Good afternoon. My name is Ben Hublin and I'm chairman of the U.S. Election Assistance Commission
or EAC. I appreciate the opportunity to speak at this year's Virtual Voting Village.
I wish I was able to be there in person. Last year I certainly enjoyed the experience and saw a real
step forward in the dialogue and discourse around making our elections more secure. I'll jump into
that more in a minute, but for some background I wanted to start by talking about the EAC
and what we do. The EAC was established by the Help America Vote Act of 2002, or HAVA,
which was Congress's response to the Florida 2000 election. The EAC is an independent bipartisan
commission charged with ensuring secure, accurate, and accessible elections by developing guidance
to meet HAVA requirements, adopting Voluntary Voting System Guidelines, or the VVSG,
and serving as a national clearinghouse of information on election administration.
The EAC also accredits testing laboratories and certifies voting systems, as well as administers
the use of HAVA funds. We are a small agency, which you might not know by the attention we get.
We certainly try to punch above our weight class as an agency with one of the smallest budgets in
federal government. But as an agency, we are committed to providing helpful and up-to-date
information to promote the continuity and integrity of election administration,
despite new challenges such as COVID-19 and cyber interference.
In FY20, the EAC received a budgetary increase from our all-time low, and as an agency we focused
on investing these precious resources wisely in a way that would help the elections. I'm pleased
to be able to tell you today that a number of our new initiatives are already underway and hopefully
already making an impact. As part of our efforts, the EAC launched the Cyber Access and Security
Program this April to provide access to security training, best practices, expertise, and other
assistance for election officials and their IT staff. An important part of this program has been
the addition of staff who have a range of experience in the cybersecurity and elections
fields, including years of expertise in software development and security analysis. The program
partners with public and private security experts with a goal that election officials will have
access to the most up-to-date and best-in-class information available through the EAC's Clearing
House. One of the Cyber Access and Security Program's first projects was in response to a
concern we'd heard from election officials about the volume of cyber expertise and recommendations
that were being developed around the election space and how it would be helpful to have an
organized repository. The EAC's election security preparedness page is designed to be a one-stop
shop for election cybersecurity guidance. It includes resources from federal agencies,
nonprofits, academia, and local election officials. These resources include the work of a number
of individuals associated with the voting village, so thank you. The page was recently updated with
new guidance on security topics that have developed since the 2016 election, and it's been reorganized
to make the information easier to find and use. In addition to pulling resources together,
we've recognized that many of the great resources that have been produced only realize their full
benefit if election officials have a solid foundation to view them from. With that in mind,
in June, the EAC announced online cybersecurity training offered at no cost and developed
specifically for election officials through a partnership with the Center for Tech and Civic
Life, or CTCL. The online training consists of both video and written materials separated into
three modules, Cybersecurity 101, 201, and 301. This is self-paced training, and it provides
foundational knowledge on cybersecurity terminology, best practices in election offices,
practical applications, and communication around cyber incidents. We hope this is a resource that
can benefit any local election official and their staff. We've been promoting it to local election
officials, and you can too. This is available to every state and local election official in the
country at no cost through May of 2021. So far, nearly 200 state and local election officials
who are responsible for running elections for millions of voters and their partners have
completed this training. We plan to continue to focus on training efforts going forward
particularly if our funding trend continues. I would also mention that later this month we're
launching both a risk management and a crisis management online workshop for state and local
election officials. Along those lines, we'll be hosting a joint effort with CISA, an online
risk management tool, allowing election officials at the local level to easily measure and mitigate
risks to their specific environments. Finally, our cyber access and security team is updating
materials currently posted to the EAC website and is working to develop new material related
to vulnerability disclosure programs, social engineering mitigation, and other education
efforts. Another area our cyber access and security team has been working on is non-voting
election technology. Not the best name, but an area of great importance when it comes to securing
our election infrastructure and maintaining public confidence in the electoral process.
First and foremost, I think we all recognize that when you look at the cyber risk profile of
elections, that non-voting election technology like poll books, election night reporting,
and statewide voter registration databases are all potential targets. This is not a secret.
Everyone's been talking about this since 2016, and in fact there have been a number of bills
introduced in Congress to try to do something about the fact that we don't have standards or
a certification program for this type of technology, even though some states do. We know, however, that
the nature of these systems don't necessarily lend themselves to a voluntary voting system
guideline style certification program. With that mind, the EAC has partnered with the Center for
Internet Security, or CIS, and a number of states to pilot a technology verification program focused
on non-voting election technology, including, as I mentioned earlier, electronic poll books,
election night reporting websites, and electronic ballot delivery systems. This program is called
the Rapid Architecture-Based Election Technology Verification, or RABiT-V. It relies on a risk-based
approach that allows rapid verification of manufacturers' security claims. The RABiT-V
pilot program supports agile software development with a verification process that anticipates and
supports rapid product changes. Goals of the pilot program include incentivizing high-quality
modern design of IT systems updated in smaller, more manageable cycles that reduce cost of
verification and re-verification with more reliable and consistent outcomes for the purchasers of
these systems. I'm excited about the prospects of this pilot, but no matter what, I'm confident that
we'll learn more about how to think about these technologies and can apply those lessons moving
forward. We're committed to expanding the EAC's clearinghouse function
to include information and best practices around non-voting election technology.
And speaking of voting technology, certainly there's nothing more central to the EAC's mission
than the Voluntary Voting System Guidelines. The VVSG are the benchmark for voting system
usability and security across the country. Unfortunately, the standard that is primarily
used was written over a decade ago and therefore preceded many of the more recent technical
innovations that we see in other areas of our lives. The update process for the VVSG is very
public and technical. We received over 1,600 unique public comments on the draft principles
and guidelines. We heard from industry stakeholders, voting advocates, and members of the public.
I'm hopeful that the VVSG 2.0 is on track to be approved by the end of the year.
In order to meet that deadline, the EAC is working on several parallel paths
addressing the VVSG 2.0 technical requirements, test assertions, the testing and certification
program manual, and the voting system test laboratory program manual. So we've got our
work cut out for us, but again, we're pushing through on this and we're working on all of
these areas right now to try to get it done by the end of the year. Speaking of the end of the
year, as we look at the 2020 election, certainly it's important to look back at the 2016 election
and where we've come. As I look at the elections community, it's certainly come together and made
tremendous progress since 2016 and the first voting village at DEFCON in 2017. The EAC regularly
collaborates with partners at the federal, state, and local levels. Earlier you heard from some of
those federal partners at NSA, CISA, and FBI. We also work with the National Association of
Secretaries of State, National Association of State Election Directors, and local election
official organizations to help reach the nearly 9,000 local election officials across the country.
Today, election officials are better educated about cyber and physical threats to their systems
and have access to resources to better help defend those systems. Manufacturers of voting
equipment are also changing their behavior. They are reporting and sharing threat intelligence,
opening up to researchers via bug bounty programs, and working with the EAC to issue critical
software patches much more quickly. And so certainly, you know, it's hard to think about
elections right now without thinking about the upcoming 2020 election and the impact of COVID-19.
Certainly that's why this voting village has been done virtually. And COVID-19 is presenting
unprecedented challenges around our country. And of course, the election administration community
is facing real challenges in determining how to best conduct elections in this environment.
At the EAC, we've pivoted substantially to focus our attention on how we can support state and
local election officials as they learn from their primaries and make tough decisions about the
general election. Between the CARES Act election money and the earlier Consolidated Appropriations
Act of 2020, EAC has distributed about $825 million to the states this year to assist with federal
elections. And we know this funding will be crucial because of the additional expenses related to
running elections during the pandemic. For most jurisdictions, that means running the largest
mail or absentee ballot election they've ever run, but also having safe in-person options as well,
which means social distancing in the polling places and personal protective equipment being
available. And so in ways to address that, we have since April, we've held public hearings.
We've also hosted a number of Zoom videos or web chats where we've brought together experts from the
elections field to discuss these best practices and lessons learned on unrelevant topics to running
an election right now during the pandemic. We've heard about challenges and lessons learned from
ramping up vote-by-mail and heard very practical examples and success stories, as well as pitfalls
and how to avoid them. Because each state runs elections somewhat differently, each response to
this pandemic has been somewhat different. With the changes to the election process,
you know, we know that creates an environment that could be taken advantage of for misinformation or
disinformation. So certainly that is an area of concern, an area that we need to continue to work
on. As you know, we've seen the dates of primaries change, you've seen processes and procedures
change. You know, there will be different polling places because some are not available. Maybe they
were in somewhere like a senior center that's no longer available. And so efforts like the National
Association of Secretaries of State's Trusted Info 2020 effort will be even more crucial.
And it is to the degree that folks from the voting village and other communities can help
promote state and local election officials as that trusted source, pushing out that information
that we know is accurate and helping to combat disinformation is going to be crucial this
election year. And speaking of ways for the voting village to help out, you know, we know there's
plenty of work to do and more work that needs to be done. Election officials, like I mentioned
earlier, absolutely, you know, working around the clock to adapt to the COVID environment
certainly can use assistance, as I mentioned before, on misinformation and disinformation.
But also, you know, researchers, one way to help is to responsibly engage with election officials
and manufacturers. The Cybersecurity and Infrastructure Security Agency, or CISA,
recently published a guide to vulnerability reporting for Americans' election administrators.
It walks election officials through the steps of establishing a vulnerability disclosure program
so that researchers don't end up having their bug reports ignored or having their activities
reported to the FBI as hacking attempts. Another way to help this year is to serve as a poll worker
and reaching out to your local election official to see if you can sign up. Matt Blaze has promoted
this for some time and I certainly appreciate his poll worker recruitment efforts, but this year
poll workers are needed more than ever. It's never an easy thing to recruit poll workers, but we've
seen a significant dropout with COVID-19. Obviously, in a pandemic, it's a personal decision
about serving as a poll worker, but if you're able and willing, that is desperately needed.
In fact, the EAC is announcing that September 1st, we're going to push National Poll Worker
Recruitment Day this year to try to help election officials around the country
get enough poll workers. By encouraging more people to become poll workers in their communities,
National Poll Worker Recruitment Day aims to address the critical shortage of poll workers,
strengthen our democracy, inspire greater civic engagement and volunteerism, and help ensure free
and fair elections in November and beyond. While the specific duties and compensation vary
depending on location, poll workers are the face of the election during voting. Most jurisdictions
task election workers with setting up and preparing the polling location, welcoming voters,
verifying voter registrations, and issuing ballots. Poll workers also help ensure voters
understand the voting process by demonstrating how to use voting equipment and explaining voting
procedures. Poll workers with technical backgrounds are especially important in jurisdictions where
newer voting equipment will be used for the first time, and voters may need a little extra assurance
to become comfortable with the new technology. I hope to see you in person at next year's Voting
Village. In the meantime, if there are ways the EAC can help or recommendations you have for us,
please reach out. Let's keep the conversation going. And again, one last time, if you can do it,
please consider serving as a poll worker. Thank you.