[00:00.000 --> 00:05.000] Good afternoon. My name is Ben Hublin and I'm chairman of the U.S. Election Assistance Commission [00:05.000 --> 00:11.340] or EAC. I appreciate the opportunity to speak at this year's Virtual Voting Village. [00:11.340 --> 00:16.900] I wish I was able to be there in person. Last year I certainly enjoyed the experience and saw a real [00:16.900 --> 00:23.020] step forward in the dialogue and discourse around making our elections more secure. I'll jump into [00:23.020 --> 00:28.080] that more in a minute, but for some background I wanted to start by talking about the EAC [00:28.600 --> 00:36.440] and what we do. The EAC was established by the Help America Vote Act of 2002, or HAVA, [00:36.440 --> 00:43.340] which was Congress's response to the Florida 2000 election. The EAC is an independent bipartisan [00:43.340 --> 00:50.000] commission charged with ensuring secure, accurate, and accessible elections by developing guidance [00:50.000 --> 00:56.100] to meet HAVA requirements, adopting Voluntary Voting System Guidelines, or the VVSG, [00:56.100 --> 01:00.960] and serving as a national clearinghouse of information on election administration. [01:01.540 --> 01:08.420] The EAC also accredits testing laboratories and certifies voting systems, as well as administers [01:08.420 --> 01:15.840] the use of HAVA funds. We are a small agency, which you might not know by the attention we get. [01:15.840 --> 01:20.920] We certainly try to punch above our weight class as an agency with one of the smallest budgets in [01:20.920 --> 01:26.940] federal government. But as an agency, we are committed to providing helpful and up-to-date [01:26.940 --> 01:31.900] information to promote the continuity and integrity of election administration, [01:32.140 --> 01:37.120] despite new challenges such as COVID-19 and cyber interference. [01:39.840 --> 01:47.160] In FY20, the EAC received a budgetary increase from our all-time low, and as an agency we focused [01:47.160 --> 01:53.840] on investing these precious resources wisely in a way that would help the elections. I'm pleased [01:53.840 --> 01:59.300] to be able to tell you today that a number of our new initiatives are already underway and hopefully [01:59.300 --> 02:05.600] already making an impact. As part of our efforts, the EAC launched the Cyber Access and Security [02:05.600 --> 02:13.000] Program this April to provide access to security training, best practices, expertise, and other [02:13.000 --> 02:18.280] assistance for election officials and their IT staff. An important part of this program has been [02:18.280 --> 02:23.840] the addition of staff who have a range of experience in the cybersecurity and elections [02:23.840 --> 02:30.180] fields, including years of expertise in software development and security analysis. The program [02:30.180 --> 02:35.480] partners with public and private security experts with a goal that election officials will have [02:35.480 --> 02:40.640] access to the most up-to-date and best-in-class information available through the EAC's Clearing [02:40.640 --> 02:47.500] House. One of the Cyber Access and Security Program's first projects was in response to a [02:47.500 --> 02:52.780] concern we'd heard from election officials about the volume of cyber expertise and recommendations [02:52.780 --> 02:57.860] that were being developed around the election space and how it would be helpful to have an [02:57.860 --> 03:04.360] organized repository. The EAC's election security preparedness page is designed to be a one-stop [03:04.360 --> 03:10.020] shop for election cybersecurity guidance. It includes resources from federal agencies, [03:10.020 --> 03:16.880] nonprofits, academia, and local election officials. These resources include the work of a number [03:16.880 --> 03:23.360] of individuals associated with the voting village, so thank you. The page was recently updated with [03:23.360 --> 03:29.740] new guidance on security topics that have developed since the 2016 election, and it's been reorganized [03:29.740 --> 03:35.200] to make the information easier to find and use. In addition to pulling resources together, [03:35.200 --> 03:40.640] we've recognized that many of the great resources that have been produced only realize their full [03:40.640 --> 03:45.400] benefit if election officials have a solid foundation to view them from. With that in mind, [03:45.400 --> 03:51.060] in June, the EAC announced online cybersecurity training offered at no cost and developed [03:51.060 --> 03:55.920] specifically for election officials through a partnership with the Center for Tech and Civic [03:55.920 --> 04:03.060] Life, or CTCL. The online training consists of both video and written materials separated into [04:03.060 --> 04:09.740] three modules, Cybersecurity 101, 201, and 301. This is self-paced training, and it provides [04:09.740 --> 04:16.300] foundational knowledge on cybersecurity terminology, best practices in election offices, [04:16.300 --> 04:21.700] practical applications, and communication around cyber incidents. We hope this is a resource that [04:21.700 --> 04:27.660] can benefit any local election official and their staff. We've been promoting it to local election [04:27.660 --> 04:33.080] officials, and you can too. This is available to every state and local election official in the [04:33.080 --> 04:40.560] country at no cost through May of 2021. So far, nearly 200 state and local election officials [04:40.560 --> 04:45.420] who are responsible for running elections for millions of voters and their partners have [04:45.420 --> 04:51.200] completed this training. We plan to continue to focus on training efforts going forward [04:51.200 --> 04:56.460] particularly if our funding trend continues. I would also mention that later this month we're [04:56.460 --> 05:01.980] launching both a risk management and a crisis management online workshop for state and local [05:01.980 --> 05:09.120] election officials. Along those lines, we'll be hosting a joint effort with CISA, an online [05:09.120 --> 05:14.600] risk management tool, allowing election officials at the local level to easily measure and mitigate [05:14.600 --> 05:21.780] risks to their specific environments. Finally, our cyber access and security team is updating [05:21.780 --> 05:27.800] materials currently posted to the EAC website and is working to develop new material related [05:27.800 --> 05:33.080] to vulnerability disclosure programs, social engineering mitigation, and other education [05:33.080 --> 05:40.800] efforts. Another area our cyber access and security team has been working on is non-voting [05:40.800 --> 05:46.580] election technology. Not the best name, but an area of great importance when it comes to securing [05:46.580 --> 05:52.220] our election infrastructure and maintaining public confidence in the electoral process. [05:52.240 --> 05:58.100] First and foremost, I think we all recognize that when you look at the cyber risk profile of [05:58.100 --> 06:04.980] elections, that non-voting election technology like poll books, election night reporting, [06:04.980 --> 06:10.540] and statewide voter registration databases are all potential targets. This is not a secret. [06:10.540 --> 06:15.440] Everyone's been talking about this since 2016, and in fact there have been a number of bills [06:15.440 --> 06:21.020] introduced in Congress to try to do something about the fact that we don't have standards or [06:21.400 --> 06:27.560] a certification program for this type of technology, even though some states do. We know, however, that [06:27.560 --> 06:33.160] the nature of these systems don't necessarily lend themselves to a voluntary voting system [06:33.160 --> 06:40.360] guideline style certification program. With that mind, the EAC has partnered with the Center for [06:40.360 --> 06:47.520] Internet Security, or CIS, and a number of states to pilot a technology verification program focused [06:47.520 --> 06:52.980] on non-voting election technology, including, as I mentioned earlier, electronic poll books, [06:52.980 --> 06:58.680] election night reporting websites, and electronic ballot delivery systems. This program is called [06:58.680 --> 07:05.960] the Rapid Architecture-Based Election Technology Verification, or RABiT-V. It relies on a risk-based [07:05.960 --> 07:12.040] approach that allows rapid verification of manufacturers' security claims. The RABiT-V [07:12.040 --> 07:18.280] pilot program supports agile software development with a verification process that anticipates and [07:18.280 --> 07:25.280] supports rapid product changes. Goals of the pilot program include incentivizing high-quality [07:25.280 --> 07:31.800] modern design of IT systems updated in smaller, more manageable cycles that reduce cost of [07:31.800 --> 07:38.280] verification and re-verification with more reliable and consistent outcomes for the purchasers of [07:38.280 --> 07:43.960] these systems. I'm excited about the prospects of this pilot, but no matter what, I'm confident that [07:43.960 --> 07:49.640] we'll learn more about how to think about these technologies and can apply those lessons moving [07:49.640 --> 07:53.900] forward. We're committed to expanding the EAC's clearinghouse function [07:53.900 --> 07:59.950] to include information and best practices around non-voting election technology. [08:00.580 --> 08:06.360] And speaking of voting technology, certainly there's nothing more central to the EAC's mission [08:06.360 --> 08:13.340] than the Voluntary Voting System Guidelines. The VVSG are the benchmark for voting system [08:13.340 --> 08:18.920] usability and security across the country. Unfortunately, the standard that is primarily [08:18.920 --> 08:24.540] used was written over a decade ago and therefore preceded many of the more recent technical [08:24.540 --> 08:33.480] innovations that we see in other areas of our lives. The update process for the VVSG is very [08:33.480 --> 08:40.500] public and technical. We received over 1,600 unique public comments on the draft principles [08:40.500 --> 08:46.720] and guidelines. We heard from industry stakeholders, voting advocates, and members of the public. [08:46.720 --> 08:52.660] I'm hopeful that the VVSG 2.0 is on track to be approved by the end of the year. [08:52.700 --> 08:57.080] In order to meet that deadline, the EAC is working on several parallel paths [08:57.080 --> 09:04.020] addressing the VVSG 2.0 technical requirements, test assertions, the testing and certification [09:04.020 --> 09:09.960] program manual, and the voting system test laboratory program manual. So we've got our [09:09.960 --> 09:15.320] work cut out for us, but again, we're pushing through on this and we're working on all of [09:15.320 --> 09:21.480] these areas right now to try to get it done by the end of the year. Speaking of the end of the [09:21.480 --> 09:29.600] year, as we look at the 2020 election, certainly it's important to look back at the 2016 election [09:29.600 --> 09:36.200] and where we've come. As I look at the elections community, it's certainly come together and made [09:36.200 --> 09:44.960] tremendous progress since 2016 and the first voting village at DEFCON in 2017. The EAC regularly [09:44.960 --> 09:50.480] collaborates with partners at the federal, state, and local levels. Earlier you heard from some of [09:50.480 --> 09:56.980] those federal partners at NSA, CISA, and FBI. We also work with the National Association of [09:56.980 --> 10:02.340] Secretaries of State, National Association of State Election Directors, and local election [10:02.340 --> 10:09.640] official organizations to help reach the nearly 9,000 local election officials across the country. [10:10.120 --> 10:15.640] Today, election officials are better educated about cyber and physical threats to their systems [10:15.640 --> 10:21.500] and have access to resources to better help defend those systems. Manufacturers of voting [10:21.500 --> 10:26.960] equipment are also changing their behavior. They are reporting and sharing threat intelligence, [10:26.960 --> 10:32.480] opening up to researchers via bug bounty programs, and working with the EAC to issue critical [10:32.480 --> 10:38.000] software patches much more quickly. And so certainly, you know, it's hard to think about [10:38.000 --> 10:45.920] elections right now without thinking about the upcoming 2020 election and the impact of COVID-19. [10:45.920 --> 10:52.740] Certainly that's why this voting village has been done virtually. And COVID-19 is presenting [10:52.740 --> 10:59.440] unprecedented challenges around our country. And of course, the election administration community [10:59.920 --> 11:05.560] is facing real challenges in determining how to best conduct elections in this environment. [11:05.560 --> 11:11.300] At the EAC, we've pivoted substantially to focus our attention on how we can support state and [11:11.300 --> 11:16.540] local election officials as they learn from their primaries and make tough decisions about the [11:16.540 --> 11:24.280] general election. Between the CARES Act election money and the earlier Consolidated Appropriations [11:24.280 --> 11:32.580] Act of 2020, EAC has distributed about $825 million to the states this year to assist with federal [11:32.580 --> 11:38.300] elections. And we know this funding will be crucial because of the additional expenses related to [11:38.300 --> 11:44.660] running elections during the pandemic. For most jurisdictions, that means running the largest [11:44.660 --> 11:51.220] mail or absentee ballot election they've ever run, but also having safe in-person options as well, [11:51.220 --> 11:56.680] which means social distancing in the polling places and personal protective equipment being [11:56.680 --> 12:05.260] available. And so in ways to address that, we have since April, we've held public hearings. [12:05.260 --> 12:11.000] We've also hosted a number of Zoom videos or web chats where we've brought together experts from the [12:11.000 --> 12:17.620] elections field to discuss these best practices and lessons learned on unrelevant topics to running [12:17.620 --> 12:23.700] an election right now during the pandemic. We've heard about challenges and lessons learned from [12:23.700 --> 12:30.340] ramping up vote-by-mail and heard very practical examples and success stories, as well as pitfalls [12:30.340 --> 12:36.040] and how to avoid them. Because each state runs elections somewhat differently, each response to [12:36.040 --> 12:41.600] this pandemic has been somewhat different. With the changes to the election process, [12:41.600 --> 12:48.400] you know, we know that creates an environment that could be taken advantage of for misinformation or [12:48.400 --> 12:54.540] disinformation. So certainly that is an area of concern, an area that we need to continue to work [12:55.240 --> 13:01.940] on. As you know, we've seen the dates of primaries change, you've seen processes and procedures [13:01.940 --> 13:08.520] change. You know, there will be different polling places because some are not available. Maybe they [13:08.520 --> 13:15.040] were in somewhere like a senior center that's no longer available. And so efforts like the National [13:15.040 --> 13:22.220] Association of Secretaries of State's Trusted Info 2020 effort will be even more crucial. [13:22.220 --> 13:28.580] And it is to the degree that folks from the voting village and other communities can help [13:28.580 --> 13:34.940] promote state and local election officials as that trusted source, pushing out that information [13:34.940 --> 13:41.580] that we know is accurate and helping to combat disinformation is going to be crucial this [13:41.580 --> 13:49.720] election year. And speaking of ways for the voting village to help out, you know, we know there's [13:49.720 --> 13:56.260] plenty of work to do and more work that needs to be done. Election officials, like I mentioned [13:56.260 --> 14:02.860] earlier, absolutely, you know, working around the clock to adapt to the COVID environment [14:03.490 --> 14:09.570] certainly can use assistance, as I mentioned before, on misinformation and disinformation. [14:09.860 --> 14:16.980] But also, you know, researchers, one way to help is to responsibly engage with election officials [14:16.980 --> 14:23.060] and manufacturers. The Cybersecurity and Infrastructure Security Agency, or CISA, [14:23.060 --> 14:28.960] recently published a guide to vulnerability reporting for Americans' election administrators. [14:28.960 --> 14:34.280] It walks election officials through the steps of establishing a vulnerability disclosure program [14:34.280 --> 14:39.920] so that researchers don't end up having their bug reports ignored or having their activities [14:39.920 --> 14:46.200] reported to the FBI as hacking attempts. Another way to help this year is to serve as a poll worker [14:46.200 --> 14:52.120] and reaching out to your local election official to see if you can sign up. Matt Blaze has promoted [14:52.120 --> 14:58.740] this for some time and I certainly appreciate his poll worker recruitment efforts, but this year [14:59.600 --> 15:04.920] poll workers are needed more than ever. It's never an easy thing to recruit poll workers, but we've [15:04.920 --> 15:11.760] seen a significant dropout with COVID-19. Obviously, in a pandemic, it's a personal decision [15:11.760 --> 15:18.160] about serving as a poll worker, but if you're able and willing, that is desperately needed. [15:18.160 --> 15:25.600] In fact, the EAC is announcing that September 1st, we're going to push National Poll Worker [15:25.600 --> 15:30.220] Recruitment Day this year to try to help election officials around the country [15:30.880 --> 15:37.120] get enough poll workers. By encouraging more people to become poll workers in their communities, [15:37.120 --> 15:42.840] National Poll Worker Recruitment Day aims to address the critical shortage of poll workers, [15:42.840 --> 15:49.100] strengthen our democracy, inspire greater civic engagement and volunteerism, and help ensure free [15:49.100 --> 15:54.960] and fair elections in November and beyond. While the specific duties and compensation vary [15:55.560 --> 16:01.860] depending on location, poll workers are the face of the election during voting. Most jurisdictions [16:01.860 --> 16:07.940] task election workers with setting up and preparing the polling location, welcoming voters, [16:07.940 --> 16:14.060] verifying voter registrations, and issuing ballots. Poll workers also help ensure voters [16:14.060 --> 16:19.920] understand the voting process by demonstrating how to use voting equipment and explaining voting [16:19.920 --> 16:25.780] procedures. Poll workers with technical backgrounds are especially important in jurisdictions where [16:25.780 --> 16:32.220] newer voting equipment will be used for the first time, and voters may need a little extra assurance [16:32.920 --> 16:39.320] to become comfortable with the new technology. I hope to see you in person at next year's Voting [16:39.320 --> 16:46.120] Village. In the meantime, if there are ways the EAC can help or recommendations you have for us, [16:46.120 --> 16:52.220] please reach out. Let's keep the conversation going. And again, one last time, if you can do it, [16:52.220 --> 16:54.900] please consider serving as a poll worker. Thank you.