With the next panel. I want to thank you all for coming back, first of all, from the break. I want to welcome my panelists up here. Thank you for being willing to participate in this discussion. Obviously, its the topic du jour, i would say, for Election Administrators as well as folks like jeremy in the Computer Science community, dealing with election cybersecurity and securing the elections process. Just as a way of background, this topic is obviously the topic du jour coming out of the 2016 election, where we saw nation state actors targeting state level election systems or registration systems as well as vendors in a spearfishing attempt in 2016 as well as the declaration of elections as Critical Infrastructure by the department of Homeland Security. So on this panel today, i hope we can delve into some of those issues, talk about the operating environment that Election Officials are in today, share the expertise that you all have, your experiences, and most importantly, what steps we are taking to secure the process moving forward looking at 2018 and how you all are moving forward prepping for both primary season, right, and november. So i do want to note jeremy gray was supposed to be a panelist from l. A. County. He came down with the flu and so we thank him for not coming and sharing that. But his expertise will be missed. I know hes greatly disappointed. You all will have to carry that extra load of not having jeremy there. I will start out first by doing introductions. Have i fo i have formal introductions but im fortunate enough to know all of you. I will do quick introductions, then tee it up with you, jeremy, after i do introductions to do quick three to five minute opening remarks. Then we will get into the discussion if thats okay. First, on my far right is jeremy epstein. Jeremy has been a longtime Computer Scientist engaged in elections research, looking at the cybersecurity challenges in elections. Jeremy was a member of the acs technical Guidelines Development committee, helping us work on writing the next version of the standards coming early 2018, april, may 2018. Jeremy also is a poll worker in his home county of fairfax county, virginia. I know it takes a great deal of pride and hes learned a lot about the process in that way. Hes affectionately known in our community as east coast jeremy because jeremy gray, who was supposed to be here, is west coast jeremy. I will try not to refer to you that way or just east coast. That was my plan if jeremy gray had been here. Immediately to my right is secretary of state Nellie Gorbea from the state of rhode island. I got to know the secretary well through the process of your Voting System procurement process. Secretary gorbea doesnt take no for an answer. She knew she wanted to innovate in the state of rhode island and pushed to get innovations into place in the state of rhode island prior to the last president ial election in 2016 including replacing the voting equipment, implementing new poll books in a number of jurisdictions and bringing about a number of reforms. So secretary gorbea and her staff were incredible to work with as they looked to innovate and improve the overall elections process in rhode island. Thank you for being here. To my immediate left is secretary of state kim wyman of washington. Undoubtedly she will talk about vote by mail so we should all be ready. The benefits of vote by mail. Secretary wyman is unique amongst her peers in that prior to being a secretary of state she was a local election official so shes intimately familiar with how elections are run, the challenges that local Election Officials face, and then the challenges that exist on the state level implementing new innovative reforms, securing the process and some of what happens when decisions are made in legislatures that impact you down all the way on the local level. Secretary wyman, thank you for being here and partaking in the panel. Finally, last but not least, David Stafford is the supervisor of elections for escambia county, florida, the pensacola area. I suggest you go down and visit david. He has a wonderful office and more importantly, its in a wonderful area. David has been a part of a National Level conversation regarding the government coordinating council, the establishment of elections as Critical Infrastructure with the department of Homeland Security as well as being a National Leader on innovating and the use of data as we heard in the last panel and technology to improve services to his voters in the county. I thank you for being here and participating in the discussion as well. Thanks, matt. I will start and i start intentionally with you, jeremy, to open the conversation and part of what i want you to discuss, im not springing this on him, he knows im going to ask him to discuss this, is discuss what it means for us to be in an environment in which nation state actors are targeting elections systems and share some of your thoughts on kind of the environment were in and where were headed. Okay. Great. Thank you very much for having me, matt, for inviting me. Thanks, everyone, for participating. I need to start by saying although i am the precinct 841 chief for virginia and work for the National Science foundation, the usual disclaimer, its my opinion only. Clearly weve seen things in 2016 many have expected. At some level for decades. Weve been talking about many of these things. In a sense, there was no surprise. In another sense, it was surprising how brazen some of these attacks were. I think perhaps the most critical thing to learn is, if you have a computer, its internet connected. Remember, in the not so distant past, we used to spread viruses through floppy disks. Those are still introducing the same risks. Talk to the iranians about a case where a nonconnected system was infected with malware to put out of Commission Nuclear centrifuges. Im not saying centrifuges and Nuclear Systems are the same things. But you cant really be offline. I spent some time as a white hat hacker, one of the good guys who helped companies. Its a given any system can be broken into. Im glad dhs is doing the sorts of things theyre doing as part of their the status, as a critical resource, but anyone who thinks thats enough hasnt looked far enough. Its you dont jump once and then youre done. Ive looked at some reports made public from dhs. They are good but they are maybe i should say theyre fair but they dont really demonstrate the level of sophistication the nations state adversary would have. The systems are uniformly vulnerable. I think any cyber expert that looked at any of these systems would come to that conclusion. We need to be focused on detection and recovery. And the average lag time from a compromise until detection is in the range of six months. Coming out on the day after election day and saying there was no compromise, thats not really surprising that you havent seen a compromise. It may not show up for three to six months, on average. Lets see. That was the first thing. I want to also focus on what we can do now, which is the move to paper ballots and audits is really important. I want to give a shout out to edgardo, i thought i saw on the agenda, from virginia who has made major pushes in virginia, my state, to get paper ballots. If you havent read the report that caused virginia to get rid of the remaining dres, its compelling reading. I dont mean compelling in the sense they put you to sleep, if anyone thinks they can use dres safely, you need to read the report. What they found was, its basically too sensitive to tell you how bad it is. That should be a message for all of us. We need to be making sure we go to the handmarked paper ballots and we need we also should recognize thats a good thing because it results in shorter lines. We were just talking about that resulting in shorter lines. I know im supposed to keep it short. I will mention two brief points, internet voting, see what i said previously, see number one. If anyone thinks internet voting is a good idea, what planet are you coming from . This is just not a good idea with any technology we have today. We do not know how to do this, when the banks and pentagon and so on cant keep hackers out, what makes you think a nation state isnt going to get into your system, as good as your people are, you dont have the resources of citibank or the pentagon or boeing or whatever to protect your systems. Its not that youre not smart, hardworking people. You dont have the resources. By you, i mean Election Officials at the state and local level, its just a bad idea. The final stake i want to throw out there is blotching. There are at least a dozen startups saying that blockchain is the answer to voting. Its one of those things if all you have is a hammer everything looks like a nail. It does an okay job solving one of the easiest parts of the voting problem and does nothing at all to solve the hard parts of the voting problem. So, blockchain is not an answer. We need to go back to basics, the things we know work, paper, chain of custody, accurate record retention, monitoring, and not assume that, oh, yes, it was secure yesterday so therefore its secure today. Thank you. Thank you for those uplifting comments. I know. Its what you do. I will come back to you to talk about not just some of the basics you talked about but ways to engage your community. Secretary . Thank you very much for putting this together. We in rhode island had a millti year relationship with your office. The kind of expertise you have has been essential to the state of rhode island. I thank you very much and your staff. In rhode island, its important to note that the panel youve put together is great. We have different styles on the panel. Rhode island is one of the original states to declare independence unlike what you may have heard in your history books. It has a fairly old Voting System that dates back to the beginnings of this country. And over the years we have modernized the way we do it. I serve as the state chief election official. We have a system that is basically a threepart system. The department of state, rhode island secretary of state is the chief election official. I handle the putting together of the ballot for the entire state. We dont have counties which simplifies things incredibly. Once we prepare that ballot and send to it the printer, it is presented to local boards who run it with the state board of elections, an independent agency that is nonpartisan and also campaign finance. Thats a brief primer. We also at the department of state run the central Voter Registration system. That whole system is one that my office takes care of. It goes to the issue of education, if you move from rhode island to massachusetts across the border or connecticut, you change the way your system works. That is a really key point discussed earlier, we need to be able to understand as americans what is the system im currently operating in so we can then talk about potential solutions and security and at the same time increasing access. Weve had wonderful collaborations with the Election Assistance Commission under the department of Homeland Security over the last few years. When i took office in 2015. This was actually my first elected term as secretary of state in an elected office, i did have the advantage of being a deputy secretary of state for four years right after it was passed and i know a number of people from the early years post that. We came in and realized our Voting Systems were really outdated. The concerns about security were an issue with 20yearold paper ballots, scanning machines on the verge of breaking down. Who has parts for a 20yearold scanner, right . I made it a point of speaking to the governor and leadership, we were able to purchase for the entire state in time for the 2016 election ballot scanning machines that really increased the Comfort Level that we had with regards to securing the election. But i will say at this point that securing an election is not theres no Silver Bullet and its not a point. Its a path. It took layers and layers of different action to take you to better risk management. As you just said, if you think youre solving it, you have other problems. We did it, went ahead and bought online bought the voting machines, we went ahead and got online Voter Registration passed, automatic Voter Registration passed and implemented online Voter Registration passed and is in the process of being implemented. We also have really done a lot of work in the education piece in simplifying how we discuss elections with voters. Basically, looking at the center for civic design for help in how do you design things in a way that people understand them. People have a zillion other things to do in life other than elections. Improving access to the ballot box, even thinking how you communicate, how do you present your information to your citizens so that they can more easily access their ballot box. So i am of the firm belief that you can improve the integrity of elections without sacrificing access. You can actually do both. I think in rhode island were in the process of showing that this can be done. It does require an incredible amount of collaboration. I dont have all the resources. Im happy to go to the eac or department of Homeland Security, organizations Like National associations of secretaries of state for best practices or conversations about how do we do this better . I think those kinds of forums are important for us to provide better elections. Thank you very much for the time and make sure we get to the other subjects. Thank you. Unfortunately for all of you now as i take notes i have additional questions. You raised a critical issue that were going to come back to which is the balance between access and security and theres no such thing as that balance, the process has to have security and has to be accessible. Thats not a balance, both are requirements. Secretary, the floor is yours. Thank you. I would agree with what the secretary mentioned across the board. Even though our states are very, very different and really show diversity across the country on this decentralized way of electing our leaders, my state, washington, has about 4 million registered voters, 39 county auditors, the ones actually responsible for conducting the elections, not only during the input of Voter Registration data but also sending ballots to voters and things and we are vote by mail. We were the second state in the country to move to vote by mail from 2005 to 2010. Its when we completely moved to vote by mail following oregon and a number of other western states are on our heels and joining us. And, you in the east, its coming. I know you dont believe us, it is coming. Our world is an 18day voting period. I think youre saying that and you certainly heard comments today about that. The dynamic of how people vote is changing and the way they vote is changing. Certainly, in the west coast. My office, just like the secretary, im the chief elections officer for the state. My state does reviews for election operations in the 39 counties and we also do training and certification of Election Administrators in our state. Many will remember our state was front and center a few years ago with the closest governors race in the history of the country. That was so much fun, by the way. I think a lot of good came out of that race and being under that microscope. It really does drive you to make sure every single voter in your state, and i think this is the goal of all Election Administrators across the country, has the same experience, has the same access, the same security level. The Election Administrators across the country, as well as secretaries of state are always working to that end, trying to make sure were being as uniform as possible so its fair across the country. In our state, we have four election vendors who provide the ballot tabulation systems our counties use that are certified in our state. And the vast majority of our voters now are using paper ballots that are digitally scanned, but we still have some optical scanned counties and we do have the use of dres, but they are voter verified paper dres, if that makes sense. And then on the Voter Registration side, our model is kind of a bottom up. The data feeds in from one of three vendors to our centralized Voter Registration database. And then we also have a number of things weve put into place over the last, probably, ten years from an application where voters can get information about themselves, very specific information, called my vote. And ill talk a little bit later about the challenges of having some of these applications. But voters can check their registration status, find out their ballot layout and what offices are going to be on their specific ballot. And ill also talk a little bit on, our state implemented online Voter Registration in 2006. And we have an i. D. Check as part of that. And one of common things youll hear today is how you implement things matters. Voter i. D. In some states is a very flashpoint hot issue. And in our state it happened on the front end, we worked with a lot of stakeholders and groups to make sure we were going to be successful in that rollout. So all of the Cyber Security discussion were going to have i think really does tie into what matters. Thank you, and i think youre right. Were going to be talking about the nuances of implication as we talk about strategies to tackle this challenge in front of us in securing the system. Mr. Staffo