Next federal and state officials take part in voting ins security. We also hear from the head of security and cybersecurity agency. Its part of the billington cybersecurity form. Well good morning. And welcome to this most Important Panel called election cybersecurity safeguards during the pandemic. It is a great pleasure to introduce to you, this worldclass moderator and panel. Let me first introduce our moderator john de symone is the president of Cybersecurity Services at raytheon intelligence in space where he oversees the strategy and operations for global team of over 6000 employees. His teams are responsible for delivering cybersecurity solutions, Global Training and logistics. And Product Support services in support of Critical Missions for government agencies, businesses and nations. Within his Chris Washington chief Information Security officer at software the largest provider of technology in the u. S. Hes here to sheriffs with us all the improvements being done to Election Security du jour accurate and audible elections. Matthew matheson security adviser for the department of Homeland Security or a focuses on Election Security efforts issues. Presently served as a commissioner at the Election Assistance Commission from december 2014 until march 2018 including serving as the commissions chairman and 2017 to 2018. Trevor timmins has served as the color colorado secretary of state since 2007 after eight years deputy ceo thank you very much for this panel thank you very much to each of you for listening and now i will turn it over to john. I am very excited to be here with this panel to moderate this topic for our country today i would like to dive right in and the first question with a deep expert i would like you to set the stage and then to understand the complex system with the correct encryption and then the confidence of the outcome so with 55 days left with the election. For many ways with the angle having confidence son so with 50 we talk to us about how the government is addressing the needs of his Election Protection absolutely thank you for moderating this panel. For us that cyberstructure security or agency our focus is on supporting the officials that we have running elections across the private sector that work hand in hand. Systems of systems is the perfect way to describe the election ecosystem. The reality is that in many counties the Election Office is the largest i. T. Operation as far as total number of assets. Youve got Voter Registration systems, voting systems get a tone of the attention, but there are so many pieces of infrastructure at the state and local level. Ferocity sza the emphasis is on one, making sure they have access to timely and actual intelligence to manage the rest of their systems. These are largely resourced challenge jurisdictions not just money wise but i tee wise. They dont always a full time i team ploys and many cases are reliant on third parties to provide that i. T. Support. So getting timely and actionable information out to understand the rest of their submit ors systems is really important. Second thing is to provide support and services with the scans the penetration, test the fishing campaign, tabletop exercises, its all with an eye towards meeting them where they are, with their level of maturity and complexity exist and providing them tangible steps they could take to shore up their systems a bill resilience is a set. Its not just about offense. Certainly that is a big part of this but we how do they recover . The nice part about us working with the Election Community is that Election Officials are natural risk managers. They spent almost all of her time working go wrong . How do i prepare for that . How do i respond . That in and how do i talk to my voters about about the integrity of this process remains intact. So that is been a very natural conversation for us to have. Recently there was an arc article about a meteor asteroid passing around election day. Rest are sure there is some Election Officials updating the Response Plan on how to respond to that because thats how they think. For us its really been an engagement around embracing that tendency, note how do we secure official elections. As we look at 2020 versus 2016. In 2016, approximately 85 of votes had an audible. Record and community 2020, were looking at 2020 will have a audible record. Thats absolutely critical not only for the security of the process but what you talked about is the insurance level. Now what we have to focus on, is how do we effectively audi those records, and how do we do a transparently so the confident can have confidence in the votes cast. So thats our starting point in working with the state local elections. Thank you. So trevor for the ceos a state of colorado, youre one of five states were almost all voters vote by mail. We have elect traumatic polls for those who voted person. Youre in the trenches at the state and local election. How do you manage this voter authentication amid the growing concerns about voter integrity or voter fraud or deception fraud. The sea under mind it confidence in the colorado voter. Great question thank you for having this. Panel i mean it really starts the front in there really three phases of elections. Theres preparing for elections, which means that youre making sure the voters are registered. If citizens know that they actually can be registered and a big part of that is getting the word out. Most states today actually have online ways for voters to check the registrations and check to see if they have enough been registered. And a check or updates rodgers if they need to do. So today weve seen a lot of states providing ways for voters to see if they want to receive a male or a ballot. And colorado we are one of the states where we mail ballots to every active order. It will appear in or mailbox a few weeks before election. And they can actually sit at the table and market with a pen, verify their choices. We have a way that they can actually reach out to us and requests to replacement ballot. If there is sufficient time before election day we will may lap to them. The recent notice on the postal system and reliance in the postal system for the mail ballots is kind of interesting. What i have seen is that some of the media reporting its about how long it takes for a bullet to do around trip. And a potential discrepancy in state laws and state regulations for someone to request a male ballot way to close to election day. We try to avoid that in colorado, thats how our state laws are geared. But we do think that the abalone to request and to update your registration thats the first part of it, making sure your voters know that theres an election coming up, where they can vote, how they can get about, whether its mail or vote in person, and how their information is accurate. The accuracy of those systems we, we think that helps support confidence of the voters in the entire process. And every step along the way if they can see the resiliency, masterson resort refer to and the process that is in place, we think that helps support the confidence of voters. The second part is really voting. Many states have early voting periods, whether its mail ballots being returned, or voters walking in voting in person or on election day walking in it and voting on election day. Thats at second stage. Afterwards its the results reporting. We will see Election Night results but many balance will not be in the hands of the elected officials or have been counted by tuesday at 7 pm. Im the laws in various states they differ. Whether its a postmark thats required by tuesday election day or whether it actually has to be in the hands of the election official. That post election process i think this year will be one of those times where people are going to express concern. So one of those things that Election Officials are talking about a lot is setting the expectations of the voters, of the media, so that they can be be prepared. Were probably not gonna be known on tuesday at 7 pm. Were probably not gonna know it tuesday in the middle of the night. So we need to make sure that the expectations are set at the right level for this election. Thanks. So you could talk a little bit more when you talk about integrity in the validator dish an oven election polling system versus a more mail and. And a little bit about how states differ, i dont want to talk about another state obviously but, how a colorado difference from state to. Stay sure while i think the process is largely similar from state to state. When somebody visit registered to vote, they may register by a mailin, but when they see show up in person, they have to show a proof of i. D. Thats federal, all that state law, states have federal forms of ideas it be sufficient for verifying that you are who you say you are, but its really making sure that authentication in verification you are who you say you are by showing some i. D. And that you are authorized to vote a particular ballot. That is you live there. Because depending on where you live in a state, a lot of different state senator, different representative, different mayor, all that sort of thing. So that authorization to know who you are, thats how they make sure they get the right ballot in front of you. It really starts right there. Today, that information is validated by human beings. I do think that is some point in the future we may be at a point where we may leverage some Electronic Technology to validate identity. The reality today is that the systems are in use, those people who are showing up to vote, requesting mailin voting ballots, their identities are being identified and validated by a human being. So chris. As a manufacture of Voting Machines in the u. S. , we have a need for the understanding of the technology of the democratic elections in federal priorities at a federal level. One of the biggest technical logical challenges to resolve for regarding these machines . Sure thank you for the question and thank you for burlington for inviting me to be a part of this panel. Voting machine security has evolved over the last 20 or 30 years. You can remember like me the lever machines, or you would make selections or move the levers and then pulled out a big lover to indicate your choices after the 2000 election, they have a bill was passed there was an influx of money and a lot of Technology Providers building electronic Voting Machines so that you didnt have people pulling punch cards tried it is german voters intent. The electronics at the time captured voter intent. But those machines did not provide a paper trail. And in the last 15 years, election Technology Providers have moved forward to provide paper trail and honorable method that voters can inject their imports to the Electronic Device before it is scanning counted. Each of those generations of elect election jet technology had those own security issues. Today under the leadership of the election infrastructure of some coordinating council, the sea have come together and really try to move the ball forward when it comes to Election Technology security. We are sharing best practices, we are meeting to three times a month sometimes talking about the risks to Election Technology and making sure that we are doing all we can to ensure that the technology in within the polling place is secure and that the counting machines whether they are in the precincts or the election sensual are secure and then the results that are recorded are secure. Thats the first part. The second part is the research and Development Design the requirements that go into building the voting machine. We collect those requirements from state and local of ex Election Officials who know their voters best to know their jurisdictions best. We asked a Technology Providers the moon and then to go cyril testing a verification process with election System Commission to make sure that each piece of technology thats in the field meets or exceeds the standards the that the eac has set forth in that there, a number of additional security testing over above the requirements done by additional states. So the election Technology Providers in our industry are working with all of those stakeholders to make sure the technology in use today in the polling place, in the Election Office and the recording of results from start to finish have the latest and greatest security builtin for compensating controls, for issues or situations that may have not allowed the inclusion of a control or a patch when the system was certified. We work very hard to understand the risks to our voting environment, we work with state and local effect Election Officials to get patches and updates out there. The proof is in the pudding. In the days leading up to the elections, election day jurisdictions, some jurisdictions are counting absentee ballots and overseas ballots, others are waiting till election day, but our industry is a whole is right there shoulder to shoulder with Election Officials making sure the votes are counted as tasked and that results can be trustworthy. Thank you. Ill throw this out to the group whoever wants to jump in first. What help you would need for your industry or the government to address the concerns. So whatever whatever we like to jump in first. Ill jump in. You know, the confidence of voters in the process. This is what actually happened in 2016 is that there were a lot of assaults on the confidence of voters in their fellow citizens and the process and whether the votes were gonna be counted accurately. There were attempts to influence Public Opinion and just so division of americans against americans. Thats one of the things thats not really a Cybersecurity Issue but it influences the entire environment that we work. And on a technologist, ive done i. T. Work for a long time. Cybersecurity is table sticks. Cybersecurity was table stakes 15, or 20 years ago. On i dont mean at all to diminish the great work that system is applying to state or local jurisdictions the industry side gives to, us with chris and his company and the other companies that are involved. And i dont mean to diminish the risk of cybersecurity, because if you have web accessible machine, it needs to be secure. You need to be monitoring it, it needs to be regularly testing it and those are standard things, for anyone who does anything on the internet. And we work in a different environment where there is this huge aura of Public Opinion, and Public Confidence that we have to work against, and i will tell you that if People Choose not to vote because they dont think the process is trustworthy, then the bad guys have won. And thats really what it comes down to. We need to do everything that we can to show that we are taking care of these things, we are doing the utmost to make sure the system is resilient, and that people can vote with confident. Thats what its all about. Get out and vote. Yes and i would just add, to trevors point and what has been keeping me up at night, at least this week, it changes probably on a weekly basis but, is heavily and are we doing everything we can, to support the state and locals, and you know the vast majority of companies in this jurisdictions i should say are mid to small, and they are challenged resource wise. And they need that support to understand what patches do i need in place, how do i segment my networks. Implementing multi factor ratification. And you dont cherish been securing the process for years, but its how do i turn and talk to my voters. And theres local Election Officials, anything you need to engage or voters. As its particularly admits this vote this election. In my 13 years, ive rarely seen this. So how are we, sorting through the dynamic environment, and the confusion because we know uncertainty is a Development Ground for disinformation. How are we getting clear concise messaging out to voters, about these steps to be taken to secure the process, what their options are and how they can engage to be prepared and be patient and predicted pray participate in the process. And the best response to all of these attempts to undermine confidence, which we know is the adversaries goal, and its an ongoing goal for multiple actors at this point, so how do we get the information over and over again, out and where i know what i can get what i need, to understand how am i registered, how my participating, what the results will look like, and the process is secure. And that constant messaging, and i worry so much that we are not doing enough to support the state and local, and the private sector, and support other trusted voices in the community, to talk to voices to talk to their their constituents and say, you know if you have questions, to go serve as a poll worker. We need you and its a best way to learn the process. Its the hybrid threat of Cyber Security and disinformation, and how we message the voters. We have to control the battle space now. Thats critical. I agree with these guys, and the system has done a great job of categorizing the risk. All the pieces of technology that are involved in the elections. Expert after expert, has said that the likelihood, of a polling place machine, whether its a pacing scanner, or the likelihood of those being hacked or manipulated, unofficial result is very low. What we are worried about, and weve been working on that is the focus on the public facing systems like Voter Registration environments, electronic poll looks, Election Night results recording those three areas, in our view are because they are public facing, have a very large attack surface, in cybersecurity terms, thats not good. We have focused a lot of effort on implementing controls in those areas. Have pushed out hundreds of and they signed up thousands of election facials, to share information and information channels, and participate in those we do participate in that. And information sharing. To make sure we know what threats are being pushed against the technology. So we can prepare for and react to them. So far, so good. Every table top exercise, every penetration status, every risk and vulnerability assessment, says that our defenses are good. We have sufficient controls in place. We cannot let our guard down for a minute. You probably heard the old adage, that hackers only need to be right once, we need to be prepared all the time. And thats where our industries focused ott. Being prepared, to the American Public can rest assured, that they can sleep at night. With the technology that theyre using, and the conduct of elections is safe and secure, and honorable. So you guys have mentioned misinformation, disinformation and now it comes in an electronic form, and you know with different mail and fraud. So can you speak to, and id like to start with you matt, how we can you know the steps you guys are taking to get the information out to the public, to make sure they can sort through these attacks, that in our coming for our adversaries. And you know we know the adversaries are using the social media platforms. For some of their operations. So what are your thoughts on how potentially we can use our social media platforms to help these guys deliver the message, and integrity in our elections. The because you know rather than just being used from an adversary standpoint. Yes john, appreciate that question so for us, we have partnered and, we our focus has been on building resilience of the american people. Having conversations trusted voices in the community. Whether that is secretary of states, mayors, civic organizations, and getting information out, simple messaging around the election process. And trusted sources of information. Go to your official election you know officials, dont rely on some post on facebook. And understanding how misinformation and disinformation is targeted and spread. We issued something we, affectionately call which takes the controversial issue of pineapple on pizza, and use it to show how to see information campaign, can be spread. Obviously pineapple does not belong on pizza, and thats how our adversaries win. And we try to walk through how that disinformation spreads. And then steps everyone can take to come at it. Think before you link, reading the on the headlines, simply to say, where am i getting the information, from what is the source. And the true source of information. Especially around the election process. State and local official website, you know rather Somebody Just having. And the other thing is working with the social media companies, we have regular meetings with the social media companies. To talk about what type of information is out there, to how they can leverage the safe and information on their platforms, so weve seen you know we have seen all the major platforms, take a news state and local official websites, so they are driving to those trusted sources. And then three, really working with them to understand the election process. What does the preelection time period look like, whats it Election Night look like. Even after the Election Night what does that look like. So if i want an adversary, where is the uncertainty, where is the best place the information, and begin to process to push information, and correct information about the process now. Because what we know, from the research is that the more avenues that voters have seen this information, the more likely they are to pause and say, wait no ive seen something on this before. Ive read about this already. I know what my options in my state are. Or how the process balance in my state. Its that prebunking, and the participating of getting out in front and correcting, and its simple messaging around this. So trevor actually mentioned Election Night, so thats going to be exactly like you are Election Night, in that we have a certain amount of ballots that are not processed yet, that happens in every election. Elections Election Officials, certified after election day. But because of an increase in absentee voting, we may have more ballots are outstanding. So what would that mean, that means Election Officials will focus on accuracy, correctness, they will process those ballots and count them, and you will get the results certified and correct as you expected. But you may have more outstanding ballots on Election Night. Doesnt mean its wrong, its a process working. Its not that we will not have results on Election Night, it wont be as complete as it used to be. Great thank you, and chris would you like to comment. Sure i would like to jump in, so there is a huge difference between 2016 and 2018 today. That is really in the community that has come together, and you know theres been some places have been incredible in terms of sharing information. Like fbi, National Guard and, chris and his team on the industry side they put together a group that are publishing vulnerability disclosure policies. The landscape today, is so different than 2016. Its like night and day. Matt and his team, and you dont terms of information sharing you have a lot of cybersecurity protection and knowing what your risks are and what you need to prioritize and is that situational awareness. And the landscape today you know its literally night and day from 2016 to today. And i think we will leverage that that ability to share information, quickly and rapidly within the elections community. And its been fantastic. The tremendous tremendous group and information sharing since 2016. Four years ago there was no Election Task force but today the we have state and local Election Officials like trevor you know we have them on speed dial. And we could share information at a moments notice it, could be misinformation disinformation and cyber situation. So we can get the right people on a call, immediately. And my thanks to Homeland Security, and the privacy private sector clearance program. And several of us in the industry, have security clearances, so we can consume the information thats being shared at a classified level. And we can do something about. It so quickly, the fbis change in victim notification, when it comes to Cyber Incidents in elections, so several months ago the fbi updated policy, where they will react and respond quickly on Election Security. And let jurisdictions know right away, if any Technology Provider you know and let us know right away, so we can react to this if theres a problem. And again the goal being, to reassure the American Public that we are doing all we cant keep these elections secure. Thank you very much, and in closing, we have a few minutes left, what would you want people to take away from this panel, and the one thing a soundbite if anything else what would you ask . The election, in 2020 could 30 plus state primaries, and leading up to the general on november 3rd, are more secured than they have ever been. State and local Election Officials, we are more prepared for secure accurate and honorable elections than they have ever been. The industry has come together, under the fcc, and the advisory abilities of the Election Task force, to be more ready for any possibility of a threat to elections than theyve ever been. You can rest assured, you can go to sleep at night, that the people on this call, and people in organizations are working closely more than they have ever done before. Thank you trevor. Can i think youre a new trevor. Sorry, i appreciate the opportunity to speak with you today. And that. Just a quick message, you know of being participatory. The folks on the audience to this, voters are voters but they are sophisticated, audience and understanding and helping support your state and local Election Officials. Whether thats cybersecurity service, working as a poll official. And you have an audience now, and that are able to work with you, and you can get meaningful feedback about vulnerabilities, or threats you have. Work with us on that, collaborate with us and we do it across the private sector now, on a constant basis. There is a way for this entire audience to participate to help secure the election. In the end the last member of his of resilience, and thats on all of us. Well i want to thank all of you, for joining and participating, its been a tremendous privilege of mind to have a discussion with you guys. And the information you shared is invaluable. Not only for the industry, but for citizens of the united states. I appreciate all the work you guys are doing to make sure our elections are secure, and are all able, and people have confidence in the process. Thank you. Thanks john. Thank you john. Today arthur h. W. Brands on 18 century figure henry clue and danya webster. He explains why the three statesman were critical to politics during the war of 1812 and a compromise of 1850. Watch tonight beginning at 8 pm eastern. Enjoy American History tv. This week and every weekend on cspan 3. Now the contenders. Our series on key political figures who ran for president and lost but nevertheless changed political history. Next, we feature former House Speaker henry clay of kentucky, known as the great compromiser. The program was recorded at clays ashland estate in lexington, kentucky, and is about 90 minutes. This is an encore presentation of cspans original 14 with series which originally wear it in 2011. Tis