The first president ial debate between president donald trump, and former Vice President joe biden. Tuesday september 29th in cleveland. Then they head to miami on the second event, october 15th. The third and final debate will take place thursday october 22nd in nashville tennessee. All the debates begin at 9 pm eastern, and you can watch them all live on cspan. You can also watch Live Streaming and on demand at cspan. Org. Or listen live with the free cspan radio app federal and state officials take part in the discussion on Voting Machines security. Ahead of the november elections, we also hear from the head of the cybersecurity on infrastructure security agency. Part of the recent burlington side with it good morning and welcome to this most Important Panel called election cybersecurity safeguards during the pandemic. It is a great pleasure to introduce to you this worldclass moderator and panel. We first introduce our moderator. Is the Vice President of Cybersecurity Services at raytheon intelligence and space where he oversees the strategy in operations for global team of over 6000 employees. His teams are responsible for delivering cybersecurity solutions, Global Training and logistics. And Product Support services in support of Critical Missions for government, agencies businesses. With him is chris well action. The Vice President of System Security and the chief Security Officer had elections systems and software. The largest provider of Elections Technology in the u. S. Easier to share with us all the improvements being made to Election Security to ensure secure accurate and audible elections. Matthew masterson currently serves as senior cybersecurity adviser at the department of Homeland Security. You previously served as a commissioner at the election assistance commission, to december 2014 to march 2018 including being the chairman in 2017, 2018. Trevor kim incest serve to the colorado secretary of state as chief Information Officer since 2007. Up to eight years as deputy ceo and director of software. Thank you very much for this panel. Thank you for listening, now i will turn it over to john. John . Thank you tom. Im very excited to be here with you with this distinguished panel and moderate is very important topic for the country today. I like the dive right into it. Matt as a deep expert in the area, id like you to set the stage for us. Very art of our democratic process revolves around the important results of these elections. My company understands the complex system of systems with the correct use of encryption trails and so on and so forth that gives users confidence in the outcome. Many ways elections represent a case study in insurance. It was 55 days left with the election, can you talk to us about how the government is addressing the reassurance needs of the systems . Absolutely john. Thank you for moderating this panel. For us at the cybersecurity agency, our focus for the people who are running elections in the private sector the system of systems is the perfect way to describe the election ecosystem. The reality is that many counties, the Election Office is the largest i. T. System. In the county. Theres so many pieces of infrastructure that exist at the state and local level for us our focus is to one making sure that they have access to timely and actionable both information and intelligence demand risks their systems. These are largely a resource challenge jurisdictions not just money wise but i. T. Wise. They dont always have fulltime eye to employees. Theyre relying on third parties to have that i. T. Support. Getting timely actionable information ought to understand the risk their system is critically important. The second step for us is providing support and services, we do everything from cyber hygiene scans. To penetrations tests to fishing campaigns to tabletop and architectural reviews, all to meet them where they are and provide them with tangible steps they could take, to shore up their systems and build resilience. Its not just about the fence, certainly thats a part of this but we recognize incidences will happen but how do they recover . The nice thing about us working with the Election CommunityElection Community are risk managers. They spend a lot of the time asking what you are on how do i respond to that and then when we talk to my voters about why the process remains intact. Thats been a natural conversation to be able to have. Recently there was an article about miami here or asteroid passing near earth on election day. I am sure they had a Response Plan to respond to that. For us its been an engagement around embracing that tendency, and characteristic of how to secure the system. As we look at 2020 versus 2016. In 2016 approximately 85 of votes cast had an audible record of some sort. Coming in 2020 early and 92 plus percent of votes cast a lot of that record. That is absolutely critical not just to the security of the process, but to what you talked about which is the assurance level. Now we need to focus on, how do we audit those records, and how do we do transparently so the public could have confidence in the votes cast. Thats a starting point for us in oregon through the state and local officials. Thank you. Trevor, the ceo of the state of colorado you have a unique system. All voters vote by mail. We have electronic polls for those who vote in person. Youre in the trenches at the state and local level. How do you manage voter identification with growing concerns of voter integrity in the election process, and avoid fraud or perception of fraud. Undermine confidence in the colorado election. Well a great question thanks don thank you tom for having this panel. Really starts at the front end. Theres three faces of election. Theres preparing for elections which means youre making sure the voters are registered. The citizens actually know they can be registered, a big part of that is getting the word out. Most states today have online ways of voters to check the registration and to register if they happen to not be registered. What update their address if they need to do so. Today we see a lot of states also providing ways for voters to indicate that they want to receive a male ballot. Colorado is one of the states where we mail ballots every active voter. It will appear in their mailbox, a few weeks before election. They could actually sit at their table market with a pen verify their choices, we have a way that they can reach out to us and requested replacement ballot. If theres sufficient time what made out that to them. The recent notice on the postal system in reliance on the postal system for mail ballots its kind of interesting. What ive seen, some of the media reporting spot how long it takes for ballot to do around trip. And the potential discrepancy and state laws and regulations for someone to request a male ballot way to close to election day. We try to avoid that thats how our state law is geared. We do think that ability to request a male ballot that is the first part of it. Its making that sure the voters know the elections coming up, where they can vote, either get a ballot whether its mail you could go and vote in person. And how to make sure their information is accurate. The accuracy of those systems that helps confidence in the voters. In the entire process. And every step along the way, if they could see the resiliency as masterson referred to, they can see the resiliency in the process that is in place, we think that helps support the conference in the voters. The second part is voting. Many states have early voting periods, whether its mail ballots being returned, whether its voters walking in and voting in person. Were on election day. Walking in and voting on election day. Thats that second stage. Afterwards, the the results reporting. We will see Election Night results. But many ballots will not be in the hands of the elected officials, or had been counted by tuesday at 7 pm. The laws in various states they differ. Whether its a postmark thats required by tuesday or whether it has to be in the hands of the elected official. That post election process in this year is every one of those areas, where one of those times where people are going to express concern. One of the things that Election Officials are talking about a lot, instead in the expectations of the voters in the media so that they could be prepared for probably not gonna know on tuesday at 7 pm. Were probably not gonna know tuesday in the middle of the night. We need to make sure all the expectations are said at the right level for this election. If you talk a little bit more about the integrity in validation and verification of the election polling system brings a male and . He thought a little bit about to get a view on how works in colorado and how it differs from state to state . The process is largely similar from state to state. When someone registered to vote, they might register a registration form, but when they show up to vote in person or request a male ballot they have to show proof of i. D. Thats federal law, that state law. States have various forms of i. D. That could be sufficient for verifying that you are you say you are. Its really making sure that authentication enters a shun. You are who you say you are by showing some might be, and you are authorized to vote a particular ballot. That means you live there. Depending on where you live in a state, you have a different state senator, given state representative indifferent mayor. And that sort of thing. That authorization to make sure you know who you are. Thats how they know they make sure you get the right ballot in front of you. It starts right there. Today, that information is validated by human beings. I do think in some point in the future will be some a point we could leverage some Electronic Technology to validate technology. The reality is today the systems that are in use, but people are showing up to vote requesting mail ballots, their identity is being verified by human being. Chris, as a former cia so far he chess, we have a unique understanding of the technology that underpins the democratic elections at the federal level. When you think has been the biggest technical challenges to secure the security and how do you work to mitigate them . Thanks for the question. Thank you for invent me to be a part of this panel. Voting machine security has evolved over the last 20 or 30 years. You could remember, if youre old like me the lever machines he would make selections our paper move levers and pulled down a big lever indicator choices after the 2000 election when we have a bill was passed, there was an influx of money and a lot of Technology Providers building electronic Voting Machines, so you dont have People Holding that punch cards trying to determine voter intent. The electronics for the time captured voter intent. Those machines did not provide a paper trail. In the last 15 years, election Technology Providers have moved forward to provide a paper trail, an audible method that voters could check their input so the Electronic Device before it is scanned in counted. Each of those generations of Election Technology at their own security issues. Today our industry, under the leadership of the election infrastructure subsequent 18 council. We have come together and really tried to move the ball forward when it comes to Election Technology security. We are sharing best practices, we are meeting with six to three times a month sometimes talking about the risks to Election Technology. Make sure we are doing all we can to ensure that the technology that voter interacts with at the polling place is secure. At the counting machines whether they are in the precinct or in the Election Central are secure. And then the results that are reported, are secure. Thats the first part. The second part, is the research and development the design, the requirements that go into building a voting machine. We collect those requirements from state and local Election Officials will know their voters best. One other jurisdictions best. And as the providers to meet those needs. We go throughout the general testing and verification process what were seeing to make sure each piece of technology thats in the field meets or exceeds the standards by which the ac has set forth and the Voting System test against. And then there are a number of admissions a number of states that do additional security testing. Over and above whatever the federal requirement is. So the election Technology Providers in our industry, are working with all of those stakeholders to make sure that the technology in used today, in the polling place in the Election Office and in the reporting and results from start to finish. Have the latest and greatest security built in. Or compensating controls for issues, or situations that may have not allowed for the inclusion of a batch. Or a control when the system was certified so we worked very hard to understand the risks, to our voting environment. We work with state and local Election Officials to get patches and updates out there, and then the proof is in the pudding. In the days leading up to elections election day, jurisdictions some jurisdictions are counting absentee ballots. And overseas ballots others are waiting till election day, but our industry as a whole is writing there, shoulder to shoulder with Election Officials. Making sure that votes are counted as cast. And that results can be trustworthy. Great thank you. Ill throw this out to the group, and whoever wants to jump in first. Im really interested in understanding what keeps you guys up at night, and what help you would need from the industry, or the government to address the concerns . Those concerns that are keeping you. Have whoever would like to jump in first. Ill jump in. Go for a. Trevor the confidence of voters in the process, this is what actually happened in 2016. There were a lot of assault on the confidence of voters in their fellow citizens. In the process, whether votes were going to be counted accurately. There were attempts to influence Public Opinion. And so division. Americans against americans. And thats one of those things, its not really a cybersecurity issue, it influences the entire environment that we work in. Im a technologist, ive done i. T. Work for a long time. Cybersecurity is table stakes, cybersecurity was table stakes 15 or 20 years ago. And so i dont mean at all to diminish the great work that system is providing to state and local jurisdictions. The fabulous help that the industry side gives to us with chris and his company and the other companies that are involved. I dont mean to diminish the risk of cybersecurity because if you have web accessible machine and needs to be secure you need to be secured you need to be regularly penn testing it in need to be testing it. Those are standard things for anyone that does anything on the internet. We work in a different environment where theres this huge aura of Public Opinion and Public Confidence that we have to work against i will tell you. If People Choose not to vote because they dont think the process is trustworthy. Then the bad guys have won. And thats really what it comes down to we need to do everything we can to show that were actually taking care of these things. Were doing the utmost to make sure the system is resilient. So that people can vote with confidence. Thats what its all about, get out and vote. I would just add to traverse point, whats been keeping me up at night at least this week. And it changes probably on a weekly basis. Have we, and are we doing everything we can add to support the state and locals,. The vast majority of jurisdictions in this country are mid to small jurisdictions, that really our challenge resource wide. They just need that support to understand where the risks lie. Understand what patches do i need in place, how do i segment my network . Implementing multi factor authentication . Its the next step in that conversation Election Officials have been securing the process for years. Theyve been its then how do i turn and talk to my voters . Am i insist and giving local Election Officials everything they need to turn and engage their voters. Particularly admits this pandemic. Election administration is not in the conversation nationally like it is right now, hardly ever. In my 13 years i rarely seen this. How are we sorting through the dynamic environment, the confusion, because we know uncertainty is a fertile developing ground for disinformation. How are we getting clear concise messaging out to voters, about both the steps that have been taken to secure the process. What their options are, and how they can engage, to be prepared, to be patient, and to participate in the process. As trump or said, the best response to all these attempts to undermine confidence, which was the adversary goal in 2016, which is an ongoing goal for multiple actors at this point. How do we get the information over and over again to voters, so that they say, okay i know where i can get what i need to understand if im registered. How what results are going to really look like, is the process secure, and that constant messaging i worry so much that were not doing enough to support this state local. To support the private sector, to support other trusted voices in the community. They talk to their voters and say we run them at the state and local level you can engage directly with those who run, and if you have questions go serve as the poll worker. We need to, and its the best way to learn the process. Its that hybrid threat of cybersecurity with this info. And how we message to voters now, we control the battle space now. Thats critically important. I agree with these guys john system has done a great job by categorizing the risk to all the pieces of technology. Expert after expert, included i think. The likelihood of the polling place machine whether the ballot marking device or a precinct scan the likelihood of those being packed to somehow mine appellate official results. Its very low, but we are worried about what we have been working with to focus on those public facing system and environments electronic poll books. Election nights results reporting. Those three areas in our view are, because they are public facing, have a very large attack surfaced in cybersecurity terms. Thats not good. So we have focused a lot of effort on implementing controls and those three areas. Cisa we have pushed out hundreds of sensors, they signed up thousands of Election Officials to thread sharing information. We also participate in those albert sensors, threat information staring, to make sure we know what threats are being pushed against the technology. So that we can prepare for an react to them, so far so good every table top exercise. Every penetration test, every risk and Vulnerability Assessment that weve been a part of, says that our defenses have been good. We have sufficient controls in place, but we cant get our let our guard down for a minute. You probably heard the old vantage that actors only need to be right ones, we need to be prepared all the time. Thats where our industry is focused on, being prepared so that the American Public can rest assured, that they can sleep at night. That the technology that they are using in the conduct of elections is safe, secure, and audible. Thank you. So you guys have mentioned misinformation, disinformation, and now electronic form or physical form with different types of mailin fraud. Can you guys speak to all start with humid, how the steps you guys are taking to get information out of the public. To make sure they can sort through these attacks that are coming from you guys mention our adversaries. We know the adversaries are using social media platforms to conduct some of their operations. What are your thoughts on how potentially we can use our social media platform to help you guys deliver the message an integrity in our elections that youre trying to do. It would only be used from an adversary standpoint. If we can start with you matt lets go with. You really really appreciate that question for us at cisa the fbi leads that the influence effort around this our focus have been on building resilience in american people. Having a conversation through trusted voices in the community weather, that secretaries of state local Election Officials, mayors. Various civic organizations getting information out simple messaging around the election process, through trusted sources of information. Go to your state and local affection website. Dont rely on some post on facebook telling you how the process works. Understanding how misinformation, and disinformation, is target and spread. We issued something we called the pineapple on pizza product. Which takes the controversial issue of pineapple on pizza and uses it to show how Disinformation Campaign may or may not spread. Obviously pineapple does not belong on pizza. Thats how our adversaries win so we try to walk through how that this information spreads. And then steps everyone can take to combat it. Thinking before you link reading beyond headlines taking a critical i say anything that youre about to share. Simply to say, where am i getting this from whats the source. And who are the true sources of information here. Particularly around the election process. Can a state local election official website be used here instead of just someone asserting heres the truth about absentee balloting. Whatever the case may be. Working with social media companies, we have regular media meetings with the social media major platforms to talk about what type of information is out there, how they can leverage the state and local Election Officials on the platforms. So weve seen all of the major platforms take and you state and local websites or updates so that theyre driving to this trusted sources of information. And then, really working with them to understand the election process, what does the preelection time period look like. What does Election Night look like. Whats the time after Election Night look like. So that they can have an understanding, if i were an adversary, where is the most uncertainty, where is the best potential for disinformation . And begin to push trusted information about the process now. Because what we know from the research, the more avenues voters receive this information, the more ways theyre able to interact with it, the more likely they are to pause and say, okay no ive seen something on this before. I read about this already, i know what my options and my state are, or how they process ballots in my state. Its that prebunking, that anticipating and getting out front and sharing correct and simple messaging around this. For instance, trevor mentioned Election Night, Election Night is going to be exactly like our prior election lights. Were going to have a certain amount of ballots that are not processed yet, that happens in every election. Election officials certify results after election day, in every single election. Because of an increase in absentee voting, we may have bore more ballots that are outstanding. Whats that mean . And hes that Election Officials are going to focus on accuracy and correctness, theyre going to process those ballots and count them. And youre going to get the results certified incorrect as you expect to get. But you may have more outstanding ballots on Election Night. That doesnt mean anything is wrong, that is just the process working. So how do we get out front and make sure voters understand what that looks like. Its not that we wont have results, they just wont be as complete as were typically used to. Great thank you, like the common . I want to jump in on their, there is a huge difference between 2016 to 2018 to today. Thats really in the community that has come together. Cisa has been incredible in terms of sharing information. Fbi as a partner, National Guard units as partners on the cybersecurity monitoring site. Chris and his team on the industry side, kind of putting together a group that is publishing vulnerability disclosure policies. That is encouraging interaction with the Cybersecurity Research committee. The landscape today is so different from 2016, it is like night and day. Matt and his team, and they ei in terms of information sir sharing a lot of cybersecurity protection in knowing what your risks are, what you need to prioritize. The situational awareness, the landscape today it is literally night and day from 2016 to today. I think we will leverage that ability to share information, quickly and rapidly, within the elections community. Its been fantastic. Tremendous growth and information sharing since 2016. Four years ago, there was no Election Task force inaudible state and local Election Officials like trevor on speed dial. We can share information at a moments notice, that could be misinformation disinformation or an actual cyber situation. We can get the right people on call, immediately. And thanks to Homeland Security and the private sector clearance program, that have granted several of us in the Industry Security clearances. So that we can consume the right information that is being shared at a classified level. And be able to do something about it. And quickly, the fbis changed and victim notification. When it comes to Cyber Incidents and election, several months ago the fbi updated a policy what they are going to react and respond quickly to issues around Election Security. Let the set state and jurisdictions know right away, if any Technology Providers are involved. We can react to it, again, the goal being to reassure the American Public. Were doing all we can to keep these elections secure. Think you very much, just in closing. We have a few minutes left. What would you want the audience to take away from this panel the one thing the sound wave if anything else will. Would you ask . The elections in 20 2030 plus state primaries, leading up to the general on november 3rd. Are more secure than they have ever been. State and local Election Officials where the rubber meets the road, are more prepared for a secured accurate election then they have been. The industry has come together under the fcc, and the advisory abilities of cisa Election Task force, to be more ready for any possibility of a threat to elections. Then theyve ever been. You can rest assured, you can go to sleep at night that the people on this call, and the people in our organizations are working more closely together than ever before. Thank you. I think youre on you trevor. Appreciate the opportunity to speak today, really appreciate it. Matt. Quick message of participatory, the folks on the audience to this are voters, but theyre also sophisticated audience. Understanding, helping support your state and local Election Officials, whether thats serving as a poll worker, dont just go out and start scanning an issuing reports. You have an audience now, Election Officials insist in the private sector, that are able to work with you and taken meaningful feedback about vulnerabilities, or a threat that you hav