Transcripts For CSPAN U.S. Election Assistance Commission Meeting On Security 20240714

Liberty and justice for all. If you could silence your cell phones and electronics i would appreciate it. Im going to take the role. Good afternoon, thank you for joining us at the u. S. Election tosistence commission, examine the security challenge Election Administration faced to head of the 2020 president ial election. This little conversation will provide us with a better understanding of ways the commission can help, address a variety of Security Issues, including those that stem from aging Voting Technology. When Congress Passed the help america vote act it established the eac as the only federal entity solely focused on supporting Election Officials and the voters they serve. Part of our charges to be the nations clearinghouse of information on Election Administration. It is this responsibility that brings us here today and guides our Election Security efforts. We pride ourselves in convening the right people at the right time to address significant issues and this event is yet another example of that work stop while there are plenty of News Headlines that can serve as the backdrop for this conversation we are not here to address any one specific media report, we are gathered for a comprehensive look in here from three people, including secretaries of state, a state election director, our federal partners, testing and certification professionals, and representatives from the election industry. Todays forum and input from these witnesses could not be more timely or important. Election security is front of mind for everyone, especially those on the frontlines of administering the vote. The recently released 2018 Election Administration voting nationwidealed that fees Election Officials reported to,422 pieces of equipment cast in tabulated votes in the 2018 midterm elections. Election officials are responsible for each and every piece of that equipment. We know they rely on federal partners and election vendors to provide the resources and support they need to make election systems more secure and resilient. We all have a responsibility to provide that assistance. It is my wish we leave todays forum with a better keepstanding of how to things safe, the ongoing innovative approaches they can use to ward off security threats, and how all of us in this room can help the elections that garner Public Confidence in the end result. I ask my fellow commissioners to make the Opening Statement. Thank you, chairwoman mccormick. Im pleased we are holding this forum on such an important topic. In the six months since the commissioner and i were sworn in, they have been highly focused on our role with Voting Technology. Our first action with a restore forum was to start a 90 day Public Comment period on the Voting System guidelines. Public meetings on this new draft version of the principles and guidelines during which we heard that it is a significant step forward to modernized Voting Technology. We also discussed how the voluntary nature results in a system where the full value was only realized if the guidelines and the testing and Certification Program are utilized across country. Should strive we to create a testing and certification system that is responsive to the needs of the Election Officials and provides access and security to the American Voter that they deserve. Speaking of the testing and Certification Program, we recently added Jessica Bowers and paula meyer, who have brought decades of experience with election equipment and certification to the team. We are lucky to have such talented individuals working here. Im confident our agency and the testing and certification see arrived at the challenge before us today and worked with Election Officials, Voting System manufacturers, test laboratories, and federal partners from the National Institute of standards and technology and the Security Agency to quickly develop processes and procedures to incentivize the efficient deployment of patches or updates to Voting Systems in the field. Doing so is crucial to the security of our election systems but they do not exist in a vacuum. Onlier i mentioned our work the bsg we are also working on drafting the new technical requirements crucial to developing the next generation of voting equipment. These efforts to complement the important conversations happening every day in the yield on issues like assessing and mitigating risks or adopting a coordinated vulnerability so that potential issues can be reported and fixed before they can be exploited. This forum will be an important step in identifying areas where we has an agency can do more to improve Election Technology would it be nice if we could solve everything . I suspect this will be more of a start then a finish but we must get the job done. We must strive to maintain and improve testing and Certification Programs that provide real value to the Elections Community without adding unnecessary burdens or cost. If there are avenues where we can do more programmatically or administratively, we must consider such suggestions. If legislative fixes are necessary we should identify those numbers without delay. I look forward to todays conversation i would like to thank all the witnesses for engaging with us on this important issue. And before i turn it over i would like to anchor the staff for all the work pulling this event together, thank you. Thank you. Commissioner, do you have an Opening Statement . Good afternoon. Id like to thank our witnesses for participating, as well as those of us who are tuned in online. Todays forum is a chance to provide needed clarity about where Election Security efforts to ahead of the election and how the eac can lead to make the election systems and infrastructure strong and secure. State and local Election Officials are on the front lines for democracy. I have full confidence that we will zealously prepare and train for the 2020 election and in the end will get the job done for the American People as they did in 2016 and 2018. Because of the unique role Congress Gave us and the fact that we work closely with federal officials, the eac must take a leadership role. We arestion is whether adequately planning in establishing lines of communications with the necessary information to prevent and recover that many attempted Ransomware Attacks or other disruption from a manmade disaster or first strike on our democratic ideals. The 380 million appropriate if i is going a long way for preparation and planning on the fundamentals but as Dwight Eisenhower said in preparing for battle i have always found that plans are useless but planning is indispensable. As we look ahead at the panels im eager to hear from experts on a number of topics, including the dynamic topics faced by Election Administrators and policies to implement and address Election Security and the federal partnership put in place. Im looking forward to hearing more about how we are working to address endoflife software used in election systems, your opinions about the values in establishing a Vulnerability Disclosure Program and your input about how the testing and Certification Program can provide more meaningful security testing. As a former state election official i am familiar with the challenges faced by the men and women who run elections across the nation i know they often face difficult decisions that stem from limited resources and unlimited needs, including the growing activity associated with securing election. My goal is to conclude this meeting with a better understanding of election official needs and concerns as well as some suggestions for how Industry Leaders and others can best support local efforts to secure elections. Strengthen the nations election system is on the line, protecting that faith will take all of us working together and today we have the opportunity to demonstrate our commitment to our voters. Thank you for participating and i look forward to a robust conversation on these issues. Thank you, commissioner. Do you have an Opening Statement . I do. To theme our witnesses cac security election form. I think all of you in attendance, watching online and those in the overflow room on this very interesting topic. With the next years president ial election less than 15 months away i am pleased to be joined by my fellow commissioners for this essential and timely discussion. As i travel across the nation to visit election offices, give presentations, or attend conferences, Election Security is often the centerpiece of those conversations. After the election it was clear that our nation needed to look under the hood of election systems and through that process we identified a number of areas where we need to do better and a lot of progress has been made. Including the improvement of communications between state and local election leaders and federal partners to support their work. Todays forum will likely provide even more evidence of the progress we made but it is also a chance for us to collectively identify opportunities to further advancement and cooperation, including the market for election equipment and better attract supply chains. The challenges face by Election Officials today are often due to aging voting equipment or lack of resources. I suspect we will hear some of that reflected in todays testimony. The reality that the eac strives to reflect the daytoday work, including the forum and our ongoing efforts. Im proud of the work we did last year after congress appropriated 380 million of muchneeded Financial Support to the states and territories. The eac quickly and responsibly got these vital resources out the door. Today we continue to provide oversight and guidance of all these funds. Our most recent conversation with those who received these funds is projected at 85 of the money it is likely to spend by the 2020 general election, with 90 going to replacing aging voting equipment or improving security and resiliency. We know that more resources are always welcome, and my fellow commissioners and i have passed that along with our interactions to members of congress. Todays forum is a perfect opportunity to examine these entities, lawmakers, federal agencies, election manufacturers, and others can Work Together or continue to Work Together to improve security and strengthen voter confidence. It is also a chance for us to remember that our efforts must not undermine access to the polls. As work to make elections more secure continues we must also safeguard the statutory right that every eligible american can cast their vote independently and privately regardless of ability. I look forward to the forum and ofk forward to being a part the work that makes this accurate. Thank you. Thank you. I would like to invite our executive director to make remarks on behalf of the staff. By way of introducing the agenda, we will have three panels representing three flights of testimony that was arranged as first secretaries of state, then the eac testing and andification director, other stakeholders related to certification and software changes, including federal partners, dhs, and microsoft. Manyhird panel represents registered voting equipment manufacturers as well as test labs. Has beenale participating in another meeting this morning and will be arriving after that panel begins. If for some reason he has difficulty getting in time we will move him to the third panel. One final comment about today. Theosoft windows 7 was topic that started this discussion and we are pleased that microsoft is here today but todays topic is much broader and we will talk about risk but i wanted to acknowledge risk at a different level. Almost all of you have discussed security with Election Officials, congress, and other stakeholders and bike causing to discuss these and to engage in public dialogue where the clear end result is not yet known as a and and i hope all will see appreciate the role we are taking in this regard. The election equipment vendors and microsoft have taken a risk to come here and talk openly about the Security Issues the industry shares. I know you appreciate the willingness to come in today and speak candidly at these issues. Beyond those who are speaking today, we are receiving other fromnts from the record, the center for democracy and technology and dominion voting. These statements are available and will be posted on our website. This represents one of the broadest Public Meetings ever held, certainly the largest ever with 13 individuals appearing today and with that background i hand things back to the chairwoman for introductions of the first panel. Thank you. Is secretaryel denise who will be joining us shortly so we will start with sec. Hardwood. He is and 44th secretary of state, a resident of baton rouge. He was elected december 8, 2018. He brings a wealth of knowledge to the office, having served as interim secretary of state from may until his election and first a secretary secretary of state prior to that. As treasurerserves of the National Association of secretaries of state and on the subsector govern coordinating council. His goals include securing new voting equipment for the state, protecting sensitive voting data, and continuing the hightech protections for the election and commercial division welcome. Thank you, commissioners. It is a pleasure to be here, its a pleasure to represent the great state of louisiana, but most importantly it is so important to be here to discuss. He important issues microsoft announced they would no longer sell windows 7 6mputers and on september microsoft announced the end of support for windows 7 would be january 14 of 2020. I informed the8, governor of our state that the windows 7 operating systems conflict with the legacy Voting Machines for early voting and election day. I also provided information for the resources that would be messes every to move louisiana forward. In the summer and fall of this 250 we are switching out windows 7 pcs and voters offices. Clerks have already received windows 10 virtual laptops, uploads to the state election. Egistration network so how did this effect the state of louisiana . Endeavor,een a costly replacing all windows 7 with windows 10 virtual laptops over the past two years has caused well over 250,000. Thank you. The states leasing Voting Machines with its current vendor until the request for proposals process is completed and awarded due to the windows 7 endoflife issue. The least machines require the use of windows 10. The endeavor has cost us leasing of these machines in excess of 2 million. We have been diligent in keeping the virus definition files updated for our systems, all laptops are scanned regardless of whether or not they connected to the internet prior to each election. We have sent strict directives to all registrars and warehouse employees and secretary of state election divisions, stressing that they are never to insert memory sticks into these laptops or change their phones or any other device. We also discussed this agreed deal with our training and person, duringin the process of our voting equipment and how critical it is to follow these directives. In addition they are instructed to never insert a memory stick they are allck and scanned for viruses upon return to our office as a preventative measure. Means any homework environments that are used by our local election officers, all of this has led us to additional security measures. I would like to say that additionally, the cost of the windows 10 desktops has been 670 per machine, and that does not include the cost to train,re, test, deploy, or maintain. All windows 7 equipment is air theed, meaning none of devices ever touch the internet connected. Scanned forted or viruses before every use. We will only be used with Password Protected memory devices. So how do Software Upgrades affect our office . Upgrades can be mandated at inopportune times. It leaves the short on time to get everyone completed and tested. Notalling an upgrade and properly testing the upgrade would be detrimental to our system. Methodical and thorough and establishing an infrastructure is critical. Testing the various environments like staging and production with one week between each, with production scheduled around the cycle can be and usually is very timeconsuming and not a corner we can afford to cut. If an important patch comes out three to four weeks before an election, it causes us to wait to implement because we cant interfere in the election process that is already in motion. Can require extensive troubleshooting to identify and resolve upgrading the software. Qualifying, due to a situation a cyber incident in our state not affecting our election system but certainly of concern because it affected local governing bodies we had to install new pcs. Once turned on because we werent able to have the time iame normally have as referred to earlier, which began implementing new updates as soon as they were turned on. This sucked the entire ability of bandwidth for the local institute that had to use them and thus affected the court office which then caused us issues of qualifying. Microsoft sends patch updates every second tuesday of the month, and we provide development and testing, updating and testing, and we provide staging mimicking the predeployment, and then we deploy. We perform extensive inhouse testing on all components used in the field. Upgrades can sometimes cause issues that only occur due to their system being slightly all parties to ensure the uniformity in the updates. Nonuniformity makes fixing issues more difficult. How remediation could be addressed certainly the ac is making it quicker and cheaper for vendors to certify upgrades, certifying components versus , publishing vote capture devices or vote tabulation is helpful. Using common data format is important. Vendors are using the same , so they are able to live up to the tabulation using automated tests, by running a standard series of result outputs. Assuming a common input, the Election Results are able to make sure that the components output is what is expected. Encouraging asymmetric encryption on data transfers is more important and integrity and authenticity, data transfers could be between our errant system and election management system. Integrity confidentiality and authenticity of the most important components and asymmetric encryption offers us that. Now implementing for future equipment purchases requires devices to apply. We are requiring implementation of future equipment for devices to firm updates less than three months after manufacture. We will also be requiring any commercial offtheshelf equipment to remain within the mainstream support window of the manufacturer and be upgraded in dac certified for release of the updates by manufacturers. When accommodating Older Technology in general, we require additional layers. Requiring additional layers of production that are costly and timeconsuming and can lead to taking stronger measures when reacting to threats reacting to threats is cutting off local access out of an abundance of caution. Implementing these additional layers can break things. What i mean by breaking things is that after we deploy new windows 10, all bandwidth, which i referred to earlier, was consumed during qualifying with windows updates that we had to block temporarily. Vendors will state that you can force the updates, but it will break eac certification. This leaves our office is vulnerable to anything that happens. Eac certification, in our opinion, is of the utmost importance. So how are i am closing out this little red light keeps blinking out me. Reaching out to users and reaching out on the vulnerabilities we have today is key. Stressing to them that while additional security measures may be cumbersome, they are absolutely necessary. The sooner this is understood and accepted, the easier it will be transitioning to these new means of ensuring elections and are in election system. Additional security will become Second Nature and become accepted as common business practice stay in for the most part michael Election Officials loc electiona officials are vigilant in securing our elections. It is important to note we were doing Election Security before 2016. Unless you have been an election official and actually have put on an election, there is a huge gap by federal officials elected or appointed regarding the reality of our processes and procedures versus magnitude of speculation going on in washington dc. Election security is not a partisan issue. What is partisan is using Election Security to create fear for partisan policies which have nothing to do with Election Security. You, secretary. I would like to welcome the secretary from connecticut. She was elected to her third term as connecticuts secretary of state november 6, 2018. As connecticuts chief elections official, she focused on modernizing connecticuts elections and improving access to public record. Since taking office, she supported and expanded democratic participation, injuring every citizens price and ensuring every Citizens Rights are protected. She secured a Voter Participation through online registration. She improved connecticuts accountability and integrity of a series of rapid responses to election day problems. Thewas elected the neck secretary of state and serves as the board of advisers to the u. S. Assistant commission. Prior to her election as a secretary of state, she served as state representative for 17 years. Thank you, and welcome. Apologies for my delay. My flight was delayed. They never told us. As you just heard, i did have the privilege of being a president during the 2016 election. Sometimes i think i drew the short straw. It was quite an experience. I was very involved in the reactions to what happened during the 2016 election and thereafter in terms of setting up lots of different communication structures to deal with the cybersecurity risks we att became aware were aimed election systems and our country. I think all of my colleagues would agree we have come a long way since then in terms of setting up lots of Communication Systems so that we can have a better response if we uncover some of these problems during elections. We have a much better understanding of these drugs. Esey of us have th threats. Should paint you a picture of connecticut, because it is quite different than what my colleague was describing in louisiana. Connecticut has the distinction of being the only state that has no counties. We have an election situation where we have 169 very small towns. And very independent minded. The administrators of the elections. My office act as an advisory body. We have the voter registry. We had one of the earliest voter registries. We have used the same vendor for 20 years, which has now been acquired by other companies in the interim. Most of what we have done has been through that vendor. The Voter Registration system has had many upgrades, but it is housed and managed by our state i. T. Department. Icet i. T. Staff of my own. Said, many ofes us have been doing security on voter registry, one of the biggest databases we keep. We did avail ourselves of anything dhs had to offer. I was told by our i. T. Staff things were redundant. Essentially we were one of the 21 states told they had seen problems in our system. Probes in our system. None of them got in. I will not be as technical in my presentation, because i am giving you an overview of what i have done rather than getting into the nittygritty. The most important thing that happened last year was the release of 380 million. I would like to tell you about what we have done with it. We have taken a conservative view of technology in connecticut. Although we had one of the original voter registries and we have an election management wetem, as do many states, have not adopted e poll books. We have an Organization Called the yukon voting center. We may be unique in the country in having the services of a Computer Sciences based it is part of the Computer Science division. They test equipment. They evaluate equipment. Systems. Uate they are completely nonpartisan, objective. They are not vendors. They are not selling anything. That has been a big help to us. They every election test all of the computer chips in our tabulators. We have been using the same tabulators since they were purchased many years ago. They have served us very well. We have paper ballots. We have a fairly strong audit process after the election, although i would like to see us do more. Right now Peoples Trust is the most important thing we are dealing with. I think the stronger an audit process we can have, the better off we will all be. It is the next thing i would like to do in connecticut is strengthen our audit. We audit 5 of all of the eachncts, three offices in precinct after the election. We used to do 10 , but it is a machine audit. It has proven to be 99. 9 accurate. In of the lords, it is working isin other words, it working. The cards are tested before and after by the uconn voting center. They check they are working properly, and they mail them back. We do nothing online. That is why when we got dollars from the state to purchase electronic pollbooks, because at the time it seemed like a good idea. It is much more efficient, it is much more accurate. There is no doubt about that, but when they evaluated three different versions of electronic pollbooks, they did nothing they were secure did not think they were secure. The reasons they offered at the time surprised me, because a lot of states are using them. They said their questions about cravery, what happens if we sh, but the more important question they had, it is true, we will order people to not connect them to the internet, but they are capable to be connected. We are still looking at. At it. We are taking a very conservative approach. With our election management has theyou can it capability of uploading results from the tabulators if you put them on a memory stick. Do require them to type in the results from the tabulators. We do not feel comfortable with having that information uploaded even from a memory stick. Like i say, conservative approach. That has its share of problems, too. If you can imagine, 169 small towns. Many of our Election Officials come in twice a week. There are towns that have no computers in the townhall deliberately. I have had many a fight with several mayors about this issue. Some are as small as many as 800 voters. We have cities also. That is the challenge we face. We have taken our 5 million and spent a good deal on something called a Virtual Desktop, which, as i understand it, does two things. It solves the problem of microsoft 7. We dont know what operating systems they are using in their tens. We gave them microsoft 7 at the time we installed the equipment with the original system. Apparently if you use this desktop, which allows us to log in to every desktop on the system and to help see what is going on. Of a a great time great deal of time on the phone with people who cant login. This will allow us to override their systems. It will use a microsoft 10 operating system. It, will, as i understand make it not necessary for us to go with buying all new operating systems for each town. We had to spend some of our money on used tabulators. The tabulators we have now are coming to the end of their useful life. They were purchased two decades ago. That is egypt history in terms of ancient history in terms of computers. Millionased almost 1 almost 1 million of the money we have used to purchase tabulators. We have no funds for buying an entirely new system. There is no way. I am having a committee looking at what we are calling the future of voting, because we dont know where it is going. That is the case with any computerized system. Thisggest ask of organization is to hustle up with organization standards. We will have to replace our Current System within the next few years. We have been very satisfied with the usage of these systems. We have paper ballots. People mark them themselves. There is a great deal of trust in the connecticut election process, because we use the best practices. I can see there is a need for us to have a lot of information from a source that understands this. Would be by request. 5 million has been invaluable in maintaining what we have and do better. Plan that goes on for several years. Connecticut is also unique. We dont have clerks managing elections. Towns, we the 169 have two registrars of voters. You have a town clerk who does absentee ballots. It is a decentralized system, but lots of training is involved. It is basic, really. That covers it. Thank you for having this hearing. I feel like we are in a pretty good place at the moment. Open from like to questions from the commissioners. The jurisdiction schema in your state, are you comfortable control visibility and you have over state security as it pertains to voting equipment and software . When it comes to the voter registry, yes. I. T. Housed in our department. It. Called do we want go wont go there. They do a good job. Made upgrades, but in the next few years we will look at another upgrade. It is difficult to manage. I have made proposals to have a little more centralization, bring back a county level of government. To no avail. I think we will be where we are. Well forremarkably some purposes. I cant imagine trying to hack my election tabulators. Im comfortable at the moment. I can see two, three years from now, maybe not. You mentioned a cyber incident in louisiana that caused you great concern. You are changing from windows 7 to windows dangerous do you have windows 10. Do you have the tools necessary . Ned you are only prepared when something happens. You dont know what to expect until you are in the situation. I was plased with help pleased with how my staff reacted. It is because of louisiana being a top down system. With some having windows 7 and few having windows 10, we knew there were vulnerabilities there. Because of everything we have a strictg, we kept inventory of which parishes had windows seven units, and how many. Those were the ones we immediately banned from the system permanently from the moment the incident was brought to our attention. The incident affected some local governing bodies, but never touched the election system. Knowing some interacted with parish government authorities, we felt the need to shut down the system. We decided to take money that had been allocated from itself generated revenues within our agency and not just not just purchaseor the not centers for the Court Clerks Office and switch to windows 10, given that was a greater need in our system moving forward. We were able to move fast. We quarantined the system immediately. When we knew which parishes had been hit, we kept those parishes quarantined and unquarantined the others until we could drink them back up. Bring them back up. Tooke parish was hit, we them offline. I am pleased and thankful for my staff reacting quickly. It takes that type of incident to realize how quickly things can happen within your state. I immediately contacted the forident of and asked contact with her secretaries because we, informed them it could be more than one state attack. The importance is information is key for Election Officials. If we dont get information, we cant protect our system. The timeliness of the information is absolute. Our systems are secure, we have to get that through a local partner or state partner or federal partner. Sometimes we just dont get it. One question for both of you. How do you field updates . About updates to microsoft. When you are running several elections a year, how do you run that into your schedule . The elections start, primaries, the general election, how do you fit updates into that schedule . Sec. Adroin the best we can. The monthly tuesday updates, when they come in the problem once we start the clock for election preparations, there is no stopping that clock, because the timelines are so detailed. We have a deadline to meet. We cant avoid those deadlines. Through, patch comes we may have to delay the implementation of that patch. It affected us having to adjust with regard to this incident. It affected our ability to do qualifying online because of the patches that were being automatically updated. We had to stop that process in the Registrars Office because the clerk was not able to do their job. Is concerning to us. We need to make sure our voices are being heard with our vendors, whether it be microsoft or voting equipment vendors. We are a little unique. Early voting. Any we dont do anything uocava in the period of 45 days which is what it is in our state. We dont really know what our local towns are running. We really have very little control over their local systems. This Virtual Desktop hopefully will override that problem. We will not be able to do a pilot until this year in our municipal election. We will be able to do a pilot this year but it hopefully will be in place for 2020. Up until now, we patch our own system and thats the basic voter registry. Everything else is at the local level. Thank you. Chair, do you have questions . Thank you. Thank you all for being here and we appreciate your testimony. Weretary ardoin, you talking a lot about the process and it is extensive. It is not just taking out your phone and hitting update. One of the things that that really sends home to me is the cost associated with this. People and labor in addition to equipment. One of the questions we get asked a lot by congress is about the 380 million that secretary merrill mentioned. Do you all see would it be useful if there was obviously federalism, if there were a consistent, modest federal funding stream that was specifically toward security upgrades, maintaining maintaining equipment, maybe implementing programs like Illinois Cybernavigator Program where you have statebased Election Technology and i. T. Experts that assists parishes and counties and towns with fewer resources . Is that something that would be helpful and needed . Of course, resources are always helpful and necessary. I was say that what we have been doing in louisiana is that we set aside our 5. 8 million in uocava funds strictly for the new Voting Technology to purchase new equipment. What we have been doing is absorbing in our regular budgets, all the cybersecurity needs we have, which is growing exponentially each and every year. What we would hope for is if the federal government does make Additional Resources necessary and there be no strings attached, that each state is different. Just the two of us sitting here, weve explained how different our states are. The cultures are different and the voters have different expectations. We all have the same expectation which is a secure environment for our elections and that every vote is accurately counted. And everybody gets to participate who wishes to participate. I will say this the federal government providing Additional Resources would be helpful, but the federal government also needs to communicate to the states that they have an absolute responsibility. Im no different than my colleague here. We are constantly asking for Additional Resources to fend off cyberSecurity Issues, to update equipment, and to do what is necessary to secure our elections and offer our people the right to vote. In addition to that, we are taking on, in louisiana, we have a strong responsibility. We have all the i. T. Operations for elections in my agency and we do that for the locals as well. We provide equipment to the locals. That takes a lot of money. All partners, parish or local, state and federal need to cooperate and Work Together on this funding issue for resources for securing our elections. Lets face it, we are all in one large ship, and that is the ship of america. If we are not working together to secure our elections and fund them appropriately, then what are we here for . Thank you. Secretary merrill . I would concur with that, just recognizing the states have very different capacities for funding their elections. For quite a while, connecticut funded most of what we do through bond funds, which is perfectly appropriate because it is equipment and infrastructure for the state. Not every state can do that and right now, connecticut is not too willing to do that at the moment. We are in a budget crisis thats been going on for four or five years. I think there is certainly a role and that would be very helpful in my state because the reason we have not gone forward with providing more local equipment, upgrading their operating systems and so forth, is because we dont have money for that and traditionally, its been funded by the towns and the state. I agree with my colleague that the states have a responsibility here, too, but like i say, they have different capacities for doing things and i think it is imperative that this country and this state and the local governments and all of us, as you say, Work Together to do this. This is one of the fundamental operations of government. Youre not going to privatize elections. Its time we put some dollars behind whats happening. This is a really recent development. It was only in 2016 that we realized there were all these cyber threats. We have reacted i think pretty well in the short term. In my state, its much more efficient to control security for these big databases from a central level. I respect that. It makes a lot of sense as long as i have someone in my office who can work with that person. I think we should take the same attitude overall, that we work on it together and we are able to articulate what our particular needs are around these questions and that you provide some sort of framework for that, for the funding, but i do think some funding needs to come from the federal level. Thank you. I want to be sensitive to our time, so i will hold off any other questions until after my colleagues go. Thank you. Do you have questions . Just a few would you agree what i hear from both of you i think is that the priority in your states is that you need to upgrade your Voting Systems and your Voter Registration systems and these are fundamentals of the electoral process. That is where most of the money will really help your states, is that true . True statement. Our job is to set new Voting System standards on security and visibility, get them out to the manufacturers designing to those standards. I think thats all i have. My state is about to embark on an rfp process and we will do this we will be dealing with standards that were set in 2015. Much of the blame is to the federal government for not having had a functioning eac with a full commission. Im very thankful we now have a full commission and you all are working very hard, but we are now behind the times because of that, and 2016 snuck up on us quickly and we reacted as quickly as we could with the resources we had. Im going to have to go a little further as i stated earlier and what the requirements that we will have to work under that is not necessarily even issued by you all. Thats very concerning to me, not to mention all of the various legislation rolling around congress that could require this or that or the other. I have one followup question as congress looks at different funding potential, one of the things we hear and am fairly comfortable in my observations and having worked at the state level that the executive branch, the governor or i. T. At the state level have a lot of the protections the secretary talked about. Im more concerned about the small towns who may not have those resources or oversight. Is it possible the money can be used in a way to help those localities upgrade their local i. T. Systems to be more resilient in warding off these attacks . I would say thats exactly what im doing with the money, the 5 million dollars. By instituting the Virtual Desktop, we have essentially given them more capacity. Maybe thats a direction that others could follow. We have not tested it out yet so i dont know how it will work. Rather than purchasing 169 towns worth of new equipment, it might be better to work with what they have as long as the Virtual Desktop takes care of the security part. The training is all local capacity building. You are right, thats my biggest fear is vulnerability at the local level. Thats exactly what we are working on. That was exactly my fear. It almost came to fruition and out of the grace of god it did not. We are taking those steps because we were able to retain our election i. T. In our system and not be forced into a consolidated system along with the rest of the state agencies. Then we were able to control our own destiny and work with the local Election Officials to secure our environment and continue to secure our environment and train them on our environment. Being able to see it from a larger picture, 30,000 feet, if you will, that was the right thing to do for our state. We continue to be able to predict vulnerability and work with vendors outside to look for newer ways to secure our system. It gives us the ability to quickly react versus having to go to the state and ask for permission. Im not saying its not working for others, but it is an important component for us. Do you have a question . I will have a couple of comments and i hope i can put a couple of questions in there as well. Secretary merrill, i want to say that i was saddened to hear that peggy reeves retired. I have not worked with ted yet, but i hope he can fill her shoes. She was a very important woman and i think shes done a great job for your state. One of the things that i wanted to ask is a little bit about the overall training. Secretaries of state and other Election Officials, you have more than one job. Your job is not just to run elections. It might the other aspects as well. Are there other aspects tax collection or other aspects, that you have to have updates and how are those Updates Incorporated . Yes, absolutely, i am among other things, the business registrar. I have the other large database of the state, which is the business registry. We are constantly updating it. Samelps that we have the vendor for both systems. We have historically many years. You dont have that one day i compare an election to giving a wedding. You have the one day where everything has to go right. Unlike the business registry, where there are constant deadlines for this and that. We dont have the same issues in that sense. I am also responsible for the commercial registry in the state of louisiana. Its the same thing and we do use the same vendor as well. I think we actually have the same vendor. It is a constant concern, because that system also is being constantly scanned and probed. Business Identity Theft is a growing phenomenon, so we protect businesses as much of but as secretary merrill said, thats an ongoing process. Election day is critical. We have early voting with seven days in the state of louisiana and thats critical as well. Voters have to check in using our system on a daily basis. There is concern. We dont have electronic poll books. Given the situation where we are, i will never ask for electronic poll books. You just have to now be looking for things that you didnt necessarily have to look for before. As we say, cybersecurity is not an endgame, there is no finish line in cybersecurity. That reminds me about you plans andns for your former heavyweight champion mike tyson saying that everyone has a plan until they get punched in the mouth. I figured we have our plans ready for 2020, but i think there will be a lot of swings at us and i dont think we will get hit hard, but there will be a lot of attempts for folks to hit us. I think states are doing a good job of planning for that. I would put the plug in that the eac has i. T. Training for Election Officials. Im participating in a couple of those, and our director of testing and his team have been going out to states. If there is an opportunity to take advantage of our training for folks, definitely do that. I have been to both of your states, and i think folks have done a great job with the election process. The last thing i would ask is a little more that other than money, what can the federal government do for you . No strings attached, but [laughter] we dont say that. Its more what sort of things we can help you with moving forward in 2020 and 2022. Can you convince microsoft not to charge us for the three years of support after january . [laughter] that would be a good start for us, because it is pretty expensive. I think our quote was 300 per unit moving forward for three years. That can get quite costly. If we are unable to replace all of the windows 7 units. Whatever your parish just bought for you, put it aside. Its not worth the threat. They dont have the money because they just bought the systems. The new equipment, but they did it by didnt buy the windows 10. Hustle up with those certification standards. Thats really the short answer. Just thinking out loud, the Maintenance Cost of all these systems is a very large ongoing cost. Maybe that is where the state should be, because that is not something we can expect money every year from the federal government. Infrastructure cost might be where we could use the most help. Thats the kind of thing where you pay it once and maybe the state should pick up the ongoing costs together with the towns. Its different in different states. That would be my short answer for certification standards. People are out buying things right now and they need help. Thank you. I want to extend my sincere thanks to both of you for being here and we appreciate your comments and we will take all of that in as we continue forward looking at these issues, thank you very much. Thank you for having us. Lets call up panel 2, please. I want to thank you all for being here for this forum. This is Important Information for us to learn from you. What we can about these issues that are critical at this time. I let the secretaries go a little bit on time, but i wanted to let you know that the clock is set for five minutes and it flashes yellow at one minute and the red light comes on when your time is up. I want to introduce the panel. To my right here is our director of testing and certification at the u. S. Elections commission, jerome lovato. In this role, jerome assists jurisdictions with developing practices and procedures and conducting and implement a nd audits and published a white paper to provide the foundation for Election Officials. Prior to joining the ese, he worked as a votings system specialist in colorado for 10 years where he served as a Voting System certification lead and risk implementing audit project manager. Next to jerome is jarred dearing of the kentucky state board of elections. He has worked in campaigns and Elections Administration for over 10 years. He has worked in the public and state level, including the city of louisville and the office of california governor jerry brown. His private sector work includes several Tech Startups located in the bay area in boston. Hes a graduate of the university of california, berkeley where he studied Public Policy and engineering. The director of strategic projects for microsofts defending Democracy Program. She tackles the growing state of nationstate attacks against Democratic Institutions globally. This includes increasing Campaign Elections in addressing the issue of disinformation has an impact these organizations processes. Previous to this role, she focused on engagement with political organizations and their use of data and analytics and other emerging technologies. Prior to joining microsoft in 2014, she was Vice President for political accounts at cmdi, where she worked closely with senate and Campaign Officers and has over 15 Years Experience in Political Technology and has been recognized as a rising star and has received the American Association of Political Consultants under 40 award. Next to jenny we have matthew sholz, the chief of the security Computer Division in the Information Technology laboratory at the National Institute of standards and technology. His responsibilities include cryptographic standards used by the u. S. Government and internationally Cyber Research and development and cybersecurity standards and guidelines for federal Agency Security programs. He also leads nist participation with national and International Standards and associated performance Testing Programs. He is also a u. S. Army veteran and currently has over 20 years of federal service. Finally, we have our friend jeffrey hale, the director of the Election Security initiative at dhs cyberSecurity Agency. Electiona focus on security in response to the cybersecurity incidents of 2016. He has been instrumental to the eacs ongoing collaboration with dhs. Thanks to all of you for being here. Lets start with jerome. Sorry about that, i dont know how to operate a microphone. Good afternoon. Thank you for hosting todays forum and for taking the lead on addressing the complexity of testing, certifying and then applying Software Security updates to Voting Systems. I also want to acknowledge and thank the panelists for participating in this discussion. Personally, i greatly appreciate and value your input and look forward to hearing your thoughts. I have been heavily involved in Voting System Testing Certification for over 12 years now. I have literally installed Voting System software in thousands of voting devices in my career. I would like to highlight that once the eac certifies a Voting System, that system is certified to requirements in that moment in time. Our Testing Certification Program Manual provides guidance on changes to Voting Systems that i can talk about in more detail if time allows, but recognizing we have limited time today, i would like to hear more from our panelists and im glad to answer any questions you all have. I just want to lay the groundwork, because we have limited time. As some of you know, i can talk about this stuff for a long time. I will refrain and allow others to have the opportunity to express their thoughts. Thank you. Mr. Dearing. Thank you. Thank you commissioners for having me today to participate in this important conversation. I am the Southern Region representative for the National Association of state election directors. Im also the executive director for the kentucky state board of elections. Prior to my current position, i have worked in the private and public sector, specifically Public Policy and engineering, including software development. Im glad were having this conversation, but also wish it could have taken place sooner. Microsoft announced it was ending support for windows 7 several years ago and in 2014, it ended support for windows xp. This is not our time first experiencing this as a community. Since the passage of help america vote act of 2002, Election Administration has grown increasingly reliant on technology. It was mandated among other things, every state was to replace punchcard lever Voting Machines and created the quality Voting System guidelines in the Voting System Testing Programs. The move away from lever and punchcard machines was designed to move the act of voting to a more modern technology. Yet the move to any technology requires ongoing maintenance. Technology is not static and is in a constant state of iteration. Operating systems and software all require ongoing updates to maintain both functionality and security. As of august 2, the msisac has sent out 81 advisories in 2018 tone, ranging from Mozilla Firefox and microsoft. Anyone who is try to use a laptop or cell phone knows that keeping Technology Current and past is critical to maintaining its lifespan. The welldocumented funding issues in Election Administration means state and local Elections Officials need equipment to last as long as possible. When we invest in new technology, we do so knowing we may not have the funding do so over the next 10 or 15 years. Dedicatedhines are technology kept under tight physical security. Election officials at the state and local level work hard to keep machines patched. As with most things in elections, our ability to do so varies by state. In kentucky, while we certified Voting Systems at the state level after they have been certified by the eac, their operation and maintenance takes place at the county level, which means the commonwealth relies on county officials to update and patch Voting Systems after patches and modifications are approved by the state. Our county offices and officials , like many around the country, are severely under resourced. Other states handle patching and updates differently, but a Common Thread is that most of us cannot compel our local election jurisdictions to update their equipment. We can strongly encourage it, but we cannot require it. In many places, the local jurisdictions must make arrangements with the Voting System Services Providers directly to have Voting Machines patched, which can come with a fairly heavy price tag. Every dollar counts. Unfortunately, that means that patches are not made when they should be often times. There are challenges with a national Certification Program. Different states have different needs, laws, and structures, but consistent nationwide is our certification process represents a moment in time. The vendors submits system for certification and uses an operating system which is a time capsule of when the system was developed. We all know that it is not how we all know that is not how technology works. More importantly, that is not how bad actors work either. We need to balance the need for certification with the eminence need of Election Officials on the ground. Last month, i participated in a conversation about coordinated vulnerability disclosure on capitol hill with representatives from congress, the cybersecurity introduction Security Agency and vendors in community and technology. There are a lot of smart engineers and hackers out there who want to use their skills for good to make our elections more secure. We need to work as a field to develop a process by which ethical hackers can effectively communicate vulnerabilities they find to the relevant parties. But Elections Officials and vendors also need to respond fixes beforeploy the vulnerabilities are exposed. It is not enough to find and report bugs. There must also be a way for systems administrators to quickly digest and remediate these issues after notification. Beyond the hacker community, some vendors have already worked with cisa to have a critical evaluation of the Voting Systems conducted at the Idaho National laboratories. To take advantage of the cybersecurity expertise that our federal government can offer. The assessment conducted is more in depth than the security testing performed by the Voting System test labs. The eac currently does not have a procedure in place to incorporate these results into the Voting System certification process. This means that the vistal must conduct security testing which makes it timeconsuming and expensive for Voting System manufacturers trying to make the systems more secure. Must develop a process to quickly certify modifications made by the Voting System vendors to address potential vulnerabilities found in the assessments. Needs to be the stamp of approval that tells us our technologies and secure, not the obstacle to more secure system. Our Current System of certification d incentivizes upgrades and patches leading to issues with common endoflife cycle processes as we see with windows 7. As a community, we must come together to adapt quickly in light of an everchanging Threat Service and create a Certification Program that can accommodate the constantly iterating security environment we are in. There are a lot of intelligent individuals working on this, including the eac. We need to continue to Work Together to develop a more efficient process the federal level to drive these modifications, patches, and upgrades. Thank you again for the opportunity to speak to you today and i look forward to your questions. Thank you. Welcome. Thank you so much for the opportunity. I am the director of strategic projects for microsofts Democracy Program. Microsofts decision to engage more directly on Election Security comes from the companys belief that building and maintaining systems to bring photo confidence cannot be accomplished by one organization alone. It takes participation from all of us, the federal government, state and local, election system vendors, technology center, academia and Civil Society and voters themselves to come together and drive solutions. That is why last year, microsoft formed the defending Democracy Program which works with a variety of governmental and nongovernmental stakeholders globally to tackle issues around campaign and Election Security. Which brings us to the topic of conversation today. Election security and certification reform. Weve given a lot of consideration to the role that microsoft can play and be an impactful partner to the election community. One thing i want to notice as many of you are familiar with dr. Josh benelow, an advocate for the end to end verifiable elections. The idea that advanced cartography could come alongside the current voting process and enable a voter to learn that their vote was correctly counted was appealing to us as a team. That is why we announced the creation of election guard, an open Source Software Development Kit that will allow vendors to allow dis functionality into their system. We have norton along the elections to identify how technology might interact with certain systems and explain possible pilot opportunities. Intersection of Microsoft One technology and elections is the issue of windows 7 endoflife. By way of quick background, the Company Announced several years ago that in january, 2020, the windows team would end support for windows 7 operating system. We are committed to helping our copper helping our customers remain secure. We understand that some customers will need more time, which is why we will offer extended security updates to customers still running windows7 on their systems. Details are still being worked out regarding the cost and progress and we will have more information to share the coming weeks about exactly how these updates will be made available to this community and what will cost. I can assure you that microsoft will do whatever it takes to ensure that these customers have access and security updates that are straightforward and affordable. We are committed to protecting our elections and are dedicated doing our part. I also want to highlight a related issue thats been brought up this afternoon. Protecting our election systems against known vulnerabilities is extremely important, which is why we should be focusing on how to remove unintentional disincentives that have been created by requiring recertification after patching or updating the system. In our perception, theres a lack of clarity about if and how the Security Software update can be applied to a system without triggering a comprehensive recertification process. We should stop giving Election Administrators the choice of using election systems with known vulnerabilities or applying security patches, and eirso doing, taking th systems out of certification. I look forward to discussing this and other issues this and welcome your questions. Thank you. Thank you for having me. I am from the u. S. National institute of standards and technology, where i lead Computer Technology within the technology labs. One of my mission and what we provide is a set of tools, references, and information to assist organizations, state and local, our federal government partners, and u. S. Industry in securing their technologies and infrastructures. In these toolsets we provide, we have a series of both documentary guidance to assist an organization in establishing a patch Management Program. This will allow an organization to make medical decisions about setting up a program and making the critical Business Decisions about prioritization, timing, and application of patches and updates to important systems that they used in order to achieve their business objectives. We also provide guidance not on patch management, but on configuration management. Implementing and maintaining bothity configurations for end points as well as backend machines used to support these business executives. Not just documentary guidance, but we also provide tools to allow for the automated implementation of security configuration, as well as to allow for toolsets to identify items, endpoints, operating systems that are in spec and secure. If not, to allow for other toolsets to remediate and enforce security configurations. This also provides references for organizations to identify if they are vulnerable. One of our references we provide is the u. S. National vulnerability database. It categorizes and incorporates every known publicly declared Information Technology vulnerability and publishes it in a machinereadable format. We also provide severity metrics for these vulnerabilities for organizations to use. This then provides an essential metric for them to decide how to prioritize patches and whether or not a patch is critical to them and the Information Technology they use. I would like to echo some things that were said by my prior speakers. This runs several conforming and Testing Programs specific to cybersecurity products. It is incredibly important for any Certification Program to clearly communicate where the certification balances lie, between upgrade and patch versus maintaining a certification to a version number. Often, we give organizations a Business Risk rather than an Information Technology or cybersecurity risk decision in maintaining a certification versus patching a vulnerability. Clear, concise, communication on the intent of the program, especially in the dynamic environment in which Information Technology exists is critical so that folks can make good decisions based on those balanced decisions and maintain the security of their products. Thank you for having me here and i look forward to answering any questions you may have. Thank you. Welcome. Good afternoon chair, vice chair, commissioners. I want to thank you for the opportunity to speak on Election Security and want to thank you for considering me for a role in the technical Guidelines Development community. I serve as the director of the Election Security initiative within the cyberSecurity Agency. My teams mission is to ensure that elections stakeholders have the necessary information to manage risk to their system. Within our charge, we oversee the sector specific agency, coordinate field engagement, provide technical assistance, support Election Officials, vendors, partisan organizations and the electorate toward the objective of advancing Election Security and countering foreign interference. Our support comes at no cost to our partners and is entirely voluntary. What we have seen out in the field is the need to continue to do the fundamentals. Fundamentals like understanding the different impacts of integrity and confidentiality. Attacks on system like ensuring that systems are able to detect and recover from exploits, which is why we provide a series of the series services, including Education Training and cyber exercises, promoting email security practices, protecting the organizations online presence, securing information, and developing Incident Response plans. We have been thrilled by the engagement of the election community. With all 50 states, many jurisdictions and vendors participating in some capacity. This is timely. Discussing the endoflife of windows 7 is consistent with our vulnerability services. Two of the most common vulnerabilities we have our systems and processes. Election officials are asked to administer a complex array of systems in a strange environment. Improving Software Patching can reduce one of the risks, but it cannot solve a technology deficit. The most recent grant fund is one way for states to address the risk and you should be commended for rapidly distributing that funding. Because i have touched on the vulnerabilities in the field, it is worth noting that although large number of is not to take away from the importance of securing Voting Systems. To that end, weve invested in open ending testing for phone for Voting Systems. Again, encouraged by the vendor communities involvement. These evaluations are aimed at enumerating vulnerabilities and hardware and software in election Management Systems and other components. Matures, weystem believe there can be a complement relationship between our vulnerability assistance and compliance. As you move forward, we see an opportunity to work with you on refining the process. Caps more than ever, the eyes of the election of the Security Community is on elections. For Election Officials to benefit from security expertise as other critical sectors have, i believe they will look to the eac. Because of the leadership role, serving as an honest broker, we are in a position to provide additional value to the election community, through improving vulnerability disclosure, and management. Any coordinated Vulnerability Program is only as effective as the Testing Process enables. We work with these challenges across several sectors. We identify and discover have abilities, and Management Program where researchers turn to us for assistance. With this wealth of material, we look to you for helmet can integrate our information with your policies and processes in a way that allows adaptability to vulnerabilities and risks, including updates and patching in a timely fashion. We value our partnership with you and we look forward to additional opportunities to bring our corresponding expertise together. Coming up this morning, they look at campaign 2020 a look at campaign 2020. Historyty of kansas professor david farber on the 50th anniversary of woodstock and the counterculture of the 1960s. Join the discussion. Tonight on q a, New York Times Staff Photographer doug mills talks about photos covering president trump. I believe despite his constant comments about fake news, i really feel he enjoys having us around because it drivedrive his message, the news of the day, which he does every day, and therefore having us around allows him to do that. Ontonight at 8 00 eastern cspans q a. Now, a Senate Aging Committee hearing on ways to combat robo call fraud. Testifying on the impact of robo call scams and how to better educate the public. This is an hour and 45 minutes