WEBVTT 00:00.000 --> 00:02.320 So I'm glad to be able to join you all today. 00:02.320 --> 00:03.680 My name is Steve Newell. 00:03.680 --> 00:16.140 I'm from the American Association for the Advancement of Science, which is the world's largest multidisciplinary scientific society, where I'm project director at the Center for Scientific Evidence and Public Issues, usually referred to as the EPI Center. 00:16.140 --> 00:26.540 The EPI Center works to provide accurate, concise, and actionable scientific information to everyone from policymakers to parents to help ensure that science is a part of the decision-making process. 00:26.640 --> 00:30.420 Election security has been one of our major initiatives since founding of the Center. 00:30.780 --> 00:37.460 I'm sure many of you are already familiar with her, but Susan Greenhalgh is currently a senior advisor on election security at Free Speech for People. 00:37.520 --> 00:45.980 She's well known in the election security space for tireless work advocating for secure election protocols, paper ballot voting systems, and post- election audits. 00:46.380 --> 00:52.640 Susan and I are here today to talk about leveraging electronic ballot options safely and securely during the COVID-19 pandemic. 00:52.680 --> 00:58.060 This presentation is based on a white paper with additional detail on these issues that will also be available. 00:58.060 --> 01:07.480 As I'm sure all of you here are well aware, COVID has scrambled existing policies and procedures in every area of the country, and election security is, of course, no exception. 01:07.660 --> 01:13.340 COVID has provided an additional challenge to ensuring election security and ballot access during this critical time. 01:13.340 --> 01:16.260 Currently, five states vote primarily by mail. 01:16.260 --> 01:25.060 However, during the past few months, we've seen states across the country working to scale up their vote-by-mail options and capabilities as we head towards the November elections. 01:25.060 --> 01:29.100 These steps have taken a variety of different forms between states. 01:29.100 --> 01:39.100 For example, an emergency executive order in Delaware includes a measure that allows voters concerned about COVID to qualify as sick or physically disabled, allowing them to vote absentee. 01:39.100 --> 01:52.740 Just to make sure the evidence is known, researchers have found that universal vote-by-mail has no impact on partisan turnout or vote share, so vote-by-mail is really a non-partisan solution to ballot access concerns. 01:52.840 --> 02:04.140 Work by Amber McReynolds and Charles Stewart highlighted 204 cases of absentee ballot-related fraud in a quarter of a billion votes cast over the past two decades. 02:04.140 --> 02:09.740 As is the case across the election space, fraud is exceedingly rare with vote -by-mail. 02:10.060 --> 02:25.060 Alongside this expansion of vote-by-mail, states are examining various solutions for remote voting, such as remote accessible ballot marking, which allows voters to receive and , if necessary, mark their ballots electronically before printing the ballot and returning it to their local office. 02:25.060 --> 02:35.240 UOCAVA was expanded significantly in 2009 when Congress passed the MOVE Act to provide greater protections for service members, their families, and other overseas citizens. 02:35.360 --> 02:45.420 Among other provisions, the MOVE Act requires states to transmit validly requested absentee ballots to UOCAVA voters no later than 45 days before a federal election. 02:45.420 --> 02:53.960 However, remote accessible ballot marking is also essential for individuals with disabilities or those who encounter barriers to marking a paper ballot by hand. 02:53.960 --> 03:08.960 We know that there is still a disability gap in voting, with roughly five percent lower turnout in the 2018 midterm election, equivalent to roughly 2.4 million votes from individuals with disabilities, according to research by the Rutgers School of Management and Labor Relations. 03:08.960 --> 03:14.020 So we know that there's an ongoing equity gap in ballot access, which is essential to address. 03:14.020 --> 03:20.060 Further, electronic ballot delivery can help fill in the gaps for when traditional mail-in voting is either not possible or appropriate. 03:20.060 --> 03:25.180 However, it's important to remember that electronic return of marked ballots is an incredibly risky endeavor. 03:25.180 --> 03:29.960 The National Academy has warned against it in its 2018 Systematic Review of Voting Security. 03:30.100 --> 03:36.020 Also in 2018, our report Susan co-authored with the Common Cause Education Fund, the R Street Institute, and the U.S. 03:36.020 --> 03:42.920 Technology Policy Committee of the Association for Computing Machinery provided additional warnings against internet voting. 03:42.920 --> 04:00.500 In April, from the EPI Center, we sent an open letter to state voting officials signed by more than 70 internet pioneers, scientists, security experts, and voting groups urging those officials not to allow electronic return of marked ballots due to the scientific evidence demonstrating these votes cannot be secured. 04:00.500 --> 04:10.060 Importantly, there is no way to conduct a valid audit of the results due to the lack of meaningful voter-verified paper records for electronically returned marked ballots. 04:10.100 --> 04:17.760 In May, the Department of Homeland Security, the Federal Bureau of Investigation, the National Institute of Standards and Technology, and the U.S. 04:17.760 --> 04:21.960 Election Assistance Commission shared similar guidance echoing these concerns. 04:22.040 --> 04:26.180 Even with the tools and applications available, this activity is still high risk. 04:26.180 --> 04:31.600 To be clear to the state, there's still no known technology that can secure electronic ballot return. 04:31.600 --> 04:34.720 So with that background, this brings us to remote ballot marking. 04:34.720 --> 04:42.400 Specifically, what factors should election officials keep in mind about these systems, particularly in terms of safeguarding voters' privacy and security? 04:42.400 --> 04:46.460 At this point, I'll go ahead and hand things off to Susan to tell you a little more about these systems. 04:47.760 --> 04:49.000 Thank you, Steve. 04:49.100 --> 05:05.240 And I just have to say it's great to be presenting here at DEFCON, but it's certainly bittersweet to not be able to be in Las Vegas with everybody and at the Voting Village and seeing all the great work firsthand. 05:05.240 --> 05:17.340 So I'm really pleased to be able to present what Steve and I have worked on together with this paper and the findings, even though it's unfortunate that we're not actually there in person. 05:17.340 --> 05:25.420 And I just want to preface this by saying that this paper is really geared towards all the election officials that are participating more and more in DEFCON. 05:25.680 --> 05:38.560 We're trying to highlight some of the known security and privacy risks of these systems and how election officials can become aware of them and then make choices to mitigate those risks. 05:38.560 --> 06:01.060 So back into the presentation, as we're seeing these states expand their vote-by-mail options, it's really important that there also be an option for disabled voters to mark a ballot privately and independently if they're choosing vote-by-mail and that they have assistive technology if they need it. 06:01.520 --> 06:15.740 So what we're seeing is that there are several systems available in the commercial market which will deliver a blank ballot to the voter online and then allow the voter to mark that ballot using the assistive tech that they're familiar with on their own device, 06:15.740 --> 06:19.820 print the ballot for the voter to return either by mail or a dropbox. 06:19.820 --> 06:22.660 So we're not talking about online voting here. 06:22.660 --> 06:26.480 We're talking about a way to assistively mark that paper ballot. 06:26.800 --> 06:38.520 But what we're seeing is that there's architecture, even though you might assume that it doesn't do this, it actually sends the vote choices back over the internet. 06:38.540 --> 06:42.480 The devil is in the details and the way these systems are designed and created. 06:42.480 --> 06:57.480 Many of the commercially available systems keep all of the information resident on a remote server so that each time the voter makes the selections on their own computer, that vote choice is transmitted back to the remote server. 06:57.480 --> 07:08.140 Now that remote server has already identified who the voter is because they've had to authenticate the voter when the ballot was pulled up and given to the voter. 07:08.140 --> 07:27.320 So this creates a set of records on that remote server of both the voter's identity and their vote selections, which now can enable all sorts of secrecy and privacy vulnerabilities or compromises if anyone gains access to that server, either the state, 07:27.320 --> 07:31.040 the vendor, or somebody who compromises it remotely. 07:31.420 --> 07:37.940 Furthermore, each time those choices are going back and forth over the internet, they're vulnerable to eavesdropping and spyware. 07:38.600 --> 07:44.940 So it's really not advisable from a security and privacy standpoint. 07:45.500 --> 07:59.740 And even if that remote ballot marking system isn't designed to send these vote choices back over the internet, the ballot secrecy and the vote choice secrecy can still be compromised when marked online. 07:59.740 --> 08:16.760 So we really want to minimize the number of voters that are marking their ballots online to minimize these security risks, because those vote selections are going to be recorded temporarily in memory on the on the voter's device as well as their printer. 08:17.140 --> 08:33.840 And for these reasons, we want to highlight that issue and encourage election officials to speak to vendors and require that the systems zero out the vote data upon closing the application when they're making these systems. 08:33.840 --> 08:50.600 Furthermore, voters should be encouraged to mark their ballots on their own devices, if at all possible, and to not use their work computers or any publicly available computers, which could also invite other opportunities for secrecy violations. 08:52.320 --> 08:59.120 Furthermore, it's also always important to know that there's a risk that the ballot marking system might not record the votes correctly. 08:59.180 --> 09:01.300 There can be bugs, there can be malware. 09:01.320 --> 09:10.780 For these reasons, voters should always be instructed that if they can, to mark the ballot by hand to mitigate these privacy and integrity risks. 09:11.620 --> 09:24.560 And if they need to use the accessible technology and mark the ballot by their device, that they should always be encouraged to check the vote choices carefully. 09:24.680 --> 09:41.480 And election officials are encouraged to disable the barcode feature on the ballot marking system and remake the ballots directly from the voter selection, so that you don't have any issues that maybe the barcode is reporting vote choices incorrectly. 09:42.260 --> 09:56.700 This issue has been looked at years ago by National Institute of Standards and Technology and the Center for Civic Design, which does a lot of work with voters with disabilities and providing accessibility. 09:56.780 --> 10:15.660 Both have provided clear recommendations that any remote accessible ballot marking system should not transmit the vote choices back over the internet to a remote server, and they should be designed so that all the vote data remains local to the voter's computer in a stateless state, 10:15.660 --> 10:16.460 I guess. 10:16.720 --> 10:39.740 It's important to note that the accessibility of these remote accessible ballot marking devices isn't not impacted by the configuration in either way, meaning you're not giving up any accessibility to provide a more secure and private remote accessible ballot marking system that keeps all the information local to the voter's computer. 10:39.740 --> 10:44.660 So there's no advantage to introducing these security and privacy risks. 10:44.660 --> 10:55.420 It's only upside to to look for these devices that make these, that are adhere to this design best practice. 10:56.080 --> 11:04.180 So California is a good state to look at that looked at these issues and put the policy into practice. 11:04.520 --> 11:27.920 In 2012, when California was moving to largely a vote-by-mail state, it wanted to make sure that there was accessible remote ballot marking options, looked at these recommendations from NIST and others, and passed a law that prohibited the use of any remote ballot marking device that or system that transmitted the vote choices over the internet. 11:28.220 --> 11:37.000 And as a result, they have certified three systems that are currently commercially available and that meet this design best practice. 11:37.000 --> 11:45.000 So there are systems out there right now today that can be adopted and will protect the voter's secrecy. 11:45.000 --> 12:04.720 So just to give a quick summary of what we've just covered, states should be encouraged to adopt offline accessible remote ballot marking systems for all voters as they expand, or for voters that need it, that they need it when expanding vote-by-mail. 12:04.720 --> 12:10.840 The voters should also be instructed to carefully check printed ballots for errors. 12:11.620 --> 12:22.740 States should be required, states should require the vendors to offer systems that delete vote choices from all the memory when the application is closed. 12:22.780 --> 12:40.120 Voters should be encouraged to avoid using networked or public devices if possible, and election officials should consider disabling the barcode feature and remaking ballots directly from the voter's choices. 12:40.760 --> 12:47.920 So now we're going to look at the risks of online blank ballot delivery, and I'm turning it back over to Steve. 12:49.000 --> 12:50.280 Thanks, Susan. 12:50.280 --> 12:54.660 So as Susan mentioned, how do we minimize risk with online blank ballot delivery? 12:54.660 --> 13:03.460 The National Academy's report in 2018 described online blank ballot delivery as acceptable, and the recent DHS guidance described it as low risk. 13:03.460 --> 13:06.880 However, it's important to remember that low risk is not no risk. 13:07.000 --> 13:15.640 So the risk with blank ballot delivery systems are those that would impact the integrity and or availability of the ballots, such as altering or removing vote choices. 13:15.700 --> 13:22.260 Some electronic ballot delivery systems perform functions to verify a voter's identity before presenting them their assigned ballot. 13:22.260 --> 13:29.260 The identification process can use personal identifying information, such as name and driver's license number, or biometrics. 13:29.260 --> 13:42.880 When this verification is improperly configured, remote electronic ballot delivery systems can present additional privacy risk, such as the loss or theft of the voter's personal and or biometric identity information. 13:42.940 --> 13:49.740 Voters who have had their information stolen or harvested previously could have their ballots at risk, especially automated attacks. 13:49.740 --> 13:54.760 Speed and efficiency of automated attacks can increase the impact of these attacks considerably. 13:54.920 --> 14:01.860 Further, many ballot scanners cannot read ballots printed from voters' home printers because the paper weight and size are incompatible. 14:01.860 --> 14:08.200 So the voter selections must be hand copied onto traditional paper ballot stock that can be read by those scanners. 14:08.200 --> 14:14.360 This can be a time and resource consuming process that burdens already limited election staff and volunteers. 14:14.600 --> 14:24.960 The copying process also presents a potential source of inaccuracy, as even an incredibly low copying error rate can impact elections if the volume of copied ballots is sufficiently high. 14:24.980 --> 14:29.240 Importantly, the original returned ballots should be kept for auditing purposes. 14:29.380 --> 14:36.580 Finally, this may also create a health risk for election workers who are typically directed to sit in pairs in order to prevent manipulation or fraud. 14:36.580 --> 14:42.900 Without transparent oversight or strict security protocols, this process introduces opportunities for error or tampering. 14:43.040 --> 14:51.120 So here I'll go ahead and turn things back over to Susan to go through some of the best practices and recommendations to keep in mind as officials prepare for the upcoming election. 14:51.840 --> 14:53.200 Thanks, Steve. 14:53.320 --> 14:57.400 So we're just going to summarize the takeaways. 14:58.060 --> 15:17.520 We urge election officials to follow the best practices of NIST and to only adopt and certify remote accessible ballot marking systems that confine the vote selections data to the voters' devices and remove the choices from all memory when the application is closed. 15:17.720 --> 15:46.300 To limit the use of electronic ballot delivery only to the voters that can't get a mailed pre-printed ballot, so that you're limiting the risks of that online blank ballot delivery that Steve just talked about, or limit it to voters that may need an electronic ballot to mark the ballot with a remote accessible system. 15:46.520 --> 16:00.300 To urge election officials to make printing the blank ballot the default action of any ballot downloaded to encourage the voters to fill out the blank ballot with a pen before mailing it. 16:01.320 --> 16:23.980 We also encourage voters who must use a accessible remote ballot marking system to use their own personal devices, networks, and printers, if at all possible, rather than others, infrastructure, unless they may have some privacy concerns at home. 16:24.160 --> 16:39.360 Recommend that no voter should ever enter vote choices into a device that's connected to the internet, and maybe we skipped over that, but it's ideal that the device should be disconnected from the internet once the ballot is downloaded when the marking process is being executed. 16:40.440 --> 16:51.860 Instruct voters who do not mark their ballot with a computer or device to carefully... I'm sorry, who do mark their ballot with a computer device to carefully check and verify that their vote choices were recorded correctly. 16:53.560 --> 16:57.460 To election officials, we also encourage that they... 16:57.460 --> 17:14.960 them to disable the barcode feature and to remake the ballots directly from the voter selections, retain that original ballot, and use the human readable part for all audits and recounts so that you have the original record of voter intent when doing an auditor recount, 17:14.960 --> 17:17.580 not from the remade ballot. 17:17.900 --> 17:32.480 And consider electronically delivered ballots to be at higher risk for unauthorized duplication, and consider authentication of the voter's identity and eligibility when looking at those ballots. 17:32.860 --> 17:36.940 So I think we can wrap up with that. 17:37.040 --> 17:39.400 Any final words, Steve? 17:39.860 --> 17:42.200 No, I think you've covered it all, Susan. 17:42.200 --> 17:43.980 Great, thank you all so much. 17:43.980 --> 17:47.860 It was great to be able to present this information. 17:48.440 --> 17:56.060 The paper is on both of our websites if you're looking to to get more information. 17:56.060 --> 17:58.540 And thank you very much. 17:58.540 --> 17:59.320 Thank you all. 17:59.320 --> 18:01.160 Hope to see you in Vegas next year.