Thank you for being to participate in this discussion. Obviously, its the topic day jour for Election Administrators and folks like jeremy in the Computer Science community dealing with election cybersecurity, securing the elections process. Just as a way of background, this topic is the topic de jour coming out of the elections where we saw state actors targeting systems and vendors and sphere fishing attempts in 2016 as well as declaration of elections as Critical Infrastructure. By the department of security. I hope we can talk about the operating environment. S and what steps were looking to secure the process looking at 2018 and how you are. Jeremy gray was supposed to be here from l. A. County and he came down with the flu. We thank him for not coming. We thank him for not coming. I will tee it up to do quick three to five minute opening remarks and then get into the discussion if thats okay. My far right is jeremy epstein, a long time involved in Election Research and member of the Technical Guidelines Development Committee to help us work on the next version of standards coming april and may of 2018. Jeremy is a poll worker in his home county of fairfax in virginia and takes a great deal of pride to know well through the procurement process. She doesnt take no for an answer and knew she wanted to push to get now innovation is in the state of rhode island including replacing the voting equipment and poll voting jurisdictions and a number of reforms. She and her staff were incredible to work with as they look to innovate and improve the elections process in rhode island. Thank you for being here, secretary. To my left, secretary of state, kim whyman from washington and undoubtedly talking about vote by mail, so be ready. She is unique amongst her peers prior to being a secretary of state she was a local election official so shes intimately familiar with how local elections are run and challenges local Election Officials face and the challenges that exist on the state level innovating new reforms on the state process and what happens when decisions are made in legislature that impact you to the local level. Thank you for being here and partaking on the panel. Finally, last but not least, David Stafford is the supervisor of elections for escambia county, florida, the pensacola area, for those not familiar with florida. I suggest you visit david. He has a wonderful office and more importantly in a wonderful area in pensacola. David has been a part of a National Level conversation regarding the government recording capital and infrastructure and Homeland Security as well as being a National Leader innovating the use of data we heard in the last panel and improving data to his voters in escambia county. Thanks for being here and participating as well. I will start with you, jeremy, im not springing this on him. He knows im asking him. About nation state actors targeting the elections systems and the environment. Thank you for inviting me to meet and thanks, everyone for participating. I need to start by saying although i am the precinct 41 for virginia and work for the National Science foundation, nothing i say affects the organizations only. The usual disclaimer. Clearly weve seen things in 2016 many have expected. At some level for decades. People spread viruss through floppy disks. Talk to the iranians about a case where a nonconnected system was infected with malware to put out of Commission Nuclear centrifuges. One of the good guys, its a given any system can be broken into. Im glad dhs is doing the sorts of things theyre doing as part of their the status, as a critical resource, but anyone who thinks thats enough hasnt looked far enough. Its you dont jump once and then youre done. Ive looked at some reports made public from dhs. They are good but they are maybe i should say theyre fair but they dont really demonstrate the level of sophistication the nations state adversary would have. They are uniformly vulnerable. I think any cyber expert that looked at any of these systems would come to that conclusion. We need to be focused on recovery. The coming out on the day after election day and saying there was no compromise, thats not really surprising that you havent seen a compromise. It may not show up for 36 months on average. Lets see. I want to also focus on what we can do now, which is the move to paper ballots and audits is really important. I want to give a shout out to someone i thought i saw on the agenda from virginia who has made major pushes in virginia, my state, to get paper ballots. Its compelling, i dont mean compelling in the sense they put you to sleep, if anyone thinks they can use dre safely, you need to read the report. Its basically too sensitive to tell you how bad it is. That should be a message for all of us. We need to be making sure we go to the hand marked paper ballots and we need we also should recognize thats a good thing because it results in shorter lines. We were just talking about that resulting in shorter lines. I know im supposed to keep it short. I will mention two brief points, neth voting, if anyone thinks neth voting is a good idea, what planet are you coming from . This is just not a good idea with any technology we have today. We do not know how to do this, when the banks and pentagon and so on cant keep hackers out, what makes you think a nation state isnt going to get into your system, as good as your people are, you dont have the resources of citi bank or pentagon or boeing or whatever to protect your systems. Lots of hard working people, you dont have the resources. By you, i mean Election Officials at the state and local level, its just a bad idea. The final stake i want to throw out there is blotching. There are at least a dozen startups that say blotching is a start up to voting. Its one of those things if all you have is a hammer everything looks like a nail. It does an okay job solving one of the easiest parts of the voting problem and does nothing at all to solve the hard parts of the voting problem. It is not an answer. We need to go back to basics, the things we know work, paper, chain of custody, accurate record retention, monitoring, and not assume that, oh, yes, it was secure yesterday so therefore its secure today. Thank you. Thank you for those uplifting comments. [ laughter ] i know. Its what you do. I will come back to you to talk about not just some of the basics you talked about but ways secretary. Thank you very much for putting this together. We in rhode island had an multiyear agency in your off nis and it has been invaluable. The kind of expertise you have has been essential to the state of rhode island. I thank you very much and your staff. In rhode island, its important to note what you say is great. We have different styles on the panel. Rhode island is one of the original states to declare independence unlike what you may have heard in your history books. It has a fairly old Voting System in this country and over the years we have modernized the way we do it. As the chief state election official we have a system basically a threepart system. The department of state, rhode island secretary of state is the chief election official. I handle the putting together of the entire state. We dont have counties which simplifies things incredibly. Once we prepare that ballot and send to it the printers, it is presented with the state board of elections an independent agency nonpartisan and also campaign finance. Thats a brief trimmer. We also at the department of state run the central Voter Registration system. That whole system is one that my office takes care of. It goes to the issue of education, if you move from rhode island to massachusetts across the border or connecticut, you change the way your system works. That is a really key point discussed earlier we need to be able to understand as americans what is the system im currently operating in so we can then talk about potential solutions and security and at the same time increasing access. Weve had wonderful collaborations with the Election Assistance Commission under the department of Homeland Security over the last few years. When i took office in 2015. This was actually my first elected term as secretary of state in elected office, i did have the advantage of diagnose a deputy secretary of state for four years right after it was passed and i know a number of people from the early years post that. We came in and realized our Voting Systems were really outdated. The concerns about security were an issue with 20yearold paper ballots, scanning machines on the verge of breaking down. Who has parts for a 20yearold scanner, right . I made it a point of speaking to the governor and leadership, we were able to purchase for the entire state in time for the 2016 election ballot scanning machines that really increased the Comfort Level that we had with regards to securing the election. But i will say at this point that securing an election is not theres no Silver Bullet and its not a point. Its a path. It took layers and layers of different action to take you to better risk management. As you just said, if you think youre solving it, you have other problems. We did it, went hd and bought online bought the voting machines, we went ahead and got online Voter Registration passed, online Voter Registration passed and implemented online Voter Registration passed in the process of being implemented. We also have really done a lot of work in the education piece in simplifying how we discuss elections with voters. Basically, looking at the center for design for help in how do you design things in a way people understand them. People have a zillion other things to do and life other than elections. Improving access to the ballot box, even thinking how you communicate, how do you present your information to your citizens so that they can more easily access their ballot box. So i am of the firm belief you can improve the integrity of elections without sacrificing access. You can actually do both. I think in rhode island were in the process of showing this can be done. It does require an incredible amount of collaboration. I dont have all the resources. Im happy to go to the eac or department of Homeland Security, organizations Like National associations of secretaries of state for best practices or conversations about how do we do this better . I think those kinds of forums are convenient and important for us to provide better elections. Thank you very much for the time and make sure we get to the other subject. Thank you. Unfortunately for all of you now as i take notes i have additional questions. You raised a critical issue were going to come back to the balance between access and security and theres no such thing as balance, the process has to have security and has to be accessible. Thats not a balance vote to requirements. Secretary, the floor is yours. Thank you. I would agree with what the secretary mentioned across the board. Even though our states are very very different and really show diversity across the country on this decentralized way of electing our leaders, my state, washington, has about 4 million registered voters, 39 county auditors the ones actually responsible for conducting the elections, not only during the input of Voter Registration but also sending ballots to voters and things and we are vote by mail. We were the second state in the country to move to vote by mail from 2005 to 2010. Its only completely moved to vote by mail following oregon and a number of other western states are on our heels and joining us. East, its coming. I know you dont believe us, it is coming. Our world is an 18 day voting period. I think youre saying that and you certainly heard comments today about that. The dynamic how people vote is changing and the way they vote is changing. Certainly, in the west coast. My office, just like secretary gorbeau, im the chief elections officer for the state. My state does reviews for election operations in the 39 counties and we also do training and certification of Election Administrators in our state. Many will remember our state was front and center a few years ago with the closest governors race in the history of the country. That was so much fun, by the way. I think a lot of good came out of that race and being under that microscope. It really does drive you to make sure every single voter in your state, and i think this is the goal of all voter administrators across the country, has the same experience, has the same access, the same security level. The Election Administrators across the country, as well as secretaries of state are always working to that end trying to make sure were being as uniform as possible so its fair across the country. In our state we have four election vendors who provide the ballot tabulation systems our counties use certified in our state. The vast majority of voters now are using paper ballots digitally scanned but we have optical scan counties and dres but they are voter verified paper dres, if that makes sense. On the Voter Registration side, our model is kind of a bottom up. The counties do all the input of data of the Voter Registration that feeds in from one of three vendors to our centralized Voter Registration database. Then we also have a number of things we put into place over the last probably 10 years from an application where voters can get information about themselves, very specific information, called my vote and ill talk a little later about the challenges of having these applications. Voters can check their registration status, register online, update their registration, find out their ballot layout and what offices will be on their specific ballot. I talked a little bit. Our state implemented online Voter Registration in 2006. We have an id check as part of that. Its one of those things where, i think one of the Common Threads youll probably hear today on our panel and other panels, how do you implement things matters. Voter id in some place is a flash point hot issue. In our state it happened because we did it at the front end and worked with a lot of stakeholders and groups to make sure we were going to be successful in that rollout. All of the cybersecurity discussion we will have in the next hour really dovetails nicely into how you do it matters. Thank you, secretary. I think a lot of what we will talk about today is the nuances of implementation and understanding, as we talk about possible strategies to tackle this challenge in front of us with securing the systems. Mr. Talk about strategies to tackle this problem in front of us in securing the system. Last but not least. So from the great state of florida, i wish we knew what it was like to have a very close statewide election. But its a pleasure to be here. Thank you, commissioner masterson, to be a part of this conversation. We have three ways to vote. We have no excuse vote by mail. We have in person early voting thats mandated at the state level. For a period of time, theres a minimum. But then we have some discretion to go above and beyond that. And then we have election day. And thats probably been the biggest change in how elections were administered in the state of florida since the 2007 election. They were cast between 7 00 p. M. In the 2016 eleck that number was 30 . 61 of the vote were kept in the president ial election before the polls ever opened on election day. We have about 13 million voters. My county has just about 205,000 voters. And i know for a lot of jurisdictions out there, youd consider that a pretty large jurisdiction. Thats considered pretty small in the state of florida. We have a very diverse state and a very diverse way we conduct elections on a local level. We have been this conversation about cybersecurity, i think the point i would want to make sure gets across in elections, at least ive been doing this since 2004. And the security the overall security ballot, in particular the security Voting Systems, Voting Systems versus overall election systems has been front and center. Thats been the discussion at the local level and National Level weve been having for quite some time. What i think is new is that conversation is broad to include all of things that we do in our office as it relates to Information Technology and election systems more broadly. And i think thats the thats the bigger challenge. I think its easier if you look at one or two things like ballot security, like Voting Systems technology. Its a little more difficult when you have to deal with the Human Element like human firewall training and all the Different Things we as local Election Administrators and i think at the state level as well, you want to try provide services to the voters. You want to try provide that new technology to make your office accessible. But the more you do that, the more you expose yourself to some of these security threats. So i think thats been the biggest shift between the 2016 election and what were rapidly approaching the 2018 election. And those, quite frankly, are some of the more difficult things to address. We sit here today on almost i think about the oneyear anniversary of the declaration of election as Critical Infrastructure. It was over across the river where we had a presentation from the folks at the department of Hom