WEBVTT 00:09.950 --> 00:16.370 All right, so yes, I am a stunt double here stepping in for Jake Braun from the White House who was unable to make it. 00:16.390 --> 00:24.530 So I'm coming into this pretty hot and I have reviewed the concept of the panel and so we're going to go through this. 00:24.530 --> 00:35.770 But we're going to talk about a range of issues looking ahead to the 2024 election and kind of drawing on some of the lessons of the past from 2018, 2020, 2022, and now 24. 00:35.770 --> 00:59.690 What are A, you know, the threats that we're worried about, the threats that we need to be preparing for, and then across the cyber and physical threat vectors, what are A, the things we need to be doing and B, what are the available tools, what are the available partnerships with the federal government and with the private sector that are available. 00:59.690 --> 01:07.170 So with that, let me go ahead and start on, Ashley, maybe we'll start with you on the threat side. 01:07.590 --> 01:10.490 So you're Director of Threat Intelligence for Research Labs. 01:10.490 --> 01:24.270 What are you seeing out there, both kind of historically and, you know, as we look forward from an almost strategic intelligence perspective, what are we seeing, what should we be expecting as threats for the 24 election? 01:24.330 --> 01:34.210 Yeah, I don't think it's any secret that the volume, oh god, that sounds horrible, that the volume, okay, perfect, I'm gonna stand. 01:34.210 --> 01:36.050 It's very important now. 01:36.250 --> 01:41.590 I don't think it's any secret that the volume of things always tends to pick up as we approach election season. 01:41.770 --> 01:45.850 The research teams at Reversing Labs sort of have two primary focuses. 01:45.850 --> 01:48.330 One of those is on more traditional malware. 01:48.510 --> 01:54.910 The other of those is on open source threats, so third-party libraries, things that would be used by developers. 01:55.170 --> 01:59.970 And so what we're seeing, really interestingly, is a sort of blending of those two. 02:00.010 --> 02:07.970 And so, for example, something we saw recently was an instance where a phishing kit had actually been shoved in this third-party library. 02:07.970 --> 02:23.430 And so if you received this as a malicious attachment, standard phishing campaign, you know, it's not anything particularly exciting, but if you were a developer who happened to use this library, then now your application would be serving this phishing kit as well. 02:23.490 --> 02:29.850 So we're starting to see more and more instances where things like malware have been just shoved into open source libraries. 02:29.850 --> 02:38.990 Very strategically, we're seeing the link of these sort of supply chain, software supply chain rather, threats with the more traditional malware. 02:38.990 --> 02:44.850 I think that adds a level of complexity that makes it a little more difficult from a defender's perspective. 02:44.850 --> 02:50.550 So always, of course, working to try and advance those detection solutions. 02:51.250 --> 02:54.470 Yeah, and I think... so I'll stand up. 02:54.610 --> 03:08.930 Putting this into the context that you've laid down, I go back to the post-2016 election intelligence community assessment that laid out the three lines of effort that the Russians took. 03:08.930 --> 03:15.730 First was the technical attacks on election systems throughout the country, the voter registration databases. 03:15.810 --> 03:21.050 But of course, by natural extension, we would include voting equipment and systems within that. 03:21.050 --> 03:28.370 And then you've got the disinformation piece, and then the hack and leak campaigns against campaigns and political parties. 03:28.370 --> 03:45.530 So I think we'll put that part, those two other aside between disinformation and the hack and leak on campaigns and focus, you know, pretty exclusively here on those threats as actually laid out that we may find in the systems that are used with elections. 03:45.530 --> 03:52.310 All right, so jumping on that, I will say though, it's not just going to be cyber, there will be physical considerations here as well. 03:52.310 --> 04:05.830 All right, so Michael, you know, with some of the threat landscape that actually laid out, and what you do from a day-to-day perspective or basis in Aracopa County, what are you seeing? 04:05.830 --> 04:07.130 What have you seen historically? 04:07.130 --> 04:12.350 Can you tell us a little bit of kind of the volume of attacks that you see on a daily basis? 04:12.350 --> 04:15.090 And what are the key tools that you have? 04:15.610 --> 04:21.350 And some of the things you think you need, you and your peers, you can anonymously throw your peers under the bus. 04:22.050 --> 04:28.390 But what are the things that you see that your peers are really struggling with or need to improve as we go out to 24? 04:28.510 --> 04:29.790 All right, I guess I'll stand as well. 04:29.790 --> 04:30.730 Can you guys hear me okay? 04:30.730 --> 04:31.690 Everyone's okay in the back? 04:31.710 --> 04:32.350 Awesome. 04:34.190 --> 04:40.390 So my peers, I would call my customers, I'm gonna shift this way a little bit, so hopefully less feedback. 04:41.410 --> 04:42.210 I'm actually over 04:52.430 --> 04:55.930 at the Arizona Secretary of State's office, that's the biggest county in Arizona. 04:55.930 --> 04:58.010 Now I'm at the Arizona Secretary of State's office. 04:58.010 --> 04:58.970 I'm the CISO there. 04:58.970 --> 05:03.210 I consider myself to be the virtual CISO, and I've offered my services to all of the counties. 05:03.690 --> 05:12.600 So to me, you know, we lean incredibly heavily on the Arizona Department of Homeland Security, sorry for all these entities, long names. 05:12.790 --> 05:15.910 They have the Cyber Readiness Program. 05:15.910 --> 05:29.610 So this uses federal citizen DHS grant funds, and as well as ongoing state funds that have been dedicated to provide best-in-class solutions to all government entities in Arizona. 05:29.610 --> 05:44.870 So in the Arizona elections community, we have regular statewide election security meetings, both for leadership teams as well as our IT teams, and we've been heavily promoting like, folks, if you already have a solution, cool. 05:44.870 --> 05:46.070 If you love it, stick with it. 05:46.070 --> 05:50.130 But if you don't have the solution, here it is for free. 05:50.130 --> 05:57.610 It's already paid for in this hub-and-spoke model, where we can use collective purchasing to get these best-in-class controls. 05:57.610 --> 05:58.930 They're paid for. 05:58.930 --> 06:01.650 We have contract services to help you implement them. 06:01.650 --> 06:12.990 So that's something we've been pushing incredibly heavily to all of the counties for the past few months, especially because I know folks may not necessarily enjoy hearing this. 06:12.990 --> 06:15.810 We had a little bit of conversation before the panel. 06:15.830 --> 06:23.950 The idea that there's a vulnerability, oh, just patch it, like that's not necessarily feasible when it comes to operational elections, right? 06:23.950 --> 06:29.750 If you guys have worked in IT at all, you know that sometimes patching something breaks things. 06:29.750 --> 06:31.790 With elections, high availability. 06:32.030 --> 06:34.510 You can't be down on election day. 06:34.510 --> 06:35.370 That's crazy, right? 06:35.370 --> 06:38.570 So you have a defense in depth to protect things. 06:38.570 --> 06:40.650 So, long rambling? 06:40.650 --> 06:41.330 Bound. 06:41.330 --> 06:42.750 No, no, no. 06:43.050 --> 06:44.290 Can I add just one thing to that? 06:44.290 --> 06:45.090 Yeah, go ahead. 06:45.550 --> 06:53.210 I do think, though, that it is important if you know that a vulnerability exists, that's great. 06:53.210 --> 06:55.570 A lot of folks don't even know that something is out there. 06:55.570 --> 07:04.650 And so if you know that you have a vulnerability and maybe you can't patch it, at least you know and you can put resources and eyes on it and watch for that to potentially be exploited. 07:04.650 --> 07:06.390 So that's pretty solid. 07:06.390 --> 07:07.570 It's better than zero. 07:07.570 --> 07:09.010 If I could tag onto that briefly? 07:10.170 --> 07:12.330 So, yeah, yeah, yeah, absolutely. 07:12.330 --> 07:15.210 And obviously we're members of MS-ISAC, E-I-I-SAC. 07:15.210 --> 07:21.550 If that's new to you, it's the Multi-State Information and Analysis Center, as well as the Elections Infrastructure ISAC. 07:21.810 --> 07:27.310 So these communities let you know, hey, there's this critical vulnerability, right? 07:27.310 --> 07:34.610 So like Log4J, you recall Log4J, or there was a huge Microsoft Exchange issue recently, right? 07:34.610 --> 07:38.010 Those kind of things, it's, I know that we're in a change freeze right now. 07:38.010 --> 07:41.470 We're close to an election, but there's no, you have to patch this stuff. 07:41.470 --> 07:42.770 You cannot wait. 07:43.190 --> 07:45.030 So there is that. 07:45.790 --> 08:06.910 So, John, maybe let's pivot away from cyber for now and then talk about some of the physical and resilience issues, because maybe you can tell people, you know, what life's like in Vermont, administering elections up there and, you know, the set of threats and challenges that you have to deal with on a daily basis. 08:06.910 --> 08:16.750 And then what I want to do is come back around after and talk about what help you get from federal government, what's helpful, and then what more do we need? 08:16.750 --> 08:19.590 But then also what are some of the other mechanisms we use? 08:19.710 --> 08:22.010 Talk a little bit more about the ICE acts, for instance. 08:22.010 --> 08:23.610 So start with our physical. 08:24.190 --> 08:31.670 Yeah, of course, the election administration right there on the ground is where the conspiracy theories really hit the strongest. 08:31.670 --> 08:39.010 We're going to be front lines in a very sort of physical way with that level of attack and that level of suppression. 08:39.010 --> 08:48.990 Because I think when people start hearing more about threats to polling places and more about threats to election workers, it makes them a little less confident in coming out to the polls. 08:48.990 --> 08:54.410 In Vermont, you know, New England works a little differently than I think most of the rest of the country. 08:54.410 --> 08:56.670 We have very small jurisdictions. 08:56.790 --> 09:02.110 Jurisdictions that can be as... it's at the town level, not the county level, so jurisdictions can be as small. 09:02.110 --> 09:10.210 In New Hampshire, say, of a town of 10, 12 people, will be just as much an election jurisdiction as Boston. 09:10.730 --> 09:14.710 So that creates a whole lot of different dynamics. 09:14.710 --> 09:17.190 It makes things much more personal. 09:17.190 --> 09:28.950 And especially since it's a blue area, you haven't heard of the kind of really awful stuff that's been taking place in the southeast and the southwest with really direct threats. 09:29.270 --> 09:36.150 Even I've heard of literal attacks on election administrators, election workers, poll workers down there. 09:36.150 --> 09:40.150 But we are getting some early indications that that's changing. 09:40.150 --> 09:49.550 In my own jurisdiction, they hit the sweet spot when I could get rid of my ballots from the presidential, and they were still part of public record. 09:49.550 --> 09:59.650 We had a recount done by a lot of folks who felt that the election had been phony, and they showed up en masse into my town. 09:59.730 --> 10:03.750 And basically that was a shot across the bow. 10:03.750 --> 10:13.590 The last election, also the midterm election, we had a lot more folks showing up in smaller Vermont towns, despite the fact that these are small, tight communities. 10:13.710 --> 10:19.490 You're starting to see those same divisions, people coming up just to create havoc, just to create problems. 10:19.510 --> 10:29.270 So I think if you're starting to see that wave, even coming up into true blue, you know, New England, I think this is going to be a doozy next time around. 10:29.270 --> 10:30.690 And I don't know what to expect. 10:30.690 --> 10:45.430 I definitely worry quite a bit for my companions in election administration in the South, but I think we're going to see the conspiracy theorists out on a scale we are probably not prepared for. 10:45.930 --> 10:48.970 Let me just kind of jump onto that. 10:48.990 --> 10:52.970 So it seems to me you're expecting additional activity. 10:52.970 --> 10:56.530 How are you pulling together intelligence, so to speak? 10:56.530 --> 11:06.510 And what are your preparations for next year, assuming that you will see more kind of on the ground disruptions? 11:06.930 --> 11:12.330 You know, Arizona obviously saw a lot of that from the poll watchers and whatnot last year in 22. 11:12.350 --> 11:20.030 You know, are you trying to pull together lessons learned from 22 that you may have seen in Maricopa and then draw them for Vermont? 11:20.150 --> 11:22.930 It's difficult to draw because of the scale. 11:22.930 --> 11:28.830 So we're in a situation where we need to work really, and I am working much more directly with local law enforcement. 11:29.450 --> 11:40.090 We're modifying our continuity of operations plans, given the new threat landscape and what it looks like, which is very different than what I've had for the last 10 years doing this. 11:40.090 --> 11:51.150 It's sort of having to reimagine that from the bottom up, but really bringing in that local law enforcement as a full partner in the election process, which is something I haven't really done before. 11:52.850 --> 12:03.570 Given the sort of micro-jurisdictional layout landscape, we only get so much assistance, or only so much assistance from the Secretary of State is really practical. 12:04.110 --> 12:08.510 So we really are largely on our own in a way that I don't think you see in the rest of the country. 12:08.510 --> 12:10.510 And again, I'm not just talking about Vermont. 12:10.570 --> 12:18.990 Vermont is kind of an extreme case, but this municipal-based jurisdiction level is common throughout New England. 12:18.990 --> 12:28.850 And we're often so small, we're not in a position to take advantage of resources like the EIISAC, which are really scaled. 12:28.850 --> 12:36.550 We're sort of the forgotten stepchildren here of the election process, because we're such a small scale. 12:36.890 --> 12:43.730 We can only get so much help when the help is really targeted towards more moderate or higher scale levels. 12:43.730 --> 12:46.430 So we're largely on our own. 12:50.570 --> 13:04.090 So speaking about physical security, we have been going at the Secretary of State's office, along with some of our security partners, have been going out to each of our counties and touring their facility and talking to them about solutions at their space, 13:04.090 --> 13:09.990 looking to see, is there any kind of physical security improvements at your elections facility? 13:09.990 --> 13:14.990 Is there anything you can do to increase the hardening of your elections equipment? 13:14.990 --> 13:16.370 Can you implement port blockers? 13:16.370 --> 13:17.610 Those are basically free, right? 13:17.610 --> 13:24.430 Little pieces of plastic, you shove in a port, that way if somebody is somehow in your secure area, they can't casually plug something in. 13:24.430 --> 13:25.090 Cool. 13:25.090 --> 13:26.930 Next step, security enclosures. 13:26.930 --> 13:35.930 For like $100, you can buy a secure case to put any kind of PC in there that's in your critical infrastructure space. 13:35.930 --> 13:38.570 We're trying to fight a Stuxnet situation, right? 13:38.570 --> 13:41.190 I'm sure you're all familiar with Stuxnet, right? 13:41.310 --> 13:45.830 So the tabulation room, that's our nuclear reactor, we want to protect it. 13:46.170 --> 13:55.170 We've also been recommending, at Maricopa and at the Secretary of State's office, we've engaged in active shooter training, defense against active shooter training. 13:55.590 --> 14:05.810 I'd rather over-prepare and never need it, I hope we never need it, but there could be a shooter event, and I want to make sure that our staff are as prepared as possible and have a plan, run, hide, fight. 14:05.810 --> 14:15.290 And I'll tell you, we did the ALICE version put on by our Capitol Police, and that really underlined for me, like, the first rule is run. 14:15.290 --> 14:16.870 You're not an action hero. 14:17.090 --> 14:22.370 Every single time in the practical, when they had like a nerf gun, I got shot every single time. 14:22.370 --> 14:24.110 Every single time, I didn't immediately run away. 14:24.110 --> 14:29.070 So sincerely, if there's ever a shooter event, there's my advice to you, run away as fast as you can. 14:29.470 --> 14:31.890 Other than that, we work incredibly close with our sheriffs. 14:31.890 --> 14:39.990 And so we've made sure that when we go out to the counties, make sure you know your security folk, bring them to the table. 14:39.990 --> 14:40.870 Let's talk to them. 14:40.870 --> 14:41.950 Bring your facility folk. 14:41.950 --> 14:44.650 Are there any doors that need additional hardening? 14:44.650 --> 14:48.330 Do you need any cameras to make sure you have the visibility on things? 14:49.450 --> 14:49.910 What? 14:50.810 --> 14:52.150 Oh, yeah, yeah, sorry. 14:52.150 --> 14:58.630 We've also, again, this is a bit macabre, but we've put together some defense against active shooter kits as well. 14:58.630 --> 15:06.230 If you notice the doors that have the metal hinges on them, if you cover that with some piece of old fire hose, it's basically a physical barrier. 15:06.230 --> 15:08.510 Those doors can't physically open anymore. 15:08.510 --> 15:15.830 That's one of the recommendations we got from the federal DHS when they come out and do physical security assessments of our facilities. 15:15.830 --> 15:18.650 We've also included a glass breaking kit. 15:18.650 --> 15:22.090 If you need, if you're on a ground floor, you have a window, you can break the glass, get out. 15:22.810 --> 15:28.190 Tourniquets, chest seals, if somebody gets shot, it's depressing stuff. 15:28.430 --> 15:32.870 At Maricopa, we also had a third of our staff CPR trained, right? 15:32.870 --> 15:35.710 If someone has a heart attack, they're ready to go. 15:35.710 --> 15:41.530 We're also recommending to take stop the bleed training, which if somebody gets shot, you know, it teaches you how to apply a tourniquet. 15:41.530 --> 15:44.630 If you get shot in the chest, it's important that you don't just try to pack it. 15:44.630 --> 15:47.710 You need the chest seal to protect yourself appropriately. 15:48.850 --> 15:53.590 John, is there anything you would want to add on the active shooter piece? 15:53.590 --> 15:57.090 Or Michael, pretty much cover it in grave, depressing detail. 15:57.090 --> 15:57.890 Sorry, sir. 15:58.450 --> 16:02.790 Well, I would add a little to the first part, just to be more depressing. 16:02.790 --> 16:06.070 The first part, where you talked about literal physical security. 16:07.110 --> 16:10.730 I'm gonna harp on the very small jurisdictions thing again. 16:10.730 --> 16:12.110 This is my mantra. 16:12.190 --> 16:14.490 I've been talking about it at DEF CONs for years. 16:14.490 --> 16:27.770 Well, just to be clear, you know, while New England may not resemble Arizona, Wisconsin and Michigan also have a significant number of individual jurisdictions in those states. 16:27.770 --> 16:28.310 Right, right. 16:28.310 --> 16:31.030 And also town-based in cases. 16:31.030 --> 16:32.130 Yeah, absolutely. 16:32.130 --> 16:39.550 And even something as simple as cameras are something I don't have. 16:39.550 --> 16:43.350 And the money does not come from the top to allow for that. 16:43.350 --> 16:50.370 Elections are traditionally done some, you know, this is a traditional town meeting part of the country, right? 16:50.370 --> 16:59.010 Where old style democracy folks, the history of these towns is to all come together and yell and shout and fight it out and make your decisions. 16:59.090 --> 17:02.610 It's cute sometimes. 17:03.550 --> 17:06.550 But that's the tradition we're dealing with. 17:06.550 --> 17:11.090 So that the resources, we don't get a lot of resources from the top down. 17:11.090 --> 17:22.930 So resources for defense in depth, for everything from vaults to cameras to security personnel to any other features like that do tend to come from the resources of the individual town. 17:23.030 --> 17:29.730 So it's another place where we are behind and there needs to be something done, basically. 17:29.730 --> 17:31.350 And some of us are working on it. 17:32.170 --> 17:33.930 See what comes of it. 17:33.930 --> 17:37.310 Let's talk about those resources a little bit. 17:37.870 --> 17:40.390 Post-2016 in the U.S. 17:40.390 --> 17:47.570 government, a number of things changed in and around the 2016 election immediately following. 17:47.570 --> 18:04.490 So for one, CISA, which was then named differently at DHS, known as NPPD, was tapped by the Secretary of Homeland Security to lead the election security efforts, at a minimum for DHS, but more broadly at that point for the federal government. 18:04.750 --> 18:10.210 Established a number of different organizations, sector coordinating councils, government coordinating councils. 18:10.210 --> 18:13.370 We have members of those throughout the room. 18:13.710 --> 18:33.750 One of the key things that we were tasked with doing was making sure that there were security resources, security and vulnerability assessments, cyber hygiene scanning capabilities, all these basic cybersecurity tools were made available to as many election officials and jurisdictions as possible. 18:33.810 --> 18:35.710 Some used them. 18:35.710 --> 18:37.270 Some did not use them. 18:37.270 --> 18:39.250 Some could not use them. 18:39.250 --> 18:42.490 They didn't actually have the technology in place. 18:42.490 --> 18:43.790 And that has grown over time. 18:43.790 --> 18:52.410 We also set up things like the ISAC, the Election Infrastructure ISAC that's hosted at the multi-state ISAC in upstate New York. 18:52.550 --> 18:56.110 And then we were just talking about tabletop the vote. 18:56.110 --> 19:06.930 We would hold annual tabletop exercises to walk through various scenarios that may come up and how we would prepare for them. 19:06.970 --> 19:22.870 So in that time period in the run-up to the 2018 election, starting in February after we established the Election Infrastructure ISAC, that's February 2018, by that summer, or right before the election at least, we had all 50 states participating in that ISAC, 19:22.870 --> 19:25.370 which was a huge accomplishment. 19:25.530 --> 19:34.970 You know, what I felt at the time as director was my KPI was getting all 50 states signed up in advance of the 2018 election. 19:34.970 --> 19:36.650 We did that in one way or the other. 19:36.650 --> 19:38.650 I made 50, by the way. 19:38.930 --> 19:40.130 Me personally. 19:40.290 --> 19:41.050 I think that's right. 19:41.050 --> 19:41.850 I think that's right. 19:41.850 --> 19:43.170 Oh yeah, you guys flew me right out there. 19:43.170 --> 19:44.390 I was the only one in Vermont. 19:45.150 --> 19:50.810 I think I gave one of your senators a lot of grief about that. 19:51.350 --> 19:54.790 I wasn't afraid to pull out political soft power. 19:56.190 --> 19:58.910 So maybe Michael, we'll start with you. 19:59.010 --> 20:10.910 So of those tools that are available from the government, the security vulnerability assessment, cyber hygiene scanning, some of these on-site physical assessments you're talking about, what do you, you know, what did you get the most value out of? 20:10.910 --> 20:11.550 What do you think? 20:11.550 --> 20:17.410 And then, you know, maybe like what do we need more of and maybe not as much as something else? 20:17.750 --> 20:18.950 Oh sure, yeah. 20:19.710 --> 20:24.670 I would say that I'm the biggest fan of the physical security assessment, having our DHS rep come out, right? 20:24.670 --> 20:27.310 This is someone who is an expert on physical security. 20:27.310 --> 20:33.330 He can walk around the building, or she, the previous one was a quite a nice lady. 20:34.810 --> 20:45.930 And what's amazing is you already kind of know in election operations what your pain points are, I need more cameras, I need a fence, stuff like that. 20:46.290 --> 20:53.670 Now you have a report from the Department of Homeland Security that says, hey, you really, it'd be nice if you have these things to increase your security. 20:53.670 --> 20:59.570 So that is phenomenal when it comes to applying for grants or talking to your board of supervisors or however your county works. 20:59.570 --> 21:04.830 Like it's not just you anymore being the squeak wheel saying like, hey, I really need cameras. 21:04.890 --> 21:08.050 Well, it's the federal DHS telling me I need cameras. 21:08.050 --> 21:09.810 To me, I love that. 21:10.050 --> 21:17.990 If you had infinite money and influence, what I want, what I really, really want is something like a tiger team. 21:17.990 --> 21:27.250 I don't know exactly how it would work of CISA and probably your state DHS to go out to all of these local entities. 21:27.490 --> 21:34.470 Look, the people that are running your local government entities are doing the best they can. 21:34.470 --> 21:35.610 They're great at operations. 21:35.610 --> 21:36.970 They keep the light on. 21:37.190 --> 21:40.930 Technical debt accrues over the course of decades. 21:40.930 --> 21:55.930 You develop stuff to make sure that your business functions, having a team come in to help that specializes in remediation and doing physical security assessments, cybersecurity assessments, but not just doing the assessments, but literally helping you work. 21:56.330 --> 22:02.110 CIS admins, net admins that will help you go through your controls and optimize them. 22:02.110 --> 22:09.610 Make sure that everything's patched correctly, all your configurations correct, help you implement network segmentation, which is like a big old pain. 22:09.630 --> 22:12.890 But having some entities to help with that, that would be amazing. 22:14.090 --> 22:14.690 Mr. 22:14.690 --> 22:19.990 Secretary, I think Michael just signed you guys up for a pilot project with DHS. 22:21.950 --> 22:22.950 There you go. 22:22.950 --> 22:23.830 That's my secretary. 22:23.830 --> 22:27.010 I think that makes a lot of sense. 22:27.010 --> 22:34.970 And your question on scale is a good one because when you think about the personnel CISA has in the field, this was always the question I was getting. 22:34.970 --> 22:40.850 How many people do you have designated or dedicated to election security across CISA? 22:40.850 --> 22:45.110 And the core team was about a dozen and a half. 22:45.110 --> 22:51.450 But at any given time, there were hundreds of people across CISA doing some kind of election security work. 22:51.450 --> 22:53.890 So we'd get some logs in from a state. 22:53.890 --> 22:56.950 So we'd be crashing a team on log analysis. 22:56.950 --> 23:04.650 Our protective security advisors doing a walkthrough of a precinct or our cyber advisors out there. 23:06.410 --> 23:13.850 Director Easterly just announced, I believe a couple weeks ago, that there will be dedicated election security advisors out in the field. 23:13.850 --> 23:19.910 And so we're starting to see that shift, that this is a core priority for the department, for our state and local partners. 23:19.910 --> 23:27.730 I like your idea, of let's first off, we have to find the willing and able jurisdictions that let you come in. 23:27.730 --> 23:31.670 And that's not always a guaranteed and it's not always a given. 23:31.730 --> 23:32.170 No, no, no. 23:32.170 --> 23:33.710 I'm not talking about the state level. 23:33.710 --> 23:35.570 I'm talking about the local jurisdiction. 23:35.950 --> 23:37.330 I could probably convince a few of them. 23:37.330 --> 23:38.270 No, I'm sure you can. 23:38.270 --> 23:39.770 But I like this idea. 23:39.990 --> 23:45.850 So from a physical perspective, what do you see differently here? 23:45.850 --> 23:46.910 Or is it the same? 23:47.210 --> 23:49.210 You're still working with the ISACs. 23:49.530 --> 23:50.750 What about the FBI? 23:50.750 --> 23:53.390 What about the state level law enforcement? 23:53.390 --> 23:59.330 What are those resources that you might get from, as you were talking about earlier, the top down? 23:59.330 --> 24:00.610 What does that look like? 24:00.670 --> 24:02.830 Well, right now it doesn't look like anything. 24:03.310 --> 24:09.630 And it's tricky to imagine the paradigms we have in Vermont really squeezing them in. 24:09.630 --> 24:12.490 That's going to have to come through the Secretary of State's office. 24:12.890 --> 24:19.290 And we have a very top-down system where Secretary of State really tells us what to do and how to run our elections. 24:19.290 --> 24:24.430 But you've got to remember in Vermont anyways, that's only about half a million people in the entire state. 24:24.430 --> 24:33.570 So Vermont is really the size of what we would consider one jurisdiction in a lot of the rest of the country. 24:33.570 --> 24:45.930 So I think that's uniquely scaled so that really the FBI, state authorities should come through that to us. 24:45.930 --> 24:54.950 Because there's just otherwise not going to be enough of them to go around with 256 jurisdictions with half a million people. 24:54.950 --> 24:56.810 So we're a little different in that. 24:56.810 --> 25:11.450 But I'd like to see our state and I think these smaller states, probably true of places like Wyoming and other smaller states, to see a lot of that facilitated through the Secretary of State's office as opposed to being an expectation at my level. 25:12.470 --> 25:16.650 And so that last mile was always difficult. 25:16.650 --> 25:20.910 For us, it was easy to work directly with the Secretaries of State or most Secretaries of State. 25:20.910 --> 25:26.290 But when you talk about those 9,000 jurisdictions getting out, counties, we could cover all the major counties. 25:26.370 --> 25:32.790 But once you start getting out of the townships and the localities, A, they're like, what the hell's a CISA? 25:33.050 --> 25:37.370 And B, what am I going to do with this stuff anyway? 25:37.370 --> 25:39.290 Because we're still running Windows 95. 25:39.980 --> 25:41.750 How is this going to work? 25:42.230 --> 25:48.290 And not only are you the town clerk, you're also the town CIO. 25:48.330 --> 25:57.610 And so there's a lot of that lack of capacity in that last mile that I think is part of the challenges. 25:58.150 --> 26:04.230 So Ashley, maybe bring this back into some of the ISAC questions and the information sharing mechanism. 26:04.230 --> 26:18.910 So as you come across something, if you come across something interesting, what are your processes for making sure it gets down to, well, it gets to Michael, but it also can work its way to John? 26:19.790 --> 26:28.290 Yeah, it might surprise some folks that even though I work for a vendor, we're a for-profit company, we do share a lot of our research publicly. 26:28.790 --> 26:33.810 Not to get cheesy, but I think the saying, if you want to go fast, go alone. 26:33.810 --> 26:35.290 If you want to go far, go together. 26:35.290 --> 26:40.530 I think that really applies, especially when it comes to election security, critical infrastructure security. 26:40.790 --> 26:48.070 And so just like you might have information sharing between states, we also have information sharing between vendors. 26:48.070 --> 26:50.550 There are entire groups that are dedicated to this. 26:50.550 --> 26:53.130 Cyber Threat Alliance is one that we really love. 26:53.470 --> 27:02.910 And so the more quickly and more efficiently we can get info out to these other vendors, the better we're able to actually help something as important as election security. 27:03.370 --> 27:09.850 And so I think if you work for a company that hasn't quite adopted that ethos yet, maybe make a suggestion. 27:09.950 --> 27:18.150 I think it's always better to partner and try to go farther with research than it is to try and be first or loudest. 27:18.150 --> 27:21.690 And I think most of the security community has also adopted that sentiment. 27:22.170 --> 27:32.410 Yeah, and that's something that I for sure saw over the last several years was the for-profit vendors, threat intelligence companies, starting to open up research, share it. 27:32.430 --> 27:40.530 We actually even worked with one of the largest CTI firms that had some license restrictions on what the information they shared with us. 27:40.870 --> 27:42.290 And we're like, oh, this is really important. 27:42.290 --> 27:43.710 We need to get it down to the states. 27:43.710 --> 27:45.050 They're like, ah, we can't. 27:45.050 --> 27:46.910 It's restricted by the licenses. 27:46.910 --> 27:52.450 But they opened up the licenses and we're able to kind of get that blast, that shotgun spread out there. 27:52.450 --> 27:58.210 And so that really, I think, was a big change in kind of mentality and resourcing. 27:58.210 --> 28:06.030 Because look, a lot of these jurisdictions are not going to be able to afford to buy these licenses. 28:06.490 --> 28:13.370 And never mind the fact that the money's just not there, right? 28:13.970 --> 28:22.090 Even if you talk about federal grants, that's going to take a while, if ever, to trickle down here. 28:22.330 --> 28:28.050 So we've got about, so maybe we can open up for a couple questions. 28:28.290 --> 28:30.250 And I don't, do we have that handheld, Matt? 28:30.250 --> 28:30.950 Yeah. 28:31.650 --> 28:33.910 I think they want to get it for the live stream. 28:35.690 --> 28:36.670 We got mics here. 28:36.670 --> 28:38.170 Just yell into our chests. 28:38.490 --> 28:39.430 That's not going to be awkward. 28:39.430 --> 28:40.210 I love it. 28:42.850 --> 28:44.030 All right. 28:45.510 --> 28:56.010 I would like to know how you see the influence of foreign countries and how you want to prevent that, any negative influence or to the voting. 28:57.790 --> 29:04.630 So how do you think about, I think, you know, the question here is, how do you and your jobs think about the impact of disinformation? 29:05.290 --> 29:08.370 Foreign, we'll say, we'll caveat it out as foreign right now. 29:08.430 --> 29:14.910 And I think you talked about it a little bit when you're starting to see the waves coming up, the local disruption, you know. 29:14.910 --> 29:17.650 Do you think about that, of how is it foreign? 29:17.650 --> 29:18.330 Is it domestic? 29:18.330 --> 29:18.950 Does it matter? 29:18.950 --> 29:19.870 It's just happening. 29:19.870 --> 29:21.530 And then how do you couch back against that? 29:21.530 --> 29:24.510 So I'll just, we can, you know, why don't we start with you, Michael? 29:26.250 --> 29:26.850 Right. 29:28.030 --> 29:34.090 I mean, misdisc and malinformation are basically my biggest concern, right? 29:34.090 --> 29:35.750 And to Mr. 29:35.750 --> 29:38.810 Krebs's point, attribution is difficult. 29:38.830 --> 29:44.310 I feel like at this point, it's very frequently, we're doing this to ourselves and that's incredibly frustrating. 29:45.430 --> 29:50.390 I'm deeply concerned about the drain that we have on our elections force, right? 29:50.390 --> 29:55.130 We have lost quite a bit of people, quite a bit of experience. 29:55.130 --> 30:02.310 Sometimes we're fortunate and they'll pivot from being at this county to a different county or come up to the secretary of state's office, which is great. 30:02.310 --> 30:10.290 But that's one of the things that I've really been trying to focus on is make people be safe and make people feel safe, right? 30:10.290 --> 30:19.810 There's a very real limit to the amount of times you receive a death before you're like, why am I doing this when I can make more money in the private sector? 30:19.810 --> 30:23.990 Like, is this really worth it to be having my family threatened all the time? 30:23.990 --> 30:26.550 So I take it incredibly seriously. 30:26.850 --> 30:36.570 And as I mentioned in the previous talk, sorry for repeating myself, we do active threat hunting and Maricopa County is the largest county in Arizona. 30:36.710 --> 30:40.090 And it's not just about like taking care of yourself, right? 30:40.090 --> 30:41.250 They do threat hunting. 30:41.250 --> 30:44.410 If they see something that affects a different county, they report it. 30:44.410 --> 30:45.890 They report it up to us. 30:46.090 --> 30:49.470 We have a precise codified process. 30:49.770 --> 30:58.550 We are fortunate and it seems like we have the gold standard when it comes to fusion centers, the ACTIC, the Arizona Counterterrorism and Information Center. 30:58.550 --> 31:01.750 It's a fusion center with local, state, federal law enforcement. 31:01.750 --> 31:03.050 They take everything seriously. 31:03.050 --> 31:05.510 We report threats and they handle it, right? 31:05.510 --> 31:07.030 It tends to be a one-way street. 31:07.030 --> 31:08.650 You don't get to always hear what happens. 31:08.650 --> 31:11.010 Sometimes you hear what happens in the media. 31:11.050 --> 31:15.190 Law enforcement doesn't really communicate back to you, but they investigate every single thing we report. 31:15.850 --> 31:21.130 And again, just the other thing of social media lockdown training, right? 31:21.130 --> 31:30.790 Making sure that we reduce the attack surface as much as possible so that when somebody tries to go after one of my staff, one of my electeds, they come up with as very little as possible. 31:30.790 --> 31:34.930 And the only other thing I wanted to mention on this is we're incredibly lucky in Arizona. 31:34.970 --> 31:46.130 Senate Bill 1061 has passed and what it allows is for anyone who is an election official, they can have their information redacted from public record. 31:46.130 --> 31:48.970 So no longer are their addresses going to be out there. 31:48.970 --> 31:54.330 I've made sure to communicate with our courts to make sure that we know exactly what the process is going to be. 31:54.330 --> 31:56.950 And as I talked about before, we have these statewide election security meetings. 31:56.950 --> 31:58.190 I'm going to hammer it home. 31:58.190 --> 32:01.470 Some of the counties are like, uh, you know, the bigger counties get more threats. 32:01.470 --> 32:02.850 We don't get so many threats. 32:02.990 --> 32:03.850 This costs nothing. 32:03.850 --> 32:04.470 Just do it. 32:04.470 --> 32:06.350 Get your information redacted. 32:06.350 --> 32:08.670 When people are banging on your door, it's already too late. 32:08.670 --> 32:09.430 You've been docked, right? 32:09.430 --> 32:11.510 Let's get it taken care of ahead of time. 32:14.030 --> 32:25.370 As far as misinformation goes and the impact it has, you know, I have a lot of interest in this sort of academically, but at my level, what matters is where the rubber hits the road. 32:25.370 --> 32:27.710 And that's, what does that mean at the polls? 32:28.230 --> 32:34.470 In that sense, it sort of doesn't matter if it's coming from a foreign or domestic interest. 32:34.490 --> 32:39.470 If people are getting the wrong information and they're coming to the polls. 32:40.950 --> 32:43.450 Well, let me, let me just put it this way. 32:43.610 --> 32:52.170 One of my biggest concerns that hasn't come yet is if somebody gets very angry based on some misinformation, and I don't mean come in and start doing an active shooter thing. 32:52.250 --> 32:53.830 I mean, sure that could happen. 32:53.830 --> 32:55.730 We definitely have protocols about that. 32:55.730 --> 32:59.050 It's, it's, it'll always be near the front of my mind. 32:59.090 --> 33:02.710 Frankly, I worry more about just somebody coming in with open carry. 33:02.710 --> 33:18.800 We talk about a lot about voter suppression, voter intimidation, and we're usually talking about that on a grander level, but really the ultimate voter suppression would be somebody walking in with the intent of intimidating other people and keeping them from voting. 33:19.230 --> 33:26.670 So in that sense, it really doesn't matter to me where it's coming from, because it's all going to land right at my lap. 33:26.690 --> 33:32.110 And we haven't had big problems with that yet, but I think it's responsible. 33:32.210 --> 33:38.370 I'm responsible and other folks, other election administrators on the ground are responsible to plan for that at this point. 33:38.370 --> 33:46.190 This sounds very grim and disturbing, and I'm actually very optimistic about all this stuff, but you know, it's grim stuff sometimes. 33:46.610 --> 33:59.030 So Ashley, you know, I know tracking foreign disinformation campaigns is much different than cyber threat intelligence, but do you guys look at this broader kind of information operation space as well? 33:59.130 --> 34:20.910 Yeah, what comes to mind, I think, in work we've recently done is, if you've been to my talk this morning, I apologize, I'm going to repeat myself a little bit, but we recently at my company had reviewed an application that was going to be used by a state entity for some of their back-end infrastructure for an election. 34:21.330 --> 34:30.390 And as part of this application, there was a dependency on a third-party library, so something that was open-source hadn't been written by the contractor in question. 34:31.010 --> 34:41.670 And in this third-party library, there were callbacks to a few foreign TLDs that are nations that we have rather tense relations with in the U.S. 34:41.830 --> 34:48.910 And so when I think about that, you know, what I think about is the potential for information that would have just a little bit of truth. 34:48.970 --> 35:02.230 And I think the potential to run with that, with someone with an agenda, with very extreme feelings, who is willing to take extreme action to manipulate an election, you know, that worries me. 35:02.230 --> 35:16.110 And so I think what we are most concerned about in terms of our work, which is a little bit sad, as you mentioned, is really preventing that opportunity from ever being there in the first place. 35:16.210 --> 35:39.730 I think that's a really key point, how little fragments that are not at all relevant to the casting, counting, certification of a vote, or the disruption of it, yet become the kernel of a conspiracy theory that then feeds that sort of activity you just talked about and some of the things that you guys have seen in Arizona. 35:39.730 --> 35:55.890 So maybe let's play off that a little bit and talk about understanding that, again, 2024 is around the corner and you both experienced, whether it was in 22 or 20, audits and post-election reviews, things like that. 35:55.890 --> 36:10.730 Understanding my personal view is post-election audits are a very good thing, assuming they're professionally conducted, set to a certain set of standards that are commonly accepted and agreed upon in advance rather than post hoc. 36:11.050 --> 36:24.750 Maybe you want to talk a little bit about how you are thinking about preparing for post-election reviews, post-election audits, that are both whether in statute or could be coming down the pipe. 36:24.950 --> 36:26.050 Maybe we'll start with that. 36:26.050 --> 36:26.570 Sure. 36:27.510 --> 36:29.730 Yeah, obviously I like audits, right? 36:29.730 --> 36:30.870 But to Mr. 36:30.870 --> 36:34.650 Krebs's point, they should be run by professionals that know what they're doing. 36:35.630 --> 36:44.110 Without using too many names, the Arizona Senate had an audit in 2021 of the 2020 general election. 36:44.150 --> 36:51.210 And, you know, we have an election procedures manual and it dictates how you do audits of things. 36:51.210 --> 36:55.610 And it doesn't use the word Lazy Susan in it ever at all. 36:55.610 --> 37:09.110 So like the idea of spinning and trying to count ballots and allowing for discrepancies, like it's surprising that they were even remotely close to the actual count. 37:09.110 --> 37:11.210 So not a fan of that. 37:14.010 --> 37:20.050 We have thought about like if we're going to have to do audits like this, how can we improve, right? 37:20.050 --> 37:24.770 Like there's always a way to improve security in elections, right? 37:24.770 --> 37:27.290 Because it's a system that exists in the universe. 37:27.370 --> 37:38.710 And, you know, one of the things that would be very interesting to implement into the election management systems is a mechanism for key logging, right? 37:38.710 --> 37:39.750 Because why not, right? 37:39.750 --> 37:53.570 If they're going to, if there's going to be a question in your election management system of it has someone tampered with it, it would be really nice to, by default, have every single key lock, every keystroke, mouse click, whatever, logged. 37:53.570 --> 37:55.050 And then that can be reviewed, right? 37:55.050 --> 38:02.510 And you can demonstrate that there hasn't been any anyone doing anything wacky and trying to change any kind of results. 38:03.490 --> 38:07.210 Yeah, I think that's a key point there, John, or Michael, rather. 38:08.110 --> 38:10.030 You can run the cleanest election possible. 38:10.550 --> 38:15.630 There's someone that has an incentive out there to claim that something went wrong. 38:15.650 --> 38:26.210 And so I continue to think, and this is what I think, where Steve and Richard in Maricopa County, a reporter, has done a very good job of upfront transparency. 38:26.210 --> 38:31.630 You know, take the pieces off the board that could be used to get you down the road. 38:31.630 --> 38:47.590 And this is a shift I think we've seen in election administration over the last half decade or more, is where it was usually kind of a mundane state-local election process that, well, nobody would want to, nobody cares what we do here to make sure elections go on. 38:47.630 --> 38:49.930 This is, this is mundane stuff. 38:49.930 --> 38:55.070 But now it's, you know, headlines stuff, you know, headline news, always on TV. 38:55.070 --> 38:58.870 So you have to rethink your strategic communications approach. 38:58.870 --> 39:00.770 We talked about that a little bit this morning. 39:00.910 --> 39:03.910 All right, John, so anything you want to jump in there and add on? 39:03.910 --> 39:14.410 Like anticipating challenges, how do you make sure that you've got the tightest possible approach in preparation for any election, post-election challenges? 39:14.410 --> 39:15.370 Anything to add? 39:15.670 --> 39:19.910 Well, we're definitely dotting our I's and crossing our T's more than we usually do. 39:20.250 --> 39:29.250 I think we, again, to harp on the small jurisdiction, we would like to see a little more leadership from the state. 39:29.250 --> 39:32.370 I'll tell you all something that is probably going to shock you. 39:32.370 --> 39:43.530 I've been running elections in Montpelier for 12 years, and the Secretary of State has audited my voting machines exactly zero times. 39:43.590 --> 39:45.190 This never happened. 39:46.330 --> 39:52.250 That, we'd like to see a little, to pass the buck a little bit up, I'd like to see a little bit more of that. 39:52.510 --> 40:04.210 But other than that, you know, I'd like to say that we've always done everything absolutely up to specs, dotted every I, crossed every T. 40:04.250 --> 40:08.190 Now that I'm actually doing that, I'm realizing that we haven't always. 40:08.770 --> 40:14.370 But we're certainly taking the steps now to make sure everything can go as well as it possibly can. 40:14.370 --> 40:18.650 Do you not have LNAs in Vermont? 40:18.650 --> 40:22.150 Do you not do logic and accuracy tests by the Secretary of State? 40:23.150 --> 40:23.190 Nope. 40:23.190 --> 40:25.530 Well, no, let me qualify that. 40:25.530 --> 40:27.050 They are done randomly. 40:27.050 --> 40:28.790 Okay, but not every election? 40:29.210 --> 40:31.490 After every election, they're done randomly. 40:31.490 --> 40:33.390 My number has yet to come up. 40:33.450 --> 40:37.270 So I think a random test is inadequate, I guess is my point. 40:37.270 --> 40:38.390 So we do test. 40:38.410 --> 40:39.710 State-level tests. 40:39.710 --> 40:41.350 State-level tests. 40:41.550 --> 40:46.190 And they'll go to individual jurisdictions and test and audit their machines. 40:46.330 --> 40:48.670 But it's, it's scattershot. 40:48.670 --> 40:51.670 And I have not been hit by any of the scattershot yet. 40:51.670 --> 40:54.310 So that's, there's, there's room for improvement. 40:54.310 --> 40:56.270 And I know we're not unique. 40:56.270 --> 41:13.110 I think there's, I think all of this speaks to just what a range, what a curve there is on elections in this, in this country, between Vermont, Arizona, Mississippi, wherever, wherever you go, things are not uniform. 41:13.510 --> 41:17.390 And there are places that take this much more seriously than others. 41:17.550 --> 41:26.090 And there needs to be some kind of standardization, or at least an expectation of standardization moving forward. 41:26.090 --> 41:31.570 Or, you know, the, the more vulnerable states are going to shake out from the less vulnerable states. 41:31.570 --> 41:35.030 And we're going to start seeing more problems in some areas than others. 41:36.110 --> 41:38.210 Ashley, anything you want to jump in on? 41:38.570 --> 41:39.390 I don't think so. 41:39.390 --> 41:39.690 Okay. 41:39.690 --> 41:40.130 All right. 41:40.130 --> 41:42.510 So we're, we're getting up to time here. 41:42.510 --> 41:44.250 So I'm against better judgment. 41:44.250 --> 41:47.830 I'm actually, I will take another question from the audience. 41:48.050 --> 41:48.230 All right. 41:48.230 --> 41:50.850 So we'll take two because the hands went up simultaneously. 41:51.150 --> 41:52.710 So since you're right in front of me. 41:54.790 --> 41:57.850 So this is kind of playing off of what you said. 41:57.850 --> 42:01.870 So, you know, in, in any type of sales, right, you have different segments that you're in. 42:01.870 --> 42:05.530 And right now, what I'm hearing your segment in is, you're in a defensive mode. 42:05.530 --> 42:06.870 You're going to get attacked. 42:06.870 --> 42:08.070 I'm in a defensive mode. 42:08.070 --> 42:10.550 It's always fun to carry the ball, right? 42:10.550 --> 42:16.690 I think Americans want to be peaceful and get along, but you have a product that you're keeping secret. 42:16.950 --> 42:26.410 If you got in front of the camera 500 times and said that to the public, and you're, we're not perfect, but here's what we're doing to make them as secure as possible. 42:26.530 --> 42:27.470 You did yours. 42:27.470 --> 42:28.350 You did yours. 42:28.350 --> 42:34.570 Why not get in the offensive mode and start educating the public as much as you can and really do those things. 42:34.570 --> 42:36.290 Hey, we know we're not perfect. 42:36.290 --> 42:38.950 We're plugging the holes because how many people have iPhones? 42:39.250 --> 42:46.530 I've had to convince so many people that the notifications to update your iPhone, this is not a secret conspiracy to get into your iPhone. 42:46.530 --> 42:50.630 This is that they're putting a patch on your phone so people can't get in. 42:50.630 --> 42:55.230 So this is from the other side, because I believe a lot in detente, be prepared for the worst. 42:55.230 --> 42:58.070 My husband's a retired AC for LA County fire, right? 42:58.070 --> 43:02.110 Be prepared for the worst, but you have some time to start building confidence. 43:02.110 --> 43:07.310 There's a man from Holland here, and we actually had them conversation about building trust. 43:07.390 --> 43:09.550 It's not going to happen by saying it once. 43:09.550 --> 43:12.410 You're going to have to get on there and create a PR program. 43:12.530 --> 43:15.270 And really people don't want to be fighting. 43:15.390 --> 43:19.430 And honestly, you have a lot of Christians in this, this thing. 43:19.430 --> 43:21.230 What if Jesus was sitting next to them? 43:21.230 --> 43:27.670 You really need to say that what I heard that you expose, people need to know that this is what's happening to their neighbor. 43:28.070 --> 43:30.710 This is not acceptable, right? 43:30.710 --> 43:34.370 But get out there and tell them, stop keeping your product a secret. 43:34.650 --> 43:36.330 We are doing this. 43:36.330 --> 43:38.290 We're trying to do auditing. 43:38.290 --> 43:46.610 Yes, you can hack the machine, but there's all these other walls in place other than the machine that's helping keep the machine secure. 43:46.610 --> 43:48.770 It's not just the hack. 43:48.810 --> 43:52.330 Get out and just start talking, talking, and it's not going to be once. 43:52.330 --> 43:56.450 It's going to be a lot to that really quickly because you're so right. 43:56.730 --> 43:56.810 Okay. 43:56.810 --> 43:58.670 This is something I talked about in my own talk. 43:58.670 --> 44:03.590 So if anybody heard that, you're going to get a little bit of a rerun, but I am an incredible optimist about this. 44:03.590 --> 44:14.010 I think the message is not that there aren't going to be problems, that there aren't going to be challenges and not theoretical challenges, but actual some of this stuff manifesting. 44:14.010 --> 44:26.630 But if we are looking at all the problems openly, and we're doing everything we should do, we're covering all the bases that when we take a hit, it's going to be a glancing blow and not a mortal wound. 44:26.890 --> 44:29.970 And I think that is the message to get out. 44:29.970 --> 44:33.230 Like I said, otherwise, a lot of this becomes kind of nihilistic. 44:33.930 --> 44:40.630 But when I talk to folks, I always close up with that because that's what brings it all together. 44:40.630 --> 44:41.930 And that's why we're all here. 44:41.930 --> 44:47.830 That's why Voting Village exists, is to shine that kind of sunshine and show the world we're going to do everything right. 44:50.250 --> 44:55.010 So the PTSD you just triggered, by the way, with me, because this is what we did for the 2020. 44:55.010 --> 44:55.670 Super quick. 44:55.790 --> 44:57.850 So what? 44:57.930 --> 44:58.430 Yes. 44:58.430 --> 44:59.130 Yes. 44:59.130 --> 44:59.990 I'm here. 44:59.990 --> 45:00.930 We're having this talk. 45:00.930 --> 45:02.150 My secretary of state's right there. 45:02.150 --> 45:03.890 My communication director is here. 45:04.230 --> 45:07.510 And just the fact that vote like we're trying, we are trying. 45:07.590 --> 45:09.930 But the lies are more sexy than the truth. 45:10.030 --> 45:10.510 Right? 45:10.510 --> 45:11.890 We've got 2000 mules. 45:11.890 --> 45:13.730 We have an elections procedure manual. 45:13.890 --> 45:14.190 Right? 45:14.190 --> 45:15.830 No, nobody wants to read that. 45:15.830 --> 45:17.510 So we're right. 45:17.510 --> 45:18.270 We are trying. 45:18.270 --> 45:19.490 I assure you, we're trying. 45:21.470 --> 45:21.790 All right. 45:21.870 --> 45:22.490 Sorry. 45:22.490 --> 45:24.430 I think this could have to be the last one. 45:24.830 --> 45:30.990 So I have a question about sort of training for poll workers and training for the voter. 45:31.490 --> 45:34.470 Sometimes the risk is inside the house. 45:34.470 --> 45:41.170 So is there like insider threat training you do or other sort of cyber hygiene training you do for election workers? 45:41.950 --> 45:53.190 Oh, well, the last election was the first time I ever had a moment of doubt about a couple of my election volunteers. 45:53.190 --> 45:54.830 I was like, hmm. 45:54.830 --> 45:59.110 So I don't look for that. 45:59.110 --> 46:01.710 I'm not looking for the sneaky ones. 46:01.710 --> 46:02.870 And maybe I should be. 46:02.870 --> 46:15.210 I have the great luxury of being in, I'm going to say, I'm going election-oriented, civic-oriented Montpelier, Vermont. 46:15.650 --> 46:17.850 Others don't have that luxury. 46:17.850 --> 46:23.730 But I guess it's a long-winded way of saying I have thought about it. 46:24.310 --> 46:26.870 And I don't have good systems in place yet. 46:26.870 --> 46:28.250 But I will. 46:29.730 --> 46:32.910 I'm absolutely concerned about insider threat. 46:32.910 --> 46:34.010 Oh, I don't have to stand. 46:34.010 --> 46:36.370 I'm absolutely concerned about insider threat. 46:37.250 --> 46:38.690 I do need to stand? 46:39.710 --> 46:40.590 Okay. 46:40.730 --> 46:43.690 I am absolutely concerned about insider threat. 46:44.630 --> 46:50.290 In Arizona, we have election officer certification and that kind of thing is discussed there. 46:50.790 --> 46:55.050 Maricopa has specifically implemented premium poll worker training that's multiple day-long training, right? 46:55.050 --> 46:57.210 And it's very much a see something, say something. 46:57.230 --> 47:02.710 And if you are concerned about election security, please, if you have the means, please be a poll worker. 47:02.810 --> 47:05.790 If you see someone doing something weird, report it, right? 47:05.790 --> 47:06.530 Absolutely. 47:07.270 --> 47:22.490 But, you know, we have had some instances where people behave oddly and staff members notice that and they report it and we have it on camera and we're able to see the weirdness that people are doing and they're out of there and we contact that political party and let them know, 47:22.490 --> 47:24.290 like, hey, this person did this thing. 47:24.290 --> 47:25.670 They're not welcome back. 47:25.810 --> 47:27.230 Make sure you vet your people. 47:28.470 --> 47:29.510 Okay. 47:29.510 --> 47:32.670 We had one more question that was more about local partnerships. 47:37.610 --> 47:45.710 Basically, making use of trusted associations to try to address misinformation, malinformation and so forth. 47:45.710 --> 47:49.430 Like, is there a move locally, nationally to do more of that? 47:52.220 --> 47:56.200 I think that's a tricky thing to do as the local elections person. 47:56.380 --> 48:02.580 To sort of coordinate civic groups, you get into questions of who are you bringing into your partnership? 48:02.920 --> 48:09.220 Because, I mean, there is a certain degree of neutrality, I think, that has to be maintained. 48:09.220 --> 48:13.240 And that's the kind of thing I would like to see somebody else do. 48:13.540 --> 48:16.780 But I think coordinating it out of my office would be problematic. 48:16.820 --> 48:20.880 There'd be anything from, yeah, questions, who am I bringing in? 48:20.880 --> 48:22.540 Why am I not bringing in others? 48:22.540 --> 48:25.820 There could be questions of implicit bias that then come up. 48:25.820 --> 48:29.340 So I'd love to that happen, but I don't think I'm going to do it. 48:30.540 --> 48:36.100 So forgive me, but I don't remember the name of the association, but there's a Veterans Association, right? 48:36.100 --> 48:39.220 And veterans are the most trusted people. 48:39.220 --> 48:42.420 Unfortunately, they're also frequently the target of MDM, right? 48:43.900 --> 48:48.860 But there is an initiative to utilize veterans for poll workers. 48:48.860 --> 48:54.100 And I mean, what kind of psycho is going to be threatening veterans? 48:54.100 --> 48:57.480 So I think it's a very... and they're trusted, right? 48:59.300 --> 48:59.660 So... 48:59.660 --> 49:00.120 All right. 49:00.200 --> 49:02.460 With that, I think we're wrapping it up here. 49:02.560 --> 49:06.480 I want to thank both of you for what you do in the furtherance of democracy. 49:06.480 --> 49:07.140 Thank you. 49:07.140 --> 49:08.020 Thank you for that. 49:08.020 --> 49:10.220 And everybody, I think we give them a round of applause. 49:12.320 --> 49:14.680 Ashley, thank you for what you guys do as well.