WEBVTT 00:00.000 --> 00:01.160 Good afternoon. 00:01.160 --> 00:03.640 My name is Ben Hublin and I'm chairman of the U.S. 00:03.640 --> 00:06.600 Election Assistance Commission or EAC. 00:06.880 --> 00:11.340 I appreciate the opportunity to speak at this year's Virtual Voting Village. 00:11.340 --> 00:13.900 I wish I was able to be there in person. 00:13.940 --> 00:22.280 Last year I certainly enjoyed the experience and saw a real step forward in the dialogue and discourse around making our elections more secure. 00:22.320 --> 00:30.460 I'll jump into that more in a minute, but for some background I wanted to start by talking about the EAC and what we do. 00:30.600 --> 00:40.980 The EAC was established by the Help America Vote Act of 2002, or HAVA, which was Congress's response to the Florida 2000 election. 00:41.040 --> 01:00.960 The EAC is an independent bipartisan commission charged with ensuring secure, accurate, and accessible elections by developing guidance to meet HAVA requirements, adopting Voluntary Voting System Guidelines, or the VVSG, and serving as a national clearinghouse of information on election administration. 01:01.540 --> 01:10.540 The EAC also accredits testing laboratories and certifies voting systems, as well as administers the use of HAVA funds. 01:10.840 --> 01:15.840 We are a small agency, which you might not know by the attention we get. 01:15.840 --> 01:22.440 We certainly try to punch above our weight class as an agency with one of the smallest budgets in federal government. 01:22.440 --> 01:37.120 But as an agency, we are committed to providing helpful and up-to-date information to promote the continuity and integrity of election administration, despite new challenges such as COVID-19 and cyber interference. 01:39.840 --> 01:53.000 In FY20, the EAC received a budgetary increase from our all-time low, and as an agency we focused on investing these precious resources wisely in a way that would help the elections. 01:53.140 --> 02:01.320 I'm pleased to be able to tell you today that a number of our new initiatives are already underway and hopefully already making an impact. 02:01.320 --> 02:16.300 As part of our efforts, the EAC launched the Cyber Access and Security Program this April to provide access to security training, best practices, expertise, and other assistance for election officials and their IT staff. 02:16.360 --> 02:29.620 An important part of this program has been the addition of staff who have a range of experience in the cybersecurity and elections fields, including years of expertise in software development and security analysis. 02:29.620 --> 02:41.600 The program partners with public and private security experts with a goal that election officials will have access to the most up-to-date and best-in-class information available through the EAC's Clearing House. 02:42.020 --> 02:59.140 One of the Cyber Access and Security Program's first projects was in response to a concern we'd heard from election officials about the volume of cyber expertise and recommendations that were being developed around the election space and how it would be helpful to have an organized repository. 02:59.560 --> 03:07.240 The EAC's election security preparedness page is designed to be a one-stop shop for election cybersecurity guidance. 03:07.240 --> 03:14.160 It includes resources from federal agencies, nonprofits, academia, and local election officials. 03:14.300 --> 03:20.960 These resources include the work of a number of individuals associated with the voting village, so thank you. 03:20.960 --> 03:32.900 The page was recently updated with new guidance on security topics that have developed since the 2016 election, and it's been reorganized to make the information easier to find and use. 03:32.980 --> 03:44.520 In addition to pulling resources together, we've recognized that many of the great resources that have been produced only realize their full benefit if election officials have a solid foundation to view them from. 03:44.520 --> 03:57.760 With that in mind, in June, the EAC announced online cybersecurity training offered at no cost and developed specifically for election officials through a partnership with the Center for Tech and Civic Life, or CTCL. 03:57.760 --> 04:07.560 The online training consists of both video and written materials separated into three modules, Cybersecurity 101, 201, and 301. 04:07.560 --> 04:20.160 This is self-paced training, and it provides foundational knowledge on cybersecurity terminology, best practices in election offices, practical applications, and communication around cyber incidents. 04:20.160 --> 04:25.860 We hope this is a resource that can benefit any local election official and their staff. 04:25.860 --> 04:29.980 We've been promoting it to local election officials, and you can too. 04:30.000 --> 04:36.920 This is available to every state and local election official in the country at no cost through May of 2021. 04:37.320 --> 04:47.180 So far, nearly 200 state and local election officials who are responsible for running elections for millions of voters and their partners have completed this training. 04:47.320 --> 04:54.240 We plan to continue to focus on training efforts going forward particularly if our funding trend continues. 04:54.240 --> 05:03.300 I would also mention that later this month we're launching both a risk management and a crisis management online workshop for state and local election officials. 05:03.300 --> 05:18.160 Along those lines, we'll be hosting a joint effort with CISA, an online risk management tool, allowing election officials at the local level to easily measure and mitigate risks to their specific environments. 05:18.160 --> 05:34.620 Finally, our cyber access and security team is updating materials currently posted to the EAC website and is working to develop new material related to vulnerability disclosure programs, social engineering mitigation, and other education efforts. 05:34.980 --> 05:42.380 Another area our cyber access and security team has been working on is non-voting election technology. 05:42.380 --> 05:52.220 Not the best name, but an area of great importance when it comes to securing our election infrastructure and maintaining public confidence in the electoral process. 05:52.240 --> 06:09.020 First and foremost, I think we all recognize that when you look at the cyber risk profile of elections, that non-voting election technology like poll books, election night reporting, and statewide voter registration databases are all potential targets. 06:09.020 --> 06:10.540 This is not a secret. 06:10.540 --> 06:26.320 Everyone's been talking about this since 2016, and in fact there have been a number of bills introduced in Congress to try to do something about the fact that we don't have standards or a certification program for this type of technology, even though some states do. 06:26.500 --> 06:36.620 We know, however, that the nature of these systems don't necessarily lend themselves to a voluntary voting system guideline style certification program. 06:36.640 --> 06:52.980 With that mind, the EAC has partnered with the Center for Internet Security, or CIS, and a number of states to pilot a technology verification program focused on non-voting election technology, including, as I mentioned earlier, electronic poll books, 06:52.980 --> 06:57.500 election night reporting websites, and electronic ballot delivery systems. 06:57.500 --> 07:04.440 This program is called the Rapid Architecture-Based Election Technology Verification, or RABiT-V. 07:04.440 --> 07:11.380 It relies on a risk-based approach that allows rapid verification of manufacturers' security claims. 07:11.380 --> 07:20.880 The RABiT-V pilot program supports agile software development with a verification process that anticipates and supports rapid product changes. 07:20.880 --> 07:39.460 Goals of the pilot program include incentivizing high-quality modern design of IT systems updated in smaller, more manageable cycles that reduce cost of verification and re-verification with more reliable and consistent outcomes for the purchasers of these systems. 07:39.460 --> 07:50.580 I'm excited about the prospects of this pilot, but no matter what, I'm confident that we'll learn more about how to think about these technologies and can apply those lessons moving forward. 07:50.580 --> 07:59.950 We're committed to expanding the EAC's clearinghouse function to include information and best practices around non-voting election technology. 08:00.580 --> 08:09.800 And speaking of voting technology, certainly there's nothing more central to the EAC's mission than the Voluntary Voting System Guidelines. 08:09.800 --> 08:16.600 The VVSG are the benchmark for voting system usability and security across the country. 08:16.600 --> 08:29.680 Unfortunately, the standard that is primarily used was written over a decade ago and therefore preceded many of the more recent technical innovations that we see in other areas of our lives. 08:29.820 --> 08:35.940 The update process for the VVSG is very public and technical. 08:35.940 --> 08:41.820 We received over 1,600 unique public comments on the draft principles and guidelines. 08:41.820 --> 08:46.720 We heard from industry stakeholders, voting advocates, and members of the public. 08:46.720 --> 08:52.660 I'm hopeful that the VVSG 2.0 is on track to be approved by the end of the year. 08:52.700 --> 09:09.080 In order to meet that deadline, the EAC is working on several parallel paths addressing the VVSG 2.0 technical requirements, test assertions, the testing and certification program manual, and the voting system test laboratory program manual. 09:09.080 --> 09:18.880 So we've got our work cut out for us, but again, we're pushing through on this and we're working on all of these areas right now to try to get it done by the end of the year. 09:20.140 --> 09:31.720 Speaking of the end of the year, as we look at the 2020 election, certainly it's important to look back at the 2016 election and where we've come. 09:31.740 --> 09:43.660 As I look at the elections community, it's certainly come together and made tremendous progress since 2016 and the first voting village at DEFCON in 2017. 09:43.700 --> 09:49.060 The EAC regularly collaborates with partners at the federal, state, and local levels. 09:49.060 --> 09:53.920 Earlier you heard from some of those federal partners at NSA, CISA, and FBI. 09:54.000 --> 10:09.640 We also work with the National Association of Secretaries of State, National Association of State Election Directors, and local election official organizations to help reach the nearly 9,000 local election officials across the country. 10:10.120 --> 10:20.160 Today, election officials are better educated about cyber and physical threats to their systems and have access to resources to better help defend those systems. 10:20.420 --> 10:24.060 Manufacturers of voting equipment are also changing their behavior. 10:24.060 --> 10:34.980 They are reporting and sharing threat intelligence, opening up to researchers via bug bounty programs, and working with the EAC to issue critical software patches much more quickly. 10:34.980 --> 10:45.920 And so certainly, you know, it's hard to think about elections right now without thinking about the upcoming 2020 election and the impact of COVID-19. 10:45.920 --> 10:50.580 Certainly that's why this voting village has been done virtually. 10:51.020 --> 10:55.960 And COVID-19 is presenting unprecedented challenges around our country. 10:55.960 --> 11:05.560 And of course, the election administration community is facing real challenges in determining how to best conduct elections in this environment. 11:05.560 --> 11:18.060 At the EAC, we've pivoted substantially to focus our attention on how we can support state and local election officials as they learn from their primaries and make tough decisions about the general election. 11:18.060 --> 11:33.560 Between the CARES Act election money and the earlier Consolidated Appropriations Act of 2020, EAC has distributed about $825 million to the states this year to assist with federal elections. 11:33.560 --> 11:41.040 And we know this funding will be crucial because of the additional expenses related to running elections during the pandemic. 11:41.040 --> 11:57.900 For most jurisdictions, that means running the largest mail or absentee ballot election they've ever run, but also having safe in-person options as well, which means social distancing in the polling places and personal protective equipment being available. 11:58.160 --> 12:05.260 And so in ways to address that, we have since April, we've held public hearings. 12:05.260 --> 12:20.620 We've also hosted a number of Zoom videos or web chats where we've brought together experts from the elections field to discuss these best practices and lessons learned on unrelevant topics to running an election right now during the pandemic. 12:20.620 --> 12:31.860 We've heard about challenges and lessons learned from ramping up vote-by-mail and heard very practical examples and success stories, as well as pitfalls and how to avoid them. 12:31.860 --> 12:38.540 Because each state runs elections somewhat differently, each response to this pandemic has been somewhat different. 12:38.540 --> 12:49.060 With the changes to the election process, you know, we know that creates an environment that could be taken advantage of for misinformation or disinformation. 12:49.060 --> 12:56.040 So certainly that is an area of concern, an area that we need to continue to work on. 12:56.040 --> 13:03.040 As you know, we've seen the dates of primaries change, you've seen processes and procedures change. 13:03.200 --> 13:08.220 You know, there will be different polling places because some are not available. 13:08.220 --> 13:12.880 Maybe they were in somewhere like a senior center that's no longer available. 13:12.880 --> 13:22.220 And so efforts like the National Association of Secretaries of State's Trusted Info 2020 effort will be even more crucial. 13:22.220 --> 13:43.000 And it is to the degree that folks from the voting village and other communities can help promote state and local election officials as that trusted source, pushing out that information that we know is accurate and helping to combat disinformation is going to be crucial this election year. 13:43.000 --> 13:53.800 And speaking of ways for the voting village to help out, you know, we know there's plenty of work to do and more work that needs to be done. 13:53.820 --> 14:09.570 Election officials, like I mentioned earlier, absolutely, you know, working around the clock to adapt to the COVID environment certainly can use assistance, as I mentioned before, on misinformation and disinformation. 14:09.860 --> 14:18.680 But also, you know, researchers, one way to help is to responsibly engage with election officials and manufacturers. 14:18.680 --> 14:28.960 The Cybersecurity and Infrastructure Security Agency, or CISA, recently published a guide to vulnerability reporting for Americans' election administrators. 14:28.960 --> 14:42.620 It walks election officials through the steps of establishing a vulnerability disclosure program so that researchers don't end up having their bug reports ignored or having their activities reported to the FBI as hacking attempts. 14:42.620 --> 14:50.780 Another way to help this year is to serve as a poll worker and reaching out to your local election official to see if you can sign up. 14:50.780 --> 15:02.280 Matt Blaze has promoted this for some time and I certainly appreciate his poll worker recruitment efforts, but this year poll workers are needed more than ever. 15:02.280 --> 15:08.700 It's never an easy thing to recruit poll workers, but we've seen a significant dropout with COVID-19. 15:08.720 --> 15:18.160 Obviously, in a pandemic, it's a personal decision about serving as a poll worker, but if you're able and willing, that is desperately needed. 15:18.160 --> 15:33.040 In fact, the EAC is announcing that September 1st, we're going to push National Poll Worker Recruitment Day this year to try to help election officials around the country get enough poll workers. 15:33.040 --> 15:51.940 By encouraging more people to become poll workers in their communities, National Poll Worker Recruitment Day aims to address the critical shortage of poll workers, strengthen our democracy, inspire greater civic engagement and volunteerism, and help ensure free and fair elections in November and beyond. 15:52.060 --> 16:01.000 While the specific duties and compensation vary depending on location, poll workers are the face of the election during voting. 16:01.000 --> 16:12.120 Most jurisdictions task election workers with setting up and preparing the polling location, welcoming voters, verifying voter registrations, and issuing ballots. 16:12.120 --> 16:21.340 Poll workers also help ensure voters understand the voting process by demonstrating how to use voting equipment and explaining voting procedures. 16:21.340 --> 16:36.060 Poll workers with technical backgrounds are especially important in jurisdictions where newer voting equipment will be used for the first time, and voters may need a little extra assurance to become comfortable with the new technology. 16:36.280 --> 16:40.240 I hope to see you in person at next year's Voting Village. 16:40.240 --> 16:47.280 In the meantime, if there are ways the EAC can help or recommendations you have for us, please reach out. 16:47.280 --> 16:49.540 Let's keep the conversation going. 16:49.660 --> 16:54.240 And again, one last time, if you can do it, please consider serving as a poll worker. 16:54.240 --> 16:54.900 Thank you.