Skip to main content

tv   U.S. Election Assistance Commission Meeting on Security  CSPAN  August 21, 2019 6:27am-7:50am EDT

6:27 am
>> i call this public forum to order. if you would all stand with me for the pledge of allegiance.
6:28 am
allegiance to the flag of the united states of america and to the republic for which it stands, one nation, under god, indivisible, with liberty and justice for all. if you could silence your cell phones and electronics i would appreciate it. i'm going to take the role. good afternoon, thank you for joining us at the u.s. election tosistence commission, examine the security challenge election administration faced to head of the 2020 presidential election. this little conversation will
6:29 am
provide us with a better understanding of ways the commission can help, address a variety of security issues, including those that stem from aging voting technology. when congress passed the help america vote act it established the eac as the only federal entity solely focused on supporting election officials and the voters they serve. part of our charges to be the nation's clearinghouse of information on election administration. it is this responsibility that brings us here today and guides our election security efforts. we pride ourselves in convening the right people at the right time to address significant issues and this event is yet another example of that work stop while there are plenty of news headlines that can serve as the backdrop for this conversation we are not here to address any one specific media report, we are gathered for a comprehensive look in here from three people, including
6:30 am
secretaries of state, a state election director, our federal partners, testing and certification professionals, and representatives from the election industry. today's forum and input from these witnesses could not be more timely or important. election security is front of mind for everyone, especially those on the frontlines of administering the vote. the recently released 2018 election administration voting nationwidealed that fees election officials reported to,422 pieces of equipment cast in tabulated votes in the 2018 midterm elections. election officials are responsible for each and every piece of that equipment. we know they rely on federal partners and election vendors to provide the resources and support they need to make election systems more secure and resilient. we all have a responsibility to provide that assistance. it is my wish we leave today's
6:31 am
forum with a better keepstanding of how to things safe, the ongoing innovative approaches they can use to ward off security threats, and how all of us in this room can help the elections that garner public confidence in the end result. i ask my fellow commissioners to make the opening statement. >> thank you, chairwoman mccormick. i'm pleased we are holding this forum on such an important topic. in the six months since the commissioner and i were sworn in, they have been highly focused on our role with voting technology. our first action with a restore forum was to start a 90 day public comment period on the voting system guidelines. public meetings on this new draft version of the principles and guidelines during which we heard that it is a significant step forward to modernized voting technology.
6:32 am
we also discussed how the voluntary nature results in a system where the full value was only realized if the guidelines and the testing and certification program are utilized across country. should strive we to create a testing and certification system that is responsive to the needs of the election officials and provides access and security to the american voter that they deserve. speaking of the testing and certification program, we recently added jessica bowers and paula meyer, who have brought decades of experience with election equipment and certification to the team. we are lucky to have such talented individuals working here. i'm confident our agency and the testing and certification see arrived at the challenge before us today and worked with election officials, voting system manufacturers, test
6:33 am
laboratories, and federal partners from the national institute of standards and technology and the security agency to quickly develop processes and procedures to incentivize the efficient deployment of patches or updates to voting systems in the field. doing so is crucial to the security of our election systems but they do not exist in a vacuum. onlier i mentioned our work the bsg -- we are also working on drafting the new technical requirements crucial to developing the next generation of voting equipment. these efforts to complement the important conversations happening every day in the yield on issues like assessing and mitigating risks or adopting a coordinated vulnerability so that potential issues can be reported and fixed before they can be exploited. this forum will be an important
6:34 am
step in identifying areas where we has an agency can do more to improve election technology -- would it be nice if we could solve everything? i suspect this will be more of a start then a finish but we must get the job done. we must strive to maintain and improve testing and certification programs that provide real value to the elections community without adding unnecessary burdens or cost. if there are avenues where we can do more programmatically or administratively, we must consider such suggestions. if legislative fixes are necessary we should identify those numbers without delay. i look forward to today's conversation i would like to thank all the witnesses for engaging with us on this important issue. and before i turn it over i would like to anchor the staff for all the work pulling this event together, thank you. >> thank you. commissioner, do you have an
6:35 am
opening statement? >> good afternoon. i'd like to thank our witnesses for participating, as well as those of us who are tuned in online. today's forum is a chance to provide needed clarity about where election security efforts to ahead of the election and how the eac can lead to make the election systems and infrastructure strong and secure. state and local election officials are on the front lines for democracy. i have full confidence that we will zealously prepare and train for the 2020 election and in the end will get the job done for the american people as they did in 2016 and 2018. because of the unique role congress gave us and the fact that we work closely with federal officials, the eac must take a leadership role. we arestion is whether adequately planning in
6:36 am
establishing lines of communications with the necessary information to prevent and recover that many attempted ransomware attacks or other disruption from a man-made disaster or first strike on our democratic ideals. the $380 million appropriate if i is going a long way for preparation and planning on the fundamentals but as dwight eisenhower said in preparing for battle i have always found that plans are useless but planning is indispensable. as we look ahead at the panels i'm eager to hear from experts on a number of topics, including the dynamic topics faced by election administrators and policies to implement and address election security and the federal partnership put in place. i'm looking forward to hearing more about how we are working to address end-of-life software used in election systems, your opinions about the values in
6:37 am
establishing a vulnerability disclosure program and your input about how the testing and certification program can provide more meaningful security testing. as a former state election official i am familiar with the challenges faced by the men and women who run elections across the nation -- i know they often face difficult decisions that stem from limited resources and unlimited needs, including the growing activity associated with securing election. my goal is to conclude this meeting with a better understanding of election official needs and concerns as well as some suggestions for how industry leaders and others can best support local efforts to secure elections. strengthen the nation's election system is on the line, protecting that faith will take all of us working together and today we have the opportunity to demonstrate our commitment to our voters. thank you for participating and
6:38 am
i look forward to a robust conversation on these issues. >> thank you, commissioner. do you have an opening statement? >> i do. to theme our witnesses cac security election form. i think all of you in attendance, watching online and those in the overflow room on this very interesting topic. with the next year's presidential election less than 15 months away i am pleased to be joined by my fellow commissioners for this essential and timely discussion. as i travel across the nation to visit election offices, give presentations, or attend conferences, election security is often the centerpiece of those conversations. after the election it was clear that our nation needed to look under the hood of election systems and through that process we identified a number of areas where we need to do better and a lot of progress has been made.
6:39 am
including the improvement of communications between state and local election leaders and federal partners to support their work. today's forum will likely provide even more evidence of the progress we made but it is also a chance for us to collectively identify opportunities to further advancement and cooperation, including the market for election equipment and better attract supply chains. the challenges face by election officials today are often due to aging voting equipment or lack of resources. i suspect we will hear some of that reflected in today's testimony. the reality that the eac strives to reflect the day-to-day work, including the forum and our ongoing efforts. i'm proud of the work we did last year after congress appropriated $380 million of much-needed financial support to the states and territories. the eac quickly and responsibly got these vital resources out the door.
6:40 am
today we continue to provide oversight and guidance of all these funds. our most recent conversation with those who received these funds is projected at 85% of the money it is likely to spend by the 2020 general election, with 90% going to replacing aging voting equipment or improving security and resiliency. we know that more resources are always welcome, and my fellow commissioners and i have passed that along with our interactions to members of congress. today's forum is a perfect opportunity to examine these entities, lawmakers, federal agencies, election manufacturers, and others can work together or continue to work together to improve security and strengthen voter confidence. it is also a chance for us to remember that our efforts must not undermine access to the polls. as work to make elections more secure continues we must also
6:41 am
safeguard the statutory right that every eligible american can cast their vote independently and privately regardless of ability. i look forward to the forum and ofk forward to being a part the work that makes this accurate. thank you. >> thank you. i would like to invite our executive director to make remarks on behalf of the staff. >> by way of introducing the agenda, we will have three panels representing three flights of testimony that was arranged as first secretaries of state, then the eac testing and andification director, other stakeholders related to certification and software changes, including federal partners, dhs, and microsoft. manyhird panel represents
6:42 am
registered voting equipment manufacturers as well as test labs. has beenale participating in another meeting this morning and will be arriving after that panel begins. if for some reason he has difficulty getting in time we will move him to the third panel . one final comment about today. theosoft windows 7 was topic that started this discussion and we are pleased that microsoft is here today but today's topic is much broader and we will talk about risk but i wanted to acknowledge risk at a different level. almost all of you have discussed security with election officials, congress, and other stakeholders and bike causing to discuss these and to engage in public dialogue where the clear end result is not yet known as a and and i hope all will see appreciate the role we are taking in this regard.
6:43 am
the election equipment vendors and microsoft have taken a risk to come here and talk openly about the security issues the industry shares. i know you appreciate the willingness to come in today and speak candidly at these issues. beyond those who are speaking today, we are receiving other fromnts from the record, the center for democracy and technology and dominion voting. these statements are available and will be posted on our website. this represents one of the broadest public meetings ever held, certainly the largest ever with 13 individuals appearing today and with that background i hand things back to the chairwoman for introductions of the first panel. >> thank you. is secretaryel denise who will be joining us shortly so we will start with
6:44 am
sec. hardwood. he is and 44th secretary of state, a resident of baton rouge. he was elected december 8, 2018. he brings a wealth of knowledge to the office, having served as interim secretary of state from may until his election and first a secretary secretary of state prior to that. as treasurerserves of the national association of secretaries of state and on the subsector govern coordinating council. his goals include securing new voting equipment for the state, protecting sensitive voting data, and continuing the high-tech protections for the election and commercial division welcome. >> thank you, commissioners. it is a pleasure to be here, it's a pleasure to represent the great state of louisiana, but
6:45 am
most importantly it is so important to be here to discuss .he important issues >> microsoft announced they would no longer sell windows 7 6mputers and on september microsoft announced the end of support for windows 7 would be january 14 of 2020. i informed the8, governor of our state that the windows 7 operating system's conflict with the legacy voting machines for early voting and election day. i also provided information for the resources that would be messes every to move louisiana forward. in the summer and fall of this 250 we are switching out windows 7 pcs and voters offices. clerks have already received
6:46 am
windows 10 virtual laptops, uploads to the state election .egistration network so how did this effect the state of louisiana? endeavor,een a costly replacing all windows 7 with windows 10 virtual laptops over the past two years has caused well over $250,000. thank you. the state's leasing voting machines with its current vendor until the request for proposals process is completed and awarded due to the windows 7 end-of-life issue. the least machines require the use of windows 10. the endeavor has cost us leasing of these machines in excess of $2 million. we have been diligent in keeping
6:47 am
the virus definition files updated for our systems, all laptops are scanned regardless of whether or not they connected to the internet prior to each election. we have sent strict directives to all registrars and warehouse employees and secretary of state election divisions, stressing that they are never to insert memory sticks into these laptops or change their phones or any other device. we also discussed this agreed deal with our training and person, duringin the process of our voting equipment and how critical it is to follow these directives. in addition they are instructed to never insert a memory stick they are allck and scanned for viruses upon return to our office as a preventative measure.
6:48 am
means any homework environments that are used by our local election officers, all of this has led us to additional security measures. i would like to say that additionally, the cost of the windows 10 desktops has been $670 per machine, and that does not include the cost to train,re, test, deploy, or maintain. all windows 7 equipment is air theed, meaning none of devices ever touch the internet connected. scanned forted or viruses before every use. we will only be used with password protected memory devices. so how do software upgrades affect our office?
6:49 am
upgrades can be mandated at inopportune times. it leaves the short on time to get everyone completed and tested. notalling an upgrade and properly testing the upgrade would be detrimental to our system. methodical and thorough and establishing an infrastructure is critical. testing the various environments like staging and production with one week between each, with production scheduled around the cycle can be and usually is very time-consuming and not a corner we can afford to cut. -- if an important patch comes out three to four weeks before an election, it causes us to wait to implement because we can't interfere in the election process that is already in motion.
6:50 am
can require extensive troubleshooting to identify and resolve upgrading the software. qualifying, due to a situation -- a cyber incident in our state not affecting our election system but certainly of concern because it affected local governing bodies -- we had to install new pcs. once turned on because we weren't able to have the time iame normally have as referred to earlier, which began implementing new updates as soon as they were turned on. this sucked the entire ability of bandwidth for the local institute that had to use them and thus affected the court office which then caused us issues of qualifying.
6:51 am
microsoft sends patch updates every second tuesday of the month, and we provide development and testing, updating and testing, and we provide staging mimicking the pre-deployment, and then we deploy. we perform extensive in-house testing on all components used in the field. upgrades can sometimes cause issues that only occur due to their system being slightly all parties -- to ensure the uniformity in the updates. nonuniformity makes fixing issues more difficult. how remediation could be addressed -- certainly the ac is making it quicker and cheaper for vendors to certify upgrades,
6:52 am
certifying components versus , publishing vote capture devices or vote tabulation is helpful. using common data format is important. vendors are using the same , so they are able to live up to the tabulation using automated tests, by running a standard series of result outputs. assuming a common input, the election results are able to make sure that the components output is what is expected. encouraging asymmetric encryption on data transfers is more important and integrity and authenticity, data transfers could be between our errant system and election management system. integrity confidentiality and authenticity of the most important components and
6:53 am
asymmetric encryption offers us that. now implementing for future equipment purchases requires devices to apply. we are requiring implementation of future equipment for devices to firm updates less than three months after manufacture. we will also be requiring any commercial off-the-shelf equipment to remain within the mainstream support window of the manufacturer and be upgraded in dac certified for release of the updates by manufacturers. when accommodating older technology in general, we require additional layers. requiring additional layers of production that are costly and time-consuming and can lead to taking stronger measures when reacting to threats -- reacting to threats is cutting off local access out of an abundance of
6:54 am
caution. implementing these additional layers can break things. what i mean by breaking things is that after we deploy new windows 10, all bandwidth, which i referred to earlier, was consumed during qualifying with windows updates that we had to block temporarily. vendors will state that you can force the updates, but it will break eac certification. this leaves our office is vulnerable to anything that happens. eac certification, in our opinion, is of the utmost importance. so how are i am closing out -- this little red light keeps blinking out me. reaching out to users and reaching out on the vulnerabilities we have today is key. stressing to them that while additional security measures may be cumbersome, they are
6:55 am
absolutely necessary. the sooner this is understood and accepted, the easier it will be transitioning to these new means of ensuring elections and are in election system. additional security will become second nature and become accepted as common business practice stay in for the most part michael election officials -- loc electiona officials are vigilant in securing our elections. it is important to note we were doing election security before 2016. unless you have been an election official and actually have put on an election, there is a huge gap by federal officials elected or appointed regarding the reality of our processes and procedures versus magnitude of speculation going on in washington dc. election security is not a partisan issue. what is partisan is using election security to create fear
6:56 am
for partisan policies which have nothing to do with election security. you, secretary. i would like to welcome the secretary from connecticut. she was elected to her third term as connecticut's secretary of state november 6, 2018. as connecticut's chief elections official, she focused on modernizing connecticut's elections and improving access to public record. since taking office, she supported and expanded democratic participation, injuring every citizen's price and -- ensuring every citizen's rights are protected. she secured a voter participation through online registration. she improved connecticut's accountability and integrity of a series of rapid responses to election day problems. thewas elected the neck --
6:57 am
secretary of state and serves as the board of advisers to the u.s. assistant commission. prior to her election as a secretary of state, she served as state representative for 17 years. thank you, and welcome. >> apologies for my delay. my flight was delayed. they never told us. as you just heard, i did have the privilege of being a president during the 2016 election. sometimes i think i drew the short straw. it was quite an experience. i was very involved in the reactions to what happened during the 2016 election and thereafter in terms of setting up lots of different communication structures to deal with the cybersecurity risks we att became aware were aimed
6:58 am
election systems and our country. i think all of my colleagues would agree we have come a long way since then in terms of setting up lots of communication systems so that we can have a better response if we uncover some of these problems during elections. we have a much better understanding of these drugs. esey of us have - -th threats. should paint you a picture of connecticut, because it is quite different than what my colleague was describing in louisiana. connecticut has the distinction of being the only state that has no counties. we have an election situation where we have 169 very small towns. and very independent minded.
6:59 am
the administrators of the elections. my office act as an advisory body. we have the voter registry. we had one of the earliest voter registries. we have used the same vendor for 20 years, which has now been acquired by other companies in the interim. most of what we have done has been through that vendor. the voter registration system has had many upgrades, but it is housed and managed by our state i.t. department. so i have almost no it staff of my own and security is all managed out of our state it department. naturally we collaborate with them. many of us have done security
7:00 am
on voter registry, one of the biggest databases we keep for many years. we did avail ourselves of anything dhs had to offer. i was told most was redundant, different products do different things but essentially we were one of the 21 states that were told they had seen probes in our system. none of them got in and i'm not going to be as technical in my presentation because i am giving you an overview of what we have done rather than getting into the nitty-gritty but i would say the most important thing that happened was the release of the $380 million and i would like to tell you about what we have done with it.
7:01 am
we've taken a conservative view of technology in connecticut. we do now have an election management system is due any states, we have not adopted other books. we have an organization, the yukon voter center. we are unique in having services of the computer science department based department for lack of a better word. they evaluate equipment and systems and they are completely nonpartisan, they are not vendors, they are not selling anything and that has been a big help to us. the computer chips in our
7:02 am
tabulator's, they have paper ballots, we have a strong audit process after the election but i would like to see it do more with the audit process. right now people trust is the most important thing we are dealing with. the stronger audit process the better off we will be. we are at 5% of the precincts and three offices in each precinct. we used to do 10%. there is a machine audit that has proven to be 99% accurate. the cards are tested before and after.
7:03 am
the election officials nailed them to the voting center, check them to make sure they are programmed properly and mailed them back. we do nothing online. that is why when we get dollars from the state to purchase electronic poll books that at the time seemed like a good idea. this was 5 years ago. it's more equipment and accurate and there is no doubt about any of that but when they evaluated three versions of electronic poll books they advised us not to purchase it because they did not think they were securing the reasons they offered at the time, it surprised me because a lot of states are using them. the question was about recovery and on the verge of having a solution to that but the more important question they had was
7:04 am
it is true we will order people not to connect them to the internet but they are capable of being connected and even that was enough to have questions. we are still looking at it but we are taking a very conservative approach. likewise with our election management system which is quite sophisticated, have lots of bells and whistles and it has the capability of uploading the results from the tabulator's if you put them on memory stick and have other software to make that happen, but we do require them to type in result from tabulator's, we don't feel comfortable with having that information uploaded even from a memory stick. conservative approach, that has its share of problems if you can imagine 169 small towns.
7:05 am
many election officials come in once a week, some of them don't have many computers, there are towns that have no computers, i had many a fight with several mayors about this issue. some towns were as small as 2000 people in the town and maybe 800 voters so it is a challenge. we have cities also, that is the challenge we face. we have taken our $5 million, it was a virtual death talk. it does two things. it solved the problem of the microsoft 7. we don't know what operating systems, gave them microsoft 7.
7:06 am
it allows us to go to every desktop on the system and to help see what is going on. we spend a lot of time when people log in. don't know what function they are looking for. that will as i understand it, not necessary to have a new operating system. we had to spend money on tabulator's, the tabulator's are coming to the end of their useful life.
7:07 am
we are looking at purchasing $500,000, the money we are going to use to purchase tabulator is, we have no funds for buying a new system. there is no way. i haven't priced it out. i'm planning to have a committee put together that will look at future voting because we don't know where it is going and that's always the case with any computerized system. my biggest ask of this organization is to hustle up with the certification and standard. we are going to be in a position in the next few years. we have been very satisfied, we have paper ballots. we do use the best practices,
7:08 am
but i can see there is a big need for us to have a lot of information from a source that understands this and see where it is going. that would be my request, $5 million have been invaluable in helping us maintain what we have and do better. a lot of it is about training. connecticut is also unique. managing elections in each of the 169 towns, we have two registrar voters, one from each party and you have a town clerk who does absentee ballots and that sort of thing so it is a decentralized system. lots of training is involved, not lots of folks are familiar with technology, some are, some
7:09 am
aren't. the biggest challenge is training, making sure people change their password, know what a fishing email is. it is very basic really. that covers it. thank you for having this hearing and letting us talk about what we are doing. >> thank you. we appreciate it. i would like to open for questions. secretary merrill, in the jurisdiction scheme, are you prepared for the level of visibility and control the state security pertains to voting systems and software? >> it is spending its resources during security, housed in our
7:10 am
it department called do it. we won't go there. the system itself is getting on in years and we made significant upgrades but the next few years we will look at another upgrade but it is difficult to manage. i made proposal to state legislature with more centralization at the county level of government but to no avail, to know where we are, it works remarkably well for some purposes. i can't imagine trying to hack my election tabulators. it is unimaginable. i am comfortable at the moment. i can see 2 or 3 years from now. >> you mentioned what we were dealing with in louisiana.
7:11 am
obviously cause you great concern, changing out your computers from windows 7, to windows 10. do you have the tools and resources necessary to combat such incidents and what have you learned? >> i learned that you are only prepared when something happens. you don't know what to expect until you are in the situation. i was pleased with how my staff reacted and the steps we were able to take because of the unique system of louisiana. doing windows 7. we knew they were vulnerable and because of everything we
7:12 am
have been doing, kept a strict inventory, to windows 7 units and how many. those were the ones you immediately banned from the system permanently. from the moment the incident was brought to our attention. the incident affected some level of local governing bodies that don't touch the election system but knowing there were some that interact with parish governing authorities we felt the need to shutdown the system. we decided to take the money that had been allocated from self generated revenues within the agency and not purchase sensors for the clerk of courts offices which we had initially intended to do and utilize those funds for the windows 10 units given we felt that was a more secure opportunity and need in the system moving
7:13 am
forward so that is basically what we did. we quarantine the whole system because we were able to shut off access and the next step, we knew which parishes had been hit, we on quarantine the other parishes and kept them, the cyber security commission. we do it one parish at a time. it is very successful, i am very pleased, staff reacting very quickly but it takes that type of incident to realize how quickly things can happen. and contacted the president and as for a conference call with
7:14 am
other secretaries, much larger than one state attack. the importance is information is key for election officials. if we don't get information, we can't protect the system. the timeliness of this information is absolute, our systems are secure, we've got to get this information. it is a federal partner. sometimes we just don't get it. >> one question for both of you. how do you feel about microsoft 7 and update in this hearing. how do you work that into your
7:15 am
schedule? you have voting sometimes, the general election. >> the best we can. as i stated in the presentation, the monthly tuesday updates when they come in, the problem for us, for any election official, once we start the clock for election preparation there is no stopping that clock, the timelines are so detailed, especially -- we have a deadline to meet. we can't avoid those deadlines. even if the patch comes through we may have to delay implementation of that patch because it affected us having to adjust with regard to this incident.
7:16 am
it affect our ability to do qualifying online because of the patches that were being automatically updated, stop the process and the registrar's office because the clerk wasn't able to do their job. it is a very delicate operation, very concerning to us, to delve into in order to make sure that our forces are being heard whether it be microsoft or equipment vendors. >> we don't have any form of early voting so we have to win election day which helps it away. we don't do anything in 45 days. again, we don't really know
7:17 am
what local towns are running and we have very little control over their local systems. the virtual desktop hopefully will override that problem. we won't be able to do a pilot until this year's municipal election. we will be able to pilot it this year. and we patch our own systems and that is the basic voter registry. everything else is at the local level. >> thank you for being here. appreciate your testimony. you were talking about the process and obviously it is extensive, not just taking out your phone and hitting update.
7:18 am
one of the things that sends home to me is the cost associated with this. people labor in addition to equipment. one of the questions we get asked a lot by congress is about the $380 million secretary merrill mentioned. do you all see, would it be useful, federalism gets fed up and if there were consistent modest federal funding stream specifically, maintaining equipment, implementing programs like illinois cyber navigator programs where the experts, parishes, towns, with fewer resources, do you think
7:19 am
that is helpful and needed? >> resources are always, what we are doing in louisiana is we set aside $5.8 million strictly for the new voting technology. to purchase new equipment. what we have been doing is absorbing in our regular budget all the cybersecurity needs we have which is growing exponentially each and every year. what we would hope for his of the federal government did additional resources necessary, that there be no strings attached, just the two of us sitting here we explained how different our states are, cultures are different and voters have different expectations but we all have the same expectations which is a secure environment for our
7:20 am
elections and every vote is accurately counted and everybody gets to participate who wishes to participate. the federal government providing additional resources would be helpful but the federal government needs to communicate to the state that they have an absolute responsibility and i'm no different from my colleagues who are constantly asking additional resources to fend off cyber security issues to update equipment and to do what is necessary to secure our elections and offer people the right to vote. we are taking on in louisiana a strong responsibility. we have all the it operations in the agency and we do that for locals as well and we provide equipment to the
7:21 am
locals, that takes a lot of money. so all partners, parish, local, state, and federal, need to cooperate and work together on this funding issue for resources. let's face it, we are all in, one large ship, the ship of america. if we are not working together to secure our elections and fund elections appropriately then was are we here for? >> would you like to add? >> i would concur, recognizing states have different capacities for funding their elections. connecticut for quite a while. and infrastructure for the state. not every state can do that but connecticut isn't willing to do that at the moment, we're in a budget crisis that has been going on for four or five years. there is a role and that would
7:22 am
be helpful. the reason we have not gone forward with local equipment, upgrading the operating systems, we don't have money for that and traditionally it is funded by the state. i agree with my colleague that states have a responsibility too but they have different capacities for doing things and it is imperative that this country and the states and local government as you say work together to do this because this is one of the fundamental operations of government. you are not going to privatize elections and so it is time we put some dollars behind what is happening in this is a really recent development. it was in 2016 that we realize there were all these cyberthreats and so forth so we reacted pretty well in the
7:23 am
short term with what we can do but in my state it is more efficient to control security for big databases from a central level and i respect that. it makes a lot of sense as long as i have someone in my office who can work with that person so we are to take the same attitude that we work on it together and able to articulate what our particular needs are around these questions and you provide a framework for the funding but i think some funding needs to come from the federal level. >> i want to be sensitive to our time so i will hold off any questions until after my colleagues go. >> commissioner palmer, do you have questions? >> just a few. what i hear is the priority is
7:24 am
you need to upgrade voting systems and voter registration systems and these are fundamentals of the elect oral process. that is where most of the money will help your states. we have our job to do which is to set new voting standards on securities, disability, get that to manufacturers designing equipment to those standards. my state is about to embark on a process dealing with standards set in 2015 and much of that is to the federal government for not having a functioning eac with a full commission. you are working very hard but we are behind because of that in 2016 snuck up on us quickly and we reacted as quickly as we could with the resources we
7:25 am
had. but i'm going to have to go further as i stated earlier and what the requirements we have to work under that aren't necessary even issued by you all. that is very concerning to me not to mention various legislation rolling around congress that could require this or that. >> as congress, one of the things we hear, the executive branch, governor and it at the state level, that secretary merrill talked about. do you think it is possible that those localities upgrade their local it systems to be more resilient in warding off
7:26 am
these attacks. >> by instituting virtual desktop, that is not a direction we can follow. we haven't tested it out yet so i don't know how it is going to work out but rather than purchasing 169 counts of new equipment it might be better to work with what they have as long as the virtual desktop takes care of the security parts for all of them but yes, training is all local capacity building so you are right. my biggest fear is vulnerability at the local level and that is what we are working on. >> that was my fear and almost came to fruition. by the grace of god it did not
7:27 am
but we are taking those steps because we were able to retain election it in the system and not forced to consolidated system along with the rest of the state agencies, then we were able to control our own destiny, and election officials to secure our environment and train them on our environment. that was the right thing to do for our state and we continue to predict vulnerability and help vendors to look for newer ways to secure the system. that gives us the ability to react versus asking permission. it is an important component.
7:28 am
>> a couple comments and questions as well. i have never worked with ted rommel yet. it is a great job for your state. and secretaries of state and election officials have more than one jobs, it might be other aspects as well. are there other portions of the job, if you did tax collection or other aspects and have updates done and how are those updates inc.?
7:29 am
>> the business registrar, the business registry, we are constantly updating it. we have used those systems historically for a lot of years. you don't have that one day, you have that one day, everything has to go right. unlike the business registry where there are constant deadlines, we don't have the same issues. >> i am responsible for the commercial registry of the state. and we use the same vendor as well. i think we have the same vendor. it is constantly scanned and
7:30 am
probed, a growing phenomenon, we are protecting businesses as much as the elections but as secretary merrill said, that the ongoing process. election day is critical. we have early voting, the 7-day period of early voting in louisiana and that is critical as well. voters have to check in, using the system on a daily basis and so there is concern. we don't have electronic poll books and given the question of where we are, you have to look for things you didn't necessarily have to look for before and as we say cybersecurity is not a end game. there is no finish line in cybersecurity. >> that reminds me of what you said about having plans for your plans.
7:31 am
it reminded me of mike tyson saying everyone has a plan until they get punched in the mouth. we don't have plans ready for 2020 but there will be a lot of swings at us. there will be a lot of attempts to hit us. i think states are doing a good job planning for that and i would put the plug in that the eic has training for election officials and i participated in a couple of those and the director of testing and his team have gone to state and there's an opportunity to take advantage of training for folks, definitely do that. i've been to both your states and they have done a great job with the election process. the last thing i would ask other than money, what will the federal government do for you
7:32 am
in terms of no strings attached. it is more what sort of things can we help you with moving forward in 2020-2022? >> can you convince microsoft to not charge us for the 3 years of support after january? that would be a good start for us. it is pretty expensive. our quote was 300 some dollars per unit moving forward for a three year period. that can get quite costly if we are unable to replace all of the windows 7 units. what i'm telling locals is whatever your parents just but for you put aside. it is not worth the threat. they don't have the money because they just but the systems, the new equipment but they didn't buy the windows 10.
7:33 am
>> hustle up with those certifications. that is the short answer. thinking out loud i can hear a division. the maintenance costs on all these systems is a large ongoing cost and that is where the state should be because that is not something we can expect from the federal government but infrastructure costs might be where we need the most help because those, together with tasks in different states. that is a short answer, people are out buying things and need help. >> i want to extend severe thanks to both of you. appreciate your comments. we will take that in as we move forward looking at these issues.
7:34 am
panel 2 please. >> i want to thank you for
7:35 am
being here, important information for us to learn from you, these issues that are critical at this time. i let secretaries go a little on time. the clock is set for 5 minutes and it flashes yellow at one minute and the red light comes on when your time is up. i want to introduce the panel right here, testing and certification, jerome assists jurisdiction with developing processes and procedures for audits, he published a white paper to provide a foundation for elected officials on how limiting audits work and things to consider before conducting pilots, prior to joining the eac jerome worked as voting systems specialist at the
7:36 am
colorado secretary of state's office for 10 years where he served as the certification lead. next to jerome is jerrod deering, state election director in kentucky state board of elections and over ten years jerrod has worked in the public and private sector working at the local and state level including working for the city louisville in the office of california governor jerry brown. his private-sector work includes several tech startups located in the bay area and boston. he is graduated berkeley policy and engineering. mister deering, the director of strategic projects for microsoft defending democracy program. her work focuses on encountering nationstate attacks against vulnerable democratic institutions globally. team efforts, security of campaigns and elections, and
7:37 am
disinformation as it impacts the processes. janine's work previous to this role focused on engagement in use of data analytics and other emerging technologies. prior to joining microsoft in 2014, at the mdi, worked closely with campaign customers. she is recognized as campaign elections and american association of political consultants 40 under 40 award. we have matthew shultz, the chief of computer security division in the information technology at the national institute of standards and technology. his responsibly include cryptographic standards. in cyber research and development and cyber security standards and guidelines for federal agency security
7:38 am
programs. he also leads participation with cyber security national and international standards development organizations and associated programs and us army veteran and currently has 20 years federal service. finally we have jeffrey hale, director of election security initiative at dhs cyber security and infrastructure security agency. he supported a focus on election security in response to cybersecurity incidents in 2016 and jeff has been instrumental in the ongoing collaboration with dhs. thank you for being here, thank you for being here. i will start with jerome and go down the line. >> sorry about that. good afternoon, chairwoman
7:39 am
mccormick, commissioner palmer, thank you for hosting today's for men taking the lead on the complexity of testing, certifying and applying software security updates to voting systems. i want to thank the panelists for participating in this discussion. i greatly appreciate and value your input and look forward to hearing your thoughts. i have been heavily involved in the voting system, testing and certification program for 12 years and have literally installed voting system software in thousands of voting devices in my career. i would like to highlight once the serving -- the voting system is certified it is certified through requirements in that moment in time. testing and certification program manual provides guidance on changes to voting systems that i can talk about in more detail but recognizing we have limited time today i would like to hear more from our panelists and i'm glad to
7:40 am
answer any questions you have and i just want to lay that groundwork because we do have limited time. as some of you know we could talk about this for a long time so i will refrain and allow others the opportunity to express their thoughts on this matter. >> thank you, commissioners hicks and palmer for having me in here to participate in this conversation. my name is jerrod deering, southern region representative for the national association state election directors. i'm executive director of the kentucky state board of directions. price my current position i worked in the public and private sector, specifically public policy and engineering including software development. i'm glad we were here today
7:41 am
having this conversation but also wish it could have taken place a little sooner. microsoft announced it was ending support for windows 7 several years ago and in 2014 ended support for windows xp. is not a first-time experience. since the passage of help america vote act of 2002 election administration has grown increasingly reliant on technology. it mandated among other things every state replace punchcard and lever voting machines, created voluntary voting system guidelines and the voting system testing certification programs. the move away from punchcard machines was designed to move the act of voting to more modern technology yet the move to any technology requires ongoing maintenance. technology is not static and is in a constant state of iteration. operating systems, firmware and software all require ongoing updates to maintain functionality and security. as of august 2nd the msi stack
7:42 am
is sent out 817 updated visor he's in 2019 alone from vendors ranging from mozilla and google to oracle and microsoft. anyone who has tried to use a laptop or cell phone knows keeping technology current is critical to maintaining its lifespan and the well-documented funding issues in election administration mean the state and local election officials need their voting agreement to last as long as possible. when we invest in new technology we do so knowing we may not have funding to do so again for another 10 to 15 years, in some cases longer. voting machines or dedicated technology kept under tight physical security, election officials at the state and local level work hard to keep machines patched but as with most things their ability to do so varies by state. in kentucky we certify voting systems at the state level after they've been certified by the eac their operation and maintenance takes place at the county level which means the commonwealth relies on county officials to update and patch voting systems after patches
7:43 am
and modifications are approved by the state. our county offices like many around the country are severely under resourced. other states handle patching and updates differently but the common thread is most cannot compel local election jurisdictions to update their equipment. we can strongly encourage it but we cannot require it. further in many places local jurisdictions must make arrangements with their voting system services providers directly to have voting machines patched which can come with a fairly heavy significant price tag. every dollar counts and unfortunately that means patches are not made when they should be all the time. there are challenges with national certification program, different states have different needs and structures but consistent nationwide is certification process represents a moment in time. a vendor submit a system for certification used in an
7:44 am
operating system, firmware and software that is essentially a time capsule when the system was developed but we all know it is not how technology works, rather we all know it is not how technology works. more importantly that is not how bad actors work either. we need to balance the need for certification with the imminent security needs of elections officials on the ground where time and resources, last month i participated in a conversation about coordinated vulnerability disclosure with representatives from congress, dac, cyber security infrastructure security agency and better community and technologists as well. there are many smart engineers and hackers who want to use their skills for good to help make our elections more secure. we need to work in the field to develop a process by which ethical hackers can communicate vulnerabilities they find to the relevant parties but elections officials and vendors
7:45 am
need to respond quickly to deploy fixes before vulnerabilities are exposed. it's not enough to find and report bugs. there must also be away for systems administrators to quickly digest and remediate these issues after notification. beyond that community some vendors worked to have a critical product evaluation conducted to national laboratories. to take advantage of cyber security expertise the federal government can offer our sector, the assessment conducted is a more "in depth" performed by the voting system tax labs as part of the certification process but it does not have a procedure in place to incorporate these results into the voting system certification process. this means it must also conduct security testing which makes it time-consuming and expensive for voting system manufacturers trying to make systems more secure. they must also develop a process to quickly certify
7:46 am
modifications made by voting system vendors to be addressed, to address vulnerabilities in the assessments. certification needs to be the stamp of approval that tells us our technology is secure, not the obstacle to more secure systems. our current system of certification this incentivizes system upgrades, ultimately leading to issues with common end of life processes as we are seeing with windows 7. as a community we must come together to adapt quickly in light of an ever-changing threat service, and create a certification program that can accommodate the security environment we are now in. there are a lot of intelligent individuals working on this including at the agency. we need to continue to work together to develop a more efficient process at the federal level to drive these much needed modifications and upgrades. thank you again for the opportunity to speak to you today and i look forward to questions.
7:47 am
>> thank you for the opportunity to join you today to discuss the important issue of securing our elections. my name is ginny badanes, director of strategic projects, microsoft defending democracy program. microsoft's decision to engage direct on election security comes from the company's believe that building and maintaining systems worthy of voter confidence is a task that cannot be accomplished by one organizational entity alone. it takes participation from all of us, the federal government, state and local government, election system vendors, technology sector, academia, civil society and voters themselves to come together and drive the solutions. that is why last year microsoft forms the defending democracy program which works with a variety of governmental and nongovernmental stakeholders globally to tackle issues around campaign and election
7:48 am
security information defense which brings us to the topic of conversation today, election security and certification reform. we have given a lot of considerations of the role microsoft can play to be an impactful partner for the community. one thing i want to notice many of you are familiar with the senior photographer at microsoft research and ever present advocate for the end to end verifiable elections. the idea that advanced cryptography could come alongside voting practices and enable a voter to know their vote was correctly counted was appealing to us as a team. that's why we announced election guardian software development that will allow vendors to build functionality into their system. we have been working alongside many of the election vendors to identify how this technology might interact with systems and explore possible pilot opportunities with them. one intersection of microsoft technology and elections in the us that has been discussed a lot today is the issue of windows 7 end of life. we have gone over a lot. the company announced several
7:49 am
years ago in january 2020 the windows team would end outgoing support for windows 7. we are committed to helping customers remain secure as they modernize their systems and moved to windows 10. we understand some customers will need more time which is why we offer extended security updates to customers still running windows 7 on their system. details are still being worked out regarding costs of the process and we will have more information to share in the coming weeks about how these updates will be made available to this community and what they will cost. i can assure you microsoft will do whatever it takes to ensure these customers have access to security updates that are straightforward and affordable. we are committed to protecting our elections and dedicated to doing our part. i want to highlight a related issue that has been brought up this afternoon, protecting our election systems against known vulnerabilities is extremely important which is why we should also be focusing on how to remove unintentional disincentives that have been created by requiring receic


info Stream Only

Uploaded by TV Archive on