve.
769000	773760	Thanks, Susan. So as Susan mentioned, how do we minimize risk with online blank
773760	776440	ballot delivery? The National Academy's report in 2018
776440	780360	described online blank ballot delivery as acceptable,
780360	784380	and the recent DHS guidance described it as low risk. However, it's important to
784380	788680	remember that low risk is not no risk. So the risk with blank ballot delivery
788680	792220	systems are those that would impact the integrity and or availability of the
792220	795640	ballots, such as altering or removing vote choices.
795700	799520	Some electronic ballot delivery systems perform functions to verify a voter's
799520	802260	identity before presenting them their assigned ballot.
802260	805680	The identification process can use personal identifying information, such
805680	809820	as name and driver's license number, or biometrics. When this
809820	812180	verification is improperly configured, remote
812180	815020	electronic ballot delivery systems can present
815660	820560	additional privacy risk, such as the loss or theft of the voter's personal and or
820560	824240	biometric identity information. Voters who have had their information
824240	827700	stolen or harvested previously could have their ballots at risk,
827700	832000	especially automated attacks. Speed and efficiency of automated attacks can
832000	834760	increase the impact of these attacks considerably.
834920	838620	Further, many ballot scanners cannot read ballots printed from voters' home
838620	841860	printers because the paper weight and size are incompatible.
841860	845640	So the voter selections must be hand copied onto traditional paper
845640	848200	ballot stock that can be read by those scanners.
848200	851200	This can be a time and resource consuming process that burdens
851200	855520	already limited election staff and volunteers. The copying process
855520	859660	also presents a potential source of inaccuracy, as even an incredibly low
859660	863620	copying error rate can impact elections if the volume of copied ballots is
863620	866760	sufficiently high. Importantly, the original returned
866760	869240	ballots should be kept for auditing purposes.
869380	872440	Finally, this may also create a health risk for election workers who are
872440	875900	typically directed to sit in pairs in order to prevent manipulation or
875900	879480	fraud. Without transparent oversight or strict security protocols,
879480	882900	this process introduces opportunities for error or tampering.
883040	885920	So here I'll go ahead and turn things back over to Susan to go through some of
885920	889720	the best practices and recommendations to keep in mind as officials prepare for
889720	894580	the upcoming election. Thanks, Steve. So we're just going to
894580	899600	summarize the takeaways. We urge election
899600	903200	officials to follow the best practices of NIST and to
903200	907080	only adopt and certify remote accessible ballot marking systems
907080	912320	that confine the vote selections data to the voters' devices and remove the
912320	916340	choices from all memory when the application is
916340	920700	closed. To limit the use of electronic ballot
920700	925380	delivery only to the voters that can't get a
925380	930300	mailed pre-printed ballot, so that you're limiting the risks of that
930300	932800	online blank ballot delivery that Steve just
932800	937600	talked about, or limit it to voters that
937600	944540	may need an electronic ballot to mark the ballot with a remote accessible
945100	950440	system. To urge election officials to make printing the blank ballot the
951240	957240	default action of any ballot downloaded to encourage the voters to fill out the
957240	960300	blank ballot with a pen before mailing it.
961320	967080	We also encourage voters who must use a accessible
968380	973140	remote ballot marking system to use their own personal devices,
973140	976880	networks, and printers, if at all possible,
976880	981100	rather than others, infrastructure, unless they may have some
981880	985860	privacy concerns at home. Recommend that no voter should
985860	989320	ever enter vote choices into a device that's connected to the internet, and
989320	992720	maybe we skipped over that, but it's ideal that the device should be
992720	996260	disconnected from the internet once the ballot is downloaded when the marking
996260	999360	process is being executed.
1000440	1003940	Instruct voters who do not mark their ballot with a computer or device to
1003940	1007040	carefully... I'm sorry, who do mark their ballot with a
1007040	1010700	computer device to carefully check and verify that their vote choices were
1010700	1011860	recorded correctly.
1013560	1017460	To election officials, we also encourage that they...
1017460	1021920	them to disable the barcode feature and to remake the ballots directly from the
1021920	1025920	voter selections, retain that original ballot, and use the
1025920	1030140	human readable part for all audits and recounts so that you
1030140	1032360	have the original record of voter intent
1032790	1038720	when doing an auditor recount, not from the remade ballot. And consider
1039500	1043060	electronically delivered ballots to be at higher risk for unauthorized
1043060	1048220	duplication, and consider authentication of the
1048220	1053780	voter's identity and eligibility when looking at those ballots. So I think
1053780	1059400	we can wrap up with that. Any final words, Steve?
1059860	1063980	No, I think you've covered it all, Susan. Great, thank you all so much.
1063980	1067860	It was great to be able to present this information.
1068440	1075180	The paper is on both of our websites if you're looking to to get more
1075180	1079320	information. And thank you very much. Thank you all.
1079320	1081160	Hope to see you in Vegas next year.