[00:09.950 --> 00:14.930]  All right, so yes, I am a stunt double here stepping in for Jake Braun from the White House
[00:14.930 --> 00:21.870]  who was unable to make it. So I'm coming into this pretty hot and I have reviewed the concept
[00:21.870 --> 00:25.690]  of the panel and so we're going to go through this. But we're going to talk about a range of
[00:25.690 --> 00:32.370]  issues looking ahead to the 2024 election and kind of drawing on some of the lessons of the past from
[00:32.370 --> 00:39.370]  2018, 2020, 2022, and now 24. What are A, you know, the threats that we're worried about,
[00:39.370 --> 00:44.810]  the threats that we need to be preparing for, and then across the cyber and physical
[00:45.570 --> 00:53.690]  threat vectors, what are A, the things we need to be doing and B, what are the available tools,
[00:53.690 --> 00:58.750]  what are the available partnerships with the federal government and with the private sector
[00:58.750 --> 01:05.170]  that are available. So with that, let me go ahead and start on, Ashley, maybe we'll start with you
[01:05.170 --> 01:10.490]  on the threat side. So you're Director of Threat Intelligence for Research Labs.
[01:10.490 --> 01:17.970]  What are you seeing out there, both kind of historically and, you know, as we look forward
[01:17.970 --> 01:22.150]  from an almost strategic intelligence perspective, what are we seeing, what should we be expecting
[01:22.150 --> 01:27.890]  as threats for the 24 election? Yeah, I don't think it's any secret that the volume, oh god,
[01:27.890 --> 01:36.050]  that sounds horrible, that the volume, okay, perfect, I'm gonna stand. It's very important now.
[01:36.250 --> 01:40.310]  I don't think it's any secret that the volume of things always tends to pick up as we approach
[01:40.310 --> 01:46.070]  election season. The research teams at Reversing Labs sort of have two primary focuses. One of
[01:46.070 --> 01:52.010]  those is on more traditional malware. The other of those is on open source threats, so third-party
[01:52.010 --> 01:57.230]  libraries, things that would be used by developers. And so what we're seeing, really interestingly,
[01:57.230 --> 02:04.250]  is a sort of blending of those two. And so, for example, something we saw recently was an instance
[02:04.250 --> 02:09.810]  where a phishing kit had actually been shoved in this third-party library. And so if you received
[02:09.810 --> 02:14.810]  this as a malicious attachment, standard phishing campaign, you know, it's not anything particularly
[02:14.810 --> 02:20.990]  exciting, but if you were a developer who happened to use this library, then now your application
[02:20.990 --> 02:25.410]  would be serving this phishing kit as well. So we're starting to see more and more instances
[02:25.410 --> 02:31.550]  where things like malware have been just shoved into open source libraries. Very strategically,
[02:31.550 --> 02:36.210]  we're seeing the link of these sort of supply chain, software supply chain rather, threats
[02:36.210 --> 02:41.930]  with the more traditional malware. I think that adds a level of complexity that makes it a little
[02:41.930 --> 02:48.350]  more difficult from a defender's perspective. So always, of course, working to try and advance
[02:48.350 --> 02:57.610]  those detection solutions. Yeah, and I think... so I'll stand up. Putting this into the context
[02:57.610 --> 03:06.130]  that you've laid down, I go back to the post-2016 election intelligence community assessment that
[03:06.130 --> 03:11.430]  laid out the three lines of effort that the Russians took. First was the technical attacks
[03:11.430 --> 03:16.530]  on election systems throughout the country, the voter registration databases. But of course,
[03:16.530 --> 03:21.430]  by natural extension, we would include voting equipment and systems within that. And then you've
[03:21.430 --> 03:27.950]  got the disinformation piece, and then the hack and leak campaigns against campaigns and political
[03:27.950 --> 03:33.450]  parties. So I think we'll put that part, those two other aside between disinformation and the
[03:33.450 --> 03:41.490]  hack and leak on campaigns and focus, you know, pretty exclusively here on those threats
[03:41.490 --> 03:45.770]  as actually laid out that we may find in the systems that are used with elections. All right,
[03:45.770 --> 03:50.630]  so jumping on that, I will say though, it's not just going to be cyber, there will be physical
[03:51.030 --> 03:56.830]  considerations here as well. All right, so Michael, you know, with some of the threat landscape that
[03:56.830 --> 04:03.310]  actually laid out, and what you do from a day-to-day perspective or basis in Aracopa County,
[04:03.970 --> 04:08.250]  what are you seeing? What have you seen historically? Can you tell us a little bit
[04:08.250 --> 04:14.270]  of kind of the volume of attacks that you see on a daily basis? And what are the key tools that you
[04:14.270 --> 04:20.090]  have? And some of the things you think you need, you and your peers, you can anonymously throw
[04:20.090 --> 04:24.910]  your peers under the bus. But what are the things that you see that your peers are really struggling
[04:24.910 --> 04:30.150]  with or need to improve as we go out to 24? All right, I guess I'll stand as well. Can you guys
[04:30.150 --> 04:37.970]  hear me okay? Everyone's okay in the back? Awesome. So my peers, I would call my customers,
[04:37.970 --> 04:42.210]  I'm gonna shift this way a little bit, so hopefully less feedback. I'm actually over
[04:52.430 --> 04:56.510]  at the Arizona Secretary of State's office, that's the biggest county in Arizona. Now I'm at the
[04:56.510 --> 05:00.730]  Arizona Secretary of State's office. I'm the CISO there. I consider myself to be the virtual CISO,
[05:00.730 --> 05:07.710]  and I've offered my services to all of the counties. So to me, you know, we lean incredibly
[05:07.710 --> 05:12.600]  heavily on the Arizona Department of Homeland Security, sorry for all these entities, long names.
[05:12.790 --> 05:20.810]  They have the Cyber Readiness Program. So this uses federal citizen DHS grant funds,
[05:20.810 --> 05:27.350]  and as well as ongoing state funds that have been dedicated to provide best-in-class solutions to
[05:27.350 --> 05:34.290]  all government entities in Arizona. So in the Arizona elections community, we have regular
[05:34.290 --> 05:38.970]  statewide election security meetings, both for leadership teams as well as our IT teams,
[05:38.970 --> 05:45.510]  and we've been heavily promoting like, folks, if you already have a solution, cool. If you love it,
[05:45.510 --> 05:51.190]  stick with it. But if you don't have the solution, here it is for free. It's already paid for
[05:51.190 --> 05:56.810]  in this hub-and-spoke model, where we can use collective purchasing to get these best-in-class
[05:56.810 --> 06:02.070]  controls. They're paid for. We have contract services to help you implement them. So that's
[06:02.070 --> 06:06.910]  something we've been pushing incredibly heavily to all of the counties for the past few months,
[06:06.910 --> 06:13.530]  especially because I know folks may not necessarily enjoy hearing this. We had a little
[06:13.530 --> 06:19.330]  bit of conversation before the panel. The idea that there's a vulnerability, oh, just patch it,
[06:19.330 --> 06:23.950]  like that's not necessarily feasible when it comes to operational elections, right?
[06:23.950 --> 06:29.750]  If you guys have worked in IT at all, you know that sometimes patching something breaks things.
[06:29.750 --> 06:35.530]  With elections, high availability. You can't be down on election day. That's crazy, right? So you
[06:35.530 --> 06:43.830]  have a defense in depth to protect things. So, long rambling? Bound. No, no, no. Can I add just one
[06:43.830 --> 06:50.870]  thing to that? Yeah, go ahead. I do think, though, that it is important if you know that a vulnerability
[06:50.870 --> 06:56.070]  exists, that's great. A lot of folks don't even know that something is out there. And so if you
[06:56.070 --> 07:00.850]  know that you have a vulnerability and maybe you can't patch it, at least you know and you can put
[07:00.850 --> 07:06.390]  resources and eyes on it and watch for that to potentially be exploited. So that's pretty solid.
[07:06.390 --> 07:12.430]  It's better than zero. If I could tag onto that briefly? So, yeah, yeah, yeah, absolutely. And
[07:12.430 --> 07:16.770]  obviously we're members of MS-ISAC, E-I-I-SAC. If that's new to you, it's the Multi-State
[07:16.770 --> 07:21.930]  Information and Analysis Center, as well as the Elections Infrastructure ISAC. So
[07:21.930 --> 07:27.870]  these communities let you know, hey, there's this critical vulnerability, right? So like
[07:27.870 --> 07:34.970]  Log4J, you recall Log4J, or there was a huge Microsoft Exchange issue recently, right? Those
[07:34.970 --> 07:39.050]  kind of things, it's, I know that we're in a change freeze right now. We're close to an election, but
[07:39.050 --> 07:45.030]  there's no, you have to patch this stuff. You cannot wait. So there is that.
[07:45.790 --> 07:51.910]  So, John, maybe let's pivot away from cyber for now and then talk about some of the physical
[07:51.930 --> 07:58.970]  and resilience issues, because maybe you can tell people, you know, what life's like in Vermont,
[07:59.610 --> 08:05.230]  administering elections up there and, you know, the set of threats and challenges that you have
[08:05.230 --> 08:10.250]  to deal with on a daily basis. And then what I want to do is come back around after and talk
[08:10.250 --> 08:16.750]  about what help you get from federal government, what's helpful, and then what more do we need?
[08:16.750 --> 08:20.490]  But then also what are some of the other mechanisms we use? Talk a little bit more
[08:20.490 --> 08:23.610]  about the ICE acts, for instance. So start with our physical.
[08:24.190 --> 08:28.470]  Yeah, of course, the election administration right there on the ground is where the
[08:29.050 --> 08:33.950]  conspiracy theories really hit the strongest. We're going to be front lines in a very sort of
[08:33.950 --> 08:40.710]  physical way with that level of attack and that level of suppression. Because I think when people
[08:40.710 --> 08:45.410]  start hearing more about threats to polling places and more about threats to election workers, it
[08:45.410 --> 08:50.710]  makes them a little less confident in coming out to the polls. In Vermont, you know, New England
[08:50.710 --> 08:55.490]  works a little differently than I think most of the rest of the country. We have very small
[08:55.490 --> 09:00.270]  jurisdictions. Jurisdictions that can be as... it's at the town level, not the county level,
[09:00.270 --> 09:04.970]  so jurisdictions can be as small. In New Hampshire, say, of a town of 10, 12 people,
[09:04.970 --> 09:13.550]  will be just as much an election jurisdiction as Boston. So that creates a whole lot of different
[09:13.550 --> 09:19.770]  dynamics. It makes things much more personal. And especially since it's a blue area, you haven't
[09:19.770 --> 09:24.890]  heard of the kind of really awful stuff that's been taking place in the southeast and the southwest
[09:25.550 --> 09:34.170]  with really direct threats. Even I've heard of literal attacks on election administrators,
[09:34.170 --> 09:39.270]  election workers, poll workers down there. But we are getting some early indications that that's
[09:39.270 --> 09:46.250]  changing. In my own jurisdiction, they hit the sweet spot when I could get rid of my ballots
[09:46.250 --> 09:52.090]  from the presidential, and they were still part of public record. We had a recount done by a lot
[09:52.090 --> 09:59.650]  of folks who felt that the election had been phony, and they showed up en masse into my town.
[09:59.730 --> 10:06.670]  And basically that was a shot across the bow. The last election, also the midterm election,
[10:06.670 --> 10:11.810]  we had a lot more folks showing up in smaller Vermont towns, despite the fact that these are
[10:11.810 --> 10:16.450]  small, tight communities. You're starting to see those same divisions, people coming up
[10:16.450 --> 10:21.910]  just to create havoc, just to create problems. So I think if you're starting to see that wave,
[10:21.910 --> 10:27.890]  even coming up into true blue, you know, New England, I think this is going to be a doozy
[10:27.890 --> 10:33.410]  next time around. And I don't know what to expect. I definitely worry quite a bit for my
[10:33.410 --> 10:38.950]  companions in election administration in the South, but I think we're going to see
[10:39.650 --> 10:45.430]  the conspiracy theorists out on a scale we are probably not prepared for.
[10:45.930 --> 10:53.290]  Let me just kind of jump onto that. So it seems to me you're expecting additional activity. How are
[10:53.290 --> 11:01.750]  you pulling together intelligence, so to speak? And what are your preparations for next year,
[11:01.750 --> 11:07.070]  assuming that you will see more kind of on the ground disruptions? You know,
[11:07.070 --> 11:12.330]  Arizona obviously saw a lot of that from the poll watchers and whatnot last year in 22.
[11:12.350 --> 11:17.270]  You know, are you trying to pull together lessons learned from 22 that you may have seen in Maricopa
[11:17.270 --> 11:24.110]  and then draw them for Vermont? It's difficult to draw because of the scale. So we're in a
[11:24.110 --> 11:27.890]  situation where we need to work really, and I am working much more directly with local law
[11:27.890 --> 11:35.210]  enforcement. We're modifying our continuity of operations plans, given the new threat landscape
[11:35.210 --> 11:39.390]  and what it looks like, which is very different than what I've had for the last 10 years doing
[11:39.390 --> 11:45.910]  this. It's sort of having to reimagine that from the bottom up, but really bringing in that local
[11:45.910 --> 11:50.330]  law enforcement as a full partner in the election process, which is something I haven't really done
[11:50.330 --> 11:59.970]  before. Given the sort of micro-jurisdictional layout landscape, we only get so much assistance,
[11:59.970 --> 12:04.990]  or only so much assistance from the Secretary of State is really practical. So we really are
[12:04.990 --> 12:08.810]  largely on our own in a way that I don't think you see in the rest of the country. And again,
[12:08.810 --> 12:15.130]  I'm not just talking about Vermont. Vermont is kind of an extreme case, but this municipal-based
[12:16.070 --> 12:20.850]  jurisdiction level is common throughout New England. And we're often so small,
[12:20.850 --> 12:28.130]  we're not in a position to take advantage of resources like the EIISAC, which are really
[12:28.130 --> 12:35.150]  scaled. We're sort of the forgotten stepchildren here of the election process, because we're such
[12:35.270 --> 12:42.110]  a small scale. We can only get so much help when the help is really targeted towards more moderate
[12:42.110 --> 12:46.430]  or higher scale levels. So we're largely on our own.
[12:50.570 --> 12:55.730]  So speaking about physical security, we have been going at the Secretary of State's office,
[12:55.730 --> 12:59.470]  along with some of our security partners, have been going out to each of our counties
[12:59.470 --> 13:05.150]  and touring their facility and talking to them about solutions at their space, looking to see,
[13:05.670 --> 13:11.870]  is there any kind of physical security improvements at your elections facility? Is there anything you
[13:11.870 --> 13:16.490]  can do to increase the hardening of your elections equipment? Can you implement port blockers? Those
[13:16.490 --> 13:20.350]  are basically free, right? Little pieces of plastic, you shove in a port, that way if somebody
[13:20.350 --> 13:25.890]  is somehow in your secure area, they can't casually plug something in. Cool. Next step,
[13:25.890 --> 13:34.170]  security enclosures. For like $100, you can buy a secure case to put any kind of PC in there that's
[13:34.170 --> 13:38.710]  in your critical infrastructure space. We're trying to fight a Stuxnet situation, right? I'm
[13:38.710 --> 13:44.610]  sure you're all familiar with Stuxnet, right? So the tabulation room, that's our nuclear reactor,
[13:44.610 --> 13:50.990]  we want to protect it. We've also been recommending, at Maricopa and at the Secretary of State's
[13:50.990 --> 13:55.990]  office, we've engaged in active shooter training, defense against active shooter training. I'd
[13:55.990 --> 14:01.010]  rather over-prepare and never need it, I hope we never need it, but there could be a shooter event,
[14:01.010 --> 14:04.470]  and I want to make sure that our staff are as prepared as possible and have a plan,
[14:04.470 --> 14:11.450]  run, hide, fight. And I'll tell you, we did the ALICE version put on by our Capitol Police,
[14:11.450 --> 14:16.870]  and that really underlined for me, like, the first rule is run. You're not an action hero.
[14:17.090 --> 14:22.370]  Every single time in the practical, when they had like a nerf gun, I got shot every single time.
[14:22.370 --> 14:26.590]  Every single time, I didn't immediately run away. So sincerely, if there's ever a shooter event,
[14:26.590 --> 14:31.010]  there's my advice to you, run away as fast as you can. Other than that, we work incredibly close
[14:31.010 --> 14:37.630]  with our sheriffs. And so we've made sure that when we go out to the counties, make sure you know
[14:37.630 --> 14:42.150]  your security folk, bring them to the table. Let's talk to them. Bring your facility folk. Are there
[14:42.150 --> 14:46.710]  any doors that need additional hardening? Do you need any cameras to make sure you have the
[14:46.710 --> 14:54.490]  visibility on things? What? Oh, yeah, yeah, sorry. We've also, again, this is a bit macabre, but
[14:55.070 --> 15:00.150]  we've put together some defense against active shooter kits as well. If you notice the doors
[15:00.150 --> 15:04.610]  that have the metal hinges on them, if you cover that with some piece of old fire hose, it's
[15:04.610 --> 15:08.950]  basically a physical barrier. Those doors can't physically open anymore. That's one of the
[15:08.950 --> 15:14.110]  recommendations we got from the federal DHS when they come out and do physical security assessments
[15:14.110 --> 15:19.550]  of our facilities. We've also included a glass breaking kit. If you need, if you're on a ground
[15:19.550 --> 15:25.670]  floor, you have a window, you can break the glass, get out. Tourniquets, chest seals, if somebody gets
[15:26.210 --> 15:32.990]  shot, it's depressing stuff. At Maricopa, we also had a third of our staff CPR trained, right? If
[15:32.990 --> 15:37.510]  someone has a heart attack, they're ready to go. We're also recommending to take stop the bleed
[15:37.510 --> 15:41.630]  training, which if somebody gets shot, you know, it teaches you how to apply a tourniquet. If you
[15:41.630 --> 15:45.130]  get shot in the chest, it's important that you don't just try to pack it. You need the chest
[15:45.130 --> 15:51.830]  seal to protect yourself appropriately. John, is there anything you would want to add on the
[15:51.830 --> 15:57.890]  active shooter piece? Or Michael, pretty much cover it in grave, depressing detail. Sorry, sir.
[15:58.450 --> 16:03.610]  Well, I would add a little to the first part, just to be more depressing. The first part,
[16:03.610 --> 16:09.710]  where you talked about literal physical security. I'm gonna harp on the very small jurisdictions
[16:09.710 --> 16:15.390]  thing again. This is my mantra. I've been talking about it at DEF CONs for years. Well, just to be
[16:15.390 --> 16:22.230]  clear, you know, while New England may not resemble Arizona, Wisconsin and Michigan also
[16:22.230 --> 16:28.450]  have a significant number of individual jurisdictions in those states. Right, right. And
[16:28.450 --> 16:38.050]  also town-based in cases. Yeah, absolutely. And even something as simple as cameras are something
[16:38.050 --> 16:44.490]  I don't have. And the money does not come from the top to allow for that. Elections are traditionally
[16:44.490 --> 16:51.130]  done some, you know, this is a traditional town meeting part of the country, right? Where old
[16:51.130 --> 16:57.150]  style democracy folks, the history of these towns is to all come together and yell and shout and
[16:57.150 --> 17:06.170]  fight it out and make your decisions. It's cute sometimes. But that's the tradition we're dealing
[17:06.170 --> 17:12.430]  with. So that the resources, we don't get a lot of resources from the top down. So resources for
[17:12.430 --> 17:18.770]  defense in depth, for everything from vaults to cameras to security personnel to any other
[17:18.770 --> 17:23.390]  features like that do tend to come from the resources of the individual town. So it's
[17:23.390 --> 17:29.730]  another place where we are behind and there needs to be something done, basically. And
[17:29.730 --> 17:37.310]  some of us are working on it. See what comes of it. Let's talk about those resources a little bit.
[17:37.870 --> 17:46.110]  Post-2016 in the U.S. government, a number of things changed in and around the 2016 election
[17:46.110 --> 17:54.710]  immediately following. So for one, CISA, which was then named differently at DHS, known as NPPD,
[17:54.710 --> 18:00.390]  was tapped by the Secretary of Homeland Security to lead the election security efforts, at a
[18:00.390 --> 18:05.630]  minimum for DHS, but more broadly at that point for the federal government. Established a number
[18:05.630 --> 18:10.210]  of different organizations, sector coordinating councils, government coordinating councils. We
[18:10.210 --> 18:17.090]  have members of those throughout the room. One of the key things that we were tasked with doing was
[18:17.090 --> 18:22.390]  making sure that there were security resources, security and vulnerability assessments,
[18:22.810 --> 18:28.530]  cyber hygiene scanning capabilities, all these basic cybersecurity tools were made available to
[18:29.050 --> 18:37.270]  as many election officials and jurisdictions as possible. Some used them. Some did not use them.
[18:37.270 --> 18:43.470]  Some could not use them. They didn't actually have the technology in place. And that has grown over
[18:43.470 --> 18:48.090]  time. We also set up things like the ISAC, the Election Infrastructure ISAC that's hosted
[18:48.770 --> 18:56.110]  at the multi-state ISAC in upstate New York. And then we were just talking about tabletop the vote.
[18:56.110 --> 19:05.350]  We would hold annual tabletop exercises to walk through various scenarios that may come up and
[19:05.350 --> 19:09.630]  how we would prepare for them. So in that time period in the run-up to the 2018 election,
[19:09.630 --> 19:16.350]  starting in February after we established the Election Infrastructure ISAC, that's February 2018,
[19:16.350 --> 19:22.410]  by that summer, or right before the election at least, we had all 50 states participating in that
[19:22.410 --> 19:30.570]  ISAC, which was a huge accomplishment. You know, what I felt at the time as director was my KPI was
[19:30.570 --> 19:36.650]  getting all 50 states signed up in advance of the 2018 election. We did that in one way or the other.
[19:36.650 --> 19:41.890]  I made 50, by the way. Me personally. I think that's right. I think that's right. Oh yeah,
[19:41.890 --> 19:48.490]  you guys flew me right out there. I was the only one in Vermont. I think I gave one of your
[19:48.490 --> 19:54.790]  senators a lot of grief about that. I wasn't afraid to pull out political soft power.
[19:56.190 --> 20:01.790]  So maybe Michael, we'll start with you. So of those tools that are available from the government,
[20:01.790 --> 20:07.230]  the security vulnerability assessment, cyber hygiene scanning, some of these on-site physical
[20:07.230 --> 20:10.910]  assessments you're talking about, what do you, you know, what did you get the most value out of?
[20:10.910 --> 20:16.250]  What do you think? And then, you know, maybe like what do we need more of and maybe not as much as
[20:16.250 --> 20:22.090]  something else? Oh sure, yeah. I would say that I'm the biggest fan of the physical security
[20:22.090 --> 20:26.330]  assessment, having our DHS rep come out, right? This is someone who is an expert on physical
[20:26.330 --> 20:33.330]  security. He can walk around the building, or she, the previous one was a quite a nice lady.
[20:34.810 --> 20:42.170]  And what's amazing is you already kind of know in election operations what your pain points are,
[20:42.170 --> 20:48.110]  I need more cameras, I need a fence, stuff like that. Now you have a report from the Department
[20:48.110 --> 20:52.650]  of Homeland Security that says, hey, you really, it'd be nice if you have these things to increase
[20:52.650 --> 20:57.530]  your security. So that is phenomenal when it comes to applying for grants or talking to your board
[20:57.530 --> 21:02.370]  of supervisors or however your county works. Like it's not just you anymore being the squeak wheel
[21:02.370 --> 21:08.050]  saying like, hey, I really need cameras. Well, it's the federal DHS telling me I need cameras.
[21:08.050 --> 21:14.110]  To me, I love that. If you had infinite money and influence, what I want, what I really,
[21:14.110 --> 21:21.550]  really want is something like a tiger team. I don't know exactly how it would work of CISA
[21:22.110 --> 21:28.290]  and probably your state DHS to go out to all of these local entities. Look, the people that
[21:28.910 --> 21:34.970]  are running your local government entities are doing the best they can. They're great at
[21:34.970 --> 21:41.150]  operations. They keep the light on. Technical debt accrues over the course of decades. You
[21:41.150 --> 21:46.830]  develop stuff to make sure that your business functions, having a team come in to help that
[21:46.830 --> 21:52.790]  specializes in remediation and doing physical security assessments, cybersecurity assessments,
[21:52.790 --> 21:57.250]  but not just doing the assessments, but literally helping you work. CIS admins,
[21:57.250 --> 22:02.630]  net admins that will help you go through your controls and optimize them. Make sure that
[22:02.630 --> 22:06.090]  everything's patched correctly, all your configurations correct, help you implement
[22:06.090 --> 22:11.750]  network segmentation, which is like a big old pain. But having some entities to help with that,
[22:11.750 --> 22:17.730]  that would be amazing. Mr. Secretary, I think Michael just signed you guys up for a pilot
[22:17.730 --> 22:27.010]  project with DHS. There you go. That's my secretary. I think that makes a lot of sense.
[22:27.010 --> 22:32.570]  And your question on scale is a good one because when you think about the personnel CISA has in
[22:32.570 --> 22:36.210]  the field, this was always the question I was getting. How many people do you have designated
[22:36.210 --> 22:45.110]  or dedicated to election security across CISA? And the core team was about a dozen and a half.
[22:45.110 --> 22:50.690]  But at any given time, there were hundreds of people across CISA doing some kind of election
[22:50.690 --> 22:56.950]  security work. So we'd get some logs in from a state. So we'd be crashing a team on log analysis.
[22:56.950 --> 23:03.670]  Our protective security advisors doing a walkthrough of a precinct or our cyber advisors
[23:03.670 --> 23:10.310]  out there. Director Easterly just announced, I believe a couple weeks ago, that there will be
[23:10.310 --> 23:15.930]  dedicated election security advisors out in the field. And so we're starting to see that shift,
[23:15.930 --> 23:20.870]  that this is a core priority for the department, for our state and local partners. I like your idea,
[23:20.870 --> 23:27.730]  of let's first off, we have to find the willing and able jurisdictions that let you come in.
[23:27.730 --> 23:32.910]  And that's not always a guaranteed and it's not always a given. No, no, no. I'm not talking about
[23:32.910 --> 23:37.030]  the state level. I'm talking about the local jurisdiction. I could probably convince a few of
[23:37.030 --> 23:44.910]  them. No, I'm sure you can. But I like this idea. So from a physical perspective, what do you see
[23:44.910 --> 23:50.850]  differently here? Or is it the same? You're still working with the ISACs. What about the FBI? What
[23:50.850 --> 23:56.550]  about the state level law enforcement? What are those resources that you might get from,
[23:57.170 --> 24:00.610]  as you were talking about earlier, the top down? What does that look like?
[24:00.670 --> 24:07.270]  Well, right now it doesn't look like anything. And it's tricky to imagine the paradigms we have
[24:07.270 --> 24:11.790]  in Vermont really squeezing them in. That's going to have to come through the Secretary of State's
[24:11.790 --> 24:17.910]  office. And we have a very top-down system where Secretary of State really tells us what to do and
[24:17.910 --> 24:21.830]  how to run our elections. But you've got to remember in Vermont anyways, that's only about
[24:21.830 --> 24:28.930]  half a million people in the entire state. So Vermont is really the size of what we would
[24:28.930 --> 24:36.510]  consider one jurisdiction in a lot of the rest of the country. So I think that's uniquely
[24:38.030 --> 24:43.930]  scaled so that really the FBI, state authorities should come through that
[24:44.630 --> 24:48.630]  to us. Because there's just otherwise not going to be enough of them to go around
[24:48.630 --> 24:56.810]  with 256 jurisdictions with half a million people. So we're a little different in that.
[24:56.810 --> 25:01.510]  But I'd like to see our state and I think these smaller states, probably true of places like
[25:02.370 --> 25:07.010]  Wyoming and other smaller states, to see a lot of that facilitated through
[25:07.010 --> 25:11.450]  the Secretary of State's office as opposed to being an expectation at my level.
[25:12.470 --> 25:18.730]  And so that last mile was always difficult. For us, it was easy to work directly with the
[25:18.730 --> 25:22.310]  Secretaries of State or most Secretaries of State. But when you talk about those 9,000
[25:22.310 --> 25:27.470]  jurisdictions getting out, counties, we could cover all the major counties. But once you start
[25:27.470 --> 25:35.010]  getting out of the townships and the localities, A, they're like, what the hell's a CISA? And B,
[25:35.530 --> 25:39.290]  what am I going to do with this stuff anyway? Because we're still running Windows 95.
[25:39.980 --> 25:48.290]  How is this going to work? And not only are you the town clerk, you're also the town CIO.
[25:48.330 --> 25:56.730]  And so there's a lot of that lack of capacity in that last mile that I think is part of the
[25:56.730 --> 26:03.130]  challenges. So Ashley, maybe bring this back into some of the ISAC questions and the information
[26:03.130 --> 26:10.830]  sharing mechanism. So as you come across something, if you come across something interesting,
[26:10.830 --> 26:16.970]  what are your processes for making sure it gets down to, well, it gets to Michael, but it also
[26:16.970 --> 26:23.750]  can work its way to John? Yeah, it might surprise some folks that even though I work for a vendor,
[26:23.750 --> 26:29.990]  we're a for-profit company, we do share a lot of our research publicly. Not to get cheesy,
[26:29.990 --> 26:35.350]  but I think the saying, if you want to go fast, go alone. If you want to go far, go together. I
[26:35.350 --> 26:39.190]  think that really applies, especially when it comes to election security, critical infrastructure
[26:39.190 --> 26:46.290]  security. And so just like you might have information sharing between states, we also
[26:46.290 --> 26:50.550]  have information sharing between vendors. There are entire groups that are dedicated to this.
[26:50.550 --> 26:56.250]  Cyber Threat Alliance is one that we really love. And so the more quickly and more efficiently we
[26:56.250 --> 27:00.970]  can get info out to these other vendors, the better we're able to actually help something
[27:00.970 --> 27:07.110]  as important as election security. And so I think if you work for a company that hasn't quite
[27:07.110 --> 27:13.090]  adopted that ethos yet, maybe make a suggestion. I think it's always better to partner and try to
[27:13.090 --> 27:19.010]  go farther with research than it is to try and be first or loudest. And I think most of the
[27:19.010 --> 27:25.310]  security community has also adopted that sentiment. Yeah, and that's something that I for sure saw
[27:25.310 --> 27:30.270]  over the last several years was the for-profit vendors, threat intelligence companies,
[27:30.270 --> 27:34.510]  starting to open up research, share it. We actually even worked with one of the largest
[27:34.510 --> 27:40.530]  CTI firms that had some license restrictions on what the information they shared with us.
[27:40.870 --> 27:43.970]  And we're like, oh, this is really important. We need to get it down to the states. They're like,
[27:43.970 --> 27:48.530]  ah, we can't. It's restricted by the licenses. But they opened up the licenses and we're able to
[27:48.530 --> 27:54.330]  kind of get that blast, that shotgun spread out there. And so that really, I think, was a big
[27:54.330 --> 28:01.810]  change in kind of mentality and resourcing. Because look, a lot of these jurisdictions
[28:01.810 --> 28:09.430]  are not going to be able to afford to buy these licenses. And never mind the fact that
[28:11.170 --> 28:16.490]  the money's just not there, right? Even if you talk about federal grants,
[28:17.190 --> 28:24.070]  that's going to take a while, if ever, to trickle down here. So we've got about,
[28:24.070 --> 28:30.250]  so maybe we can open up for a couple questions. And I don't, do we have that handheld, Matt?
[28:30.250 --> 28:33.910]  Yeah. I think they want to get it for the live stream.
[28:35.690 --> 28:40.210]  We got mics here. Just yell into our chests. That's not going to be awkward. I love it.
[28:42.850 --> 28:49.690]  All right. I would like to know how you see the influence of foreign countries
[28:49.690 --> 28:56.010]  and how you want to prevent that, any negative influence or to the voting.
[28:57.790 --> 29:02.390]  So how do you think about, I think, you know, the question here is, how do you and your jobs
[29:02.390 --> 29:07.330]  think about the impact of disinformation? Foreign, we'll say, we'll caveat it out as
[29:07.330 --> 29:11.130]  foreign right now. And I think you talked about it a little bit when you're starting to see the
[29:12.430 --> 29:17.650]  waves coming up, the local disruption, you know. Do you think about that, of how is it foreign?
[29:17.650 --> 29:20.870]  Is it domestic? Does it matter? It's just happening. And then how do you couch back
[29:20.870 --> 29:24.510]  against that? So I'll just, we can, you know, why don't we start with you, Michael?
[29:26.250 --> 29:34.290]  Right. I mean, misdisc and malinformation are basically my biggest concern, right? And
[29:34.830 --> 29:41.330]  to Mr. Krebs's point, attribution is difficult. I feel like at this point, it's very frequently,
[29:41.330 --> 29:46.610]  we're doing this to ourselves and that's incredibly frustrating. I'm deeply concerned
[29:46.610 --> 29:53.630]  about the drain that we have on our elections force, right? We have lost quite a bit of people,
[29:53.630 --> 29:58.770]  quite a bit of experience. Sometimes we're fortunate and they'll pivot from being at this
[29:58.770 --> 30:02.430]  county to a different county or come up to the secretary of state's office, which is great. But
[30:02.430 --> 30:08.350]  that's one of the things that I've really been trying to focus on is make people be safe and
[30:08.350 --> 30:14.810]  make people feel safe, right? There's a very real limit to the amount of times you receive a death
[30:14.810 --> 30:19.910]  before you're like, why am I doing this when I can make more money in the private sector? Like,
[30:19.910 --> 30:25.530]  is this really worth it to be having my family threatened all the time? So I take it incredibly
[30:25.530 --> 30:32.610]  seriously. And as I mentioned in the previous talk, sorry for repeating myself, we do active
[30:32.610 --> 30:38.850]  threat hunting and Maricopa County is the largest county in Arizona. And it's not just about like
[30:38.850 --> 30:42.790]  taking care of yourself, right? They do threat hunting. If they see something that affects a
[30:42.790 --> 30:49.470]  different county, they report it. They report it up to us. We have a precise codified process.
[30:49.770 --> 30:54.230]  We are fortunate and it seems like we have the gold standard when it comes to fusion centers,
[30:54.230 --> 30:59.550]  the ACTIC, the Arizona Counterterrorism and Information Center. It's a fusion center with
[30:59.550 --> 31:03.810]  local, state, federal law enforcement. They take everything seriously. We report threats
[31:03.810 --> 31:07.970]  and they handle it, right? It tends to be a one-way street. You don't get to always hear
[31:07.970 --> 31:11.890]  what happens. Sometimes you hear what happens in the media. Law enforcement doesn't really
[31:11.890 --> 31:16.690]  communicate back to you, but they investigate every single thing we report. And again,
[31:16.690 --> 31:22.570]  just the other thing of social media lockdown training, right? Making sure that we reduce the
[31:22.570 --> 31:28.030]  attack surface as much as possible so that when somebody tries to go after one of my staff,
[31:28.030 --> 31:31.430]  one of my electeds, they come up with as very little as possible. And the only other thing I
[31:31.430 --> 31:37.670]  wanted to mention on this is we're incredibly lucky in Arizona. Senate Bill 1061 has passed
[31:37.670 --> 31:43.910]  and what it allows is for anyone who is an election official, they can have their information
[31:44.550 --> 31:49.230]  redacted from public record. So no longer are their addresses going to be out there. I've made
[31:49.230 --> 31:53.810]  sure to communicate with our courts to make sure that we know exactly what the process is going to
[31:53.810 --> 31:57.110]  be. And as I talked about before, we have these statewide election security meetings. I'm going
[31:57.110 --> 32:01.110]  to hammer it home. Some of the counties are like, uh, you know, the bigger counties get more
[32:01.110 --> 32:06.350]  threats. We don't get so many threats. This costs nothing. Just do it. Get your information redacted.
[32:06.350 --> 32:09.430]  When people are banging on your door, it's already too late. You've been docked, right?
[32:09.430 --> 32:18.310]  Let's get it taken care of ahead of time. As far as misinformation goes and the impact it has,
[32:18.310 --> 32:23.690]  you know, I have a lot of interest in this sort of academically, but at my level, what matters
[32:23.690 --> 32:29.410]  is where the rubber hits the road. And that's, what does that mean at the polls? In that sense,
[32:29.410 --> 32:36.130]  it sort of doesn't matter if it's coming from a foreign or domestic interest. If people are
[32:36.130 --> 32:42.590]  getting the wrong information and they're coming to the polls. Well, let me, let me just put it
[32:42.590 --> 32:48.210]  this way. One of my biggest concerns that hasn't come yet is if somebody gets very angry based on
[32:48.210 --> 32:52.850]  some misinformation, and I don't mean come in and start doing an active shooter thing. I mean,
[32:52.850 --> 32:57.170]  sure that could happen. We definitely have protocols about that. It's, it's, it'll always be
[32:57.170 --> 33:02.710]  near the front of my mind. Frankly, I worry more about just somebody coming in with open carry.
[33:02.710 --> 33:09.630]  We talk about a lot about voter suppression, voter intimidation, and we're usually talking
[33:09.630 --> 33:13.870]  about that on a grander level, but really the ultimate voter suppression would be somebody
[33:13.870 --> 33:18.800]  walking in with the intent of intimidating other people and keeping them from voting.
[33:19.230 --> 33:24.390]  So in that sense, it really doesn't matter to me where it's coming from, because it's all
[33:24.390 --> 33:31.290]  going to land right at my lap. And we haven't had big problems with that yet, but I think it's
[33:31.290 --> 33:35.630]  responsible. I'm responsible and other folks, other election administrators on the ground
[33:35.630 --> 33:40.650]  are responsible to plan for that at this point. This sounds very grim and disturbing,
[33:40.650 --> 33:46.190]  and I'm actually very optimistic about all this stuff, but you know, it's grim stuff sometimes.
[33:46.610 --> 33:52.730]  So Ashley, you know, I know tracking foreign disinformation campaigns is much different
[33:52.730 --> 33:57.310]  than cyber threat intelligence, but do you guys look at this broader kind of information
[33:57.310 --> 34:04.510]  operation space as well? Yeah, what comes to mind, I think, in work we've recently done
[34:04.510 --> 34:09.330]  is, if you've been to my talk this morning, I apologize, I'm going to repeat myself a little bit,
[34:09.330 --> 34:16.750]  but we recently at my company had reviewed an application that was going to be used by a state
[34:16.750 --> 34:23.610]  entity for some of their back-end infrastructure for an election. And as part of this application,
[34:23.610 --> 34:27.710]  there was a dependency on a third-party library, so something that was open-source
[34:27.710 --> 34:32.650]  hadn't been written by the contractor in question. And in this third-party library,
[34:32.650 --> 34:40.270]  there were callbacks to a few foreign TLDs that are nations that we have rather tense relations
[34:40.270 --> 34:45.830]  with in the U.S. And so when I think about that, you know, what I think about is the potential for
[34:46.330 --> 34:53.590]  information that would have just a little bit of truth. And I think the potential to run with that,
[34:53.590 --> 34:58.770]  with someone with an agenda, with very extreme feelings, who is willing to take extreme action
[34:58.770 --> 35:04.890]  to manipulate an election, you know, that worries me. And so I think what we are most concerned
[35:04.890 --> 35:11.850]  about in terms of our work, which is a little bit sad, as you mentioned, is really preventing
[35:11.850 --> 35:21.110]  that opportunity from ever being there in the first place. I think that's a really key point,
[35:21.770 --> 35:29.070]  how little fragments that are not at all relevant to the casting, counting, certification of a vote,
[35:29.070 --> 35:36.210]  or the disruption of it, yet become the kernel of a conspiracy theory that then feeds that sort
[35:36.210 --> 35:39.730]  of activity you just talked about and some of the things that you guys have seen in Arizona.
[35:39.730 --> 35:47.310]  So maybe let's play off that a little bit and talk about understanding that, again, 2024 is around
[35:47.310 --> 35:55.290]  the corner and you both experienced, whether it was in 22 or 20, audits and post-election reviews,
[35:55.290 --> 36:00.390]  things like that. Understanding my personal view is post-election audits are a very good thing,
[36:00.390 --> 36:05.710]  assuming they're professionally conducted, set to a certain set of standards that are commonly
[36:05.710 --> 36:12.650]  accepted and agreed upon in advance rather than post hoc. Maybe you want to talk a little bit
[36:12.650 --> 36:20.070]  about how you are thinking about preparing for post-election reviews, post-election audits,
[36:20.070 --> 36:26.050]  that are both whether in statute or could be coming down the pipe. Maybe we'll start with that.
[36:26.050 --> 36:32.890]  Sure. Yeah, obviously I like audits, right? But to Mr. Krebs's point, they should be run by
[36:32.890 --> 36:38.890]  professionals that know what they're doing. Without using too many names, the Arizona Senate
[36:39.320 --> 36:46.250]  had an audit in 2021 of the 2020 general election. And, you know, we have an election procedures
[36:46.250 --> 36:53.590]  manual and it dictates how you do audits of things. And it doesn't use the word Lazy Susan
[36:53.590 --> 37:00.970]  in it ever at all. So like the idea of spinning and trying to count ballots and allowing for
[37:00.970 --> 37:09.110]  discrepancies, like it's surprising that they were even remotely close to the actual count.
[37:09.110 --> 37:18.890]  So not a fan of that. We have thought about like if we're going to have to do audits like this,
[37:18.890 --> 37:24.770]  how can we improve, right? Like there's always a way to improve security in elections, right?
[37:24.770 --> 37:29.550]  Because it's a system that exists in the universe. And, you know, one of the things that would be
[37:29.550 --> 37:38.310]  very interesting to implement into the election management systems is a mechanism for key logging,
[37:38.310 --> 37:43.110]  right? Because why not, right? If they're going to, if there's going to be a question in your
[37:43.110 --> 37:48.210]  election management system of it has someone tampered with it, it would be really nice to,
[37:48.210 --> 37:53.770]  by default, have every single key lock, every keystroke, mouse click, whatever, logged. And
[37:53.770 --> 37:59.070]  then that can be reviewed, right? And you can demonstrate that there hasn't been any anyone
[37:59.070 --> 38:02.510]  doing anything wacky and trying to change any kind of results.
[38:03.490 --> 38:08.850]  Yeah, I think that's a key point there, John, or Michael, rather. You can run the cleanest
[38:08.850 --> 38:14.730]  election possible. There's someone that has an incentive out there to claim that something went
[38:14.730 --> 38:21.330]  wrong. And so I continue to think, and this is what I think, where Steve and Richard in Maricopa
[38:21.330 --> 38:28.430]  County, a reporter, has done a very good job of upfront transparency. You know, take the pieces
[38:28.430 --> 38:33.310]  off the board that could be used to get you down the road. And this is a shift I think we've seen
[38:33.310 --> 38:39.210]  in election administration over the last half decade or more, is where it was usually kind of a
[38:40.030 --> 38:46.050]  mundane state-local election process that, well, nobody would want to, nobody cares what we do
[38:46.050 --> 38:52.550]  here to make sure elections go on. This is, this is mundane stuff. But now it's, you know,
[38:52.550 --> 38:56.710]  headlines stuff, you know, headline news, always on TV. So you have to rethink your strategic
[38:56.710 --> 39:01.570]  communications approach. We talked about that a little bit this morning. All right, John, so
[39:02.110 --> 39:06.950]  anything you want to jump in there and add on? Like anticipating challenges, how do you make
[39:06.950 --> 39:12.790]  sure that you've got the tightest possible approach in preparation for any election,
[39:12.790 --> 39:17.950]  post-election challenges? Anything to add? Well, we're definitely dotting our I's and crossing
[39:17.950 --> 39:25.650]  our T's more than we usually do. I think we, again, to harp on the small jurisdiction, we
[39:25.650 --> 39:30.710]  would like to see a little more leadership from the state. I'll tell you all something that is
[39:30.710 --> 39:38.410]  probably going to shock you. I've been running elections in Montpelier for 12 years, and the
[39:38.410 --> 39:47.150]  Secretary of State has audited my voting machines exactly zero times. This never happened. That,
[39:47.150 --> 39:51.330]  we'd like to see a little, to pass the buck a little bit up, I'd like to see a little bit more
[39:51.330 --> 40:00.130]  of that. But other than that, you know, I'd like to say that we've always done everything absolutely
[40:00.130 --> 40:06.990]  up to specs, dotted every I, crossed every T. Now that I'm actually doing that, I'm realizing that
[40:06.990 --> 40:12.950]  we haven't always. But we're certainly taking the steps now to make sure everything can go as well
[40:12.950 --> 40:20.670]  as it possibly can. Do you not have LNAs in Vermont? Do you not do logic and accuracy tests
[40:20.670 --> 40:27.430]  by the Secretary of State? Nope. Well, no, let me qualify that. They are done randomly. Okay,
[40:27.430 --> 40:32.730]  but not every election? After every election, they're done randomly. My number has yet to come
[40:32.730 --> 40:39.150]  up. So I think a random test is inadequate, I guess is my point. So we do test. State-level
[40:39.150 --> 40:44.970]  tests. State-level tests. And they'll go to individual jurisdictions and test and audit
[40:44.970 --> 40:51.670]  their machines. But it's, it's scattershot. And I have not been hit by any of the scattershot yet.
[40:51.670 --> 40:57.090]  So that's, there's, there's room for improvement. And I know we're not unique. I think there's,
[40:57.090 --> 41:05.410]  I think all of this speaks to just what a range, what a curve there is on elections in this,
[41:05.410 --> 41:11.330]  in this country, between Vermont, Arizona, Mississippi, wherever, wherever you go,
[41:11.330 --> 41:17.390]  things are not uniform. And there are places that take this much more seriously than others.
[41:17.550 --> 41:24.010]  And there needs to be some kind of standardization, or at least an expectation of standardization
[41:25.010 --> 41:29.850]  moving forward. Or, you know, the, the more vulnerable states are going to shake out from
[41:29.850 --> 41:34.330]  the less vulnerable states. And we're going to start seeing more problems in some areas than
[41:34.330 --> 41:40.710]  others. Ashley, anything you want to jump in on? I don't think so. Okay. All right. So we're,
[41:40.710 --> 41:44.870]  we're getting up to time here. So I'm against better judgment. I'm actually,
[41:44.870 --> 41:49.150]  I will take another question from the audience. All right. So we'll take two
[41:49.150 --> 41:52.710]  because the hands went up simultaneously. So since you're right in front of me.
[41:54.790 --> 42:00.090]  So this is kind of playing off of what you said. So, you know, in, in any type of sales, right,
[42:00.090 --> 42:04.310]  you have different segments that you're in. And right now, what I'm hearing your segment in is,
[42:04.310 --> 42:08.070]  you're in a defensive mode. You're going to get attacked. I'm in a defensive mode.
[42:08.070 --> 42:13.450]  It's always fun to carry the ball, right? I think Americans want to be peaceful and get along,
[42:13.450 --> 42:18.670]  but you have a product that you're keeping secret. If you got in front of the camera
[42:18.670 --> 42:24.550]  500 times and said that to the public, and you're, we're not perfect, but here's what we're doing to
[42:24.550 --> 42:30.130]  make them as secure as possible. You did yours. You did yours. Why not get in the offensive mode
[42:30.130 --> 42:35.150]  and start educating the public as much as you can and really do those things. Hey,
[42:35.150 --> 42:38.950]  we know we're not perfect. We're plugging the holes because how many people have iPhones?
[42:39.250 --> 42:43.550]  I've had to convince so many people that the notifications to update your iPhone,
[42:43.550 --> 42:48.350]  this is not a secret conspiracy to get into your iPhone. This is that they're putting a patch on
[42:48.350 --> 42:54.010]  your phone so people can't get in. So this is from the other side, because I believe a lot in detente,
[42:54.010 --> 42:58.070]  be prepared for the worst. My husband's a retired AC for LA County fire, right?
[42:58.070 --> 43:02.970]  Be prepared for the worst, but you have some time to start building confidence. There's a
[43:02.970 --> 43:07.830]  man from Holland here, and we actually had them conversation about building trust.
[43:07.830 --> 43:11.610]  It's not going to happen by saying it once. You're going to have to get on there and create
[43:11.610 --> 43:18.350]  a PR program. And really people don't want to be fighting. And honestly, you have a lot of
[43:18.350 --> 43:23.170]  Christians in this, this thing. What if Jesus was sitting next to them? You really need to say that
[43:23.170 --> 43:27.670]  what I heard that you expose, people need to know that this is what's happening to their neighbor.
[43:28.070 --> 43:34.370]  This is not acceptable, right? But get out there and tell them, stop keeping your product a secret.
[43:34.650 --> 43:40.230]  We are doing this. We're trying to do auditing. Yes, you can hack the machine, but there's all
[43:40.230 --> 43:47.150]  these other walls in place other than the machine that's helping keep the machine secure. It's not
[43:47.150 --> 43:52.870]  just the hack. Get out and just start talking, talking, and it's not going to be once. It's going
[43:52.870 --> 43:57.930]  to be a lot to that really quickly because you're so right. Okay. This is something I talked about
[43:57.930 --> 44:01.530]  in my own talk. So if anybody heard that, you're going to get a little bit of a rerun,
[44:01.530 --> 44:07.010]  but I am an incredible optimist about this. I think the message is not that there aren't going
[44:07.010 --> 44:11.650]  to be problems, that there aren't going to be challenges and not theoretical challenges,
[44:11.650 --> 44:16.750]  but actual some of this stuff manifesting. But if we are looking at all the problems openly,
[44:16.750 --> 44:22.830]  and we're doing everything we should do, we're covering all the bases that when we take a hit,
[44:22.870 --> 44:29.970]  it's going to be a glancing blow and not a mortal wound. And I think that is the message to get out.
[44:29.970 --> 44:36.290]  Like I said, otherwise, a lot of this becomes kind of nihilistic. But when I talk to folks,
[44:36.290 --> 44:41.590]  I always close up with that because that's what brings it all together. And that's why we're all
[44:41.590 --> 44:46.430]  here. That's why Voting Village exists, is to shine that kind of sunshine and show the world
[44:46.430 --> 44:52.990]  we're going to do everything right. So the PTSD you just triggered, by the way, with me,
[44:52.990 --> 45:00.370]  because this is what we did for the 2020. Super quick. So what? Yes. Yes. I'm here. We're having
[45:00.370 --> 45:05.010]  this talk. My secretary of state's right there. My communication director is here. And just the
[45:05.010 --> 45:09.930]  fact that vote like we're trying, we are trying. But the lies are more sexy than the truth.
[45:10.030 --> 45:15.430]  Right? We've got 2000 mules. We have an elections procedure manual. Right? No, nobody wants to read
[45:15.430 --> 45:22.690]  that. So we're right. We are trying. I assure you, we're trying. All right. Sorry. I think
[45:22.690 --> 45:28.590]  this could have to be the last one. So I have a question about sort of training for poll workers
[45:28.590 --> 45:35.830]  and training for the voter. Sometimes the risk is inside the house. So is there like insider
[45:35.830 --> 45:41.170]  threat training you do or other sort of cyber hygiene training you do for election workers?
[45:41.950 --> 45:51.670]  Oh, well, the last election was the first time I ever had a moment of doubt about a couple of my
[45:51.670 --> 46:00.910]  election volunteers. I was like, hmm. So I don't look for that. I'm not looking for the sneaky
[46:00.910 --> 46:11.150]  ones. And maybe I should be. I have the great luxury of being in, I'm going to say, I'm going
[46:11.850 --> 46:17.950]  election-oriented, civic-oriented Montpelier, Vermont. Others don't have that luxury. But
[46:18.630 --> 46:23.730]  I guess it's a long-winded way of saying I have thought about it.
[46:24.310 --> 46:28.250]  And I don't have good systems in place yet. But I will.
[46:29.730 --> 46:34.810]  I'm absolutely concerned about insider threat. Oh, I don't have to stand. I'm absolutely
[46:34.810 --> 46:42.330]  concerned about insider threat. I do need to stand? Okay. I am absolutely concerned about
[46:42.330 --> 46:49.090]  insider threat. In Arizona, we have election officer certification and that kind of thing
[46:49.090 --> 46:53.690]  is discussed there. Maricopa has specifically implemented premium poll worker training that's
[46:53.690 --> 46:57.210]  multiple day-long training, right? And it's very much a see something, say something.
[46:57.230 --> 47:01.010]  And if you are concerned about election security, please, if you have the means,
[47:01.010 --> 47:06.530]  please be a poll worker. If you see someone doing something weird, report it, right? Absolutely.
[47:07.270 --> 47:14.390]  But, you know, we have had some instances where people behave oddly and staff members notice that
[47:14.390 --> 47:18.650]  and they report it and we have it on camera and we're able to see the weirdness that people are
[47:18.650 --> 47:22.630]  doing and they're out of there and we contact that political party and let them know, like,
[47:22.630 --> 47:27.230]  hey, this person did this thing. They're not welcome back. Make sure you vet your people.
[47:28.470 --> 47:32.670]  Okay. We had one more question that was more about local partnerships.
[47:37.610 --> 47:44.050]  Basically, making use of trusted associations to try to address misinformation,
[47:44.050 --> 47:49.430]  malinformation and so forth. Like, is there a move locally, nationally to do more of that?
[47:52.220 --> 47:58.360]  I think that's a tricky thing to do as the local elections person. To sort of coordinate civic
[47:58.360 --> 48:03.460]  groups, you get into questions of who are you bringing into your partnership? Because, I mean,
[48:03.460 --> 48:10.720]  there is a certain degree of neutrality, I think, that has to be maintained. And that's the kind of
[48:10.720 --> 48:15.900]  thing I would like to see somebody else do. But I think coordinating it out of my office would be
[48:15.900 --> 48:21.500]  problematic. There'd be anything from, yeah, questions, who am I bringing in? Why am I not
[48:21.500 --> 48:26.940]  bringing in others? There could be questions of implicit bias that then come up. So I'd love to
[48:26.940 --> 48:32.580]  that happen, but I don't think I'm going to do it. So forgive me, but I don't remember the name of
[48:32.580 --> 48:39.220]  the association, but there's a Veterans Association, right? And veterans are the most trusted people.
[48:39.220 --> 48:46.660]  Unfortunately, they're also frequently the target of MDM, right? But there is an initiative to
[48:46.660 --> 48:53.500]  utilize veterans for poll workers. And I mean, what kind of psycho is going to be threatening
[48:53.500 --> 48:59.660]  veterans? So I think it's a very... and they're trusted, right? So...
[48:59.660 --> 49:04.560]  All right. With that, I think we're wrapping it up here. I want to thank both of you for what you do
[49:05.020 --> 49:08.800]  in the furtherance of democracy. Thank you. Thank you for that. And everybody,
[49:08.800 --> 49:14.680]  I think we give them a round of applause. Ashley, thank you for what you guys do as well.