Transcripts For CSPAN3 Discussion On Election Security Infrastructure 20240713

The center for democracy, technology and the center for justice to welcome you to what i consider to be a very timely, obviously a very, very important forming symposium. At the outset i want to thank all the participants. An incredible array of speakers, guests who have taken the time to address this subject and cspan, regardless of republican, democrat or independent think is critically important. Its undisputed that there are people that have been hacking into our elections for a long, long time. The evidence is indisputable. We can start with 2016, but i think if we look back before that we might have seen there are people playing around in that arena even before that time. We decided to get together to pull together a symposium to deal with hacking in u. S. Elections and how to make the 2020 election more secure. So were grateful that they could join us this morning. Some of you in the audience probably remember, but i did happen to talk to some of my colleagues from Penn State Dickinson School of law and ask them how old they were 2001 on 9 11. Most were in grade school, a couple were in high school. At that time, i reminded them that i was called to the white house and then given the opportunity to set up the department of Homeland Security right after those horrific events. And as i look back and reflect on that time, im reminded that initially we were focused on a small group of terrorists from a small part of the world, who would attack us and use physically, and attack our citizens. Within a couple of months, a year or so, we decided in addition to dealing with physical attacks, we better start paying attention to digital attacks, but now think about this. This is 2002 and 2003. The tools available to those who would attack us with Digital Tools was minimal. The sophistication was probably primitive, compared to what were dealing with today. And clearly the frequency has been expanded chexponentially. I think back about those days and trying to deal with both physical and Cyber Attacks. By creating doubt and uncertainty to the legitimacy of our political process. And create chaos that divides our political leaders. If the goal of those who attacked our country was to destabilize our government and political institutions, im afraid we have to admit to date theyre succeeding. Truth and civility and the very foundation of our Constitutional Government are the primary victim victims of the abuse and misuse of social media. If the enemys goal was to destabilize, theyre succeeding. Lets be very clear. We focus a lot on foreign influence and there certainly is. There will be some discussion about that. Lets not underestimate the rule of domestic cyber activity as well. Perhaps not to destabilize our process, but to promote a political candidacy or point of view. No matter what the goal, its unamerican. No matter what the goal in the Digital World is one of the major challenges we have going forward. The other challenge is and i include all these remarks, the digital sun is never going to set. Its just going to get hotter. In a hyper connected world, the challenges associated with Cyber Threats to our institutions of government continue to grow, continue to expand. So its for that reason that these four organizations got together and said lets take a look at vulnerabilities in the electoral process and lets take a look at the impact of the abuse and misuse of social media on that process itself. I had a great opportunity to work with professor mckenna. Shes really the catalyst. I mean, shes really made a lot of this happen and a lot of the speakers are here because of their admiration and respect for her. Without further ado, i want to introduce my friend and colleague, professor. Ann . So really, im the chief button pusher. Its a pleasure to be here today. I want to thank you all and welcome to our audience on cspan. The governor has told you about the sponsors who are involved. I think one thing thats important to remember, because well be talking today about infrastructure and social media and were talking about money and data as well. The important thing to remember is that no one here is a paid speaker. No one was charged admission. No sponsor is doing this pursuant to a grant. This is because the group of entities and individuals, like you all here, recognize the importance of securing our elections and recognizing the actual threat to our elections that come from these two different aspects were going to talk about today. So when we talk about politics, its very easy to get personal. This group of speakers is incredibly interdisciplinary. Its incredibly mixed in terms of their backgrounds and affiliations, the speakers that have come here today. And so is this audience. This is really an impressive list of members of media, Intelligence Community, security, academia, researchers and so we are looking forward to working towards problem solving with you all. I dont want to take very much time, but i want to remind everybody, as we frame our questions, as we frame our responses and have a really great opportunity for audience participation with the luncheon. And we want to hear from you. This is an Incredible Group of people who have come together to work toward this important goal. So, again, remember, this is not about my politics or your politics. This is about saving democracy. So, lets work to do that together. Without further ado, i want to turn the mike over to my colleague, jenny evans, one of the leading data scientists in the country. Thanks, jenny. Thank you, anne. And my personal thanks to you and governor ridge for your investment in bringing us here together today. Were here to wrestle with a critical challenge to our democracy. As as anne mentioned im the director of the penn state institute of cyber sciences. We also support penn states High Performance computing system and events such as this. The mission of the institute is to bring Interdisciplinary Research of societal and scientific importance and advance these goals. We do that by cohiring faculty with departments all across the university. Were jointly hiring with numerous colleges and departments, departments such as astro physics and biomedical engineering, political science, psychology, gee dpraef and law and one of these intellectually adventurous, intelligent and interdisciplinary scholars. To bring together a diversity of experts in action. Through many disciplines, professional perspectives and backgrounds, you are that Interdisciplinary Group of scholars today. Its our tendency as humans to limit ourselves to consideration of just the facts in front of us, consider the image well, where do i find that image . There we go. Consider the image behind me. This was purported to be australia on fire. The fires in a single day in australia last year. As an australian, also as an american, this was terrifying to me until i found out that this is not a day. Its a month. Its still horrendous, but its a different story. No no single expert can take on securing elections today. It is not a technology issue. It is not a policy issue, it is not a law issue. It is a problem requiring collaboration from expert frs all of these specialties and more. Because elections are at the heart of our democracy, it is imperative that we investigate this issue from an multitude of perspective. Thats at the core of our election starting months before the votes to come. The Demographic Data creates opportunities to provide messages and selecting groups through social media. While this can be a boom to business, this data minding had been regular used to spread information across the election. Once elections take place each vote is a data point in determining the leadership. These are important as the elect traditional process that must be secure. While we dive on a new perspective on the electoral process today, the critical need to come together to share the diversity of the perspective and opening to discovery is unquestionably important. I am delighted that penn state institu institute, penn state of dickerson law are collaborating today and governor reed to host this event. I take you take advantage of this Exceptional Group to continue or initiate conferrings thatll lead to action in support of this grand challenge. Thank you all for joining us today and thank you again to the governor for bringing us today. [ applause ] i want to introduce larry, the director of the election reform program. Welcome, larry. All right, thank you, anne. Thank you to all the groups involved in partnering on the event today. I have been asked to, lets see if i can present an over view of some of the Biggest Challenges facing American Election infrastructure. I am going to discuss a little bit about why theyre not challenges in 2020 but also what we can do in the longer term after 2020 to start making bigger changes to secure our election and infrastructure. It is a fair but i am going to use iowa and the caucuses as an introduction to this topic. I was a little worried over the weekend. Fortunately i didnt have toover haul my slides last night. I dont think it is fair to use iowa. I should say of course there was new cyber attack on the infrastructure they were using there as far as we know. And of course as others have pointed out, the caucuses were run by a political party, the democrats, theyre not run by profit election professionals but the states or the counties as our primaries are and the general election as november will be. Nevertheless, i think there are important lessons going into 2020. Vendors are a point of vulnerability in our elections. We often on capitol hill when people talk about election infrastructure and security, they talk about states and counties. Much of our election infrastructure is created and supported by private vendors. They touch nearly every aspect of our elections. So folks may know that there are three big manufactures of Voting Machines in the United States and they control that 90 of the market for voting systems. There are certainly hundreds of Additional Companies that maintain these machines and electronic poll books determining whos eligible to vote and other functions for our elections. Unlike other vendors and other sectors that have been deemed part of Critical Infrastructure like dams or energy or defense. There are no federal regulations over these vendors. There is been little oversight of these vendors to date. What it means is we dont haves a full picture of how many vendors. They are working on our election infrastructure, we dont know where they are working. We dont know what kind of screening they do or employees, we dont know who owns them. Maryland learned in the past couple of years that a vendor for the Registration System was owned by a russian oligarch, they found that out because of the fbi informing them of that. We dont know what their supply chain practices are and their parts come from. We dont know what kind of internal Cyber Security practices they enforce. Election officials can no what kind of security practices they put in place in their offices. They really dont know when they are dealing with vendors and purchasing products or services from them of what they are doing. They can ask or trust about what they are doing but they cant know. We are not going to get that problem fixed for 2020. I do think there is a bipartisan interests in tackling this problem. There was a hearing at the House Administration committee in the past couple of months where both republicans and democrats expressed concerns about this issue. When i talk about Election Officials of both parties, they Say Something they want to address. I dont think that means we need to worry about 2020. The department of Homeland Security Election Officials and state and local government have all done a lot to secure our elections and our election infrastructure since 2016. Of course, for the first time in more than a decade, congress has provided money to the states to help secure their systems to vulnerabilities and those systems that they purchase from these vendors. Never the less, i think it is a real weakness in going into 2020 and the solution as always in an election is hoping for the best and to prepare for the worst. That brings me to the second lesson from iowa that i want to talk about which is a great danger of Cyber Attacks is system wide failure. If the reporting app in iowa were just a few glitches and some precincts have trouble reporting their results, we would not be here talking about iowa today. The problem of iowa was the failure system wide and system wide failure is different. It is a danger of Cyber Attacks that entire communities or jurisdictions can be targeted from the system failure. It prevents people from voting and having accurate numbers counted, electronic poll books checking in when voters check in at the polling places and Voting Machines. The answer to this vulnerability is redundancy. So here is an example of one of those pieces infrastructure that i was talking about, electronic poll books. What may happen if this system is attacked or failed . It may start up. We seen examples of this in nearly every federal election. But at a county or statewide level, it would be a real mess and i would argue a bigger mess than the problem we sign with the iowa caucus. What kind of thing can we do to ensure resiliency . Only 12 of them using the books required to have backups for electronic poll books. That seems to be an obvious solution, having something thats not on this tablet to go to if the system fails. Even if you have a paper backup it is possible that the paper backup itself could be corrupted in some way. And there you have a federal solution for that. The Voter Registration databases is infiltrated in some way. The federal solution is provisional ballot. We can have people vote and go back and check later with the data that we have. Thats a good federal safe. Every polling place has about two or three hours worth of provision materials. Voting machines failure could be a problem. They use machines to castor mark ballots. Emergency ballots that can be broken out and people can vote on them. Many states dont have minimum for emergency paper ballots in case of that kind of a failure. That brings me to the third and final lesson that i want to talk about in iowa which is that paper backups are essential. If voters in iowa had voted on that app that failed, instead of just being a recording app, we really would not have problems in iowa. There would not have been a record to go back to that people could have trusted, we may have lost those books entirely. We still unfortunately have states that have that are using paperless, Voting Machines in the United States. And, this is despite the fact that it is near universal agreement at least as 2016. We drastically reduce the number of paperless machines that we used in the United States. I would guess less than 16 million, coming up in this new electi election, you can see from the battleground states that would be using paperless machines in the 2020 election this november. One challenge is in addition to having paper we should be routinely looking at it to check the software thats reported, only half of the state required that kind of review of the paper before certification and fewer check statistically significant number of the paper ballots so i am going to wrap up by saying the good news for 2020 is that all the things i talked about as a resiliency measure are things that can be done for 2020. Getting bag up poll books in the polling places is something thats accomplishable and having minimum of emergency paper ballots and provision ballots is something that we can do this year and things like conducting post election audits are things that we can get done in time of the november election. [ applause ] thank you, larry. Our state are on the front line in infrastructure. One of the resources that our states have are National State electors. We are fortunate to be joined by annie cohen. [ applause ] good morning everyone. Real quick i want to emphasize what larry said, caucuses are not run by Election Officials. They are run by political parties. I want to emphasize it as we kickoff the rest of today. So thank you very much and for having me. I thought it would be helpful before we spend all day Start Talking about elections and Election Security to give you an over view of how elections work and to have an informed discussion. The National Association of state election director a professional association for state election directors. All 50 states in the u. S. Territories. We cover a lot of grounds because we have california, texas, guam and literally everything in between. Those are very different as you all know. If 40 states, the chief Election Officials are secretary of state. My colleagues from nasa in the bag there. In those 40 states the election director works for the secretary of state. The other 16 states the election director is the chief election official. If you are wondering what they do, they implement policies and technologies, run training and work with local Election Officials and so much more. There are a handful of federal laws that are governed e llectis elections. Election officials have difficult jobs making sure our elections are secure and assessable for all voters. There are of course other laws in the constitution. In general, elections are run by the states. Most states are at the county level but they are 12 or so that theyre mostly in new england and also michigan and wisconsin. Theyre some where between 8,000 or 10,000 in the country depending how you count. Every single one of those local election jurisdiction is responsible for their elections in their jurisdiction. I would like to use wisconsin as an example, depenniding how you are countdownining, some are ov 1900. Thats about 20 of the local election jurisdiction in the country. Many of those are part time and a third of them turn over annually. When we are talking about implementing Cyber Security at the local level in particular, thats what we are working with, right . We have to run training and educate local Election Officials who may have other responsibilities but who cared deeply about democracy and who cares deeply about doing this. We dont want to care them off. We cant run democracy without them. Wisconsin is not here but i will pick on them anyway. They have run training at the local level on ongoing bases, theyre doing hundreds of training a year for all kinds of things and Cyber Security and administration and things like that. Theyre doing table top exercises. They implemented multifactor authentication. It is hard because again you need to make sure that you are not scaring people off and running them out of the process. Since the Critical Infrastructure designation in 2017, states taken advantage of a lot of different resources at their disposal. All of the states are working at the department of Homeland Security in various and different ways to secure elections. Many states are also taking advantage of inner state resources working with the states cio and other things like that to do fishing tests or vulnerability assessments or things like that. We see washington who are working with their National Guards to take advantage of that cyber expertise. Amazon and many others based in washington so they have a lot of good cyber expertise. There are a lot of states doing the same thing. Many states are working with colleges and universities to run training and to take advantage of expertise there. Local election jurisdictions have colleges or universities and they are relying on that expertise because they may or may not have it in their office. Something that larry touched on. More resources. Elections i think most of you in this room, elections are chronically under resource. When federal dispersement come, certainly people are appreciate of that. I would like to remind people in 2018 that it is hard to procure stuff for states and local government. Voting machines, these are not things where you can go to home depot it is dedicated technology and takes a long time and can be difficult to do. The other thing to keep in mind of procurement of different ways of infrastructure. You have the bind power of the entire state which can help with negotiating. In other states thats done at the local level. That can be really difficult. Again, then you get into the timeline of such things. Once you get through a procurement timeline then you have an implementation timeline. Nobody wants to implement a new technology, you know, two weeks before the election. Thats silly, thats insane frankly. You need to have time to educate voters if it is going to be a voter facing technology. You need to have time to educate coworkers and staffs. In an election, it requires all these different people to Work Together. The thing that i will say again also to chemokeep in mind to go through today. The best way to go on with elections is to talk to state officials and talk to your local officials. There are 8,000 to 10,000 local officials in the country. I can guarantee you can find a local official wholl talk to you. Everyone of you have the opportunity to be apart of the process. The best way you can make sure that things are going the way they should be doing is participate in the process. Participate in the processes as voters and participate as a poll worker. People feel comfortable in their locations when they see their neighbors. So be there and help your neighbors feeling more confident in the process. Finally i will say that you also have the opportunity to attend your local logic and accuracy testing. So that you can see how local election jurisdictions are testing and preparing for an election. I talk to quite a few local officials in 2018 and i said did anybody attend your local accuracy testing . Everyone is talking about Cyber Security. The answer is always no or maybe one or two. Those are my two big ways you in this room and at home can get involved in the election. If you are concerned, attend your accuracy testing. Thank you very much and enjoy the day. [ applause ] thank you, annie, that was really helpful. I am excited to introduce danielle conway. I am going to bring up the panelists, you guys can sit in which ever order. We have pam thessler. He was covering Homeland Security when it was an empty desk in the west wing with tom ridge sitting at it. It has come a long way. We have jared dearing. This is an incredible panel. Next to pam is Morris Turner whos cdts technologies. Incredible to have him here and giving us the Real Technology and sitting next to maurice is larry who we have already heard from. Danielle, take it away. Thank you, so from the institution of our nation through the Voting Rights act of 1965, i will get no argument that voting is the corner stone of our democracy. From Frederick Douglas to Elizabeth Katy stanton, we have been in a constant and struggle to be selfactualized as voters. The modern struggle though against this disfranchisement and Voter Suppression and obstacle to restoration must account for insecurity of Voting Technology. The Voting Technology creates failures in a democratic system, functional failures and security failures. So this panel is here to address these failures. I want to begin with pam thessler talking about voters confidence and democratic failure. I will give you a question about helping us understand the decline in Public Confidence and the fairness, the accuracy of our elections by hacking in these failures i have listed. Well, thank you very much. Glad to be here. We at npr and many other organizations have recently done polling on voter confidence in the elections. I just want to give you some of the results which i found quite astonishing in part because we have had good elections so far. There is really not much evidence of people tampering with votes or breaking it down. But, thats not how the public feels. This poll we did in january. 41 of the people that we polled do not think of the nation is prepared to fend off an attack of our elections. 44 thinks many votes will not be counted. Thats pretty as ttonishingasto. I sort of wonder of the 23 . It is concerning because more than half think that it is much more difficult now to distinguish what is true and what is not true. And i get these results because we did this in january and we did this before iowa. We did this before what we had the news last week where we had these briefings. News about these briefings about russian intentions in the upcoming elections. And what i found sort of most surprising, generally did not see from my reporting any way that there is much new and surprising in those actual briefings. What to me was something that was surprising was the response to that news. We had the president reportedly very upset that once again it was an assessment was made that russia was working in his favor. He replaced his director of National Intelligence. We had Bernie Sanders revealing that he also had been informed a month earlier that his campaign was being heacked by the russians. He implied that somebody was leaking this intentionally right before the nevada caucuses for political conditions. It was just one thing after another where everybody was pointing their fingers at each other. And so as low as the confidence was before all this happened, we have to wonder what the conference is going to be going forward. So you outlined this decline in Public Confidence not just including this information to voting or media reports but now it is our internal actors and our candidates who are pointing to this. That may be this information in of itself. Exactly. May i ask you pam to comment on the growing doubts of the validity of the election as we move forward. What are we doing now to try to combat this and what can be done to address this in the likes that amy talked about as well. Well, i think one of the things that amy talked about of Election Officials everywhere we need to talk about, you need to go to a trusted source of information that you should not believe everything you see on social media. The problem is there is so much information out there. And i want to talk a little bit about the media, the role of the media. It is difficult because our job is to point out where there are potential problems. I think more needs to be done to make a distinction of what is a problem thats a technical thing that machine that broke, i once think of larry. Remember a few years ago there were so many reports of machines where there were flipping of votes and all these people oh, something nefarious is happening. It is important for social media to make distinctions between whats the normal problems thats happening and verses something nefarious. So we know to have a better idea of what we are errorireporting. I would like to turn the discussion to jared and maurice to talk about the procurement functions. I want you to address what kind of strategies could be taken in the appropriation sector to support elections and function security. How do we get out of the security that we are in because all solutions required funding. It took a year on the hill to help appropriations passed. We took a lot of time and capital when members were interested in the process. We had dozens of bills and congressional hearings and usually those are strong signals thatll get something done, unfortunately that did not happen. It just took so much time and effort to get relatively small amount of money through in coming at the last minute, there were unfair expectations how quickly that money could be spent. It is hard to imagine what it would be like and trying to figure out how much money is coming to washington and when is it going to arrive. So similar to maurice. My take on this though is we have a lot of people in kentucky that were saying clearly this is the federal governments fault. In my opinion really stable election funding needs to be federal, state and local. If all three are not participating in that process then it is not stable election funding. And my belief is that instead of help but, what we see now is some significance negative extra nalities. Routinely i would speak to state legislatures, hey we need to do more to fund these systems and create these more opportunities for counties. We are being told the feds are going to drop money. At the local level it is harder for them because theyre not getting regular access to federal dollars and theyre not getting regular access to state dollars. I had to recently go into the county and one of the most rural parts of kentucky where the county democratic coucourt was out for the clerk. One, you cant do that. I sat down with them and worked on their budget for several hours because theyre trying to fund water bills for the hospitals and theyre trying to fund roads and do that in a time that the town itself is completely transitioning from a cold base economy to an economy thats not there at all. That Funding Source that was there prior, you know they need to be able to have a Funding Source thats routine and they can count on. From the state level thats the same for us. From the federal side, if the federal government continues to drop every decade or so. It is only going to intensify the fact that all of our systems are coming to the end of a life cycle at the exact same time. I think i am anticipating what larry wants to talk about because referring to upgrading the system and making it inoperable. The question that i want to talk about with systems is, is there an i. T. Knowledge gap . Do we have the needs and the capacity to address that i. T. Knowledge gap along with the funding gap, larry . I was going to add something to jared. State will point to counties or federal government and the results is that there is no investment and i think ultimately congress has to solve that problem. Congress is the one that can lead and they can do what they did with the last set of money. It would be nice where they require states to match a center percentage of that money. Everybody is waiting for somebody else to fund it. In particular what you start to see is the poorest counties that suffer, particularly rural counties. We did an analysis in virginia a few years ago before they repla replaced their equipment. It is those counties that were left with equipment that were breaking down the most and the oldest because nobody was acting. I think it would cost the federal government less money in installments or if the federal election cycle rate. If they did that, it would encourage the states to spend more and encourage the counties to spend more and own more of that responsibility throughout the entire ecosystem and procure ment. Would that be a first start in creating a wholistic system to close the i. T. Gap . Absolutely. What else . I got 120 county clerks that very in skills set and abilities where i can say about every single one of them is they are deeply invested and care about the sanctity of our elections and the foundational of our democracy. Some of them dont have the resources. We are talking about individuals who may be nondigital natives. We are asking these individuals to participate what is national security. We are asking them to do that with limited resources and communities of many smartest individuals are leaving college and going to larger cities and theyre not returning with those skills set to be able to provide some of that gap and i. T. Understanding. Maurice. So i think there is a multiprong approach would be appropriate. First we would start in the local community as amy mentioned earlier, one of the best ways to help to be a poll worker. Every community there are folks who are readily comfortable with technology, folks that have the ability to get specific i. T. Security training and become poll workers. As a nation we are facing a Cyber Security work force gap and that could be a place where additional dollars could helped. It is being done where there is special classifications that can take place and help encourage people with the field to come on board. That can happen at the state or local level and boring that longterm solutions. In short term where you have a state level small force of folks with these skills that can go out and be assigned on short term bases and expectly steppst right direction and rotating them around. See if there are ways where states can Work Together to help each other to benefitbenefit e arrangemen arrangements. Thank you. Amy. Larry, can you flesh it out a little bit more so we have a good working knowledge of that distinction. In fact, some body said this to me a long time ago that anything can happen by accident especially with technology. Many things we see that are technical problems on election day. I talked about polling books failing. They fail some where. They fail some where in every federal election but with the cyber attack obviously you can be much more deliberate about which you are targeting and same thing with like problems with, we had a situation in los angeles, some time ago of information that was in the database that went to the poll books that was inaccurate. Often if we want to look at what kind of problems that we can have as a result of cyber tech, the best way to look is where the technical failures have happened in the past if they were more directed or systematic, what would they look like. Larry and maurice, could you address some of those practices used by Election Administrators to avoid the functional failure say protecting against Software Collapse or lack of maturity of software. Certainly. I want to start off by saying elected officials are some of the best when it comes to planning and making contingency arrangements in case something happens. We are not talking about Cyber Security threats but their Power Outages or a bad storm. The roads are not passable. There are a number of things that can go wrong on election day. It is one avenue of that. Something acutely, you know foreseeable that we ran into last year was the idea that windows 7 support was going to be ending and somehow that came to a great surprise over the summer even though it was something published many years ago. I think it is looking down the road, we are talking about software road map to make sure as a critical piece of equipment that software is something that needs to be kept up to date and fully supported. It is dangerous to run software thats no longer receiving security patches. We need to be taking it seriously. We need to make sure software are up to date and equipment that software is running on is appropriately configured. I would emphasize what i spoke a little bit about my presentation resiliency planning is critical and having redundancy is critical. Being ready of what to do and the Voting Machines are not working and have the backup materials ready, to get you through the worse Case Scenario when you may have as many as 35 of voters coming through. And to figure out what do i need in this polling place to get me through that period and solutions are low tech. Theyre having an emergency paper ballot and of course there is also the key thing which is training poll workers and making sure they know what to do when these problems happening. I will open questions to everyo everyone. Well talk about security failure and round out discussion. Identify the greatest threat to Election Security say Media Coverage of election, vulnerabilities, the role media plays in Public Confidence and how media reports come in daytoday and give us this information. I think i talked about that a little bit already. I guess one of the things i have been covering the election process since the 2000s elections when we had the ha hanging chad issue. What had struck me is every single election, the problem that emerges that and i am talking about the major cycle is something that people did not expect, whether it is long lines or a storm and thats of course what the challenges is for all these officials, they have to prepare for everything. We have not talked about the fact that we have this coronavirus right now. What if something emerges on election day or around that where people are not supposed to be gathering. There are so many things to be worried about. Every single time is something different. I think we do obviously have a lot of focus now on Cyber Security which is important and training and communication. As we have also said, our adversaries only have to make it look like they have the potential to disrupt something. I think thats a biggest danger right now is us kind of believing that they have this power when they dont actually. The other big thing is that we have not talking about much is the whole spreading of ransom wear. The National Intelligence of people who are very concerned about. It would not take much in very specific jurisdictions simultaneously paralyze to get the Voting Results and we dont know when thats going to happen or how it is going to happen. Jared . Obviously, facebook and twitter are the two biggest threats that we have in our country. We often talk about resiliency throughout the entire system wholistically but when we are talking about the security, when we look in order for democracy we see decrease voter turn out and year after year and some of the polls we are seeing and some what of what pam is talking about, a lot of people dont believe their votes will be counted correctly. Last summer we were on a panel and we were discussing this, i am saying this as a junior and not as an administrator. We were in a room of engineers, the moderator asked, how many peop of you are confident that your vote will count. He turned to the audience and said the same thing and everyone laughed and they thought it is a joke. Oh, we are not secure at all. We are talking about a limited group that these are people who are being interviewed by the media. These are people on camera right now and i was sitting next to the election system in colorado who knows more than anything in the state and he was confident that his vote is going to be cast correctly. I am confident that when i cast my vote it will be counted correctly and appropriately but yet the general public is unease and unfortunately a lot of it is both miscommunication and disinformation coming out via social media. It is also sometimes the normal media process. There is a lot of incredibly, dedicated journalists out there. I have yet to meet journalists trying to help this process but the problem is you know unfortunately when we tell stories, we can tell stories that can push people to the polls or inadvertedly pulling them back to the polls. Any time stories come out, if we can get that trust a little bit, it breaks the system. I know we are having burning questions. I want to give maurice and larry a final word on these greatest threats. Sure, for me my biggest time for concern is coming out so it is going to start in about a week and run through the first couple of weeks in march because there is such an opportunity for both the operation of failures but also in some of the misinformation campaigns really haves an impact and very shorten time period. I am not so confident that we have the process in place across different states having primary elections to be resilient in a shorten period of time. We had several weeks to be able to deliberate what it means to count the votes and ultimately of the Supreme Court and for me i see if we have a similar situation where some of the outcomes are unknown and we have these backtoback primary elections that we dont really have a process, we have not tested those processes to really allow for an fbi investigation to take place or some other local investigations to take place. If there is evidence of interference, what does it look like if votes are changed. We saw whats happening in nevada where we are not having 100 results of whats being reported. I dont know given the number of candidates that we have in the democratic races that well be able to recover. We see candidates dropping out immediately after the primaries, alliances will be formed and new ads will come out. Candidates are not sticking around in races starting in states where they had those races. The timetable is going to be dramatically shorten. I am not so confident that well be able to as a nation of state to be able to have the coordinated response to take recover if there is evidence of malicious activities. Larry. I would echo what everybody else says. A combination of disinformation whether it is operational failures or something else. With social media can result an undermining of the trust of the elections. You need that to work. Particularly as we get more and more hyper polarized. If liuyou look at polls of who trust the outcome. The losing side is much less trusted. If you add to social media and you have forces domestically and abroad that are looking to fuel the fire. It is a dangerous combination and neieds a lot of work that w have to do. Well take questions now and you will pass the mic to those who are raising their hands. We have a hand over here. I am an undergraduate student and trying to help out our College Campus being regarding to voting. This is for jared because you mentioned facebook and twitter. It is huge at my campus because a lot of my peers and friends and family members in my age range are looking at twitter and facebook for political contents. Thats one of the worst things you can do when it comes to securing elections or just in general having political opinion. What would be advise for College Students like me whos trying to steer people away from social media. One, identifying trust as an sources. Is there a state Board Election or secretary of state or in some circumstances to the executive branch. But understanding where those trusted sources of information are coming from. Also identify when you see something thats in promote. Identify it and let someone know, right . We had an incident in kentucky in our last Gubernatorial Election where someone tweeted out they had shredded out thousands of ballots for a specific party. Thats not true. We knew it was not missing. This was someone putting that information out. Because someone saw at a small limited network, identify it and pass that information up to us. We are able to take it down from twitter and have them do that. Now, part of the problem we are facing is people repost it on twitter, and saying it is commentary so we are not going to take it down. Honestly, it is one understandiunderstan understanding consumers still have some control in the ma marketplace. Notify twitter and facebook, remove yourself. We have to start putting pressure on facebook and twitter. At facebook one point you would do society a favor if you replace your platform with cat videos. I dont think theyll do that realist realistically. As a society we need to put pressure on them as an organization. Hello, i am have dickenson law school. The problem is facebook, instagram and twitter and windows systems. Is it possible to remove these private actors from the election process . Can we downgrade to a system where we use paper or should we upgrade where a system it is heavily masked and we have to consider these cyber social engineering interferences on these platforms and just use a completely different system of state county or township system. Sure, i think private sector links to our infrastructure. Thats something that is true for most work that governments do. It is not always going to be Government Employees going the work. There are positive examples of private sector coming into election process. I will highlight a couple here, voting works is a nonprofit, thats actually designing and ruling out open source software, using commercial software to hard lower the cost of Election Officials where you can help closing the gap. There has been pilots in a couple of states. Microsoft is putting resources behind a concept of end to end verifiability. Votes have been in the news a lot lately. Some stations are going to them as a way of using security builtin mobile devices and Block Chain Technology to be able to help increase security for voters that are least likely to turn out and having accessibility needs. Those are voters that have turn out such low numbers that it is worth considering adding a little bit morrise risk to the they vote. Because trying to get it back by email or fax are everyon less secure. With the appropriate round of investment and development of new technologies and rolling it out as Pilot Program and sharing information across stays ates a local jurisdictions. Basically counting on local officials to be Security Professionals but procurement experts when it comes to evaluating wholistically. Whats the best technology to use with my local jurisdiction. I will add quickly, it is hard for me to imagine getting the private sector out of our elections, i do think and even los angeles built their own voting system. Theyre working with private vendors to help them. It is not like they have their inhouse expertise to build their own voting system. I am alluded to this in my talk, we need somebody to help Election Officials. There a there are so many vendors out there. There was a study that came out that identified some Real Security risks. The jurisdiction that are cra contracting with them. Somebody need to help and to my mind have some kind of federal catering system would be helpful so that we are not relying on elections to basically have to guess and relying on sales people who look at the end of the day are interested if selling and are not interested in ensuring their systems are secure as possible. It would seem to me that there are ways precontract to do designs, specifications and Performance Specifications that are uniformed and inoperable, such that you can actually respond to that even though you have a vendor working with the government. And i do think local officials are a lot better than they used to be because i think they used to have these vendors coming in saying well provide these machines, trust us. There is a lot more questioning of not only how machines work but what vulnerabilities are but also what their security practices are. And some of the states and localities have built that into the contracts that they have now with vendors. You need to tell us the security protoc protocol. That does not mean there is still a lot of vulnerabilities. You know you said that it is the private sector where a lot of the problems were. The one thing with the facebook and twitter. Serious issues, but you also have to look at and i just point again to last week, the example of what the response was to the news coming out about these briefings on russian interference. It was the campaigns that went to twitter and the candidates who used it for their own political purposes. Its not just the private sector. Its the Public Sector and the candidates as well. We have one question here, then another question. Penn state students are helping us get the word out about the upcoming census. The census is going to help us redraw electoral boundaries. Are there any issues with the security of the census or how thats translated into new electoral boundaries . Ill speak to that a little bit. Im also concerned with the census and the security of the census, ive been concerned about that since my time here on the hill as a fellow a faew yeas ago, when it was obvious the operational benchmarks were not going to be met. With this massive push to get people to complete the census online, if people arent confident that they can complete the process online or theyre simply not able to because the systems arent up, its going to be put additional pressure on volunteers to be able to go out and person. Currently the census is behind when it comes to getting volunteers, theyre behind on community partnerships. There will be precious on backup systems that are also not functioning. That has a cascading effect. What were seeing is the potential for the American Public to see the institutions of government as not being able to function in the digital age. It started with the healthcare. Gov obama website. These are massive hits to confidence that regular people can identify and it sticks with them. At some point we have to show as government that we can do this, we can do the digital age correctly and securely, in a way thats accessible to everyone. And so my hope is that there wont be any major incidents that have a negative impact on census. But census tracks with elections when it comes to, were doing this to ourselves. That means if there is a coordinated attack that is targeted, theres a high likelihood that it will be successful. Ill add real quick that i think you have a similar issue between the census and elections with disinformation as well, there the potential for that information around the census, attempts to discourage people from participating in the census. The media and trusted officials have the responsibility to be out there giving good information about it. So two things to the census part. One is, it also shows you how interconnected elections are with so many varying things. Theyre so granular and its so hard to tell that story. When there is some sort of issue, whether thats an equipment failure or maybe a website at the county level has been taken over, when its reported, its often reported as, hey, election systems hacked. When the general public hears that, this is whats skewing numbers when people talk about their votes being cast. Unfortunately, because the inability to really granularize stories when it comes to election systems, thats pushing some of that narrative. I took my political hat off a couple of years ago, we cant run elections and still have a party hat on. So had it comes to the redrawing of lines, i wont comment on that, thats someone elses job. What i will say is, we often talk about elections being the foundation of democracy. I actually think its maps. Maps are the foundation of democracy. Updating Gis Technology in states is highly important, because we live in a representative democracy. If i cant guarantee that youre getting your correct ballot to make sure youre voting for your representatives, youre being disenfranchised. Your comment points to the fact that this is a holistic issue. Questions here . Hello. When, maurice, you were talking about how primaries after iowa and how the reliability of those results really matters in terms of a candidates push, the money they receive, im thinking back to the incident a few years ago in knox county, tennessee, in which the county website that reported these results had gone down because of a vulnerability on the web server. Im just curious, your thoughts, any of you, on, you know, even if results are tallied and kept securely by the state, local and county officials will still put up results on their website. And if somebody is able to hack their machines, especially with 15yearold windows operating systems, and bring them down or even create fraudulent results that are dueling winners for a county or federal election, first, do you see this as a potential problem, an area that has not been addressed beyond sort of the talk about Voting Machines . And if so, what can really be done about it, if it means more upgrades, moving to the cloud, securing information that way . I am worried about that. That seems like unfortunately an easy way to undermine voter confidence. In fact abroad, weve seen attacks on things like reporting sites. You know, i think having redundant sites ready to go if theres a problem with your sites. And again, i think theres a responsibility for those that can do it, to report accurately on what those totals are, on the fact that theyre unofficial, on the fact that where the official sites are, all of that, i think all of those are ways of potentially addressing problems that might occur on Election Night with reporting results. And, you know, i think we even saw this a little bit with iowa. What happened was a mess, it looked really bad. But at the end of the day it was about reporting those results, and they did have paper backup for the votes that they were able to go back to. Some of it is just on the media and the reporting and making sure that we get out Accurate Information. And as i said, i do think its valuable to have for election offices to have redundant sites if something goes wrong with their election sites, if they go down. Its important to keep in mind how people are looking for results on Election Night. Are they just typing in Election Results, insert my state, in google . Are they going to social media, are they going to their Election Officials website . If we can make it easier for the machines to find out what the Election Night results are, it would be easier so if someone does type in whats the Election Night result in google, what are some ways we can make it easier for google to find those trusted Information Sources with Accurate Information on them . From that at some point, it would be things like a dot gov domain, different from other domains, having machine readable web pages, so that that information can be easily parsed and updated, because i can definitely see a situation where on Election Night, people are just asking their voice assistants, whos winning or who did win. And they have no idea where that information is coming from. When was the last same you asked siri or alexa, whats the weather, and you thought, whats the data source for that election . Its going to be 32 degrees, i should get a jacket, you go on with your day. From that mindset we can take a look at what are ways we can make those trusted sources more readily identifiable and accessible by the tools people are using, assuming they may not go directly to that source of information. You know, i think there is more of a push this year to try and get the word out, not only just from the media but also Election Officials, that youre not dont expect to get the results on Election Night. That does seem to be the message. And i think iowa, if there was any great advantage to that, it was to say, you know, this is initial information, you might have to wait days. The problem is i think you can talk til youre blue in the face, people are still going to want the results immediately. One problem i see is that the candidates will, you know, one candidate came out ahead in the beginning and then when they get more official results and somebody else is ahead, if its a really close election, thats whats you know, theyre going to use that to try and sow doubt in the results. And im thinking in terms of i guess it was both in florida and california, in 2018, there were huge numbers of absentee ballots that were not counted, and it was days, and there were all these President Trump raised this question, and others raised it, why do the results keep changing, whats going on, as though that were fraud. And i think, you know, we just all have to be very careful and try to get the message out, that this is the process. I think there are going to be tons and tons of absentee ballots this year. Well, you know better than i do on that. And jared, youll have the last comment. Its absolutely a problem. I think Election Night returns, as a society we need to get away from this idea that we have to have them immediately. But part of that process is that we put controls in place to mitigate risk, right . So in kentucky we actually post Election Results on every single precinct before those results actually go back to the county. To me, that does several things. One, it adds a layer of security into the system that says that votes arent being changed at the county level and that we can always go back. Its also giving access to ap and edmonds that have runners, they actually pull the results off the doors at the precincts in kentucky and have those results ready to go, quite frankly, before i have those results. Even though it says in big flashing red letters, unofficial results, it doesnt matter how many times i say it, how big and bold it is, people take that as verbatim and run with it. From an elections administrative process, its a human process. There is Human Interaction with this data. Because of that sometimes a clerk may fail to put in absentee numbers at the end of the day night. Guess what, when they now go back to certify that elections, those numbers grow and it becomes a breeding ground for disinformation and for that sort of thing. In my last Gubernatorial Election i had a governor that didnt concede immediately based on the fact that our Election Night return system was showing different things. He appropriately asked for a recanvass and he appropriately let that process go through and appropriately conceded when the numbers came back. But what happens when the numbers are so vast that the general public doesnt trust them . Its a big problem. And larry brought this up a little bit in the beginning when he gave his talk, thats the importance, why its so important to have these audits after the election so as a matter of routine, that you do a risk limiting audit so that people will actually have confidence that those results, those official results, if theyre very different from those initial results, are accurate. I want to that wenk the panes for this conversation about cybersecurity and election infrastructure. Thank you. [ applause ] thank you all. Were having a coffee break now. They queued perfect the social engineering discussion. Theyre coming up. Im going to go ahead and start introducing our next speaker. Were really fortunate in this current climate in which all of this is happening that we have per spe perspectives from the Intelligence Community and the department of defense. Its a privilege and honor to welcome our next two speakers who will do a combined flash talk together with different points o