President of Cybersecurity Services at raytheon intelligence in space where he oversees the strategy and operations for global team of over 6000 employees. His teams are responsible for delivering cybersecurity solutions, Global Training and logistics. And Product Support services in support of Critical Missions for government agencies, businesses. including serving as serving as the chairs commission from 2018. Serving as the colorado secretary of state cio 2007 after eight years of deputy cio and director of software. Thank you very much to this panel and to each of you for listening and now i will turn it over to john. I am very excited to be here with this panel to moderate this topic for our country today i would like to dive right in and the first question with a deep expert i would like you to set the stage and then to understand the complex system with the correct encryption and then the confidence of the outcome so with 55 days left with the election. Absolutely thank you for moderating this panel. For us that cyberstructure Security Agency our stressing is to look at those officials running elections across the private sector that work hand in hand. It is the perfect way to describe the election ecosystem. The reality is in many counties the largest it operation as far as total number of assets. Voter registration theres some a pieces of infrastructure making sure they timely and actual intelligence these are resource challenge jurisdictions not just money but it. They dont always have fulltime it and rely on third parties. So getting timely and actionable information out and then to provide support and services with the scans with the out out word network. And then to provide them tangible steps they could take it isnt just about defense that those will happen and how do they recover. Then nice working with the risk managers. Asking ourselves what could go wrong and how they respond and why the process remains intact. And there was an article to meteor or asteroid passing close to election day rest assured they are updating the Response Plan to respond to that because that is how they think. And with that characteristic. And as we look at 2020 coming into 202092 percent of those to have that record and that is absolutely critical to what you talked about with that level. And how do we do that transparently. That is the starting point working with local officials. You have a unique system almost all voters vote to buy mail the electronic polls for those in person see you are in the end in the trenches how do you manage your authentication amid growing concerns voter integrity or voter fraud or deception fraud . Great question. Thank you for having this panel. It starts at the front and there are three phases there is preparing making sure voters are registered. The citizens know they can be registered and getting the word out most have an online way to check Voter Registration and register if they are not or update their address if they need to do so. We have seen a lot of states providing ways for voters to say they want to receive mail and ballot we do mail ballots to every active voter it will appear a few weeks before election and then they can sit at their table and market with the pen. We have a way they can reach out to us to request a replacement ballot that there is sufficient time we will. The recent notice on the postal system for the mail ballots is interesting. What i have seen is some of the media reporting how long it takes for a ballot to do a round trip and the discrepancy is way too close to election day we try to avoid that. That we do think the ability to re quest that is so that they know there is the election coming up how they can get a valid and how to make sure the information is accurate. The accuracy of those systems on that process in every step along the way if we can see the resiliency. And that helps support the confidence of voters. Many states have her leave Holding Periods whether mail ballots were voting in person and then afterward the results reporting. And not in the hands of the elected officials tuesday 7 00 p. M. And that election process in one of those times with a word expressed concern and one of the times they talk about a lot with the voters of the media to be prepared so we wont know tuesday at 7 00 p. M. We probably will not know tuesday in the middle of the night. And in the selection. And with the election polling system. Talk about colorado and how that differs from state to state it is largely similar. Somebody registers to vote they could fill out a male in Voter Registration form but if they request a mail ballot they have to show proof of identification. States have various forms that could be sufficient but its making sure that the authentication and authorization you are who you say you are and you are authorized to vote on a particular ballot. Depending where you live so it is that authorization so they know who you are and that they get the right ballot in front of you. It starts right there. Today that information is validated. I do think at some point in the future we could have Electronic Technology and the reality is today the systems in use though showing up to vote, their identity is verified by a human being. As form a cssa for hhs and that to underpin the democratic elections what you think are the biggest technical challenges and how do you work to mitigate those risks . Thank you for inviting me to be a part of the panel. Voting machine security over the last 20 or 30 years you can remember the lever machines to move levers and then pull it down to indicate your choices after the 2000 election there was an influx of money for Technology Providers building electronic Voting Machines so those not having punchcards to decide their intent. But those machines did not provide a paper trail. And then election Technology Providers have move forward with they can check the input to the electronic device. If those generations of Election Technology. And under the leadership of the coordinating council. When it comes to Election Technology security we are sharing best practices and meeting with cssa two or three times a month to talk about the risk to Election Technology. We are doing all we can that it interacts with the voting place is secure and the machines in the precinct and thats the first part. The second part and we collect those requirements from state and local Election Officials and then to meet those needs with a thorough testing and verification process with the election System Commission so that each piece of Technology Meets or exceeds the standards and there are a number of additional security testing over and above the requirements. So the election Technology Providers in our industry are working with all the stakeholders to make sure what we use in the polling place in the Election Office and the reporting of the results from start to finish have the latest and greatest security built in for the issues or the situation with the control when the system was served. We work very hard. We work with state and local Election Officials and the proof is in the pudding some jurisdictions are counting overseas ballots it is right up there shoulder to shoulder with Election Officials. Im interested to understand what help you would need from industry or the government and then we like to jump in first. Spent the confidence of voters in the process. And there was on the confidence of voters and whether they would be counted accurately with the attempt to influence Public Opinion americans against americans and its not really a Cybersecurity Issue but it influences the entire environment we have done it work for a long time. I dont mean to diminish the great work that cssa is providing to state and local jurisdictions with chris and his company and those involved. I dont mean to diminish the risk of cybersecurity because if you have web accessible machine has to be secure and monitored and those are standard things for anyone that does anything on the internet. And with that huge aura of Public Opinion and confidence if People Choose not to vote because they dont think that process is trustworthy then the bad guys have one. Thats what it comes down to. And to do the most to make sure its resilient. Get out and vote. But is keeping me up at night have we done everything that we can to support the state and locals the vast majority in this country and then to be challenge Resource Wise were the risk by and what patches do i need in place and how we segment the network the multi factor authentication. And then to secure the process for years but how i turn and talk to my voters. And everything they need to engage the voters amidst the pandemic. Is not a conversation nationally like it is right now in my 13 years ive rarely seen this. How are we sorting through that dynamic environment because we know it is a Fertile Ground for information and how we get clear and concise methods about the steps what their options are and to be patient and participate in the process because the best response to undermine confidence which was their goal in 2016 and multiple actors at this point how do we get the information to the voters am i registered how do i participate and if the process is secure with the constant messaging i worry were not doing enough to support the private sector to talk to their voters to say at the state and local level if you have questions you can engage directly with those who run it. Its the best way to learn the process so with that cybersecurity to control the battle space now thats critically important. Doing a great job to categorize the risk the pieces of Technology Expert after expert is sad the likelihood whether a scanner or a way to manipulate those results we are worried like Voter Registration environments electronic pull books Election Night results reporting, those three areas in our view because they are public facing we have focused a lot of effort to implement controls in those three areas. Cssa pushed out hundreds of sensors and thousands of Election Officials to share information. We also participate in formation sharing to make sure we know what threats are pushed against so far so good in every the tabletop exercise and penetration test and Vulnerability Assessment shows we are a good. We cant let our guard down for a minute. And then to be rest assured to make sure that is safe and secure and auditable. Into common electronic or physical form. And then to make sure they can sort through with the adversaries. And then to conduct those operations. With that message of integrity. It would love to hear you first. And with that influence effort having a conversation through trusted voices secretary of state and with the Civic Organization groups getting information out and simple messaging and go to the official website and then from that misinformation is targeted and spread talk about the pineapple on pizza product takes a controversial issue and uses that to show it may or may not spread. Obviously pineapple does not belong on pizza that is how the adversaries when. And then steps everyone can take to combat read beyond the headlines taking a a critical eye to anything you are about to share to say where my getting this from . Particularly around the election process. And working with the social Media Companies so what type of information is out there . And then to take and lose other officials so that they drive the trusted sources of information and then to understand the election process and the time after Election Night what does that look like to have an understanding of im the adversary where is the most uncertainty . And trusted information about the process now. In the more ways to interact with it. I have read about this already i know my options and how they process ballots in my state. And then to get out in front to share the simple messaging around this. Election night will be exactly to have a certain amount of ballots that are not prefaced yet Election Officials certify results. Because of an increase in absentee voting and then to focus on accuracy and correctness and then they will count them and then you will get the results certified and correct but you may have more outstanding ballots on Election Night. That doesnt make it wrong is just working so what does that look like . Is not that we wont have results just not as complete as what we are used to. There is a huge difference between 2016 from 2018 through today that is a community that has come together. Cssa has been incredible fbi as a partner, national guard. And on the industry side they are putting together a group with the vulnerability disclosure policies. And then the landscape today is so different from 2016 it is like night and day. Matt and his team and a lot of cybersecurity protection knowing what your risks are and what you need to prioritize is situational awareness. Literally it is night and day. And we will leverage that ability to share information within the elections community. It has been fantastic really. Information sharing since 2164 years ago there was no Election Task force. To have everybody in that group and then to find information at a moments notice and then an actual cybersituation and with the private sector Clearance Program and so that we can consume that information to be shared at a classified level to do something about it. So in victim notification several months ago the fbi updated a policy to respond quickly and then any Technology Providers so we can react to it to reassure the American Public we are doing all we can to keep election secure. That the election in 2020 the 30 state primaries are more secure than they have ever been. And where the rubber meets the road to be accurate more than they have ever been. The industry is come together and with that task force to be more ready with the possibility of threat to elections and they have ever been. And those working better than ever before. We appreciate the opportunity to speak to you today. But they are also sophisticated audience understanding whether serving as a poll worker or cybersecurity and now you have one have an audience that are able to work with you with those vulnerabilities or the threats and we do it across the private sector so there is a way for the entire audience and then the last member of resilience and that is on all of us. Thank you for joining and participating to have a discussion with you guys not only to the industry that are citizens of the United States and then to make sure elections are secure and then to have confidence in the process. We have to figure out a way we will. But it will take some years but there are two ways to help reduce the risk only part of the solution. And not the way to manage it longterm the more people who build up immunity to the virus to reduce the possibility and then to have several years for that to take place. Langevin and others. I recognize myself for an opening statement. Thank you for being here today. And with the decision at least in january 2019 the united