Voting Village - Election Security
Wyman, Kim
Jacob, Kate
Kylee Zabel’s ‘Washington State’s Secretary of State Kim Wyman On Voting Security’
 Hello, I'm Secretary of State Kim Wyman from Washington State and I want to first say thank you for inviting me to be part of DEF CON 2020 and share a little bit about Washington's experience with vote by mail and the challenges that we have with election security and how we've tried to overcome them and how we're preparing for the upcoming August primary and November general elections here in Washington State. So I'm going to real quick share my screen and walk you through kind of what Washington State has done to prepare for the 2020 election cycle and how we are dealing with all of the things that are coming at us in 2020. So first and foremost, I'm pretty certain each one of you has been very aware of Russians trying to hack into the election system in the 2016 elections and I've been an election official for many years and have watched this kind of progression that we've had in the election community for election security. And in the 1990s, we instituted cutting edge technology like using the driver's license information to register voters and put election night results online. And from that moment to today, election security has been something we've been aware of and have worked really hard to try to make sure our systems are secure. And I think right up until 2016, most election officials felt pretty good about the level of security that we had in our industry. And today what I want to do is share with you kind of what a Washington State election system looks like, how we inspire public confidence in our process and what our kind of tryout of election security is. And then talk a little bit about the impacts of COVID-19 on our election system and quite frankly the nation's election system. So I got into election administration in the 1990s, early 1990s, and I can tell you when I started in this field, my goal was to become an elections expert to learn and understand how the election process works and to be able to conduct elections in a secure and accessible manner. And then the 2000s that evolved because suddenly the demands on our system were so great that we had to rely on technology to be able to produce election results quickly and to serve our voters well by providing a lot of information on the internet. So we now suddenly not only had to become an elections expert, but also had to be an IT expert and understand at least how systems work and how to use technology in a way to help us oversee our election systems. And about the time I started feeling like I knew what I was doing in the IT world and I say that because I'm just dangerous enough to know how to use technology, but certainly not to any of the levels that any of you are. But by 2016 it became very apparent that not only did we need to be election experts and understand IT systems, but we needed to know how to secure them. And cybersecurity for the last four years has certainly been front and center in election administration. So let me start kind of with the basics of why I think the United States election system is very secure just because of the decentralized nature of it. So when people think of elections, I think oftentimes they think of the national, that there's some sort of national election administration when in fact it's a really decentralized network made up of 10,000 election officials nationwide who like me are very much who like me are either appointed or are elected to office. They take an oath to uphold the Constitution and the Constitution and laws in their state. And I think the overall strength of this system is that no single person or group has total control of the overall operation. And so when you get down to election systems in each individual state, and I bear with me here, I'm having a challenge operating my own PowerPoint system, you have the same similar threads. We have a decentralized system here in Washington and each state is going to be different and unique. And Washington is certainly one of five vote by mail states, but I think you can look at the individual makeup of each state and know that this decentralization is actually happening within the states as well. So here in Washington, we have the Secretary of State myself. My office is the overseer of elections in Washington and I'm the chief election officer. I have the rulemaking authority to put into put into effect rules that adapt our laws that our legislature passes. So this is how counties implement the day to day operations on the ground. We manage a statewide voter registration database and oversee the election initiative and referendum process, as well as do election night reporting. We do voter outreach and education and we certify and train our election officials, as well as the election tabulation systems that are used in each of our 39 counties. Our system is decentralized in that 39 county election officials are the chief election officials in their county, and they are elected. They oversee the voter registration processing and the management of elections in their county. So they're the ones who are actually issuing ballots and operating the tabulation systems and any kind of other tech like ballot sorting equipment or the actual facilities that process ballots. They also provide voter outreach and education to their voters and manage all of that information, usually through social media and their web pages. Now, I imagine most of you are aware that in 2016, the federal government designated elections as critical infrastructure and this is significant because it put us on the same national security level as the power grid or the banking system. And so what it has done in our state is really helped us reinforce what I like to think of as our triad of security for Washington and our vote by mail system. I forgot to mention that earlier in 2011, Washington state became a vote by mail state. And at that point, every single one of our counties had had to conduct elections entirely by mail and mail out a ballot to each of their voters. So this process didn't happen overnight. We really started back in the 1990s and in allowing any voter to be a permanent absentee voter, which meant they received a ballot every election. And that evolved to the early 2000s when we had the closest governor's race in the country's history. And following that and following a lot of things that went wrong, both at the polling place and in the absentee balloting, we determined that we couldn't do both elections well and the legislature allowed counties to move to vote by mail voluntarily. In 2005, many of the counties in the state did move to vote by mail, but it still took our state five years to completely become a vote by mail state. And that's because it took time to get the equipment and facilities to really provide for processes and procedures that we could conduct elections. Well, so. Which is what leads us to the triad of security for Washington vote by mail elections. So there's three real pieces to this, this election model. It's the physical security, the logical security things you would just do innately and the digital security that we provide. So let me start by just talking through kind of the physical security elements that are inherent in a vote by mail election. First and foremost, I think the strength is that we are we rely on paper ballots, even the ballots that are issued in a vote center and voters use to use an assistive device to vote them. All of those ballots are paper ballots that are printed by those machines that the voter actually does mark and our process. So we can always go back to those paper ballots and do a risk limiting audit or a full recount if we need to to really inspire that confidence that voters need to have in the election results. We have ballot drop boxes here in Washington state in addition to the blue mail boxes provided by the USPS. The drop boxes are throughout the state and they're managed by our county election officials. They we have about 470 of them statewide and they open at the beginning of the voting period, which is 20 days before election day. And anytime they are emptied, they are emptied by two employees of the county. And I know that sometimes they try to have that be a Democrat and a Republican when possible but they are staffed by their staff that are employed by the county and take a note to uphold the laws and the procedures and policies for the county. So they are held accountable for that processing. They seal they lock and seal those boxes and they do that with individual numbers numbered seals that are actually logged and kept track of two. So pretty much all of the steps I'm going to talk about are what we use to build an electronic and physical audit trail that we have in place in case we ever get into a recount or a situation where anyone is calling into question our processes. We go back and show which employees had access to which ballots at any given time. And we have dual control environments throughout this so it's it's just really important that those audit logs and dual controls are in place to inspire confidence again. And that's true throughout all of our election processing facilities as well. We have secured storage for ballots and ballot materials that involve physical locks in some of our counties that may be key card access servers for the server room for example for the server room. So the security system equipment is in a secured room and has very limited access and again is log or key card controlled. So we have a record of anyone who has access to it. And then we have security systems and key card access throughout these facilities as well to just have that physical control on top of any cybersecurity elements that we have in place. The second I guess group of security measures are those sort of logical ones things that just make sense. Of course the first one would be that our tabulation systems aren't connected to the internet. And I know this is something that came under fire in the last few years nationally. But our county election officials have made sure that their tabulation systems not only are air gapped from the internet in every way. But there's no modems operating or even installed in those systems and that any connection that needs to be made with the vendor or with with election officials is done on site in that air gapped environment. So we have a real love of transparency in elections and certainly that was true in any processing facilities or courthouses across our state that all of the activities are observable. We like it when it's bipartisan when we have Democrats and Democrats seeing that process. We actually asked the local county parties to appoint observers to come in and represent each of the parties. If that can happen and of course in the COVID-19 environment that's becoming a bit of a problem for just space reasons. And I think that the county courthouses oftentimes do not have a lot of extra space in the smaller counties. So a lot of counties have used their security money to install cameras that run 24 seven during the voting period during that entire 20 days and then the 20 days or so after when we're certifying the election so that people can watch it online from safety and comfort. But also have that transparency so you can show that we're not we're not trying to hide anything or do anything kind of under the table. And ballot reconciliation is a really important part as well. This would be, you know, counting the number of ballots that are received each day in the mail and then through the process reconciling them and being able to show whether a ballot was counted. That was issued to a voter or not. And if it wasn't counted why it wasn't and the only people that can reject a ballot are bipartisan canvassing boards. We also have election night reporting and we have fail safe measures and checks and balances that my CISO told me to say is out of band communication verification. And what we do on election night is counties are uploading their results to our state election night reporting system and we compile those results for offices that go across county lines. And we take that initial file that they send us and then we verify it by a fax or an email that is sent by the county as well separately to just make sure that the information that we're putting up online is accurate and is the way that the county's reported it in the first place. So all of these systems, you know, this logical element of our election security is really just trying to create that sense of transparency and provide a lot of checks and balances, both physical and electronic. That makes sense and are easy to explain to the average voter so that they can understand what it is we're doing. Of course, the final leg of that that try that stool would be the digital security and for us we really started working on this probably 10 years ago by modernizing our election system. And now we have a highly segmented network system that employs multi factor authentication for all of our users. We have really tried to increase and expand our user training and outreach to just make them aware of cybersecurity issues and things that they need to do to make sure our overall system is secure and we've done robust testing and that happens on an ongoing basis. And as all of you are aware, you know, it's a constant battle to stay ahead of hackers and people trying to get into our system. So I think just that user awareness has increased in the last four years on a level and a scale that we just weren't doing before 2016. We're currently part of the National Sensor Network and this is not only the state system but counties across the state are part of it as well. And we built and have created a dedicated election security operation center that is in my office but it also supports the 39 county election offices because what we found is that many smaller and medium sized counties are lucky if they have an IT professional for their entire county, let alone in their their elections division and let alone a cybersecurity expert. So this partnership has also helped us have good communication and training with those election officials and do assessments in their counties that help them strengthen their system as well. We also played an active role in the critical infrastructure build out of the election sector. So these are all kind of the key parts of our system and I think that critical infrastructure designation also allowed us to create partnerships with our own state, CISO and CIO, but also our Washington National Guard who is a very strong cybersecurity team and they've come in and done assessments and monitor our system and give us feedback and ways to improve our system. They've also helped us do tabletop exercises and trainings for our users, which again just continues to raise the awareness level and prepare to some level of our election officials. We've worked with them also to build out our continuity of operation plans, which have obviously a digital component to in the security of our system, but also how are we going to not only detect and defend our system or protect and defend our system, but how are we going to detect an intrusion and recover and respond in case that does happen. We've also worked with the State Auditor's Office, Department of Homeland Security and the FBI with similar threats to those activities. So we've been focusing on all of this for the last four years pretty intently and as if that wasn't enough in the early part of this year we had to throw in a global pandemic because you know why not. So, Washington was in the middle of our presidential primary when COVID-19 began to spike and we started having the first deaths in the country actually for COVID-19. And it did affect and impact our March 10th presidential primary. We were on track to have turnout of about 60%. And the weekend right before election day was when COVID really started spiking and the governor started to issue stay at home orders. So we ended up with a turnout of 49%. And I think we're running about the third highest in the country for presidential primary turnout. And a lot of that has to do with vote by mail because our voters were still able to drop ballots off and didn't have to go into a polling place or vote center on election day. We've seen of course across the country presidential primaries canceled or postponed. There has been incredible interest nationally on vote by mail and I've given many, many talks and been on panels and talk to media about our experience here in Washington. And what I can tell you is that our state is well, we're implementing a primary right now. Our regular primary is on August 4th. So we'll be in the middle of the, we're right in the middle of processing ballots for that election and certifying it. And of course, we're gearing up for the general election and my colleagues across the country are doing the same in their states trying to expand absentee voting or vote by mail as best they can because Congress hasn't allocated money. And as if that wasn't enough, you know, the USPS is in financial distress and Congress has just allocated an additional $10 billion of potential loans. So we're hoping that they remain stable between now and November. I think they're going to. But the USPS is a critical element for elections this year across the country because so many elections offices are expanding voting by mail. To give you kind of perspective of how significant this is. If you look at this map, the states in blue are the states at the end of 2019. We're already vote by mail, including Washington, Oregon, Utah, Colorado and Hawaii. As you can see, as you move east in the country, fewer and fewer states either are vote by mail or even have access to absentee voting. And so the gray or the wider the states as you move east, those are going to be the states that have the hardest time moving to expanded absentee usage and vote by mail because they have the systems in place high speed ballot sorters envelope openers, even just the physical space to socially distance and process those ballots as efficiently as we can here in Washington or the other 4 states that do vote by mail elections. So we're trying to help those states gear up and they're working very hard to expand that capacity and capability. And I think you're going to see hybrid model across the country, including my state here in Washington of voting at home and voting in person because even here in Washington, 1 to 2% of our voters will vote in person. So, so it's going to be a heavy lift, but election officials are working hard to make sure it's going to happen. And in that environment, of course, we introduce the politics and it's bipartisan. I'm not going to talk about these things in terms of bipartisanship, but we have Republicans on on the right, certainly the president and Senator McConnell and some of their associates who are concerned about voter fraud. And on the left, we have members of Congress, like Senator Wyden and Senator Klobuchar, who are really trying to expand vote by mail access and voting at home. And, and unfortunately, out of the White House and Department of Justice, we're hearing about voter fraud on a level that is implying and he's point blank said that there's going to be rampant fraud and vote rigging. And, you know, this is the environment that election officials are operating in and trying to inspire confidence in. And so I say that because we're seeing success stories already in the primaries that have been held in the last month or so. I think Kentucky is a great example of the innovation that that election officials are trying to bring to the COVID environment and make voting a safe experience. And you can see in these pictures, these are things that happened on election day in Kentucky. Huge security as we have seen in the past, I think, election workers because many of our election workers are senior citizens who are in the House with the COVID-19. The other thing that I'm going to talk about is making these radio calling centers. And I think this was right in the right in the national, I think in that national right in Northampton. I believe this picture is on. The other thing that of course is I was talking about is election officials in our state will have offices throughout the state that are secure and better. And I serve a state lead by putting up all the USPS mailboxes. So, you know, what we're going to be trying to do, like here, I know we're going to be here much in the same, I think what we're trying to do across the country is to volume voters' options and make sure that those are secure options that they can believe in and try to inspire confidence in elections. And so, I think with the leadership that I'm concerned with, all of the arts and charter about voting suppression, if you don't have universal vote by mail or voter fraud, if we don't have complete poll site voting, is really dealing with the misinformation and disinformation that are out there, not only from the president or from members of Congress or whoever, but, you know, from foreign actors like Russia. We have a national movement, national movement, national hashtag, trusted info 2020. And what we're really trying to do is drive voters to trusted sources like secretaries of state offices or county election departments or local election departments that are going to provide info that you can believe in and know is true. And, you know, different jurisdictions have different other hashtags and taglines like ours is the vote starts with you and really trying to empower voters to know where to get information on social media and online. So, I think that is my point and I hope that that gives you a good overview of some of the security measures and practices we've implemented here in Washington state. I know that we can't be together in person, but I guess I want to leave you with more of thanks for all of the work that you're doing to try to find the vulnerabilities in election cybersecurity and giving us feedback so we can make the system better. I think as I looked back a few years ago to a few early back on managers, we're not going to have some pretty bad news. And I think that it was difficult for election officials like myself to hear and our major reaction was to push back and say we were wrong. And what I love about that now and what I understand more is that we need to work together and help us find those vulnerabilities and give us tips on how we can secure our election system because at the end of all of this, no matter where we are in the political spectrum, no matter what job we have in this process, we need to inspire confidence in the public that our elections are accessible and secure and that the election results are fair and accurate. And we look forward to working with you in the future. I hope in 2021 that you'll invite me back to DEF CON and we can have these conversations in person, but feel free to reach out to me at the Secretary of State's office and I'm here in Washington. I'm going to email this because this is so fashion problem, but to this group is him that's K. I am at ss.wa.gov ss.wa.gov. So thank you so much for giving me time at the conference. I hope you have a great conference remotely and we hopefully can be all together next year. So take care.
 Hello, I'm Secretary of State Kim Wyman from Washington State and I want to first say thank you for inviting me to be part of DEF CON 2020 and share a little bit about Washington's experience with vote by mail and the challenges that we have with election security and how we've tried to overcome them and how we're preparing for the upcoming August primary and November general elections here in Washington State.  So I'm going to real quick share my screen and walk you through kind of what Washington State has done to prepare for the 2020 election cycle and how we are dealing with all of the things that are coming at us in 2020.  So first and foremost, I'm pretty certain each one of you has been very aware of Russians trying to hack into the election system in the 2016 elections and I've been an election official for many years and have watched this kind of progression that we've had in the election community for election security.  And in the 1990s, we instituted cutting edge technology like using the driver's license information to register voters and put election night results online.  And from that moment to today, election security has been something we've been aware of and have worked really hard to try to make sure our systems are secure.  And I think right up until 2016, most election officials felt pretty good about the level of security that we had in our industry.  And today what I want to do is share with you kind of what a Washington State election system looks like, how we inspire public confidence in our process and what our kind of tryout of election security is.  And then talk a little bit about the impacts of COVID-19 on our election system and quite frankly the nation's election system.  So I got into election administration in the 1990s, early 1990s, and I can tell you when I started in this field, my goal was to become an elections expert to learn and understand how the election process works and to be able to conduct elections in a secure and accessible manner.  And then the 2000s that evolved because suddenly the demands on our system were so great that we had to rely on technology to be able to produce election results quickly and to serve our voters well by providing a lot of information on the internet.  So we now suddenly not only had to become an elections expert, but also had to be an IT expert and understand at least how systems work and how to use technology in a way to help us oversee our election systems.  And about the time I started feeling like I knew what I was doing in the IT world and I say that because I'm just dangerous enough to know how to use technology, but certainly not to any of the levels that any of you are.  But by 2016 it became very apparent that not only did we need to be election experts and understand IT systems, but we needed to know how to secure them.  And cybersecurity for the last four years has certainly been front and center in election administration.  So let me start kind of with the basics of why I think the United States election system is very secure just because of the decentralized nature of it.  So when people think of elections, I think oftentimes they think of the national, that there's some sort of national election administration when in fact it's a really decentralized network made up of 10,000 election officials nationwide who like me are very much  who like me are either appointed or are elected to office.  They take an oath to uphold the Constitution and the Constitution and laws in their state. And I think the overall strength of this system is that no single person or group has total control of the overall operation.  And so when you get down to election systems in each individual state, and I bear with me here, I'm having a challenge operating my own PowerPoint system, you have the same similar threads.  We have a decentralized system here in Washington and each state is going to be different and unique.  And Washington is certainly one of five vote by mail states, but I think you can look at the individual makeup of each state and know that this decentralization is actually happening within the states as well.  So here in Washington, we have the Secretary of State myself.  My office is the overseer of elections in Washington and I'm the chief election officer.  I have the rulemaking authority to put into put into effect rules that adapt our laws that our legislature passes. So this is how counties implement the day to day operations on the ground.  We manage a statewide voter registration database and oversee the election initiative and referendum process, as well as do election night reporting.  We do voter outreach and education and we certify and train our election officials, as well as the election tabulation systems that are used in each of our 39 counties.  Our system is decentralized in that 39 county election officials are the chief election officials in their county, and they are elected.  They oversee the voter registration processing and the management of elections in their county. So they're the ones who are actually issuing ballots and operating the tabulation systems and any kind of other tech like ballot sorting equipment or the actual facilities that process ballots.  They also provide voter outreach and education to their voters and manage all of that information, usually through social media and their web pages.  Now, I imagine most of you are aware that in 2016, the federal government designated elections as critical infrastructure and this is significant because it put us on the same national security level as the power grid or the banking system.  And so what it has done in our state is really helped us reinforce what I like to think of as our triad of security for Washington and our vote by mail system.  I forgot to mention that earlier in 2011, Washington state became a vote by mail state. And at that point, every single one of our counties had had to conduct elections entirely by mail and mail out a ballot to each of their voters.  So this process didn't happen overnight. We really started back in the 1990s and in allowing any voter to be a permanent absentee voter, which meant they received a ballot every election.  And that evolved to the early 2000s when we had the closest governor's race in the country's history.  And following that and following a lot of things that went wrong, both at the polling place and in the absentee balloting, we determined that we couldn't do both elections well and the legislature allowed counties to move to vote by mail voluntarily.  In 2005, many of the counties in the state did move to vote by mail, but it still took our state five years to completely become a vote by mail state.  And that's because it took time to get the equipment and facilities to really provide for processes and procedures that we could conduct elections. Well, so.  Which is what leads us to the triad of security for Washington vote by mail elections. So there's three real pieces to this, this election model.  It's the physical security, the logical security things you would just do innately and the digital security that we provide.  So let me start by just talking through kind of the physical security elements that are inherent in a vote by mail election.  First and foremost, I think the strength is that we are we rely on paper ballots, even the ballots that are issued in a vote center and voters use to use an assistive device to vote them. All of those ballots are paper ballots that are printed by those machines that the voter actually does mark and our process.  So we can always go back to those paper ballots and do a risk limiting audit or a full recount if we need to to really inspire that confidence that voters need to have in the election results.  We have ballot drop boxes here in Washington state in addition to the blue mail boxes provided by the USPS.  The drop boxes are throughout the state and they're managed by our county election officials. They we have about 470 of them statewide and they open at the beginning of the voting period, which is 20 days before election day.  And anytime they are emptied, they are emptied by two employees of the county. And I know that sometimes they try to have that be a Democrat and a Republican when possible but they are staffed by their staff that are employed by the county and take a note to uphold the laws and the procedures  and policies for the county. So they are held accountable for that processing. They seal they lock and seal those boxes and they do that with individual numbers numbered seals that are actually logged and kept track of two.  So pretty much all of the steps I'm going to talk about are what we use to build an electronic and physical audit trail that we have in place in case we ever get into a recount or a situation where anyone is calling into question our processes.  We go back and show which employees had access to which ballots at any given time. And we have dual control environments throughout this so it's it's just really important that those audit logs and dual controls are in place to inspire confidence again.  And that's true throughout all of our election processing facilities as well. We have secured storage for ballots and ballot materials that involve physical locks in some of our counties that may be key card access servers for the server room for example for  the server room. So the security system equipment is in a secured room and has very limited access and again is log or key card controlled. So we have a record of anyone who has access to it. And then we have security systems and key card access throughout these facilities as well to just have that physical  control on top of any cybersecurity elements that we have in place. The second I guess group of security measures are those sort of logical ones things that just make sense. Of course the first one would be that our tabulation systems aren't connected to the  internet. And I know this is something that came under fire in the last few years nationally. But our county election officials have made sure that their tabulation systems not only are air gapped from the internet in every way.  But there's no modems operating or even installed in those systems and that any connection that needs to be made with the vendor or with with election officials is done on site in that air gapped environment.  So we have a real love of transparency in elections and certainly that was true in any processing facilities or courthouses across our state that all of the activities are observable. We like it when it's bipartisan when we have Democrats and  Democrats seeing that process. We actually asked the local county parties to appoint observers to come in and represent each of the parties. If that can happen and of course in the COVID-19 environment that's becoming a bit of a problem for just space reasons.  And I think that the county courthouses oftentimes do not have a lot of extra space in the smaller counties. So a lot of counties have used their security money to install cameras that run 24 seven during the voting period during that entire 20 days and then the 20 days or so after  when we're certifying the election so that people can watch it online from safety and comfort. But also have that transparency so you can show that we're not we're not trying to hide anything or do anything kind of under the table.  And ballot reconciliation is a really important part as well. This would be, you know, counting the number of ballots that are received each day in the mail and then through the process reconciling them and being able to show whether a ballot was counted.  That was issued to a voter or not. And if it wasn't counted why it wasn't and the only people that can reject a ballot are bipartisan canvassing boards.  We also have election night reporting and we have fail safe measures and checks and balances that my CISO told me to say is out of band communication verification.  And what we do on election night is counties are uploading their results to our state election night reporting system and we compile those results for offices that go across county lines.  And we take that initial file that they send us and then we verify it by a fax or an email that is sent by the county as well separately to just make sure that the information that we're putting up online is accurate and is the way that the county's reported it in the first place.  So all of these systems, you know, this logical element of our election security is really just trying to create that sense of transparency and provide a lot of checks and balances, both physical and electronic.  That makes sense and are easy to explain to the average voter so that they can understand what it is we're doing.  Of course, the final leg of that that try that stool would be the digital security and for us we really started working on this probably 10 years ago by modernizing our election system.  And now we have a highly segmented network system that employs multi factor authentication for all of our users.  We have really tried to increase and expand our user training and outreach to just make them aware of cybersecurity issues and things that they need to do to make sure our overall system is secure and we've done robust testing and that happens on an ongoing basis.  And as all of you are aware, you know, it's a constant battle to stay ahead of hackers and people trying to get into our system. So I think just that user awareness has increased in the last four years on a level and a scale that we just weren't doing before 2016.  We're currently part of the National Sensor Network and this is not only the state system but counties across the state are part of it as well. And we built and have created a dedicated election security operation center that is in my office but it also supports the 39 county election offices because what we found is that  many smaller and medium sized counties are lucky if they have an IT professional for their entire county, let alone in their their elections division and let alone a cybersecurity expert.  So this partnership has also helped us have good communication and training with those election officials and do assessments in their counties that help them strengthen their system as well.  We also played an active role in the critical infrastructure build out of the election sector. So these are all kind of the key parts of our system and I think that critical infrastructure designation also allowed us to create partnerships with our own state,  CISO and CIO, but also our Washington National Guard who is a very strong cybersecurity team and they've come in and done assessments and monitor our system and give us feedback and ways to improve our system.  They've also helped us do tabletop exercises and trainings for our users, which again just continues to raise the awareness level and prepare to some level of our election officials.  We've worked with them also to build out our continuity of operation plans, which have obviously a digital component to in the security of our system, but also how are we going to not only detect and defend our system or protect and defend our system,  but how are we going to detect an intrusion and recover and respond in case that does happen.  We've also worked with the State Auditor's Office, Department of Homeland Security and the FBI with similar threats to those activities.  So we've been focusing on all of this for the last four years pretty intently and as if that wasn't enough in the early part of this year we had to throw in a global pandemic because you know why not.  So, Washington was in the middle of our presidential primary when COVID-19 began to spike and we started having the first deaths in the country actually for COVID-19.  And it did affect and impact our March 10th presidential primary. We were on track to have turnout of about 60%.  And the weekend right before election day was when COVID really started spiking and the governor started to issue stay at home orders. So we ended up with a turnout of 49%. And I think we're running about the third highest in the country for presidential primary turnout.  And a lot of that has to do with vote by mail because our voters were still able to drop ballots off and didn't have to go into a polling place or vote center on election day.  We've seen of course across the country presidential primaries canceled or postponed. There has been incredible interest nationally on vote by mail and I've given many, many talks and been on panels and talk to media about our experience here in Washington.  And what I can tell you is that our state is well, we're implementing a primary right now. Our regular primary is on August 4th. So we'll be in the middle of the, we're right in the middle of processing ballots for that election and certifying it.  And of course, we're gearing up for the general election and my colleagues across the country are doing the same in their states trying to expand absentee voting or vote by mail as best they can because Congress hasn't allocated money.  And as if that wasn't enough, you know, the USPS is in financial distress and Congress has just allocated an additional $10 billion of potential loans. So we're hoping that they remain stable between now and November.  I think they're going to. But the USPS is a critical element for elections this year across the country because so many elections offices are expanding voting by mail.  To give you kind of perspective of how significant this is. If you look at this map, the states in blue are the states at the end of 2019. We're already vote by mail, including Washington, Oregon, Utah, Colorado and Hawaii.  As you can see, as you move east in the country, fewer and fewer states either are vote by mail or even have access to absentee voting. And so the gray or the wider the states as you move east, those are going to be the states that have the hardest time moving to expanded absentee usage and vote by mail because they  have the systems in place high speed ballot sorters envelope openers, even just the physical space to socially distance and process those ballots as efficiently as we can here in Washington or the other 4 states that do vote by mail elections.  So we're trying to help those states gear up and they're working very hard to expand that capacity and capability. And I think you're going to see hybrid model across the country, including my state here in Washington of voting at home and voting in person because even here in  Washington, 1 to 2% of our voters will vote in person. So, so it's going to be a heavy lift, but election officials are working hard to make sure it's going to happen. And in that environment, of course, we introduce the politics and it's bipartisan.  I'm not going to talk about these things in terms of bipartisanship, but we have Republicans on on the right, certainly the president and Senator McConnell and some of their associates who are concerned about voter fraud. And on the left, we have members of Congress, like  Senator Wyden and Senator Klobuchar, who are really trying to expand vote by mail access and voting at home. And, and unfortunately, out of the White House and Department of Justice, we're hearing about voter fraud on a level that is implying and he's point blank said that there's going to be  rampant fraud and vote rigging. And, you know, this is the environment that election officials are operating in and trying to inspire confidence in. And so I say that because we're seeing success stories already in the primaries that have been held in the last month or so.  I think Kentucky is a great example of the innovation that that election officials are trying to bring to the COVID environment and make voting a safe experience.  And you can see in these pictures, these are things that happened on election day in Kentucky. Huge security as we have seen in the past, I think, election workers because many of our election workers are senior citizens who are in the House with the COVID-19.  The other thing that I'm going to talk about is making these radio calling centers. And I think this was right in the right in the national, I think in that national right in Northampton. I believe this picture is on.  The other thing that of course is I was talking about is election officials in our state will have offices throughout the state that are secure and better.  And I serve a state lead by putting up all the USPS mailboxes. So, you know, what we're going to be trying to do, like here, I know we're going to be here much in the same, I think what we're trying to do across the country is to volume voters' options and make sure that those are secure options that they can believe in and try to inspire confidence in elections.  And so, I think with the leadership that I'm concerned with, all of the arts and charter about voting suppression, if you don't have universal vote by mail or voter fraud, if we don't have complete poll site voting, is really dealing with the misinformation and disinformation that are out there, not only from the president or from members of Congress or whoever, but, you know, from foreign actors like Russia.  We have a national movement, national movement, national hashtag, trusted info 2020.  And what we're really trying to do is drive voters to trusted sources like secretaries of state offices or county election departments or local election departments that are going to provide info that you can believe in and know is true.  And, you know, different jurisdictions have different other hashtags and taglines like ours is the vote starts with you and really trying to empower voters to know where to get information on social media and online.  So, I think that is my point and I hope that that gives you a good overview of some of the security measures and practices we've implemented here in Washington state.  I know that we can't be together in person, but I guess I want to leave you with more of thanks for all of the work that you're doing to try to find the vulnerabilities in election cybersecurity and giving us feedback so we can make the system better.  I think as I looked back a few years ago to a few early back on managers, we're not going to have some pretty bad news. And I think that it was difficult for election officials like myself to hear and our major reaction was to push back and say we were wrong.  And what I love about that now and what I understand more is that we need to work together and help us find those vulnerabilities and give us tips on how we can secure our election system because at the end of all of this, no matter where we are in the political spectrum, no matter what job we have in this process,  we need to inspire confidence in the public that our elections are accessible and secure and that the election results are fair and accurate. And we look forward to working with you in the future.  I hope in 2021 that you'll invite me back to DEF CON and we can have these conversations in person, but feel free to reach out to me at the Secretary of State's office and I'm here in Washington.  I'm going to email this because this is so fashion problem, but to this group is him that's K. I am at ss.wa.gov ss.wa.gov. So thank you so much for giving me time at the conference.  I hope you have a great conference remotely and we hopefully can be all together next year. So take care.
DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_0_647.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_648_971.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_972_1019.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_1020_1271.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_1272_1571.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_1572_2591.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_2592_3107.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_3108_5183.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_5184_6395.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_6396_6575.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_6576_6623.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_6624_8339.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_8340_9323.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_9324_9863.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_9864_24503.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_24504_26147.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_26148_26459.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_26460_26507.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_26508_29447.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_29448_31463.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_31464_32183.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_32184_32807.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_32808_34187.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_34188_35003.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_35004_36611.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_36612_36791.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_36792_37379.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_37380_37667.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_37668_38291.png DEF_CON_Safe_Mode_Voting_Village_-_Kylee_Zabel_38292_39831.png
Hello, I'm Secretary of State Kim Wyman from Washington State and I want to first say thank you for inviting me to be part of DEF CON 2020 and share a little bit about Washington's experience with vote by mail and the challenges that we have with election security and how we've tried to overcome them and how we're preparing for the upcoming August primary and November general elections here in Washington State. So I'm going to real quick share my screen and walk you through kind of what Washington State has done to prepare for the 2020 election cycle and how we are dealing with all of the things that are coming at us in 2020. So first and foremost, I'm pretty certain each one of you has been very aware of Russians trying to hack into the election system in the 2016 elections and I've been an election official for many years and have watched this kind of progression that we've had in the election community for election security. And in the 1990s, we instituted cutting edge technology like using the driver's license information to register voters and put election night results online. And from that moment to today, election security has been something we've been aware of and have worked really hard to try to make sure our systems are secure. And I think right up until 2016, most election officials felt pretty good about the level of security that we had in our industry. And today what I want to do is share with you kind of what a Washington State election system looks like, how we inspire public confidence in our process and what our kind of tryout of election security is. And then talk a little bit about the impacts of COVID-19 on our election system and quite frankly the nation's election system. So I got into election administration in the 1990s, early 1990s, and I can tell you when I started in this field, my goal was to become an elections expert to learn and understand how the election process works and to be able to conduct elections in a secure and accessible manner. And then the 2000s that evolved because suddenly the demands on our system were so great that we had to rely on technology to be able to produce election results quickly and to serve our voters well by providing a lot of information on the internet. So we now suddenly not only had to become an elections expert, but also had to be an IT expert and understand at least how systems work and how to use technology in a way to help us oversee our election systems. And about the time I started feeling like I knew what I was doing in the IT world and I say that because I'm just dangerous enough to know how to use technology, but certainly not to any of the levels that any of you are. But by 2016 it became very apparent that not only did we need to be election experts and understand IT systems, but we needed to know how to secure them. And cybersecurity for the last four years has certainly been front and center in election administration. So let me start kind of with the basics of why I think the United States election system is very secure just because of the decentralized nature of it. So when people think of elections, I think oftentimes they think of the national, that there's some sort of national election administration when in fact it's a really decentralized network made up of 10,000 election officials nationwide who like me are very much who like me are either appointed or are elected to office. They take an oath to uphold the Constitution and the Constitution and laws in their state. And I think the overall strength of this system is that no single person or group has total control of the overall operation. And so when you get down to election systems in each individual state, and I bear with me here, I'm having a challenge operating my own PowerPoint system, you have the same similar threads. We have a decentralized system here in Washington and each state is going to be different and unique. And Washington is certainly one of five vote by mail states, but I think you can look at the individual makeup of each state and know that this decentralization is actually happening within the states as well. So here in Washington, we have the Secretary of State myself. My office is the overseer of elections in Washington and I'm the chief election officer. I have the rulemaking authority to put into put into effect rules that adapt our laws that our legislature passes. So this is how counties implement the day to day operations on the ground. We manage a statewide voter registration database and oversee the election initiative and referendum process, as well as do election night reporting. We do voter outreach and education and we certify and train our election officials, as well as the election tabulation systems that are used in each of our 39 counties. Our system is decentralized in that 39 county election officials are the chief election officials in their county, and they are elected. They oversee the voter registration processing and the management of elections in their county. So they're the ones who are actually issuing ballots and operating the tabulation systems and any kind of other tech like ballot sorting equipment or the actual facilities that process ballots. They also provide voter outreach and education to their voters and manage all of that information, usually through social media and their web pages. Now, I imagine most of you are aware that in 2016, the federal government designated elections as critical infrastructure and this is significant because it put us on the same national security level as the power grid or the banking system. And so what it has done in our state is really helped us reinforce what I like to think of as our triad of security for Washington and our vote by mail system. I forgot to mention that earlier in 2011, Washington state became a vote by mail state. And at that point, every single one of our counties had had to conduct elections entirely by mail and mail out a ballot to each of their voters. So this process didn't happen overnight. We really started back in the 1990s and in allowing any voter to be a permanent absentee voter, which meant they received a ballot every election. And that evolved to the early 2000s when we had the closest governor's race in the country's history. And following that and following a lot of things that went wrong, both at the polling place and in the absentee balloting, we determined that we couldn't do both elections well and the legislature allowed counties to move to vote by mail voluntarily. In 2005, many of the counties in the state did move to vote by mail, but it still took our state five years to completely become a vote by mail state. And that's because it took time to get the equipment and facilities to really provide for processes and procedures that we could conduct elections. Well, so. Which is what leads us to the triad of security for Washington vote by mail elections. So there's three real pieces to this, this election model. It's the physical security, the logical security things you would just do innately and the digital security that we provide. So let me start by just talking through kind of the physical security elements that are inherent in a vote by mail election. First and foremost, I think the strength is that we are we rely on paper ballots, even the ballots that are issued in a vote center and voters use to use an assistive device to vote them. All of those ballots are paper ballots that are printed by those machines that the voter actually does mark and our process. So we can always go back to those paper ballots and do a risk limiting audit or a full recount if we need to to really inspire that confidence that voters need to have in the election results. We have ballot drop boxes here in Washington state in addition to the blue mail boxes provided by the USPS. The drop boxes are throughout the state and they're managed by our county election officials. They we have about 470 of them statewide and they open at the beginning of the voting period, which is 20 days before election day. And anytime they are emptied, they are emptied by two employees of the county. And I know that sometimes they try to have that be a Democrat and a Republican when possible but they are staffed by their staff that are employed by the county and take a note to uphold the laws and the procedures and policies for the county. So they are held accountable for that processing. They seal they lock and seal those boxes and they do that with individual numbers numbered seals that are actually logged and kept track of two. So pretty much all of the steps I'm going to talk about are what we use to build an electronic and physical audit trail that we have in place in case we ever get into a recount or a situation where anyone is calling into question our processes. We go back and show which employees had access to which ballots at any given time. And we have dual control environments throughout this so it's it's just really important that those audit logs and dual controls are in place to inspire confidence again. And that's true throughout all of our election processing facilities as well. We have secured storage for ballots and ballot materials that involve physical locks in some of our counties that may be key card access servers for the server room for example for the server room. So the security system equipment is in a secured room and has very limited access and again is log or key card controlled. So we have a record of anyone who has access to it. And then we have security systems and key card access throughout these facilities as well to just have that physical control on top of any cybersecurity elements that we have in place. The second I guess group of security measures are those sort of logical ones things that just make sense. Of course the first one would be that our tabulation systems aren't connected to the internet. And I know this is something that came under fire in the last few years nationally. But our county election officials have made sure that their tabulation systems not only are air gapped from the internet in every way. But there's no modems operating or even installed in those systems and that any connection that needs to be made with the vendor or with with election officials is done on site in that air gapped environment. So we have a real love of transparency in elections and certainly that was true in any processing facilities or courthouses across our state that all of the activities are observable. We like it when it's bipartisan when we have Democrats and Democrats seeing that process. We actually asked the local county parties to appoint observers to come in and represent each of the parties. If that can happen and of course in the COVID-19 environment that's becoming a bit of a problem for just space reasons. And I think that the county courthouses oftentimes do not have a lot of extra space in the smaller counties. So a lot of counties have used their security money to install cameras that run 24 seven during the voting period during that entire 20 days and then the 20 days or so after when we're certifying the election so that people can watch it online from safety and comfort. But also have that transparency so you can show that we're not we're not trying to hide anything or do anything kind of under the table. And ballot reconciliation is a really important part as well. This would be, you know, counting the number of ballots that are received each day in the mail and then through the process reconciling them and being able to show whether a ballot was counted. That was issued to a voter or not. And if it wasn't counted why it wasn't and the only people that can reject a ballot are bipartisan canvassing boards. We also have election night reporting and we have fail safe measures and checks and balances that my CISO told me to say is out of band communication verification. And what we do on election night is counties are uploading their results to our state election night reporting system and we compile those results for offices that go across county lines. And we take that initial file that they send us and then we verify it by a fax or an email that is sent by the county as well separately to just make sure that the information that we're putting up online is accurate and is the way that the county's reported it in the first place. So all of these systems, you know, this logical element of our election security is really just trying to create that sense of transparency and provide a lot of checks and balances, both physical and electronic. That makes sense and are easy to explain to the average voter so that they can understand what it is we're doing. Of course, the final leg of that that try that stool would be the digital security and for us we really started working on this probably 10 years ago by modernizing our election system. And now we have a highly segmented network system that employs multi factor authentication for all of our users. We have really tried to increase and expand our user training and outreach to just make them aware of cybersecurity issues and things that they need to do to make sure our overall system is secure and we've done robust testing and that happens on an ongoing basis. And as all of you are aware, you know, it's a constant battle to stay ahead of hackers and people trying to get into our system. So I think just that user awareness has increased in the last four years on a level and a scale that we just weren't doing before 2016. We're currently part of the National Sensor Network and this is not only the state system but counties across the state are part of it as well. And we built and have created a dedicated election security operation center that is in my office but it also supports the 39 county election offices because what we found is that many smaller and medium sized counties are lucky if they have an IT professional for their entire county, let alone in their their elections division and let alone a cybersecurity expert. So this partnership has also helped us have good communication and training with those election officials and do assessments in their counties that help them strengthen their system as well. We also played an active role in the critical infrastructure build out of the election sector. So these are all kind of the key parts of our system and I think that critical infrastructure designation also allowed us to create partnerships with our own state, CISO and CIO, but also our Washington National Guard who is a very strong cybersecurity team and they've come in and done assessments and monitor our system and give us feedback and ways to improve our system. They've also helped us do tabletop exercises and trainings for our users, which again just continues to raise the awareness level and prepare to some level of our election officials. We've worked with them also to build out our continuity of operation plans, which have obviously a digital component to in the security of our system, but also how are we going to not only detect and defend our system or protect and defend our system, but how are we going to detect an intrusion and recover and respond in case that does happen. We've also worked with the State Auditor's Office, Department of Homeland Security and the FBI with similar threats to those activities. So we've been focusing on all of this for the last four years pretty intently and as if that wasn't enough in the early part of this year we had to throw in a global pandemic because you know why not. So, Washington was in the middle of our presidential primary when COVID-19 began to spike and we started having the first deaths in the country actually for COVID-19. And it did affect and impact our March 10th presidential primary. We were on track to have turnout of about 60%. And the weekend right before election day was when COVID really started spiking and the governor started to issue stay at home orders. So we ended up with a turnout of 49%. And I think we're running about the third highest in the country for presidential primary turnout. And a lot of that has to do with vote by mail because our voters were still able to drop ballots off and didn't have to go into a polling place or vote center on election day. We've seen of course across the country presidential primaries canceled or postponed. There has been incredible interest nationally on vote by mail and I've given many, many talks and been on panels and talk to media about our experience here in Washington. And what I can tell you is that our state is well, we're implementing a primary right now. Our regular primary is on August 4th. So we'll be in the middle of the, we're right in the middle of processing ballots for that election and certifying it. And of course, we're gearing up for the general election and my colleagues across the country are doing the same in their states trying to expand absentee voting or vote by mail as best they can because Congress hasn't allocated money. And as if that wasn't enough, you know, the USPS is in financial distress and Congress has just allocated an additional $10 billion of potential loans. So we're hoping that they remain stable between now and November. I think they're going to. But the USPS is a critical element for elections this year across the country because so many elections offices are expanding voting by mail. To give you kind of perspective of how significant this is. If you look at this map, the states in blue are the states at the end of 2019. We're already vote by mail, including Washington, Oregon, Utah, Colorado and Hawaii. As you can see, as you move east in the country, fewer and fewer states either are vote by mail or even have access to absentee voting. And so the gray or the wider the states as you move east, those are going to be the states that have the hardest time moving to expanded absentee usage and vote by mail because they have the systems in place high speed ballot sorters envelope openers, even just the physical space to socially distance and process those ballots as efficiently as we can here in Washington or the other 4 states that do vote by mail elections. So we're trying to help those states gear up and they're working very hard to expand that capacity and capability. And I think you're going to see hybrid model across the country, including my state here in Washington of voting at home and voting in person because even here in Washington, 1 to 2% of our voters will vote in person. So, so it's going to be a heavy lift, but election officials are working hard to make sure it's going to happen. And in that environment, of course, we introduce the politics and it's bipartisan. I'm not going to talk about these things in terms of bipartisanship, but we have Republicans on on the right, certainly the president and Senator McConnell and some of their associates who are concerned about voter fraud. And on the left, we have members of Congress, like Senator Wyden and Senator Klobuchar, who are really trying to expand vote by mail access and voting at home. And, and unfortunately, out of the White House and Department of Justice, we're hearing about voter fraud on a level that is implying and he's point blank said that there's going to be rampant fraud and vote rigging. And, you know, this is the environment that election officials are operating in and trying to inspire confidence in. And so I say that because we're seeing success stories already in the primaries that have been held in the last month or so. I think Kentucky is a great example of the innovation that that election officials are trying to bring to the COVID environment and make voting a safe experience. And you can see in these pictures, these are things that happened on election day in Kentucky. Huge security as we have seen in the past, I think, election workers because many of our election workers are senior citizens who are in the House with the COVID-19. The other thing that I'm going to talk about is making these radio calling centers. And I think this was right in the right in the national, I think in that national right in Northampton. I believe this picture is on. The other thing that of course is I was talking about is election officials in our state will have offices throughout the state that are secure and better. And I serve a state lead by putting up all the USPS mailboxes. So, you know, what we're going to be trying to do, like here, I know we're going to be here much in the same, I think what we're trying to do across the country is to volume voters' options and make sure that those are secure options that they can believe in and try to inspire confidence in elections. And so, I think with the leadership that I'm concerned with, all of the arts and charter about voting suppression, if you don't have universal vote by mail or voter fraud, if we don't have complete poll site voting, is really dealing with the misinformation and disinformation that are out there, not only from the president or from members of Congress or whoever, but, you know, from foreign actors like Russia. We have a national movement, national movement, national hashtag, trusted info 2020. And what we're really trying to do is drive voters to trusted sources like secretaries of state offices or county election departments or local election departments that are going to provide info that you can believe in and know is true. And, you know, different jurisdictions have different other hashtags and taglines like ours is the vote starts with you and really trying to empower voters to know where to get information on social media and online. So, I think that is my point and I hope that that gives you a good overview of some of the security measures and practices we've implemented here in Washington state. I know that we can't be together in person, but I guess I want to leave you with more of thanks for all of the work that you're doing to try to find the vulnerabilities in election cybersecurity and giving us feedback so we can make the system better. I think as I looked back a few years ago to a few early back on managers, we're not going to have some pretty bad news. And I think that it was difficult for election officials like myself to hear and our major reaction was to push back and say we were wrong. And what I love about that now and what I understand more is that we need to work together and help us find those vulnerabilities and give us tips on how we can secure our election system because at the end of all of this, no matter where we are in the political spectrum, no matter what job we have in this process, we need to inspire confidence in the public that our elections are accessible and secure and that the election results are fair and accurate. And we look forward to working with you in the future. I hope in 2021 that you'll invite me back to DEF CON and we can have these conversations in person, but feel free to reach out to me at the Secretary of State's office and I'm here in Washington. I'm going to email this because this is so fashion problem, but to this group is him that's K. I am at ss.wa.gov ss.wa.gov. So thank you so much for giving me time at the conference. I hope you have a great conference remotely and we hopefully can be all together next year. So take care.
Hello, I'm Secretary of State Kim Wyman from