[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]
SECURE, SAFE, AND AUDITABLE: PROTECTING THE INTEGRITY OF THE 2020
ELECTIONS
=======================================================================
HEARING
before the
SUBCOMMITTEE ON
CYBERSECURITY, INFRASTRUCTURE
PROTECTION, AND INNOVATION
of the
COMMITTEE ON HOMELAND SECURITY
HOUSE OF REPRESENTATIVES
ONE HUNDRED SIXTEENTH CONGRESS
SECOND SESSION
__________
AUGUST 4, 2020
__________
Serial No. 116-81
__________
Printed for the use of the Committee on Homeland Security
[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT]
Available via the World Wide Web: http://www.govinfo.gov
__________
U.S. GOVERNMENT PUBLISHING OFFICE
43-954 PDF WASHINGTON : 2021
COMMITTEE ON HOMELAND SECURITY
Bennie G. Thompson, Mississippi, Chairman
Sheila Jackson Lee, Texas Mike Rogers, Alabama
James R. Langevin, Rhode Island Peter T. King, New York
Cedric L. Richmond, Louisiana Michael T. McCaul, Texas
Donald M. Payne, Jr., New Jersey John Katko, New York
Kathleen M. Rice, New York Mark Walker, North Carolina
J. Luis Correa, California Clay Higgins, Louisiana
Xochitl Torres Small, New Mexico Debbie Lesko, Arizona
Max Rose, New York Mark Green, Tennessee
Lauren Underwood, Illinois John Joyce, Pennsylvania
Elissa Slotkin, Michigan Dan Crenshaw, Texas
Emanuel Cleaver, Missouri Michael Guest, Mississippi
Al Green, Texas Dan Bishop, North Carolina
Yvette D. Clarke, New York Jefferson Van Drew, Texas
Dina Titus, Nevada Mike Garcia, California
Bonnie Watson Coleman, New Jersey
Nanette Diaz Barragan, California
Val Butler Demings, Florida
Hope Goins, Staff Director
Chris Vieson, Minority Staff Director
------
SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND
INNOVATION
Cedric L. Richmond, Louisiana, Chairman
Sheila Jackson Lee, Texas John Katko, New York, Ranking
James R. Langevin, Rhode Island Member
Kathleen M. Rice, New York Mark Walker, North Carolina
Lauren Underwood, Illinois Mark Green, Tennessee
Elissa Slotkin, Michigan John Joyce, Pennsylvania
Bennie G. Thompson, Mississippi (ex Mike Rogers, Alabama (ex officio)
officio)
Moira Bergin, Subcommittee Staff Director
Sarah Moxley, Minority Subcommittee Staff Director
C O N T E N T S
----------
Page
Statements
The Honorable Cedric L. Richmond, a Representative in Congress
From the State of Louisiana, and Chairman, Subcommittee on
Cybersecurity, Infrastructure Protection, and Innovation:
Oral Statement................................................. 1
Prepared Statement............................................. 3
The Honorable John Katko, a Representative in Congress From the
State of New York, and Ranking Member, Subcommittee on
Cybersecurity, Infrastructure Protection, and Innovation:
Oral Statement................................................. 4
Prepared Statement............................................. 5
The Honorable Bennie G. Thompson, a Representative in Congress
From the State of Mississippi, and Chairman, Committee on
Homeland Security:
Oral Statement................................................. 33
Prepared Statement............................................. 34
Witnesses
Mr. David Levine, Elections Integrity Fellow, Alliance for
Securing Democracy, German Marshall Fund of the United States:
Oral Statement................................................. 7
Prepared Statement............................................. 9
Ms. Sylvia Albert, Director of Voting and Elections, Common
Cause:
Oral Statement................................................. 15
Prepared Statement............................................. 17
Ms. Amber McReynolds, Chief Executive Officer, National Vote at
Home Institute:
Oral Statement................................................. 21
Prepared Statement............................................. 24
Mr. John M. Gilligan, President and Chief Executive Officer,
Center for Internet Security, Inc.:
Oral Statement................................................. 26
Prepared Statement............................................. 27
Appendix
Questions From Honorable James R. Langevin for Sylvia Albert..... 49
Questions From Honorable James R. Langevin for John Gilligan..... 49
SECURE, SAFE, AND AUDITABLE: PROTECTING THE INTEGRITY OF THE 2020
ELECTIONS
----------
Tuesday, August 4, 2020
U.S. House of Representatives,
Committee on Homeland Security,
Subcommittee on Cybersecurity,
Infrastructure Protection,
and Innovation,
Washington, DC.
The subcommittee met, pursuant to notice, at 10:02 a.m.,
via Webex, Hon. Cedric L. Richmond (Chairman of the
subcommittee) presiding.
Present: Representatives Richmond, Jackson Lee, Langevin,
Rice, Underwood, Slotkin, Thompson (ex officio), Katko, and
Joyce.
Also present: Representatives Demings, and Green of Texas.
Mr. Richmond. The Subcommittee on Cybersecurity,
Infrastructure, Protection, and Innovation will come to order.
Good morning. I want to thank the witnesses for
participating in today's hearing. We all have a stake in
ensuring a safe, secure election in November. This hearing
comes a week after we laid to rest a giant in the right for
voting rights--in the fight for voting rights. Before he died,
Congressman Lewis reminding us that the vote is the most
powerful, nonviolent change agent you have in a Democratic
society. You must use it because it is not guaranteed. You can
lose it. We must vigorously defend our right to vote, our
access to the ballot box, and the integrity of our election.
In less than 90 days, Americans across the country will
participate in an election unlike any other in our history. The
COVID-19 pandemic is forcing State and local election officials
to rapidly expand vote-by-mail, early voting, and other crowd-
reducing election policies so no voter has to choose between
their democratic rights and their health.
As States scramble to administer safe primary elections
this spring, seemingly, administrative decisions related to the
number and location of polling sites had substantive impacts on
people's right to vote. Long lines and crowded polling
locations in predominantly Black and Brown neighborhoods raise
the stress levels in communities disproportionately impacted by
COVID-19. Police violence that underscored that existence of
systematic racism as an injustice that we must still overcome.
We have a President who has repeatedly tried to manipulate
a news cycle, going so far as to falsely suggest he can move
the election date, and, more insidiously, making baseless
claims about the security of vote-by-mail. This behavior is in
service to his own narcissistic political ends, softens the
turf for dangerous foreign influence campaigns, and puts
Americans who want to exercise the franchise at risk.
For the record, the President does not have the power to
move the date of the election from November. Moreover, last
Friday, the Cybersecurity Infrastructure Security Agency
released a risk assessment of vote-by-mail. CISA concluded that
while there are risks associated with mail-in voting, just as
with every other method of voting, those risks can be
mitigated.
Further, I am not a voyeur of any intelligence assessment
indicating that foreign actors have expressed interest or
capability to successfully interfere with vote-by-mail
processes. We must learn the lessons of our recent elections
and do better in November.
First, we must prepare Americans for the reality that
elections will be administered differently this fall. We must
educate voters about vote-by-mail, its related deadlines, and
how expanded vote-by-mail might affect the timing of election
results. We must encourage participation in vote-by-mail while
inoculating the public from disinformation campaigns aimed at
undermining confidence in election results.
Second, we must ensure that changes to the USPS service
standards do not jeopardize vote-by-mail, and that the election
officials seeking to expand vote-by-mail coordinate with the
Postal Service to coordinate vote-by-mail policies and
deadlines.
Third, we must ensure election officials do not use COVID-
19 as a pretext for making administrative decisions that could
disenfranchise voters.
Time and time again, the impacts of dysfunctional and
chaotic election administration falls hardest on Black and
Brown communities. Election officials must be deliberate in
their efforts to ensure that no community is disenfranchised.
Fourth, we must not forget the lessons of 2016. It was
around this time in 2016 when a Russian foreign interference
campaign engaged in hack-and-dump-operations against one
candidate, and targeted election systems in all 50 States.
We must continue to improve the election--the security of
election infrastructure and campaign organizations, and improve
the public resilience to foreign influence campaigns.
Finally, we need to be honest with ourselves about what it
will take to administer safe, secure, and auditable elections
this fall. It has been over 10 weeks since the House passed the
HEROES Act, which would have provided $3.6 billion in funding
to support State and local election officials. Despite urgent
requests for additional resources from State and local election
officials across the country, the Senate never voted on the
HEROES Act, nor did it include any election administration
funding in the COVID response package it released last week.
As the House and Senate negotiations on COVID relief
package continues, I urge my Senate colleagues to step up and
provide State and local election officials the funding they
need to administer safe, secure, and auditable elections this
November.
I look forward to hearing from the witnesses today, their
recommendations for Congress on ways to give Americans more
opportunities to vote this November, and to ensure the safety
and integrity of the election.
[The statement of Chairman Richmond follows:]
Statement of Chairman Cedric L. Richmond
August 4, 2020
We all have a stake in ensuring safe, secure, and auditable
elections in November. This hearing comes a week after we laid to rest
a giant in the fight for voting rights. Before he died, Congressman
Lewis reminded us that ``[t]he vote is the most powerful nonviolent
change agent you have in a democratic society. You must use it because
it is not guaranteed. You can lose it.'' We must vigorously defend our
right to vote, our access to the ballot box, and the integrity of our
elections.
In less than 100 days, Americans across the country will
participate in an election unlike any other in our history. The COVID-
19 pandemic is forcing State and local election officials to rapidly
expand vote-by-mail, early voting, and other crowd-reducing election
policies so no voter has to choose between their democratic rights and
their health.
As States scrambled to administer safe primary elections this
spring, seemingly administrative decisions related to the number and
location of polling sites had substantive impacts on people's voting
rights. Long lines and crowded polling locations in predominantly black
and brown neighborhoods raised the stress levels in communities
disproportionately impacted by COVID-19 and police violence and
underscored that the existence of systemic racism as is an injustice
that we must still overcome. We have a President who has repeatedly
tried to manipulate a news cycle, going so far as to falsely suggest he
can move the election date and, more insidiously, making baseless
claims about the security of vote-by-mail.
This behavior, in service to his own narcissistic political ends,
softens the turf for dangerous foreign influence campaigns and puts
Americans who want to exercise the franchise at risk. For the record,
the President does not have the power to move the date of the November
election. Moreover, last Friday the Cybersecurity and Infrastructure
Security Agency released a risk assessment of vote-by-mail.
CISA concluded that while there are risks associated with mail-in
voting--just as there with every other method of voting--those risks
can be mitigated. Further, I am not aware of any intelligence
assessment indicating that foreign actors have expressed interest or
capability to successfully interfere with vote-by-mail processes. We
must learn the lessons of our recent elections and do better in
November.
First, we must prepare Americans for the reality that elections
will be administered differently this fall. We must educate voters
about vote-by-mail, its related deadlines, and how expanded vote-by-
mail might affect the timing of election results. We must encourage
participation in vote-by-mail while inoculating the public from
disinformation campaigns aimed at undermining confidence election
results.
Second, we must ensure that changes to USPS service standards do
not jeopardize vote-by-mail, and that election officials seeking to
expand vote-by-mail coordinate with the Postal Service to coordinate
vote-by-mail policies and deadlines. Third, we must ensure election
officials do not use COVID-19 as a pretext for making administrative
decisions that could disenfranchise voters. Time and again, the impacts
of dysfunctional and chaotic election administration fall hardest on
black and brown communities. Election officials must be deliberate in
their efforts to ensure that no community is disenfranchised.
Fourth, we must not forget the lessons of 2016. It was around this
time in 2016 when the Russian foreign interference campaign engaged in
hack-and-dump operations against one candidate, and targeted election
systems in all 50 States. We must continue to improve the security of
election infrastructure and campaign organizations, and improve the
public's resilience to foreign influence campaigns.
Finally, we need to be honest with ourselves about what it will
take to administer safe, secure, and auditable elections this fall. It
has been over 10 weeks since the House passed the HEROES Act, which
would provide $3.6 billion in funding to support State and local
election officials. Despite urgent requests for additional resources
from State and local election officials across the country, the Senate
never voted on the HEROES Act, nor did include any election
administration funding in the COVID response package it released late
last month.
As House and Senate negotiations on COVID relief package continue,
I urge my Senate colleagues to step up and provide State and local
election officials the funding they need to administer safe, secure,
and auditable elections this November. I look forward to hearing from
the witness today their recommendations for Congress on ways to give
Americans more opportunities to vote this November, and to ensure the
safety and integrity of the election.
Mr. Richmond. I ask unanimous consent that Mrs. Demings of
Florida and Mr. Green of Texas be permitted to participate in
today's hearing without objection.
With that, I would like to recognize the Ranking Member of
the subcommittee, Mr. Katko of New York, for any opening
statements he may have.
Mr. Katko. Thank you, Mr. Chairman. I want to echo your
sentiment at the outset about John Lewis. He truly was a giant
in American politics and American leadership, and I considered
him a friend, and his legacy will live on long after his
passing, that is for sure.
I want to thank the CAT staff for accommodating the
schedule today. I have another example of how bad 2020 is. My
best friend's son is being laid to rest this morning, and so it
is, it is another awful--another awful example of this awful
year.
I want to thank Chairman Richmond for holding this
important hearing. Election security is something that I am
very concerned about. I have been working hard to ensure that
all Americans are able to vote securely and have their vote
counted.
Although we have made significant progress since 2016,
elections security remains a major concern of mine. Secure
voting systems and accurate reporting of votes are fundamental
to our democracy. Americans should have full confidence in
every aspect of our election process.
I want to applaud the elections security efforts by the
Cybersecurity and Infrastructure Agency that are known as CISA,
and its partnerships with State, local, territorial, and Tribal
governments that have resulted in a marked improvement of
election security over 2016. CISA provides State and local
officials the technical assistance, playbooks, and exercises,
shares information on threats, and assists us responding to
cyber incidents.
The pandemic has injected new elements of uncertainty into
the 2020 election that have forced many local election
officials to reinvent the process by which citizens vote. These
changes will keep citizens and poll workers safe while
maintaining citizens' faith in the process.
In March, Congress provided $400 million in the new Help
America Vote Act or HAVA funds to States to prepare for and
conduct a 2020 election during the pandemic. Aided by this
infusion of funding, State and local election officials are
adjusting to huge increases in voting-by-mail and the
consolidation of voting locations.
CISA is also working with State and local election
officials to head off disinformation campaigns engineered by
adversaries. A key component of this strategy is countering the
opportunity for adversaries to spread disinformation on remote-
voting procedures and changes in polling locations.
CISA has assisted State and local officials with methods to
drive voters to reliable sources of information, and how to
communicate changes to election procedures, polling locations,
and times.
Election security for 2020 has also improved as a result of
the growing participation in the Election Infrastructure ISAC
by State and local officials. The Election ISAC has provided
thousands of election offices with the cyber resources they
need to maintain the reliability of their election
infrastructure, including best practices, tools, training, and
perhaps, most important, information sharing and analysis.
However, many election offices don't have the IT knowledge
or resources necessary to take advantage of this information.
Some of them feel deluged with information that they simply
cannot sift through or handle from the ISAC. These local
election offices are not equipped to handle the cyber threats
to the election infrastructure alone. This is why I introduced
my Cyber Navigators Bill, which authorizes grants for State and
local governments to hire cybersecurity experts to provide risk
management, resiliency, and technical support in the
administration of elections. My bill enables the State to hire
a cybersecurity expert familiar with the State's unique
election systems. The regional nature of the assistance ensures
that those navigators are able to establish relationships with
their regional and State election officials. By targeting this
assistance at the administration of elections, State election
officials aren't forced to compete with other State priorities.
Election security has a history of bipartisan cooperation and
support. Ensuring that our election process is uncompromised
during the upcoming election must remain a top priority from
both sides of the aisle.
Together, I look forward to continuing to work toward the
goal with my colleagues on the subcommittee. I thank the
witnesses for providing the subcommittee with their testimony,
and I look forward to hearing their ideas in how we can further
improve the security of our election systems. With that, Mr.
Chairman, I yield back.
[The statement of Ranking Member Katko follows:]
Statement of Ranking Member John Katko
August 4, 2020
Thank you, Mr. Chairman.
I want thank Chairman Richmond for holding this important hearing.
Although we have made significant progress since 2016, election
security remains a major concern of mine. Secure voting systems and the
accurate reporting of votes are foundational to our democracy.
Americans should have full confidence in every aspect of our election
process.
I want to applaud election security efforts led by Cybersecurity
and Infrastructure Security Agency (CISA) and its partnerships with
State, local, territorial, and Tribal governments that have resulted in
a marked improvement of election security over 2016. CISA provides
State and local officials with technical assistance, playbooks, and
exercises, shares information on threats, and assists with responding
to cyber incidents.
The pandemic has injected new elements of uncertainty into the 2020
elections that have forced many local election officials to reinvent
the process by which citizens vote. These changes will keep citizens
and poll workers safe while maintaining citizens' faith in the process.
In March, Congress provided $400 million in new Help American Vote Act
(HAVA) funds to States to prepare for and conduct the 2020 Election
during the pandemic. Aided by this infusion of funding, State and local
election officials are adjusting to huge increases in voting-by-mail
and the consolidation of voting locations.
CISA is also working with State and local election officials to
head off disinformation campaigns engineered by adversaries. A key
component of this strategy is countering the opportunity for
adversaries to spread disinformation on remote voting procedures and
changes in polling locations. CISA has assisted State and local
officials with methods to drive voters to reliable sources of
information, and how to communicate changes to election procedures,
polling locations, and times.
Election security for 2020 has also improved as a result of the
growing participation in the Election Infrastructure ISAC (EI-ISAC) by
State and local election officials. The EI-ISAC has provided thousands
of election offices with the cyber resources they need to maintain the
reliability of their election infrastructure including best practices,
tools, training, and information sharing and analysis.
However, many local election offices don't have the IT knowledge or
resources necessary to take advantage of this information. These local
election offices are not equipped to handle cyber threats to their
election infrastructure alone.
This is why I introduced my Cyber Navigators bill which authorizes
grants for State and local governments to hire cybersecurity experts to
provide risk management, resiliency, and technical support in the
administration of elections. My bill enables a State to hire a
cybersecurity expert familiar with a State's unique election systems.
The regional nature of the assistance ensures that these navigators are
able to establish relationships with their regional and State election
officials. By targeting the assistance at the administration of
elections, State election officials aren't forced to compete with other
State priorities.
Election security has a history of bipartisan cooperation and
support. Ensuring that our election process is uncompromised during the
upcoming election must remain a top priority for both sides of the
aisle. I look forward to continuing to work toward this goal with my
colleagues on the subcommittee.
I thank the witnesses for providing the subcommittee with their
testimony and I look forward to hearing their ideas on how we can
further improve the security of our election systems.
I yield back.
Mr. Richmond. The gentleman from New York yields back.
Mr. Katko, we will all be saying prayers for you as you
attend the funeral, and we thank you for your attendance.
Mr. Katko. Thank you. Say a lot of prayer. I have got to
deliver the eulogy, and it is going to be a tough one. So thank
you, Mr. Chairman.
Mr. Richmond. Thank you. Members are reminded that the
subcommittee will operate according to the guidelines laid out
by the Chairman and Ranking Member in the July 8 colloquy. With
that, I ask unanimous consent to waive Committee Rule 882 for
the subcommittee during remote proceedings under the covered
period designated by the Speaker under the House Resolution
965. Without objection, so ordered.
The Chair now recognizes the Chairman of the full
committee, the gentleman from Mississippi, Mr. Thompson, for an
opening statement.
Maybe we don't. Do we have Mr. Thompson here?
The Chair will now--we will go on to the Ranking Member of
the full committee, and then we will come back to the Chairman.
So now the Chair recognizes the Ranking Member of the full
committee, the gentleman from Alabama, Mr. Rogers, for an
opening statement. Mr. Rogers is not here.
So let's do this, let's go straight to our amazing
witnesses. So I will now welcome our panel of witnesses. First,
I would like to welcome David Levine, an elections integrity
fellow at the Alliance for Securing Democracy. Mr. Levine
previously served in a range of positions administering and
observing elections and advocating for election reform,
including as the Ada County, Idaho elections director and as
the director of elections for the city of Richmond, Virginia.
Next, Ms. Sylvia Albert, the director of Voting and
Elections, Common Cause. Ms. Albert brings more than a decade
of professional experience in public interest law, and public
policy campaigns, expanding ballot access, reducing barriers to
participation, and combating voter intimidation among
historically disenfranchised communities.
Next, we will hear from Ms. Amber McReynolds, CEO for the
National Vote at Home Institute and Coalition. She is the
former director of elections for Denver, Colorado, and serves
on a National election task force on election crises. As a
former election official in a State with universal vote-by-
mail, I look forward to hearing her unique perspective on that
topic.
Finally, we have Mr. John Gilligan, the president and CEO
of the Center for Internet Security, or CIS. Together with
Elections Infrastructure, Information Sharing, and Analysis
Center, EI-ISAC, provides many resources to support the
Cybersecurity needs of the election community.
I appreciate you all joining us today. Without objection,
the witnesses' full statements will be inserted for the record.
I now ask each witness to summarize his or her statement for 5
minutes, beginning with Mr. Levine.
STATEMENT OF DAVID LEVINE, ELECTIONS INTEGRITY FELLOW, ALLIANCE
FOR SECURING DEMOCRACY, GERMAN MARSHALL FUND OF THE UNITED
STATES
Mr. Levine. Chairman Richmond, Ranking Member Katko, and
Members of this subcommittee on Cybersecurity, Infrastructure
Protection, and Innovation. Good morning, and thank you for the
opportunity to testify today on protecting the integrity of the
2020 elections during the COVID-19 pandemic.
My name is David Levine, and I am the elections integrity
fellow for the Alliance for Securing Democracy, a bipartisan,
Transatlantic initiative housed within the German Marshall Fund
of the United States. ASD develops comprehensive strategies to
defer and defend against authoritarian efforts to undermine and
interfere with Democratic institutions.
The 2020 primary election season has been unique with a
global pandemic, Nation-wide protests, and an on-going threat
of foreign interference. My testimony today focuses on 6 steps
that can be taken now to help ensure that the 2020 election is
safe, secure, and fair.
State and local election officials with help from their
partners must continually evaluate their election
infrastructure to ensure it is as secure as possible. Testing
and auditing existing systems is essential.
At a recent meeting of the National Association of
Secretaries of State, Matt Masterson, an advisor with the U.S.
Department of Homeland Security, told State officials that DHS
testing of State and local elections systems have found a
number of concerning vulnerabilities. These included, No. 1,
sharing passwords and other credentials, and using default
passwords commonly known to outsiders; and No. 2, continuing to
fall for phishing attacks that allow hackers to install
malware, including ransomware that could paralyze Election Day
operations.
As Masterson noted, the good news is that many of these
issues can be easily fixed by election day. The bad news is
that many local election offices are unable to make these fixes
quickly because they lack the necessary resources or IT
support. The coronavirus has exacerbated the problem by forcing
a number of States to divert election security funding to cover
other unanticipated costs stemming from the pandemic.
As the election infrastructure is modified to account for
the coronavirus or other intervening events, security and
resiliency measures must be part of the design and not
introduced after the fact.
In its June 2 primary election, the Washington, DC Board of
Elections, inundated with complaints from voters who did not
receive absentee ballots in the mail, decided as a last resort
to allow a number of domestic voters to submit their ballots by
email, so that their votes could be cast and counted. While the
effort was well-intentioned, it put election results at risk
because there is no way either for those voters to verify that
their votes were recorded accurately, or to ensure that those
votes were not altered in transmission by bad actors. Even if
there is no actual interference with email ballots, allowing
them provides fodder to foreign adversaries who could use such
actions to sow doubt and confusion about the legitimacy of our
elections.
We need to ensure that our elections are run as smoothly as
possible so that mis- and disinformation is less likely to be
effective. If our general election is plagued by significant
problems, inaccurate information is more likely to find a
receptive audience, as we have seen with Russia and Iran
already.
Regardless of how secure our elections are, experts and
officials are concerned that some voters could dismiss
November's results as invalid or rigged because of mis- and/or
disinformation. Voters could argue, for example, that the much-
longer-than-usual time required to count an anticipated surge
in mail-in ballots is direct evidence of nefarious conduct.
We must seek to flood the information space with credible,
consistent election information so that voters are immunized
against falsehoods. This will admittedly be challenging in
light of the coronavirus and the constant change it is
required. But it is doable, particularly, if Federal
authorities can provide State and local election officials
additional funding to publicize and explain changes to their
election processes. It is essential that also partisan politics
be kept out of election administration to build confidence in
the integrity of the election process, and it should happen
long before Election Day.
For example, Kentucky had a relatively smooth primary
election, in part, due to a bipartisan agreement reached well
in advance of the election between a Democratic Governor and a
Republican Secretary of the State. It took a number of joint
steps to help the State prepare for its primary, including
allowing for unprecedented expansion of absentee voting, and
allowing in-person absentee voting, which is effectively early
voting.
Election officials, finally, must also have sufficient
resources to plan for reasonably foreseeable contingencies.
Offering robust voting-by-mail, early voting, and election-day
options to minimize confusion and risks are optimal, but many
jurisdictions don't currently have the resources and/or
personnel to offer all of these approaches. Additional
resources from Federal authorities would help enormously with
administering and securing the election, but time is of the
essence.
The late Congressman John Lewis once said, ``Your vote is
precious, almost sacred. It is the most powerful, nonviolent
tool we have to create a more perfect union.''
I urge Congress to do everything possible to ensure that
every person who wants to exercise their right to vote can do
so. Thank you.
[The prepared statement of Mr. Levine follows:]
Prepared Statement of David Levine
August 4, 2020
i. introduction
Chairman Richmond, Ranking Member Katko, and Members of the
Subcommittee on Cybersecurity, Infrastructure Protection & Innovation:
Thank you for the opportunity to testify today on protecting the
integrity of the 2020 elections during the COVID-19 pandemic.
My name is David Levine, and I am the Elections Integrity Fellow
for the Alliance for Securing Democracy (ASD), a bipartisan,
transatlantic initiative housed within the German Marshall Fund of the
United States. ASD develops comprehensive strategies to deter and
defend against authoritarian efforts to undermine and interfere in
democratic institutions. Election integrity has been a core priority
since our inception, and we continue to be at the forefront of efforts
to raise awareness of threats and recommend legislative and technical
mitigation measures.
Prior to joining ASD, I served as the Ada County, Idaho elections
director, where I collaborated with the county's elected officials to
plan, oversee, and administer elections for more than 250,000
registered voters across 150 precincts. Before that, I spent several
years as a senior election administrator and consultant, helping
administer elections in Richmond, Virginia and Washington, DC. And on
behalf of the Organization for Security and Cooperation in Europe, of
which the United States is a member, I have been privileged to act as
an observer for a number of elections overseas.
This year, the United States has had a primary election season
unlike any other. Since the primaries began, our country has endured a
public health crisis that has claimed the lives of more than 150,000
people;\1\ experienced substantial protests and unrest in the aftermath
of George Floyd's death;\2\ and conducted elections while trying to
secure them from foreign adversaries, including Russia, China, and
Iran.\3\ State and local election officials, partner organizations,
voters and other stakeholders are being forced to grapple with new
election-related challenges in real time as they strive to hold safe,
secure, and accessible elections. Changes to voting processes to
account for the coronavirus impact the security of our elections. The
steps we take to combat the coronavirus must therefore consider the
threat of foreign interference, in addition to public health and
election administration.
---------------------------------------------------------------------------
\1\ Norah O'Donnell. ``U.S. hits 150,000 deaths,'' CBS News, July
29, 2020, https://www.cbsnews.com/news/covid-united-states-150000-
deaths-coronavirus/.
\2\ Derrick Bryson Taylor. ``George Floyd Protests: A Timeline,''
The New York Times, July 10, 2020, https://www.nytimes.com/article/
george-floyd-protests-timeline.html.
\3\ U.S. Department of National Intelligence, Statement by NCSC
Director William Evanina: 100 Days Until Election 2020, July 24, 2020,
https://www.dni.gov/index.php/newsroom/press-releases/item/2135-
statement-by-ncsc-director-william-evanina-100-days-until-election-
2020.
---------------------------------------------------------------------------
My testimony today focuses on steps that can be taken now to help
ensure that the 2020 general election is safe, secure, and fair. To do
this, I will address election infrastructure, information,
administration, and funding.
ii. election infrastructure
One noteworthy success from the 2020 primary elections is that
there hasn't yet been any confirmed successful attack on our country's
election infrastructure. I think that is a testament, at least in part,
to the strides our country has made in improving our election security
since the 2016 Presidential election, when we had relatively little
awareness of the threats foreign actors posed to our elections. State
and local election officials have subsequently become more well-versed
on cybersecurity issues, and with the assistance of Federal agencies
like the Department of Homeland Security's (DHS) Cybersecurity &
Infrastructure Security Agency (CISA), and a whole host of civil
society organizations and private-sector actors, there is now much more
information sharing and awareness of potential threats, as well as
proactive measures to protect our election infrastructure than before.
That said, the work of securing the 2020 Presidential election is
far from over. Below are 3 steps that election officials and their
partners must continue taking to help ensure that November's 2020
election is a secure one.
First, State and local election officials, with help from their
partners, must continually evaluate their election infrastructure to
ensure it is as secure as possible. Testing and auditing existing
systems is essential.
In June 2016, the State of Illinois experienced the first known
breach by Russian actors of State election infrastructure during the
2016 election. By the end of 2018, Russian agents had successfully
penetrated Illinois's voter registration database, accessed as many as
200,000 voter registration records, and exfiltrated an unknown quantity
of voter registration data. And while we are not aware of any evidence
that voter registration data was deleted or changed, the U.S. Senate
Select Committee on Intelligence found that Russian cyber actors were
in a position to modify the data they accessed.\4\
---------------------------------------------------------------------------
\4\ U.S. Congress, Senate, Select Committee on Intelligence,
Russian Active Measures Campaigns and Interference in the 106 U.S.
Election, Volume 1: Russian Efforts Against Election Infrastructure
with Additional Views, 116th Cong., 1st sess., 2019, 4 [sic], https://
www.intelligence.senate.gov/sites/default/files/documents/
Report_Volume1.pdf.
---------------------------------------------------------------------------
The Colorado Secretary of State's office recently announced that it
is partnering with a security firm to conduct penetration tests of its
election systems ahead of the Presidential vote. Trevor Timmons, the
chief information officer for Colorado Secretary of State Jena
Griswold, indicated that the firm's ``white-hat'' hackers would examine
the agency's election infrastructure, including the State-wide voter
registration database, the Secretary's main website, and electronic
pollbooks at physical precincts for people who choose to vote in person
because ``We need to know [vulnerabilities]. We've got enough time that
if they found anything we'd be able to respond to them.''\5\
---------------------------------------------------------------------------
\5\ Benjamin Freed. ``Colorado official details plan for
penetration testing of election systems,'' StateScoop, July 28, 2020,
https://statescoop.com/colorado-official-details-plans-for-penetration-
testing-of-election-systems/.
---------------------------------------------------------------------------
While the security of our election infrastructure, including our
State voter registration databases, appears to have improved since
2016, this kind of testing still has tremendous value. At a recent
meeting of the National Association of Secretaries of State, Matt
Masterson, an advisor with CISA, told State officials that DHS testing
of State and local election systems had found a number of
``concerning'' vulnerabilities. These included: (1) Sharing passwords
and other credentials, and using default passwords commonly known to
outsiders; and (2) continuing to fall for ``phishing'' attacks that
allow hackers to install malware, including ransomware that could
paralyze Election Day operations.\6\ As Masterson noted, the good news
is that many of these issues can be easily fixed by Election Day. The
bad news is that many local election offices are unable to make these
fixes quickly because they lack the necessary resources or IT support.
The coronavirus has exacerbated the problem by forcing a number of
States to divert election security funding to cover other unanticipated
costs stemming from the pandemic.\7\
---------------------------------------------------------------------------
\6\ Pam Fessler. ``With November Approaching, Election Officials
Still Face Safety, Security Fears,'' NPR, July 24, 2020, https://
www.npr.org/2020/07/24/894736356/with-november-approaching-election-
officials-still-face-safety-security-question.
\7\ Matthew Vann. ``Some cash-strapped States turn to election
security funds to fight COVID-19,'' ABC News, April 6, 2020, https://
abcnews.go.com/Politics/cash-strapped-states-turn-election-security-
funds-fight/story?id=69940136.
---------------------------------------------------------------------------
Second, as the election infrastructure is modified to account for
the coronavirus or other intervening events, security and resiliency
measures must be part of the design and not introduced after the fact.
In its June 2 primary election, the Washington, DC Board of
Elections (DCBOE)--inundated with complaints from voters who did not
receive requested absentee ballots--decided as a last resort to allow a
number of domestic voters to submit their ballots by email so that
their votes could be cast and counted.\8\ While the effort was well-
intentioned,\9\ it put the election results at risk because there is no
way either for those voters to verify that their votes were recorded
accurately, nor is there a way to ensure that those votes were not
altered in transmission by bad actors.\10\
---------------------------------------------------------------------------
\8\ Alexa Corse. ``D.C. Lets Voters Submit Ballots by Email After
Mail Problems,'' The Wall Street Journal, June 3, 2020, https://
www.wsj.com/articles/d-c-lets-voters-submit-ballots-by-email-after-
mail-problems-11591211518.
\9\ In addition to trying to ensure that additional voters could
cast ballots in a timely manner, the DCBOE was reported to have
required people who voted by email to submit an affidavit verifying
their identity. The DCBOE also indicated that it planned to call
everyone who voted by email to verify that was how they submitted a
ballot. Joseph Marks. ``The Cybersecurity 202: D.C.'s use of email
voting shows what could go wrong in November,'' The Washington Post,
June 4, 2020, https://www.washingtonpost.com/news/powerpost/paloma/the-
cybersecurity-202/2020/06/04/the-cybersecurity-202-d-c-s-use-of-email-
voting-shows-what-could-go-wrong-in-november/5ed7dd38602ff12947e83396/.
\10\ Ibid.
---------------------------------------------------------------------------
And even if there is no actual interference with emailed ballots,
allowing them provides fodder to foreign adversaries who could use such
actions to sow doubt and confusion about the legitimacy of our
elections. That is not idle speculation--it has been voiced by
authoritative sources ranging from the Senate's Select Committee on
Intelligence,\11\ to the National Academies of Science, Engineering,
and Medicine,\12\ CISA, the Election Assistance Commission (EAC), the
Federal Bureau of Investigation, and the National Institutes of
Standards of Technology.\13\
---------------------------------------------------------------------------
\11\ U.S. Congress, Senate, Select Committee on Intelligence,
Russian Active Measures Campaigns and Interference in the 106 U.S.
Election, Volume 1: Russian Efforts Against Election Infrastructure
with Additional Views.
\12\ The National Academies of Sciences, Engineering, and Medicine,
Securing the Vote: Protecting American Democracy, 2018, http://nap.edu/
25120.
\13\ The Cybersecurity and Infrastructure Security Agency, the
Election Assistance Commission, the Federal Bureau of Investigation and
the National Institute of Standards and Technology, Risk Management for
Electronic Ballot Delivery, Marking, and Return, May 2020, https://
s.wsj.net/public/resources/documents/
Final_%20Risk_Management_for_Electronic-
Ballot_05082020.pdf?mod=article_inline.
---------------------------------------------------------------------------
While the DCBOE has already said that it does not plan to allow
email voting in November, the situation it found itself in is one that
other jurisdictions could face, especially if COVID-19 continues to
make in-person voting challenging, requests to vote-by-mail continue to
multiply, and additional funds are not made available.\14\ It is
important that contingency plans for scenarios such as those above be
developed well in advance of November and rely on proven, secure,
resilient voting processes.
---------------------------------------------------------------------------
\14\ Marks, ``The Cybersecurity 202: D.C.'s use of email voting
shows what could go wrong in November.''
---------------------------------------------------------------------------
Finally, State and local officials should continue to be offered
help in securing their election infrastructure before November.
Federal agencies such as CISA and the EAC have resources available
to help detect and fix flaws, provide security training, and share best
practices for securing our elections. Some civil society organizations
can act quickly to help secure elections from the bottom up.\15\ With
fewer than 100 days before November 3, one of the best ways such
organizations could assist election officials at this juncture would be
to help identify poll workers who are willing to assist with in-person
voting at a time when the coronavirus is still expected to be
circulating.
---------------------------------------------------------------------------
\15\ U.S. Cyberspace Solarium Commission, March 2020, https://
www.solarium.gov/.
---------------------------------------------------------------------------
But civic action and commitment are not enough. The single most
important assistance that election officials could use at this juncture
is additional Federal funding. Congress provided $400 million to the
States for election assistance in March as part of the Coronavirus Aid,
Relief and Economic Security (CARES) Act. That was an important first
step that has helped enable many States and localities to go to greater
lengths to try and conduct accessible, secure elections during the
pandemic. That said, as a recent report put out by a(n) ideologically
diverse group of organizations, including ASD, Brennan Center for
Justice at NYU Law, the R Street Institute and University of Pittsburgh
Institute for Cyber Law, Policy and Security noted, $400 million isn't
enough to cover the remaining 2020 election costs in Georgia, Michigan,
Missouri, Ohio, and Pennsylvania, let alone the costs of the other 45
States and entities like DC, Puerto Rico, and the U.S. Virgin
Islands.\16\ Without further Federal assistance, the likelihood of
there being significant issues in the November general election will go
up. States and local governments across the country are facing severe
budget challenges as a result of COVID-19.\17\ Not surprisingly,
dealing with the disease itself gets first priority, but that means
that many are not in a position to cover the unanticipated election
costs arising from the virus.
---------------------------------------------------------------------------
\16\ Christopher R. Deluzio, Elizabeth Howard, David Levine, Paul
Rosenzweig, Derek Tisler, ``Ensuring Safe Elections: Federal Funding
Needs for State and Local Governments During the Pandemic,'' Brennan
Center for Justice, April 30, 2020, https://
securingdemocracy.gmfus.org/wp-content/uploads/2020/05/Ensuring-Safe-
Elections.pdf.
\17\ Ibid.
---------------------------------------------------------------------------
iii. election mis- and disinformation
Regardless of how secure our elections are, many election experts
and officials are concerned that some voters could dismiss November's
results as invalid or rigged because of mis- and/or disinformation.
Voters could argue, for example, that the much-longer-than-usual time
required to count an anticipated surge in mail-in ballots is prima
facie evidence of nefarious conduct. While most of us know that such
allegations are not true, similar rhetoric is already being amplified
by foreign adversaries, such as Russia and Iran, to diminish confidence
in the election results and undermine our democracy.\18\ In response,
we need to do at least two things.
---------------------------------------------------------------------------
\18\ Clint Watts. ``Triad of Disinformation: How Russia, Iran &
China Ally in a Messaging War Against America,'' Alliance for Securing
Democracy, May 15, 2020, https://securingdemocracy.gmfus.org/triad-of-
disinformation-how-russia-iran-china-ally-in-a-messaging-war-against-
america/.
---------------------------------------------------------------------------
First, we need to ensure that our elections are run as smoothly as
possible, so that mis- and disinformation is less likely to be
effective. If our general election is plagued by significant problems,
inaccurate information is more likely to find a receptive audience.
For example, during the February 3, 2020 Iowa Democratic caucuses--
which were administered by political party officials, not election
officials--the new app that the Iowa Democratic Party used to report
caucus results did not work as planned,\19\ resulting in a system-wide
meltdown.\20\ That provided enough of an opening for a conspiracy
theory to go viral and be amplified by accounts with Russian links.
This conspiracy theory accused Robby Mook (Hillary Clinton's 2016
campaign manager) of developing Iowa's mobile app to rig the Democratic
primary against Senator Bernie Sanders (Secretary Clinton's former
rival)--even though Mr. Mook had not developed (or even heard of) the
app.\21\
---------------------------------------------------------------------------
\19\ David Levine. ``The Election Official's Handbook: Six steps
local officials can take to safeguard America's election systems,''
Alliance for Securing Democracy, February 13, 2020, https://
securingdemocracy.gmfus.org/wp-content/uploads/2020/02/The-Election-
Officials-Handbook-2.pdf.
\20\ Shane Goldmacher and Nick Corasaniti. `` `A Systemwide
Disaster': How the Iowa Caucuses Melted Down,'' The New York Times,
February 04, 2020, https://www.nytimes.com/2020/02/04/us/politics/what-
happened-iowa-caucuses.html.
\21\ Nicole Perloth. ``A Conspiracy Made in America May Have Been
Spread by Russia,'' The New York Times, June 15, 2020, https://
www.nytimes.com/2020/06/15/technology/coronavirus-disinformation-
russia-iowa-caucus.html.
---------------------------------------------------------------------------
Even reasonable decisions about our voting processes can be become
fodder for foreign adversaries.\22\ In April, New York tried to become
the first State to cancel its Presidential primary over coronavirus
concerns, a move that was subsequently overturned \23\ by a Federal
court. Never wanting to miss an opportunity to cry foul, Russian actors
seized on the move to highlight domestic ``outrage'' at the change and
suggest that it constituted a ``blatant coronation'' of Vice President
Joe Biden at the expense of Senator Bernie Sanders.\24\ Reasonable
minds can differ about the State Board of Election's (SBE) decision to
cancel the Presidential primary, but the transparent, legal process
that played out after that decision stood in stark contrast to the lack
of recourse or due process offered by authoritarian regimes like
Russia.
---------------------------------------------------------------------------
\22\ Jessica Brandt. ``To Ensure a Healthy Election in a Pandemic,
First Prepare the Information Space,'' Alliance for Securing Democracy,
May 14, 2020, https://securingdemocracy.gmfus.org/to-ensure-a-healthy-
election-in-a-pandemic-first-prepare-the-information-space/.
\23\ Katelyn Burns, ``The New York State Presidential primary is
back on a Federal court ruling,'' Vox, May 6, 2020, https://
www.vox.com/policy-and-politics/2020/5/6/21249108/new-york-state-
presidential-primary-back-on-Federal-court-ruling.
\24\ Brandt, ``To Ensure a Healthy Election in a Pandemic, First
Prepare the Information Space.''
---------------------------------------------------------------------------
Second, we must seek to flood the information space with credible,
consistent election information so that voters are `immunized' against
falsehoods.
This will admittedly be challenging in light of the coronavirus--
because many voters are likely to be voting in a different manner than
they have previously, and election officials have been forced to make
continuous changes to their voting processes as the pandemic evolves.
But it is doable, particularly if Federal authorities can: (1) Provide
State and local election officials additional funding to publicize and
explain changes to their voting processes; and (2) communicate as much
information about election threats as possible to election officials
and the public. Flooding the space with this kind of information will
also sensitize journalists, candidates, and the public to the fact that
we may not know the election results immediately and that this is not,
in and of itself, proof of malfeasance.
iv. election administration
The 2020 primary elections gave many States an opportunity to
conduct at least one election during the pandemic prior to November.
There are at least 3 important takeways from these elections that can
be applied to November.
First, it is essential that partisan politics be kept out of
election administration to build public confidence in the integrity of
the election process, and this must happen long before Election Day.
Wisconsin's April 7 primary illustrated what can go wrong when
State leaders refuse to act on a timely basis, and ended up conducting
in-person voting in the middle of the State's coronavirus outbreak.
There were not enough poll workers and dueling court cases sowed
confusion about absentee voting, contributing to thousands of missing
or nullified ballots.\25\ In Milwaukee, where roughly 4 in 10 residents
are Black, officials closed all but 5 of the city's 180 polling places,
forcing thousands of voters to congregate at a handful of voting sites.
Many voters were forced to choose between risking their health to cast
a ballot or staying at home and forfeiting their vote.\26\
---------------------------------------------------------------------------
\25\ Amber Phillips. ``Wisconsin's decision to hold its primary is
threatening to become a worst-case scenario for elections amid a
pandemic,'' The Washington Post, April 6, 2020, https://
www.washingtonpost.com/politics/2020/04/03/wisconsins-decision-go-
ahead-with-its-primary-is-glimpse-worst-case-scenario-elections-during-
coronavirus/.
\26\ Li Zhou and Ella Nilsen. ``Liberal challenger Jill Karofsky
wins a seat on the Wisconsin Supreme Court,'' Vox, April 13, 2020,
https://www.vox.com/2020/4/13/21219284/jill-karofsky-wisconsin-supreme-
court.
---------------------------------------------------------------------------
Such mishaps provide openings to adversaries such as Russia, which
has targeted African-Americans with disinformation operations since the
2016 Presidential election,\27\ as well as China and Iran, both of whom
have used the coronavirus in an effort to undermine our democracy.\28\
---------------------------------------------------------------------------
\27\ U.S. Congress, Senate, Select Committee on Intelligence,
Russian Active Measures Campaigns and Interference in the 2016 U.S.
Election, Volume 2: Russia's Use of Social Media, 116th Cong., 1st
sess., 2019, https://www.intelligence.senate.gov/sites/default/files/
documents/Report_Volume2.pdf.
\28\ Watts. ``Triad of Disinformation: How Russia, Iran & China
Ally in a Messaging War Against America.''
---------------------------------------------------------------------------
In contrast, Kentucky had a relatively smooth primary election
despite early fears of turmoil, in part due to a bipartisan agreement
reach well in advance of the election between the Democratic Governor,
Andy Beshear, and the Republican Secretary of State, Michael Adams.
Beshear and Adams took a number of joint steps to help the State
prepare for its primary, including allowing for an unprecedented
expansion of absentee voting and allowing ``in-person absentee
voting'', which is effectively early voting and does not typically take
place in Kentucky.\29\
---------------------------------------------------------------------------
\29\ Zach Montellaro. ``Coronavirus threatened to make a mess of
Kentucky's primary. It could be a model instead,'' Politico, July 4,
2020, https://www.politico.com/news/2020/07/04/coronavirus-voting-
kentucky-primary-348611.
---------------------------------------------------------------------------
Second, election officials must have sufficient resources to plan
for reasonably foreseeable contingencies.
From an election administration, election security, and public
health standpoint, it would be optimal if as many voters as possible
voted before Election Day, either in person or from home. That
increases the time and choices available to address any issues that may
arise, such as malfunctioning voting equipment, long lines at voting
locations or unexpected delays in the mail service. But whatever
election officials do, many people will likely insist on voting in-
person on Election Day regardless of the pandemic--a development
Georgia experienced first-hand during its primary.
After twice postponing its primary due to the coronavirus, Georgia
substantially modified its election process to try to account for the
virus. It took the unprecedented step of mailing out absentee ballot
applications to all of the 6.9 million active registered voters in
Georgia to encourage more mail-in voting,\30\ and while a much higher
percentage of ballots were cast by mail than in previous elections,
more than half of all votes were still cast in-person;\31\ many of
those voters had a difficult experience. For example, voters in parts
of metro Atlanta waited in lines for more than 4 hours on Election Day
as election officials conducted an election with fewer voting machines
in polling places, fewer places to vote, and fewer experienced poll
workers because of the pandemic.\32\
---------------------------------------------------------------------------
\30\ Alexa Corse. ``Voting by Mail to Face Biggest Test Since
Pandemic Started,'' The Wall Street Journal, June 1, 2020, https://
www.wsj.com/articles/voting-by-mail-to-face-biggest-test-since-
pandemic-started-11591003801.
\31\ Mark Niesse, ``Turnout broke records in Georgia primary
despite coronavirus threat,'' The Atlanta Journal-Constitution, Updated
July 11, 2020, https://www.ajc.com/news/state--regional-govt--politics/
turnout-broke-records-georgia-primary-despite-coronavirus-threat/
G1JnSflr1YMOU06btlnbVJ/.
\32\ Stephen Fowler, `` `It Was Very Chaotic': Long Lines, Voting
Machine Issues Plague Georgia Primary,'' NPR, June 9, 2020, https://
www.npr.org/2020/06/09/873054620/long-lines-voting-machine-issues-
plague-georgia-primary.
---------------------------------------------------------------------------
Offering robust voting-by-mail, early voting, and Election Day
options to minimize confusion and risk are optimal, but many
jurisdictions don't currently have the resources and/or personnel to
offer these approaches. For example, Maryland Governor Larry Hogan
decided last month that the State would hold a traditional election in
November, offering many in-person voting locations and allowing voters
to vote in their customary precincts. At the end of July, the President
of the Maryland Association of Election Officials indicated that local
election boards are experiencing tremendous difficulty in recruiting
Election Day poll workers, with roughly 13,000 vacant positions State-
wide.\33\ On July 27, Howard County, Maryland Election officials
reported that 491 people had signed up to serve as Election Judges for
the general election, about a third of the number needed. By the time
the county election board met soon thereafter, the number of confirmed
Election Judges had dropped to 12 as Judges hurriedly withdrew their
pledges to participate in the face of the pandemic.\34\
---------------------------------------------------------------------------
\33\ Zach Montellaro, ``Coronavirus creates election worker
shortage ahead of November,'' Politico, July 31, 2020, https://
www.politico.com/news/2020/07/31/coronavirus-election-worker-shortage-
389831.
\34\ Emily Opilo and Talia Richman, ``Local election officials in
Maryland look at slashing number of polling places due to election
judge shortage,'' The Baltimore Sun, July 29, 2020, https://
www.baltimoresun.com/politics/bs-md-pol-polling-place-consolidation-
Governor-hogan-2020- 0729-4s3j7gq3afb3va57iwxpa24lcy-story.html.
---------------------------------------------------------------------------
Additional resources from Federal authorities will help enormously
with the administration of the 2020 Presidential election, but with
fewer than 100 days to go until November 3, time is of the essence. As
other experts have noted, more funding could enable election officials
to procure personal protective equipment (PPE) to make in-person voting
safer; purchase additional mailing, ballot, and postage supplies in
preparation for the anticipated surge in absentee voting; conduct
robust voter education campaigns so that voters are aware of how to
vote safely; recruit and train needed poll workers; and identify
additional polling places.\35\
---------------------------------------------------------------------------
\35\ Statement of Kristen Clarke, Lawyers' Committee for Civil
Rights Under Law, Senate Committee on Rules and Administration Hearing
on ``2020 General Elections Preparations,'' July 22, 2020, https://
www.rules.senate.gov/imo/media/doc/Testimony_Clarke.pdf.
---------------------------------------------------------------------------
New funding could also mitigate any cyber or technical-related
problems that would impact the administration of the general election.
While jurisdictions in 41 States and the District of Columbia use
electronic pollbooks (EPBs) to verify voter eligibility at polling
places, only 12 States and DC appear to require paper back-ups in case
the EPBs malfunction.\36\ More funds could help more jurisdictions
obtain paper back-ups for use if their EPBs become inoperable due to a
cyber attack or technical glitch.\37\ To cite just one other example,
localities with electronic voting machines could use funding to
purchase extra provisional ballots in the event that their voting
machines go down during the general election so that voters don't have
to wait for extended periods of time following a system failure.\38\
---------------------------------------------------------------------------
\36\ Edgardo Cortes, Elizabeth Howard, Lawrence Norden, Gowri
Ramachandran, and Derek Tisler, ``Preparing for Cyberattacks and
Technical Problems During the Pandemic: A Guide for Election
Officials,'' Brennan Center for Justice, June 5, 2020, https://
www.brennancenter.org/our-work/research-reports/preparing-cyberattacks-
and-technical-problems-during-pandemic-guide.
\37\ David Levine and Matthew Weil. ``20 for 20: 20 Ways to Protect
the 2020 Presidential Election,'' Alliance for Securing Democracy and
Bipartisan Policy Center, May 20, 2020, https://
securingdemocracy.gmfus.org/wp-content/uploads/2020/06/20-for-20-20-
Ways-to-Protect-the-2020-Presidential-Election.pdf.
\38\ Ibid, 6.
---------------------------------------------------------------------------
v. conclusion
Administering and securing a Presidential election is no small feat
in ordinary times, and these times are anything but ordinary. Success
will require a coordinated Nation-wide effort. Congress needs to
provide election officials with additional funding to help them
administer and secure the November election.
Federal officials involved in helping secure and administer our
country's elections need to continue to actively support the efforts of
State and local election officials to, among other things, mitigate any
efforts by foreign adversaries to interfere in our elections. And civil
society and private sector actors need to work with Government entities
to help fill any remaining gaps.
Voters have a part to play as well. They must plan now for how they
will vote in November. And if they want to vote in-person, they should
give serious thought to serving as a poll worker.
The late Congressman John Lewis once said, ``Your vote is precious,
almost sacred. It is the most powerful nonviolent tool we have to
create a more perfect union.''
We urge Congress to do everything possible to ensure that every
person who wants to exercise their right to vote can do so.
Thank you.
Mr. Richmond. Thank you, Mr. Levine.
We now recognize Ms. Albert to summarize her statement for
5 minutes.
STATEMENT OF SYLVIA ALBERT, DIRECTOR OF VOTING AND ELECTIONS,
COMMON CAUSE
Ms. Albert. Good morning. Thank you, Chairman Richmond, for
inviting me to testify today. Thank you to Chairman Richmond,
Ranking Member Katko, and all Members of the subcommittee, for
holding this critically important hearing.
My name is Sylvia Albert, and I am the director of voting
and elections at Common Cause, a National nonpartisan watchdog
organization with 1.2 million supporters and more than 25 State
chapters. For nearly 50 years, Common Cause has been holding
power accountable through lobbying, litigation, and grassroots
organizing. Common Cause fights to get big money out of
politics, enhance voting rights, foster an open, free, and
accountable media, strengthen ethics laws to make Government
more responsive to the people, ensure a fair Census, and stop
gerrymandering.
The COVID-19 pandemic presents an unprecedented challenge
to our democracy. We have long known that our decentralized
voting systems mean that voters have vastly different voting
experiences, depending on where they live. While the world
varies, there is one thing that is uniform. There is no such
thing as a perfect election. Long-standing disparities,
including long lines, polling place closures, a ballot
rejection rate, particularly in Black and Brown communities,
are now exacerbated by the COVID-19 pandemic. The chasm between
those with access to ballots and those with significant
barriers to that access is growing larger. Voters of color,
young voters, and first-time voters are on the losing end.
Without proper funding, the problems seen in previous elections
are going to be just the tip of the iceberg this November.
While only a small percentage of the electorate
participates in primaries, the 2020 primary season is a preview
of the problems to come. There is no single solution to ensure
a safe and secure election. However, by understanding this
compounding issue, we can work to eliminate the barriers voters
face. I want to highlight some of these issues, but for more
detailed proof in my written testimony.
In nearly every State that voted since the pandemic, we saw
a dramatic increase in the use of mail-in ballots. One common
issue was that ballots were mailed too late and some voters did
not receive them at all. In many States, the infrastructure to
process requests and produce ballots did not handle this huge
increase.
Expecting voters to vote-by-mail, election officials
overconsolidated poll locations. When they were unable fulfill
the requests for absentee ballots, voters were forced to vote
in person at a small number of polling locations that were,
therefore, overrun.
For example, Pennsylvania's 2 most populous counties,
Philadelphia and Allegheny, shifted for more than 2,100 polling
places to fewer than 500, resulting in confusion and long
lines. In addition, the polling places chosen for consolidation
were not done equitably or with regard to the disparity of
mail-in ballot applications.
In addition, voting machine failures led to
disenfranchisement. Problems were particularly wide-spread in
Georgia, ranging from machines not working to polling locations
not having enough machines, or when machines go down, there is
not--there was not enough paper ballots available to meet the
demand. As a result, voters had no choice but to wait in line
or not vote.
To be clear, with the correct implementation of resources,
running an election that gives voters safe and secure options
to vote-by-mail and in person if it is possible, but time is
running out.
During an election, officials have long tried to make
voting more difficult for Black and Brown communities. Impacts
in these efforts are greater exacerbated in a global pandemic.
However, there are solutions that will create systemic change.
Most importantly, it is going to take significantly more
resources for States to run effective elections in the COVID-19
environment. To address each of the problems discussed, States
need not only to adopt the policies, but also to have the funds
necessary to execute those policies. One study estimates this
cost to be $4 billion. Senate Republicans must follow the
House's lead and allocate $3.6 billion in election funding.
Second, even prior to the pandemic, 70 percent of election
officials reported that it was difficult to staff polling
locations. In addition, many traditional polling locations are
no longer available.
Members of Congress can help recruit poll workers and find
new polling locations by putting out requests on social media,
doing PSAs, and using their extensive network to encourage this
important civic engagement.
Third, H.R. 1 includes many strong protections for voters,
including the Voter Empowerment Act, which Congressman Lewis
long championed. We appreciate Chairman Richmond cosponsoring
and voting for H.R. 1 when it passed the House in March 2019,
and we continue to strongly urge Senator McConnell to bring it
up for a vote in the Senate.
Finally, as we approach the 55th anniversary of the Voting
Rights Act later this week, I can't think of a better way to
honor the life of Congressman John Lewis than by having the
Senate follow the House's lead and pass the John Lewis Voting
Rights Advancement Act.
Voters should not be forced to choose between their health
and their right to vote. With the election less than 3 months
away, we need Congress to act now. In order to ensure the 2020
election is safe, secure, accessible, and fair, Congress must
invest so States and localities can implement critical voting
system changes that this pandemic demands. Thank you.
[The prepared statement of Ms. Albert follows:]
Prepared Statement of Sylvia Albert
August 4, 2020
introduction
Thank you, Chairman Richmond, for inviting me to testify before the
House Homeland Security Subcommittee on Cybersecurity, Infrastructure
Protection, and Innovation. Thank you to Chairman Richmond, Ranking
Member Katko, and all Members of the subcommittee for holding this
critically important hearing. My name is Sylvia Albert, and I am the
director of voting and elections at Common Cause, a National
nonpartisan watchdog organization with 1.2 million supporters and more
than 25 State chapters. For nearly 50 years, Common Cause has been
holding power accountable through lobbying, litigation, and grassroots
organizing. Common Cause fights to get big money out of politics,
enhance voting rights, foster an open, free, and accountable media,
strengthen ethics laws to make Government more responsive to the
people, ensure a fair Census, and stop gerrymandering.
Common Cause was founded by John Gardner, a Republican, at a time
when Republicans and Democrats worked together on the most pressing
issues of the day. During the 1970's, Common Cause worked with many
Members of Congress--Democrats and Republicans alike--who put country
over party, and we were able to help pass major democracy reforms that
sought to correct some of the most egregious abuses of power, including
the Federal Election Campaign Act, the Ethics in Government Act, and
Voting Rights Act reauthorizations, which are still extremely
consequential to this day.
The COVID-19 pandemic presents an unprecedented and different kind
of challenge to our democracy. Under normal circumstances, conducting
elections is a collection of choreographed large-scale productions.
With more than 10,000 election jurisdictions Nation-wide, our
decentralized voting system is in the hands of local and State election
officials. While the mechanisms and rules vary across the country,
there is one thing that is uniform--there is no such thing as a perfect
election. Voters' experiences reveal the cracks in the foundation that
infringe on their right to vote. These cracks can be seen in the
adoption of policies that create significant barriers to voting for
certain individuals, especially Black and Brown voters. They can be
seen in election administration choices that lead to long lines,
polling place closures, and ballot rejections at higher rates in Black
and Brown communities. These cracks have always existed. The crisis we
are currently facing is exposing the weaknesses in the system that have
previously been hidden from much of the electorate. COVID-19 is
exacerbating these cracks and widening the chasm between those with
access to the ballot and those with significant barriers to that
access. Without proper funding, guidance, and preparedness, the
problems seen in previous elections are going to be just the tip of the
iceberg this November.
2020 primaries
The 2020 primary season gave us a small preview of the problems to
come. Keeping in mind that only a small percentage of the electorate
participates in primaries, we know that the issues we saw will grow
exponentially if proper preparation isn't made before November. The
problems we saw did not exist in a vacuum. Each issue, from poor
election management, to faulty voting machines, to lack of poll
workers, affects each other. There is neither one problem nor one
solution to ensure a safe, secure, free, and fair election. However, by
understanding the compounding issues, we can work to eliminate the
barriers voters face from making their voices heard.
As a member of the Election Protection coalition, a National group
of National and local organizations that help voters who experience
problems casting their ballots through a suite of vote protection
hotlines and other tools, we at Common Cause have seen many of these
issues play out not only in the last few months, but in all recent
elections. The COVID-19 pandemic has only made problems worse.
Polling place consolidations
As State and local governments dealt with a dramatic increase in
mail-in voting, a shortage of poll workers, and attempts to follow
public health guidelines, we saw many polling place consolidations
across the country. Overconsolidation in the current environment can
have drastic results.
Pennsylvania's two most populous counties, Philadelphia and
Allegheny, shifted more than 2,100 polling places open in a typical
election to fewer than 500, resulting in confusion, long lines, and
inaccessibility for voters with disabilities. In addition, the choices
with respect to consolidation were not done equitably, or with regard
to the disparities in mail ballot applications. In some counties, such
as Allegheny County, mail ballot applications were more likely received
from white voters, so non-white voters were faced with voting in-person
at more consolidated locations.
In New Mexico, only 381 out of the 548 polling locations were open,
which was particularly challenging for the Native population that is
suffering from COVID-19 at a much higher rate than the rest of the
State. In Rhode Island, only 47 polling places of the 144 that were
open in 2016 were available to voters. In Washington, DC, only 20 of
the 144 polling places from 2016 were open. In Nevada's June 9
primaries, which was conducted primarily by mail, only 3 polling places
were open for the Las Vegas area's 1.3 million voters, contributing to
long lines. In Richland County, SC, polling place consolidation coupled
with poll worker shortages led to long lines for the State's June 9
primary. Polling place consolidations in Wisconsin for the State's
April 7 elections received wide-spread media coverage because of the
drastic changes. In Milwaukee, just 5 of the normal 180 voting
locations were open, and in Green Bay, only 2 out of the normal 31 were
open.
These are just not facts and figures either. These problems affect
real people and voters across the country. Amina M., a Wisconsin voter
who had given birth only 2 weeks earlier, waited over 2 hours in line
in Milwaukee, fearing for her health. Layato G, a voter in Fulton
County, Georgia, told Common Cause her story during our election
protection efforts, and her story was not unique. She requested an
absentee ballot, but it never arrived so she was forced to vote in
person. When she arrived at her polling place, she found out there were
problems with the voting machines and ended up waiting in line to vote
for 3 hours. When she was finally able to cast her ballot, she was
forced to vote on a provisional ballot because she had been marked as
an absentee voter in the pollbook. Because of this confusion, she left
the polling place without assurance that her vote would even be
counted.
When coupled with the roll-out of new vote-by-mail procedures,
election officials' inability to process absentee ballot applications
in a timely manner, new voting machines, a lack of voter education, and
a global pandemic, long lines and confusion were a foreseeable outcome
of overconsolidation. Again, no issue exists in a vacuum. Decisions
around polling place closures must be made in consideration of all of
the other pieces of election administration, and the needs and wants of
the community. Closing a polling location should never be the first
option considered in changes to election administration.
Administration of Increased Vote by Mail Usage
In nearly every State that voted since the COVID-19 pandemic
outbreak, we saw a dramatic increase in the use of mail-in ballots. In
Washington, DC, more than 60 percent of ballots cast in the 2020
primary were by mail, compared to just 7 percent in the 2016 primary.
In Iowa, 410,000 people voted absentee in the 2020 primary, compared to
38,000 in the 2016 primary. In Pennsylvania, more than 1.8 million
people requested absentee ballots, compared to just over 100,000 from 4
years ago, thanks to Pennsylvania's recent law expanding absentee
ballot use. In Georgia, election officials saw a 2,500 percent increase
in voting-by-mail from the 2016 primary. In West Virginia, more than
262,000 voters requested an absentee ballot compared to 6,700 requests
in 2016.
Unfortunately, States were not equally prepared to handle this
influx. Voting-by-mail is a solution that has been tried and tested in
States across the country, but many of the primary States were trying
to implement and process a level of mail-in voting that took Colorado,
Oregon, Washington, and Utah years to get to. To be clear, with the
correct implementation, administration, and resources, running an
election mostly by mail is possible, but time is running out, and
States must act now.
The challenges we saw with voting-by-mail varied from State to
State. One common issue we saw was that ballots were mailed too late to
voters and that some voters did not receive them at all. In many of the
States that recently expanded vote-by-mail options because of COVID-19,
the infrastructure to process requests and produce ballots was not
fully implemented to deal with the huge increase of mail-in ballot
requests. Expecting voters to use the mail, election officials
overconsolidated polling locations. When they were unable to fulfill
the requests for absentee ballots, voters were forced to vote in person
at a small number of polling places that were therefore overrun.
In Maryland, for example, ballots were mailed to all of the State's
3.5 million registered voters, but at least 1 million of those ballots
were delayed in Baltimore City and Montgomery County. In both of those
localities, people of color make up a majority of the population. In
Pennsylvania, the complaint heard overwhelmingly from voters was that
they requested their absentee ballot, had not received it, and were
risking their health to vote in person. Indiana, Rhode Island, and
Georgia had similar challenges with ballots being mailed late.
Another issue with rapidly expanding mail-in voting are the use of
strict return deadlines, such as Indiana's deadline for voters to drop
off their ballots that they could or wish not to mail by 12 p.m. on
Election Day, even though the polls didn't close until 6 p.m. In
Virginia, over 5 percent of absentee ballots were rejected for arriving
after Election Day. For Pennsylvania's June 2 primary, the State's
inability to process absentee ballot applications and provide voters
with an absentee ballot led Governor Tom Wolf to extend the deadline
for receiving mail-in ballots in some counties until Tuesday June 9 as
long as they were postmarked by Election Day. As a result, tens of
thousands of ballots were counted that would have been rejected.
As voters exercise their right to vote in a new manner, there are
bound to be mistakes made. There is a learning curve, and
implementation which educates and assists voters is vital.
Unfortunately, without this, voters using mail-in voting saw their
ballots rejected at high rates. In the April primary in Wisconsin,
23,000 ballots were rejected, mostly because voters or their witness
missed one line on the form. These voters did not receive notice of the
mistake or given an opportunity to address it--their votes were simply
not counted. Wisconsin's experience is not unique. In New York, as many
as 28 percent of ballots in parts of Brooklyn were rejected. Seven
percent of absentee ballots were rejected in Kentucky's primary and
6,700 Nevada voters had their ballots rejected because officials could
not verify signatures. These ballot rejections do not affect all
communities equally. Disproportionate numbers of young people, people
of color, and first-time voters have their ballots rejected. We must do
more to ensure that voters can vote a ballot and have confidence that
it will be counted.
While all the issues we saw with mail-in voting can be solved by
November with proper funding, planning, and processes, we should not
lose sight of the dramatic increases in people wanting to vote-by-mail,
which is a good thing. It is clear that many people want to vote-by-
mail given the COVID-19 pandemic, and now election officials must make
the appropriate changes to ensure they are prepared to handle a
dramatic increase in mail-in ballot requests for November. State and
Federal lawmakers must also provide the adequate resources to make this
happen, and implement policies that notify voters of any issues with
their ballots, and allow them the opportunity to cure.
Technology Problems
The pandemic also coincided with the rollout of new voting
equipment in various States, such as Georgia and Pennsylvania. While
States with new equipment were not the only ones to encounter problems,
their problems were more severe and wide-spread. In deploying any
machinery during elections, jurisdictions must have resiliency plans to
deal with unforeseen events while protecting voters' access. Election
jurisdictions that only deploy machines to vote must have emergency
ballots and provisional paper ballots on hand in the event that the
primary voting system fails and no one can vote or only a few people
can vote at a time. Unfortunately, during the primary elections,
machine failures and a lack of paper backup ballots led voters to be
disenfranchised.
Several States, including Georgia, Pennsylvania, and Indiana, saw
voting machine glitches and failures which contributed to further long
lines. Voting machine problems in Georgia were particularly a wide-
spread problem. Issues ranged from machines not working to polling
locations not being staffed with enough machines, both which
contributed to long lines. Unfortunately, election officials were
warned that this would happen and did not listen. In February, Common
Cause and the Brennan Center for Justice submitted comments to the
office of Secretary of State Brad Raffensperger with specific
recommendations on managing the 2020 elections. Included in these
comments was both a call for more voting machines in polling locations
and a clear warning that Georgia's new voting machines could fail on
Election Day and that emergency back-up paper ballots were needed.
Regardless of the warning, these actions were not taken. When machines
went down, there were not enough paper ballots available to meet the
demand, despite a legal settlement in 2019 that required greater
numbers of paper emergency ballots be available. Polling places did not
have ``ballot on demand'' printers that could print out ballots once
the original supply of paper ballots was depleted. As a consequence of
the shortage, voters had no choice but to wait in line or not vote.
Lack of Poll Workers
A dearth of poll workers is a long standing problem in the United
States that has been exacerbated by COVID-19. In the 2018 Election
Administration and Voting Survey, 70 percent of election officials
reported that it was difficult to staff polling locations with an
adequate number of poll workers. These poll workers, with an average
age of 60, are overwhelmingly at high risk for COVID-19 and unable to
work the polls without danger.
David B. of Kentucky is another voter Common Cause contacted in our
election protection efforts. David was a long time poll worker, but
decided he should not work the polls in the 2020 primary election
because, as an older American, he was more vulnerable to COVID-19.
David is not alone in the thousands of poll workers across the country
who rather not expose themselves to this pandemic--and although we
desperately need poll workers like David, we cannot force people to
choose between their health and the willingness to volunteer.
As mentioned earlier, all these problems play off one another. When
a significant number of voters who requested absentee ballots but did
not receive them decided to vote in person, they voted in consolidated
polling places, some with faulty voting equipment and a shortage of
poll workers, all of which led to long lines for voters. In some cases,
like in Georgia, the poll worker shortages and confusion over polling
place consolidation led to voting locations not opening on time on
Election Day.
solutions
As election experts can attest, the majority of these problems are
not new. Certain election officials have long tried to make voting more
difficult for Black and Brown communities. It is especially appalling,
though, that in the midst of a global pandemic, certain election
officials are trying to suppress the votes and voices of largely Black
and Brown communities. In many cases, the coronavirus pandemic is
simply exposing these problems for all to see. It is also clear that
there is neither one problem nor one solution to problems witnessed in
the primaries. However, there are several short-term solutions, as well
as a number of legislative solutions that would get to the root of many
of these problems and create systemic change.
Members of Congress can help recruit poll workers and find new
polling locations.--Given the significant shortage of poll workers this
year, Members of Congress are encouraged to use various platforms to
help recruit new poll workers. Putting out requests on social media,
doing PSAs, and using their extensive email lists can be effective ways
to attract new poll workers. Additionally, because some in-person
polling locations that have previously been used may no longer be
conducive to social distancing, Members of Congress can play an
important role in identifying and connecting with venues in their
district, such as sports stadiums and other large buildings that could
provide social distancing for voters, that could serve as polling
locations.
Additional election funding.--As many States and localities face
huge budget deficits caused by the pandemic, our democracy is not
immune. Because many elections officials essentially have to prepare
for 2 different elections (one conducted by mail and one for in-person
voting) this November, States and localities need additional resources
to ensure no one is disenfranchised. To address each of the problems
discussed above, States need not only to adopt good policies, but also
have the funds necessary to execute those policies. The CARES Act
passed and signed into law in March provided $400 million for States to
administer their elections, but it is going to take significantly more
resources for States to run efficient elections in the COVID-19
environment. One study estimates the cost of the 2020 election during
the COVID-19 pandemic to be $4 billion.
In May, the U.S. House passed the HEROES Act, which includes an
additional $3.6 billion in election funding, a modest investment in our
democracy to help States and localities prepare to run their elections
during the pandemic. It was unconscionable that the recently released
``HEALS Act'' from Senate Republicans contained no funding for our
elections, yet included billions of dollars for fighter jets and other
extraneous causes. Senate Republicans must immediately pass $3.6
billion in election funding to ensure that hundreds of thousands or
even millions of voters are not disenfranchised this year. With less
than 3 months until the November election, Congress must act now so
States have enough time to make the necessary changes and plans,
recruit and train workers, buy equipment, and do outreach to the public
about new voting processes.
H.R. 1, the For the People Act.--H.R. 1 includes many extremely
strong protections for voters, such as on-line voter registration,
same-day (also known as ``Election Day'') registration, and automatic
voter registration to ensure that voters can safely and securely
register to vote during the pandemic. Each of these provisions allows
for voters to have more opportunities, in the face of challenges
(brought on by COVID for some, but always in existence for others) to
be able to vote and have confidence that it will count. The For the
People Act also includes the Deceptive Practices and Voter Intimidation
Prevention Act to deter bad actors from trying to spread false
information about voting. And importantly, the For the People Act
includes the Voter Empowerment Act, which Congressman Lewis long
championed. We very much appreciate Chairman Richmond cosponsoring and
voting for H.R. 1 when it passed the House in March 2019, and we
continue to strongly urge Senator McConnell to bring it up for a vote
in the Senate.
H.R. 4, the John Lewis Voting Rights Advancement Act.--Before
elections officials close, move, or consolidate polling locations or
make other changes to voting procedures, covered jurisdictions with a
history of discrimination would need sign-off from the Department of
Justice to ensure that these changes aren't being made for
discriminatory purposes. Five previous Voting Rights Act
reauthorizations were signed into law by Republican presidents, most
recently by President George W. Bush in 2006. As we approach the 55th
anniversary of the Voting Rights Act later this week, I can't think of
a better way to honor the life of Congressman John Lewis by having the
Senate follow the House's lead and pass the John Lewis Voting Rights
Advancement Act.
conclusion
Voters should not be forced to choose between their health and
their right to vote. With the 2020 election less than 3 months away, we
need Congress to act now to help protect our elections so all voters
can have their voices heard and votes counted. In order to ensure the
2020 elections are safe, secure, accessible, and fair, Congress must
make modest investments so States and localities can implement critical
voting system changes that this pandemic demands of us. At a bare
minimum, we urge Senate Republicans to listen to the hundreds of
thousands of Americans who have contacted their offices to urge them to
support additional election funding.
And if there's a more reform-minded Senate and administration next
year, Congress must pass critical reforms like H.R. 1 and H.R. 4. As
President Obama made plain just last week, the fight for a more just
and responsive democracy demands we continue the march of John Lewis.
We must ensure all voices can be heard in our democracy by restoring
voting rights, enacting automatic voter registration, and ending
partisan gerrymandering, as H.R. 1 and H.R. 4 would do. And if
Republicans refuse, we must cast aside the filibuster as the ``Jim Crow
relic'' it represents. Thank you.
Mr. Richmond. Thank you, Ms. Albert, for your testimony.
I now recognize Ms. McReynolds to summarize her statement
for 5 minutes.
STATEMENT OF AMBER MC REYNOLDS, CHIEF EXECUTIVE OFFICER,
NATIONAL VOTE AT HOME INSTITUTE
Ms. McReynolds. Thank you, Mr. Chairman, Members, and
staff. Thank you for inviting me to provide testimony about the
resiliency and readiness of our election systems during this
unprecedented public health crisis.
The pandemic has appended all aspects of our lives, and the
voting process is no different. Simply put, our democracy is
essential, and we must do everything we can to ensure our
election system is ready, resilient, and secure. Let me be very
clear: Election officials are working each and every day to
make this happen, even in extraordinary and extremely
challenging circumstances, and often with one hand tied behind
their backs, due to outdated laws and a lack of funding and
resources.
Extraordinarily long lines or other challenging
circumstances that voters often face, even prior to this year,
are usually the most visible symptoms of a policy or resource
problem.
Election officials have responded to difficult
circumstances with little support, and will attempt to do so
again this year, but this year is unprecedented. They need
support from elected leaders that have the power to help. They
are on the front lines delivering democracy to all voters in
small towns and metro areas across the United States. It is
only right that policy makers, not only at the Federal level,
but also at the State level, respond to their needs.
Extraordinary challenges call for extraordinary solutions.
What is clear to me during this pandemic and other
challenges we have faced as a Nation is that Americans are
resilient, and we need a voting process that is proven,
resilient from a pandemic, from unfairness, from barriers, from
foreign adversaries, from administrative deficiencies, and from
outdated policies that create challenges. We need a system that
can withstand all of those issues.
The fact is the pandemic has exposed challenges in most
States historical reliances on in-person voting on one single
day that requires a large number of people and resources to
manage. In too many primary States this year, the closure of
polling places, poll worker shortages, long lines, insufficient
training, and voters' reluctance to enter crowded environments,
along with surges, unprecedented surges in absentee ballot
requests that went unfilled due to the administrative burdens
to process, left many voters unable to safely exercise their
fundamental right to vote.
It is our elected leaders' responsibility to ensure that
our democracy functions, and that all voters have access to
participate. Enabling voting-at-home options is one way to
solve the challenges election officials, and by extension,
voters, face during this pandemic. Voting-by-mail is proven,
time-tested, and secure, and it dates all the way back to the
Civil War.
The mail ballot model, as designed, puts voters first, and
has proven to be resilient during both natural disasters and
the current pandemic. It is possible to improve to improve the
voting experience, streamline administrative processes, enhance
security, all while conserving valuable resources, increasing
turnout, and increasing trust in Government. Voters have been
voting this way at home, safely and securely for decades, in
many States. From Utah to Colorado, California, Oregon,
Washington, now Washington, DC, Vermont, and now Nevada, after
this weekend, policy makers have acted to ensure voters have a
clear range of options to vote safely and securely, because no
one should have to choose between voting and protecting their
health.
What does this process look like? In the 8 States plus
District of Columbia, as of August of this year, just recently
Nevada passed, voters will be mailed a ballot in advance of the
election and have multiple options to return that ballot.
In the rest of the States, voters can request a ballot to
be mailed to them. A small number of those States still require
an excuse to be provided with the ballot request, and even
fewer still limit options based on the voter's age.
But every single State offers an option to vote at home.
Whether you call it absentee, vote-by-mail, mail-in ballots, it
means that a ballot is being sent to the voter by mail, the
voter completes the ballot, and the ballot is returned. This
method of voting has been proven to be safe and secure, and it
includes strong safety measures to ensure the authenticity of
the ballots, and in some States, this includes ballot tracking
from the day the ballots are mailed all the way through when
they are processed.
Now, as a couple of notable considerations, and as you
mentioned the CISA report, the CISA report that was released on
Friday that talked about the importance of securing vote-by-
mail systems noted that disinformation risks to mail-in voting
infrastructure and processes is similar to that of in-person
voting while utilizing different content. Threat actors may
leverage limited understanding regarding mail-in voting to
mislead and confuse the public. This includes casting doubt
without evidence about the mail ballot process, thus combating
disinformation and misinformation is a critical aspect of
election officials' work to secure the election. Expanding
vote-at-home options is nonpartisan and supported by leaders on
both sides of the aisle.
A second notable consideration is the recent changes to the
USPS processes and delivery time lines that will have a
significant impact on our election process, regardless of the
voting method. Mail ballots are just one piece of how the Post
Office supports election infrastructure. Federal and State laws
have legal mandates with regards to sending voter registration
information, ballot issue notices, election information, poll
worker appointment letters, polling place notification cards,
signature cards, address update notifications, and other
required mailings.
All of these legally required mailings are at risk if the
Post Office is not able to process mail effectively, or
experiences delays.
Some States have also not updated their laws with regards
to processing, ensuring adequate time to process ballots. These
States include Michigan, Pennsylvania, Wisconsin, New York,
Maryland, and Alabama, and others. This is exactly why we have
seen delays in election results because election officials
don't have adequate time to process ballots in advance of
Election Day.
As with every part of our election system, we must be able
to deter, detect, and hold accountable any bad actor who tries
to interfere with our election process.
While voter fraud is exceedingly rare in elections
regardless of voting method, it is critical for election
officials to detect malicious activity, and for voters to
report suspicious activity to the appropriate authorities.
Our democracy functions when every eligible voter is able
to exercise their right to vote. Voters have already chosen to
vote at home in record numbers in the primaries, and they will
continue to do so.
Our democracy is essential, and we need to be sure that our
systems are secure from any interference and any misinformation
and disinformation as noted in the CISA report on Friday.
No election system is perfect, and this is why it is
critical to continually review and improve systems by enhancing
security access transparency, particularly in this
unprecedented time. An example of the necessary improvement is
the implementation ballot tracking system that many States are
working on right now. Another example is advanced auditing
techniques, such as risk-limiting audits. We cannot settle for
when this moment and this unprecedented crisis calls us to do
better.
Democracy is the shared DNA of our Nation, to our people,
to our communities. We must do everything we can to ensure that
the elections are secure. Going into November, election
administration must be about who votes, not who wins. You have
the authority to create a path for the American people and for
the American Democratic method that voters of all stripes can
be confident in. Let's do that together. Thank you.
[The prepared statement of Ms. McReynolds follows:]
Prepared Statement of Amber McReynolds
August 4, 2020
Chairman, Members & staff, thank you for inviting me to provide
testimony about the resiliency and readiness of our election systems
during this unprecedented public health crisis.
The pandemic has upended all aspects of our lives and the voting
process is no different. Simply put, our democracy is essential and we
must do everything we can to ensure our election system is ready,
resilient, and secure. Let me be clear: Election officials are working
each and every day to make this happen, even in extremely challenging
circumstances and often with one hand tied behind their backs due to
outdated laws and a lack of funding and resources. Extraordinarily long
lines or other challenging circumstances that voters often face are
usually the most visible symptoms of a policy or a resource issue.
Election officials have responded to difficult circumstances with
little support and will attempt to do so again this year. But this year
is unprecedented. They need support from elected leaders that have
power to help. They are on the front lines, delivering democracy to all
voters in small towns and in metro areas, and it is only right that
policy makers respond to their needs. Extraordinary challenges call for
extraordinary solutions.
What is clear to me during this pandemic and other challenges we
have faced as a Nation is that Americans are resilient, and we need a
voting process that is proven--resilient from a pandemic, from
unfairness, from barriers, from foreign adversaries, from
administrative deficiencies, and from outdated policies that create
challenges. We need a system that can withstand all.
The fact is the pandemic has exposed challenges in most States'
historical reliances on in-person voting on one single day that require
a large number of people and resources to manage. In too many primary
States this year, the closure of polling places, poll worker shortages,
long lines, insufficient training, and voters' reluctance to enter
crowded environments threaten the ability to vote in-person, and surges
in absentee ballot requests that went unfulfilled left many voters
unable to safely exercise their fundamental right to vote. It is our
elected leaders' responsibility to ensure our democracy functions and
all voters have access to participate. Enabling voting at home options
is one way to solve the challenges election officials and by extension,
voters face during this pandemic. Voting-by-mail is proven, time-
tested, and secure, and it dates back to the Civil War.
The mail ballot model puts voters first and has proven to be
resilient during both natural disasters and the current pandemic. It is
possible to improve the voting experience, streamline the
administrative process, enhance security, all while conserving valuable
resources, increasing turnout, and increasing trust in Government.
Voters have been voting this way at home safely and securely for
decades in many States. From Utah, to Colorado, California, Oregon,
Washington, DC, Vermont, and now Nevada, policy makers have acted to
ensure voters have a clear range of options to vote safely and
securely. No one should have to choose between voting and protecting
their health.
What does the process look like?
1. In 8 States plus DC (CA, CO, DC, HI, NV, OR, UT, VT, and WA, all
as of August 2020) voters will be mailed a ballot in advance of
the election and have multiple options to return their ballot
at a secure drop box, voting location, or by mailing the ballot
back through the postal service.
In the rest of the States, voters can request that a ballot be
mailed to them. A small number of those States still require an
excuse to be provided with the ballot request, and even fewer
still limit options based on a voter's age.
Every State offers an option to vote from home. Whether you call it
absentee, vote-by-mail, mail-in ballots--it means that a ballot
is being sent to the voter by mail, the voter completes the
ballot, and the ballot is returned.
2. Voting at home is a safe and secure method of voting and the
process includes strong security measures that ensure the
authenticity of ballots. In some States, the process includes
tracking ballots from the day they are printed to the day they
are processed. Just like tracking a package ordered on-line.
3. Accurate voter information is key, which requires that election
officials have the latest address information for each voter.
Most States share information on voter movement across State
lines, others directly contact voters based on mail forwarding
designations, death records, motor vehicle registrations, and
more to make sure voter information is accurate.
4. Your ballot is as unique as you are: Every voter gets a ballot
with barcodes on the envelope that correspond to the individual
voter and the voter's address. The ballot itself has a
removable stub, the information for the specific election,
precinct style, and other variables depending on the State.
5. Once ballots are dropped off, they go through a verification
process: During the process, election officials make sure that
the voting record of each voter is marked and that the ballot
envelope is verified before the ballot is counted, much like
when a voter checks in at their polling location.
6. The ballot is then extracted from the envelope. The extraction
process protects voter privacy, while maintaining the voter's
identity in the barcoding process for security. Audits are
conducted at each step and these audits ensure that every
eligible vote received in the designated time frame is counted.
7. Then the ballots are sent to the counting room and at this
point, state-of-the-art scanning equipment counts each batch of
ballots. Voter intent issues on ballots (such as stray marks)
are flagged for review and resolved by election officials.
8. Signature verification is a best practice security measure when
combined with appropriate processes: Voters sign their ballot
the same way they sign other legal documents, and that
signature is verified against other official signatures on
record. When done according to best practices like
demographically blind review, signature verification is an
important security measure that leads to greater election
confidence. Also voters with signature issues are given the
opportunity to ``cure'' their ballots, meaning that they are
able to directly verify the authenticity of their ballot.
Notable considerations:
1. As noted in the CISA Report released on Friday, ``Disinformation
risk to mail-in voting infrastructure and processes is similar
to that of in-person voting while utilizing different content.
Threat actors may leverage limited understanding regarding
mail-in voting to mislead and confuse the public.''
a. This includes casting doubt without evidence about the mail
ballot process.
Thus, combatting disinformation and misinformation is a critical
aspect of election officials' work. Expanding vote-at-home
options is nonpartisan and supported by leaders on both sides
of the aisle.
2. Changes to USPS processes and delivery time lines will have a
significant impact on our election process, regardless of
voting method. Mail ballots are just one piece of how the USPS
supports election infrastructure. Federal and State laws have
legal mandates with regards to sending voter registration
information, ballot issue notices, election information, poll
worker appointment letters, polling place notification cards,
signature cards, address update notifications, and other
required mailings. All of these legally required mailings are
at risk if the post office is not able to process mail
effectively or experiences delays.
3. Some States, such as MI, PA, WI, NY, MD, and AL, have not
updated certain election laws and processes to ensure adequate
time to process mail ballots, hence recent delays with election
results. Local election officials have repeatedly highlighted
this gap, and policy makers have not made these necessary
adjustments even though they are simply operational, and not
partisan. States still have time to close these holes, and
support election officials.
4. As with every part of our election system, we must be able to
detect, deter, and hold accountable any bad actor who tries to
interfere with the election process or with an individual
voter. While voter fraud is exceedingly rare in elections
regardless of voting method, it is still critical for election
officials to detect malicious activity and for voters to report
suspicious activity to appropriate authorities.
Our democracy functions well when every eligible voter is able to
exercise their right to vote.
Voters have already chosen to vote at home in record numbers in the
primaries. Recent surveys show that an extraordinary number of voters
are choosing to vote from home this November as well. Voters--the
customers of our democracy--are sending a very clear message about how
they want to vote; policy makers must respond to the needs of election
officials to ensure they have the resources to serve voters
effectively.
No election system is perfect, and this is why it is critical to
continually review and improve systems by enhancing security, access,
and transparency, particularly in this unprecedented time. An example
of a necessary improvement is the implementation of ballot tracking
systems that provide accountability to voters about the status of their
ballot and give election officials an ability to track ballots through
the process. Another example is advanced auditing techniques such as
risk-limiting audits. We cannot settle when the moment calls for us to
do better.
Democracy is the shared DNA of our Nation, to our people, to our
communities. We must do everything we can to ensure that it works for
all, even in this most trying time. Going into November, election
administration must be about who votes, not who wins. You all have the
opportunity to create a path forward for the American people, and for
an American democratic method that voters of all stripes can be
confident in. Let's do that together.
Mr. Richmond. Thank you for your testimony.
Finally, I recognize Mr. Gilligan to summarize his
statement for 5 minutes.
STATEMENT OF JOHN M. GILLIGAN, PRESIDENT AND CHIEF EXECUTIVE
OFFICER, CENTER FOR INTERNET SECURITY, INC.
Mr. Gilligan. Chairman Richmond, Ranking Member Katko, and
Members of the subcommittee, thank you for the invitation to
appear before this important committee.
My name is John Gilligan. I am the chief executive officer
of a nonprofit Center for Internet Security, or CIS. For the
past 10 years, CIS has had the privilege of operating the
monthly State Information Sharing and Analysis Center, the
cyber threat and best practice sharing organization consists of
nearly 10,000 State, local, Tribal, and territorial government
organizations.
In 2018, CISA was asked to establish a parallel
organization focused on U.S. election organizations. The
Elections Infrastructure Information Sharing and Analysis
Center or EI-ISAC is now fully operational, and has more than
2,600 State and local organizations as members. Today, I will
share my views about the progress that has been made in
protecting our Nation's elections' infrastructure from cyber
threats.
In the summer of 2016 and into 2017, many elections'
jurisdictions had immature technology security capabilities,
limited cybersecurity awareness and education, and insufficient
collaboration among key stakeholders at the Federal, State, and
local levels. In early 2018, DHS, the Elections Assistance
Commission, or EAC and the State and local elections officials
came together to jointly take on a series of actions to improve
the security of our elections' infrastructure. Information of
the EI-ISAC was one of these actions.
In addition to the cybersecurity activities that State and
local election officials undertake on their own, today the
technical protections deployed across the elections'
infrastructure have significantly improved since 2018. I will
highlight 3 of these technologies, comprising a layered, cyber-
defense approach, each funded, at least in part, to
Congressional appropriation.
First is the deployment of the Albert Network Monitoring
sensors at every State-level elections organization and a total
of 270 Albert Network Monitoring devices deployed to local
elections offices.
Second, an endpoint detection and response program with the
deployment of cyber sensors for individual systems in the
elections infrastructure. Thousands of these sensors are being
deployed as we speak.
Third, a capability called malicious domain blocking and
reporting that prevents elections offices' computers from
connecting to known malicious sites.
In the area of cyber awareness and education, a set of
broad initiatives has enhanced elections officials'
understanding of cyber attacks and what they should do to
assess their organization's cyber readiness. Conferences,
webinars, tabletop exercises, State-sponsored cyber education
events, educational materials, and situational updates from EI-
ISAC, as well as on-line courses sponsored by DHS's CISA
organization, the EAC, and third-party organizations, have
resulted in a dramatic improvement in the cybersecurity
awareness of elections official.
In addition to Federally-funded activities, CIS continues
to invest our own funds and seeks private grant support to
develop best practice guidance and tools for elections
officials.
While elections officials are not cybersecurity experts,
they now better understand the nature of cyber threats, the
available technical solutions, and what to do in response to a
cyber event.
Finally, with regard to the critical area of collaboration,
the working relationships and partnerships among Federal,
State, and local organizations have shown a remarkable
maturation. CISA, the EI-ISAC, associations representing the
secretaries of state or NASS, State elections directors, or
NASED, local elections officials, IGO, the EAC and the
elections center, as well as elections vendors and other
private and public organizations have been working
collaboratively with elections offices for the past several
years to improve the office's cybersecurity posture, and
relationships continue to improve.
Simply put, compared to 2016 and 2018, the security of the
election's infrastructure looks quite different in 2020. While
there are no guarantees on cybersecurity, I can assure you that
the security defenses that we have in place for November 2020
are vastly improved over those in place a short 4 years ago.
Congress, the elections officials, CISA, and a host of
public and private organizations, should be rightfully proud of
the progress that has been made in this area.
I close by respectfully recommending that Congress continue
to emphasize the importance of collaboration and cyber
technology innovation. I also encourage you to focus on the
attention on this and disinformation in American elections,
major vulnerability through November, and beyond.
In this last period, CIS has developed a misinformation
reporting portal for elections officials in order to simplify
reporting of elections-related lists and disinformation. We
piloted the system with elections officials in 5 States, and
have engaged with DHS, NASS, NASED to promote this capability
to social media platform. We believe that this capability will
be a valuable tool of increasing visibility of elections-
related mis- and disinformation. This concludes my oral
remarks, I look forward to your questions.
[The prepared statement of Mr. Gilligan follows:]
Prepared Statement of John M. Gilligan
August 4, 2020
Chairman Richmond, Ranking Member Katko, and Members of the
subcommittee, thank you for inviting me today to this hearing. My name
is John Gilligan, and I serve as the president and chief executive
officer of the nonprofit Center for Internet Security, Inc. (CIS). I
have spent most of my career in service to the Federal Government,
including serving as the chief information officer of both the U.S.
Department of Energy, and the U.S. Air Force. I appreciate the
opportunity today to share our thoughts on the current state of
American election security. I look forward to offering our ideas on how
we can collectively build on the progress being made in this important
area of critical National security.
Free and fair elections are essential to our democracy. In the
United States, elections are highly decentralized with more than 8,000
jurisdictions across the country responsible for the administration of
elections. While the Federal Government provides some laws and
regulations, the Federal Government does not administer elections and
has a limited role in dictating how the process is conducted. States
act as the primary authority for the laws and regulations that govern
the process of conducting an election and, accordingly, States have
substantial discretion on the process of conducting elections through
Secretaries of State and State election directors. State and local
officials have been defending our elections for over 2 centuries. The
2016 election was less about a new threat and more about the breadth
and depth of threat activity. Fortunately, since 2016 we have
collectively learned a great deal about how best to respond to these
cyber risks and to prepare for the 2020 election.
In short, I would like to: (1) Provide you a short background about
CIS; (2) describe the role and functions of the Elections
Infrastructure Information Sharing and Analysis Center (EI-ISAC), which
we operate in conjunction with the U.S. Department of Homeland Security
(DHS) Cybersecurity and Infrastructure Security Agency (CISA) with
funding from Congress; (3) describe our collaboration with elections
offices and key stakeholder organizations; (4) describe CIS's other,
significant best practice work in this area; and (5) respectfully make
3 recommendations.
(1) background about the center for internet security
Established in 2000 as a nonprofit organization, the primary
mission of CIS is to advance cybersecurity readiness and response. CIS
was instrumental in establishing the first guidelines for security
hardening of commercial Information Technology (IT) systems at a time
when there was little on-line security leadership. Today, CIS works
with the global security community using collaborative deliberation
processes to define security best practices for use by Government and
private-sector entities. The approximately 250 professionals at CIS
provide cyber expertise in 3 main program areas: (1) The Multi-State
Information Sharing and Analysis Center (MS-ISAC) and, more recently,
the EI-ISAC; (2) the CIS Benchmarks; and (3) the CIS Critical Security
Controls. I describe each briefly below.
The CIS Benchmarks \1\.--CIS produces the largest number of
authoritative, community-supported, and automatable security
configuration benchmarks and guidance. The CIS Benchmarks (also known
as ``configuration guides'' or ``security checklists'') provide highly-
detailed security setting recommendations for a large number of
commercial IT products, such as operating systems, database products
and networking systems. These benchmarks are vital for any credible
security program. The CIS Benchmarks are developed through a global
collaborative effort of public and private-sector security experts.
Over 200 consensus-based Benchmarks have been developed and are
available in PDF format free to the general public on the CIS or NIST
websites. An automated benchmark format along with associated tools is
also available through the purchase of a membership. CIS has also
created a number of security configured cloud environments, called
``hardened images'' that are based on the benchmarks that we are
deploying in the Amazon, Google, Oracle, and Microsoft cloud
environments. These hardened images help ensure that cloud users can
have confidence in the security provided within the cloud environment
they select. The CIS Hardened Images are used world-wide by
organizations ranging from small, nonprofit businesses to Fortune 500
companies.
---------------------------------------------------------------------------
\1\ Find out more information about the CIS Benchmarks here:
https://www.cisecurity.org/cis-benchmarks/.
---------------------------------------------------------------------------
The CIS Benchmarks are referenced in a number of recognized
security standards and control frameworks, including:
NIST Guide for Security-Focused Configuration Management of
Information System
Federal Risk and Authorization Management Program (FedRAMP)
System Security Plan
DHS Continuous Diagnostic Mitigation Program
Payment Card Industry (PCI) Data Security Standard v3.1
(PCI)
CIS Controls
U.S. Department of Defense Cloud Computing Security
Requirements Guide.
The CIS Controls \2\.--CIS is also the home of the CIS Critical
Security Controls (or the CIS Controls), the set of internationally-
recognized, prioritized actions that form the foundation of basic cyber
hygiene and essential cyber defense. They are developed by an
international community of volunteer experts and are available free on
the CIS website.
---------------------------------------------------------------------------
\2\ Find out more information about the CIS Controls and download
them for free here: https://www.cisecurity.org/critical-controls.cfm.
---------------------------------------------------------------------------
The CIS Controls act as a blueprint for system and network
operators to improve cyber defense by identifying specific actions to
be done in a priority order--achieving the goals set out by the NIST
Cybersecurity Framework (CSF). Moreover, the CIS Controls are
specifically referenced in the NIST CSF as one of the tools to
implement an effective cybersecurity program.\3\
---------------------------------------------------------------------------
\3\ NIST Framework, Appendix A, page 20, and throughout the
Framework Core (referred to as ``CCS CSC''--Council on Cyber Security
(the predecessor organization to CIS for managing the Controls)
Critical Security Controls).
---------------------------------------------------------------------------
To bring another level of rigor and detail to support the
development and implementation of the CIS Controls, CIS leveraged the
industry-endorsed ecosystem that is developing around the MITRE ATT&CK
(Adversarial Tactics, Techniques, and Common Knowledge) Framework.\4\
The ATT&CK Model comprehensively lists attack techniques that an
attacker could use at each step of an attack. Our analysis shows that
implementing the CIS Controls mitigates approximately 83 percent of all
the techniques found in ATT&CK.\5\ This implies that application of the
CIS Controls provides significant security value again a very wide
range of potential attacks, even if the details about those attacks are
unknown.
---------------------------------------------------------------------------
\4\ MITRE ATT&CK Framework, https://attack.mitre.org/.
\5\ CIS Community Defense Model v 1.0, the Center for Internet
Security, August 2020.
---------------------------------------------------------------------------
MS-ISAC \6\.--In late 2002, the Multi-State Information Sharing and
Analysis Center (MS-ISAC) was created by the State of New York with the
recognition that the State government community needed an information-
sharing mechanism (i.e., an information sharing and analysis center or
``ISAC'') to coordinate cybersecurity efforts and promote best
practices. In January 2003, the MS-ISAC had its first meeting, formally
launching an ISAC for State governments. DHS first reached out to the
MS-ISAC in September 2004 and began providing some funding. In 2010,
DHS officially designated the MS-ISAC as the key resource for cyber
threat prevention, protection, response, and recovery for the Nation's
SLTT governments and issued the first Cooperative Agreement. This
designation [sic] Also, in 2010, the MS-ISAC moved to its current
organizational home within CIS, where it has since resided.
---------------------------------------------------------------------------
\6\ Find out more information about the MS-ISAC here: https://
msisac.cisecurity.org/. A list of MS-ISAC services here: https://
www.cisecurity.org/wp-content/uploads/2018/02/MS-ISAC-Services-Guide-
eBook-2018-5-Jan.pdf.
---------------------------------------------------------------------------
The members of the MS-ISAC, the largest ISAC in the world, include
all 56 States and territories, and over 10,000 other SLTT government
entities including local governments, schools, hospitals, and publicly-
owned water, electricity, and transportation elements of the U.S.
critical infrastructure. MS-ISAC's 24x7 cybersecurity operations center
provides: (1) Cyber threat intelligence that enables MS-ISAC members to
gain situational awareness and prevent incidents, consolidating and
sharing threat intelligence information with the DHS National
Cybersecurity and Communications Information Center (NCCIC); (2) early
warning notifications containing specific incident and malware
information that might affect them or their employees; (3) incident
response support; and (4) various educational programs and other
services. Furthermore, MS-ISAC provides around-the-clock network
monitoring services with our Albert network monitoring devices for many
SLTT networks, analyzing over 1 trillion event logs per month. Albert
is a cost-effective Intrusion Detection System (IDS) that uses open
source software combined with the expertise of the MS-ISAC 24 7
Security Operations Center (SOC) to provide enhanced monitoring
capabilities and notifications of malicious activity. In 2019, MS-ISAC
analyzed, assessed, and reported on over 72,000 instances of malicious
activity for over 8,500 MS-ISAC members. CIS is installing a layered
set of cyber defense capabilities for the elections infrastructure that
results what is often referred to as ``defense-in-depth.'' The Albert
IDS capabilities are being complemented with end-point protection
capabilities, as well as automated blocking of known malicious internet
sites.
(2) the role and functions of the ei-isac
After the interference in the 2016 election, DHS, the National
Association of Secretaries of State (NASS), the National Association of
State Election Directors (NASED), the Elections Assistance Commission
(EAC), as well as local elections organizations, and CIS discussed the
possibility of creating an ISAC devoted solely to the Nation's
elections infrastructure. In 2017, DHS agreed to conduct a pilot
elections ISAC with 7 States. This pilot group developed and tested a
range of products geared toward communicating cybersecurity issues to
State and local election officials. Upon the success of that pilot, in
2018, DHS and the Election Infrastructure Subsector Government
Coordinating Council tasked CIS to stand up the Elections
Infrastructure ISAC (EI-ISAC). Leveraging the services offered and
experience gained through the MS-ISAC, the EI-ISAC is now fully
operational \7\ with all 50 States and the District of Columbia
participating, and over 2,600 total members, including the election
vendor community. The EI-ISAC provides elections officials and their
technical teams with regular updates on cyber threats, cyber event
analysis, and cyber education materials.
---------------------------------------------------------------------------
\7\ Find out more information about the EI-ISAC here: https://
www.cisecurity.org/ms-isac/. A list of EI-ISAC services can be found
here: https://www.cisecurity.org/ei-isac/ei-isac-servic-
es/.
---------------------------------------------------------------------------
Deploying More Albert Sensors.--As part of the initial launch, CIS
was also tasked with deploying a network of Albert sensors to all 50
State election offices and the 5 largest counties in States that have
bottom-up and hybrid voter registration processes. Since then, all 50
States have deployed and many States have leveraged HAVA funding to
procure additional Albert sensors for every county election office. CIS
now processes data from 269 Albert sensors monitoring State and local
election networks, which support on-line elections functions such as
voter registration and election night reporting. The Albert sensors
processed 30 petabytes of data in the first half of 2020, resulting in
nearly 2,000 cyber event notifications to elections offices.
Improving Situational Awareness.--Starting with the 2018 primaries
and mid-term elections, the EI-ISAC has hosted the Election Day Cyber
Situational Awareness Room, an on-line collaboration forum to keep
elections officials aware of cyber and non-cyber incidents and
potential cyber threats for any State-wide or National election. More
than 600 elections officials, Federal partners, and election vendors
have participated in these forums. It is expected that participation in
the situation room will likely grow to all 50 States for the November
2020 General Election.
Piloting New Technology.--Earlier this year, the EI-ISAC, in
cooperation with DHS CISA and Congressional appropriators, expanded our
protection of elections through 2 new programs aimed at addressing the
needs of lower-resourced organizations. These new programs also provide
a defense-in-depth capability where multiple cyber defense capabilities
working together improve threat situational awareness and increase
effectiveness in defeating malicious threats:
The Endpoint Detection and Response (EDR) Pilot for Elections
Infrastructure provides a sophisticated cybersecurity
technology that complements the network monitoring performed by
the Albert network sensors for the elections community. The EDR
sensors also expand and enrich the threat intelligence
available to the MS- and EI-ISAC. The EDR solution has the
capability to monitor internal network traffic, and the EDR
agents can programmatically block malicious activity and
quarantine compromised systems, shifting the immediate
cybersecurity response effort from election offices to the CIS
SOC. This will allow smaller or less mature offices to take
advantage of the same protections as larger offices improving
the community's cybersecurity. CIS is currently deploying EDR
sensors, focusing on critical systems in the elections
infrastructure, like voter registration, election management,
and election night reporting.
The Malicious Domain Blocking and Reporting (MDBR) Pilot provides a
commercial secure Domain Name System (DNS) service to block
access from SLTT member organizations to known malicious
domains. In effect, the capability prevents the execution of
the majority of malicious attacks associated with ransomware,
malware, command and control, and phishing domains. Anonymized
data from this offering will be correlated with other threat
intelligence feeds and provided in threat reporting to CISA and
the broader SLTT community. The MDBR capability can be
implemented in minutes and recent NSA analysis indicates that
this solution can reduce the ability for 92 percent of malware,
from a command-and-control perspective, to deploy malware on a
network.\8\ CIS began deploying this capability in early July.
While the capability is available to all SLTT organizations,
the priority is to deploy to elections organizations prior to
November.
---------------------------------------------------------------------------
\8\ ``The NSA is piloting a secure DNS service for the defense
industrial base'', Cyberscoop, June 18, 2020, https://
www.cyberscoop.com/nsa-secure-dns-service-pilot-defense-industrial-
base/.
---------------------------------------------------------------------------
(3) collaboration with elections offices and key stakeholder
organizations
Both as a part of CIS's role in operating the EI-ISAC as well as
efforts not funded by the Government, we have placed emphasis on
establishing a trusted relationship with elections officials and other
key stakeholders. CIS has participated and conducted cyber exercise for
elections offices, conducted numerous cyber webinars, and made in-
person visits to almost every State and many local elections
jurisdictions, many of these activities in partnership with DHS CISA.
In addition, we have worked closely with other key organizations
supporting the elections community such as the National Association of
Secretaries of State (NASS), the National Association of State
Elections Directors (NASED), the Elections Assistance Commission (EAC),
the Election Center, and the International Association of Government
Officials (IGO). Finally, we have also worked closely with private-
sector organizations such as Harvard's Belfer Center, Microsoft,
elections vendors, and other organizations who are working to improve
the security of our elections infrastructure.
(4) cis's other, significant election security best practices
CIS also makes significant investment is Election Security Best
Practices and related tools. Since the release of our Handbook for
Election Infrastructure Security in 2018, CIS has become the leading
non-Government provider of election security advice to SLTT election
authorities, election technology vendors, and the elections community
at large.
The Handbook for Election Infrastructure Security provides 88 best
practices covering the entirety of the election administration
technology. These best practices have been widely adopted by the
election community with State and local offices in 34 States using them
as a metric for assessing the security of elections systems. To assist
States and local election officials assess and adopt these best
practices, CIS developed and maintains the Election Infrastructure
Assessment Tool (EIAT). The EIAT is a free on-line tool designed to
help election officials assess their IT infrastructure against the 88
best practices from the Handbook. We have had over 600 users
representing 34 States and 265 local election jurisdictions take
advantage of the EIAT.
A Guide for Ensuring Security in Election Technology Procurements
was released in May 2019 to assist election officials with ensuring
security is properly accounted for in their election technology
procurements. This guide provides 33 recommended questions to ask of
election technology providers and assist election officials assess
responses by providing descriptions of good and bad responses.
CIS released its Security Best Practices for Non-Voting Election
Technology in October 2019 to address internet-connected election
technology such as electronic poll books, electronic ballot delivery,
and election night reporting systems. This guide covers 5 areas of
technology: Network and Architecture, Servers and Workstations,
Software Application, Data, and Administration. The areas were chosen
carefully based on similarities in threats, mitigations, and
governance.
CIS has followed up these election technology best practices with
an on-going pilot project on how to verify systems against these best
practices. Traditional voting systems are verified against large
monolithic standards using lengthy and expensive certification
campaigns. Our alternative approach, known as Rapid Architecture-Based
Election Technology Verification (RABET-V), focuses on the need for
internet-connected election technology to be responsive and adapt
quickly to changes in the threat landscape. RABET-V is addressing this
with a process model that provides assurances of security, reliability,
and functionality in a risk-based, flexible, change-tolerant process.
We are currently piloting this process with several election technology
vendors and a steering committee consisting of the Election Assistance
Commission, DHS CISA, Federal Voting Assistance Program, and the States
of Wisconsin, Ohio, Maryland, Texas, Pennsylvania, and Indiana. We
anticipate a report following the November General Election.
Misinformation Reporting Portal Pilot.\9\ CIS is currently
producing a better means for election officials to report election
infrastructure misinformation and disinformation to the social media
platforms for their investigation and adjudication. Currently, a
limited set of election officials can report to Facebook and Twitter
using the means provided directly by the social media platform.
Elections officials must pre-register with the platform and report
independently to each one. CIS is working to facilitate a single
reporting portal where election officials can report the suspected
misinformation and disinformation once, and have it distributed to the
various social media platforms. We have been working closely with DHS,
NASS, and NASED, along with 5 States to vet and promote this concept to
the social media platforms.
---------------------------------------------------------------------------
\9\ The RABET-V and Misinformation Reporting Portal are projects
being funded by the nonprofit Democracy Fund.
---------------------------------------------------------------------------
The Misinformation Reporting Portal will provide elections
officials with a single place (i.e., the portal) for reporting mis- and
disinformation across multiple social media platforms with a
streamlined, consistent user experience. In addition, the entire
elections community will have visibility of what's going on with mis-
and disinformation in the elections community within and outside their
jurisdictions, including to see trends and be able to strategically
respond. The portal will also streamline and standardize reporting for
the social media organizations. In addition, voters will have the
benefit of more rapid correction of erroneous information, leading to
improved voter confidence.
(5) three recommendations to continue securing elections
While much progress has been made over the last 4 years, we know
that the threat remains, and, as a Nation, we must continue to address
these new risks and vulnerabilities. We respectfully recommend 3
courses of action to keep our elections safe and secure. We must: (1)
Continue to emphasize the importance of collaboration and foster
collaboration across all elections stakeholders; (2) continue to
innovate and leverage evolving security and applicable commercial
technologies; and (3) consider how best to address the impact of mis-
and disinformation on American elections.
Emphasize Collaboration.--We hear much of the importance of
resilience in the homeland security context. When you look back on it,
the post-2016 response to securing our elections is an excellent
example of a successful public-private partnership. The recognized
shortfalls in 2016 have helped highlight a National crisis that has
been responded to by many organizations working together.
NASS, NASED, the Election Center, IGO and their respective members
remain central in running American elections. Collectively, they
continue to provide the deep expertise in exactly how the complicated
function of operating elections works, and how new processes and
technology can best be used in each jurisdiction. Other State and local
associations like the National Governors Association (NGA), the
National Conference of State Legislatures (NCSL), the National
Association of State Chief Information Officers (NASCIO), the National
Association of Counties (NACo), the National League of Cities (NLC),
the National Emergency Management Association (NEMA), and others have
stepped up and collaborated to identify and facilitate the best
approaches to improving security of the elections infrastructure within
their jurisdictions.
On the Federal side, Congressional appropriators were several times
able to provide significant funding for critical election security
grants that were, simply put, essential to help prepare elections
offices with limited resources across the country. An active and
engaged DHS CISA enthusiastically accepted the role of the Nation's
Risk Advisor on elections, used their convening power and bully pulpit
as the lead Federal agency to good effect, and CISA continues to be an
excellent partner in the MS- and EI-ISACs. Despite having one of the
smallest budgets in the Federal Government and new leadership, the
Election Assistance Commission (EAC) efficiently distributed $825
million in grants to the States, helped develop guidance around voting
as safely as possible during the COVID-19 pandemic, and stood up a
RABET-V (with CIS as described above).
Further, the elections vendors, private sector, public and private
universities, think tanks and foundations, as well as nonprofit
corporations like CIS have come together to help address the technical,
process, and educational challenges facing the U.S. elections
community. The result is that the protection capabilities of our
elections infrastructure are enormously improved from 2016 and even
where they were in 2018. However, it is recognized that we are not yet
where we want to be and the threat continues to increase. It will take
continued collaboration to sustain and hopefully even accelerate the
progress that we have seen over the past 3 years.
Continue to Innovate.--As noted above, the progress made in
deploying additional technical measures and in education and training
since November 2016 is impressive. However, there are opportunities to
improve in each area. A danger when addressing the sensitive area of
elections is to be overly cautious in assessing and piloting new
methods and technical solutions. CIS was grateful to be given funding
from Congress and tasking from CISA to pilot EDR and the MDBR
technology. We are already seeing that these technologies will be
important capabilities to protect our elections infrastructure. Working
with the EAC, we are piloting what we hope will be a much quicker and
less costly process for verifying elections systems. We encourage
Congress to continue to support experimentation and innovation so that
we can continue to leverage the best talent and capabilities that the
country has to offer in a way that produces the most value for the
American taxpayer.
Address the impact of mis- and disinformation on elections.--While
we have made great strides in improving resilience against cyber
threats, perhaps the biggest challenge that we face as a Nation going
forward is how we address the impact of mis- and disinformation on
elections. While we treasure our rights granted to all citizens by the
First Amendment, the power of social media in shaping opinions and
attitudes is expanding rapidly. CIS is working to help address the
challenge of identifying and reporting deliberate or accidental
misinformation or disinformation that might prevent voters from
exercising their right to vote. This is a first step. However, the
broader challenge is to establish norms and conventions that will help
voters understand what is factual and what is opinion or even
deliberate attempts to mislead. We would encourage Congress to take an
incremental approach to addressing this challenge.
conclusion
Securing American elections is a complex, decentralized enterprise
that is fundamental to preserving our democracy. Fortunately, our State
secretaries of state, State elections directors, and elections
officials have been successfully defending our elections for over 2
centuries. Furthermore, since 2016, we have learned much about how this
new risk can be defended. CIS is proud to have developed and to operate
the Elections Infrastructure ISAC (EI-ISAC), and to have devised
several other significant best practices to help the with this vital
task.
To that end, CIS is committed to a long-term effort to continuously
advance and promote best practices for elections security as part of a
National response to threats against election infrastructure.
Mr. Richmond. Thank you. I want to thank all the witnesses
for their testimony. I see that we have been joined by the
Chairman of the full committee. I will recognize the gentleman
from Mississippi, Mr. Thompson, for his opening statement.
Mr. Thompson. Thank you very much. Thank you very much, Mr.
Chairman. I appreciate the opportunity to speak. As you know,
we are less than 100 days away from the election, and House
Democrats are working hard to persuade Senate leadership to
provide additional election assistance to help States
administer safe, secure, and auditable elections during the
COVID-19 pandemic. This hearing could not come at a more
appropriate time.
Last week, we celebrated the life of Congressman John
Lewis. As we mourned our loss, we grappled with the tremendous
task of how best to honor his legacy. In his final days,
Congressman Lewis committed a lifetime of fighting for justice
to parting advice to guide us through this turbulent time. He
challenged us to stand up for injustice. He called each of us
to use our talents to build a better country than the one we
inherited. We are reminded that democracy is not a state. It is
an act.
This November, our Nation will participate in an election
that would look like no other in our history. The COVID-19
pandemic will demand that we adopt our voting procedures to
ensure that no American must choose between exercising their
democratic right to vote and protecting their health. At the
same time, we must defend our democracy against adversaries who
will use our differences of opinion to sow irreparable division
among us.
We must remain vigilant in defending the truth and keep the
public informed to deny our adversaries the opportunity to fill
information vacuums with lies. Now more than ever, we each have
a role to play in defending our democracy.
As Chairman of the Homeland Security Committee, I have
fought to protect the voting rights of all Americans, and to
secure funding to help State and local election officials
replace outdated, unsecured election equipment. Last March, the
House passed H.R. 1, which included the Election Security Act,
which will provide funding to States to improve election
security and direct a whole-of-Government response to counter
foreign influence campaigns aimed at undermining confidence in
our democratic institutions.
On May 15, the House passed the HEROES Act, which would
provide $3.6 billion to help States navigate the challenges
associated with administering November elections during COVID-
19 pandemic. That is in addition to the $800 million already
made available this year. Both bills are languishing in the
Senate.
The recent COVID-19 relief package proposed by the Senate
Majority provides no resources to help States afraid of costs
of administering Federal elections. As my Senate colleagues
post their tributes to Congressman Lewis, I call on them to
remember the cause that was so dear to him. Access to the
ballot box, and fight to include necessary voting reforms and
funding to implement them in the next COVID-19 package.
Our State officials must adopt by changing outdated voting
rules that prohibit no-excuse absentee voting and the early
voting, both of which would release lines and crowding, making
it safe to vote. The also has a role to play. They must seek
out reliable sources of accurate information and engage in
election process. The integrity of the November elections
depend on a whole-of-Nation commitment to our democracy.
I look forward to our conversation today on that effort,
and I yield back the balance of my time.
[The statement of Mr. Thompson follows:]
Statement of Chairman Bennie G. Thompson
August 4, 2020
We are less than 100 days away from the election, and House
Democrats are working hard to persuade Senate leadership to provide
additional election assistance to help States administer safe, secure,
and auditable elections during the COVID-19 pandemic. This hearing
could not come at a more appropriate time.
Last week, we celebrated the life of Congressman John Lewis. As we
mourned our loss, we grappled with the tremendous task of how best to
honor his legacy. In his final days, Congressman Lewis committed a
lifetime of fighting for justice to parting advice to guide us through
this turbulent time. He challenged to us to stand up to injustice. He
called on each of us to use our talents to build a better country than
the one we inherited. And he reminded us that ``Democracy is not a
state. It's an act.''
This November, our Nation will participate in an election that will
look like no other in our history. The COVID-19 pandemic will demand
that we adapt our voting procedures to ensure that no American must
choose between exercising their democratic right to vote and protecting
their health.
At the same time, we must defend our democracy against adversaries
who will use our differences of opinion to sow irreparable divisions
among us. We must remain vigilant in defending the truth and keep the
public informed to deny our adversaries the opportunity to fill
information vacuums with lies. Now more than ever, we each have a role
to play in defending our democracy.
As Chairman of the Homeland Security Committee, I have fought to
protect the voting rights of all Americans and secure funding to help
State and local election officials replace outdated, unsecure election
equipment. Last March, the House passed H.R. 1, which included The
Election Security Act, which would provide funding to States to improve
election security and direct a whole-of-Government response to counter
foreign influence campaigns aimed at undermining confidence in our
democratic institutions.
On May 15, the House passed the HEROES Act, which would provide
$3.6 billion to help States navigate the challenges associated with
administering November elections during the COVID-19 pandemic. That is
in addition to the $800 million already made available this year. Both
bills are languishing in the Senate.
The recent COVID-19 relief package proposed by the Senate Majority
provides no resources to help States defray the costs of administering
Federal elections. As my Senate colleagues post their tributes to
Congressman Lewis, I call on them to remember the cause that was so
dear to him--access to the ballot box--and fight to include necessary
voting reforms and the funding to implement them in the next COVID-19
package.
Our State officials must adapt by changing outdated voting rules
that prohibit no-excuse absentee voting and early voting, both of which
would reduce lines and crowding, making it safer to vote. The public
also has a role to play. They must seek out reliable sources of
accurate information and engage in the election process. The integrity
of the November elections depends on whole-of-Nation commitment to our
democracy.
Mr. Richmond. Thank you, Chairman, for this opening
statement.
I will remind the subcommittee that we will each have 5
minutes to question the panel. I will now recognize myself for
questions. My first question will be to all witnesses.
As you know, the President and Attorney General, who I had
an opportunity to question last week, have repeatedly tried to
cast mail-in voting as fraudulent, illegal, or tantamount to
rigging an election. On Friday, however, CISA released a mail-
in voting and 2020 infrastructure risk assessment, which
considered a number of risks to vote-by-mail, but ultimately
found that, ``All forms of voting, in this case mail-in voting,
brings variety of cyber and infrastructure risks. Risk to mail-
in voting can be managed through various policies, procedures,
and protocols, and controls.''
No. 1, what were your takeaways from the risk assessment?
No. 2, is there more that CISA or other Federal agencies can be
doing to promote confidence in safe, secure, mail-in voting
this November? Any of you? Mr. Levine, I see that you are
ready.
Mr. Levine. Chairman, thank you for that question. You
know, in terms of the takeaways, the CISA report, I think, was
a really important document. I think it really showed a
blueprint, like for the kinds of things, security-wise, that
folks ought to consider, right, when they are administering an
election via vote-by-mail.
Facts matter. This document is littered with facts that
unambiguously state that vote-by-mail is a safe and secure
process. But it does also walk through, right, some really
important pieces that I think are worth mentioning. No. 1, some
of the factors to consider with vote-by-mail are a bit
different, right? It is worth noting that, you know, in terms
of doing vote-by-mail, if the voter registration database is
not as accurate, your ability after the fact to go show up at a
polling place and cast a ballot, right, takes on a different
kind of thing than if, in fact, you are able to go to a polling
place, right, on Election Day.
I think the second thing that is really worth noting,
though, is that--it was pointed out in this report is also the
notion that if people spread mis- and disinformation about the
vote-by-mail process, if they say that the process is easily
rigged, that is the kind of thing that can be easily amplified
by foreign adversaries.
In my testimony, I pointed out that authoritarian actors,
like Russia and Iran, have already done that.
So, you know, I think what is really important in terms of
the takeaways are No. 1, people take a look at this report so
that they can understand what things they need to do to make
sure they can utilize vote-by-mail in as a successful manner as
possible. No. 2, I think they need to make sure, right, that
they understand how that vote-by-mail process works so that
they can be disseminating information to the public about how
that needs to be done.
In terms of Federal authorities, you know, I think one of
the things that they can be--continue to do, which they have
already done, is they were reaching out in an affirmative
manner, to State and local election officials as well as to
civil society organizations to talk them through, right, how
they can best communicate with the American public about how
the vote-by-mail process can be done so that voters can have
confidence, that even though voting will be different in
November than previously, it is still going to be a safe and
secure process.
Mr. Richmond. Anybody else want to join in on that answer?
Ms. Albert. Mr. Gilligan.
Ms. McReynolds. Sure. Thank you, Mr. Chairman. So as I am--
as previously stated, I was an elections official in Colorado,
ran elections for 13 years, ran 3 different Presidential
elections, along with many others, and also, transitioned
various systems as--from in-person polling places, to early
voting, to vote centers, to the system in Colorado.
The fact is, there is not a single State that is all vote-
by-mail, or universal vote-by-mail, even though those terms get
used a lot. The States that do this mail-in ballot and still
preserve in-person voting options, should voters want to do
that. So you really have all choices on the table.
But I was struck in the CISA report that came out, I think
it included many of the best practices that my organization has
recommended, but also that many States have actually adopted in
recent years with regards to the vote-by-mail program. I--what
struck me in the CISA guidance also was the highlight for
disinformation and misinformation as being a critical risk to
our elections systems. That it goes--that is true for in-person
voting, it is true for early voting, and it is true for the
vote-by-mail program.
So whatever we can do to combat that is critically
important. We have to boost and make sure our election
officials and our official State websites and local websites
have and contain the best information so that voters know what
to do.
But one other security risk, or actually 2 other security
risks that I want to highlight is postal operations. I
mentioned this in my testimony. I think it absolutely is a
critical factor here. It is critical infrastructure to not only
the vote-by-mail program, but elections overall, especially
given all of the notices required, legal notices that are not
only at the Federal level, but also at the State level in terms
of making the election run, not just mail ballots, but voter
notifications, ballot-issued notices, polling place notices,
all of those pieces of mail that go out through the
infrastructure that is literally the only entity that serves
every single customer and citizen daily, along with every
election office.
The United States Post Office is literally the only entity
that provides that kind of service to every American and every
election office daily. We need it to be operating at full
capacity. We need it to be doing what it is capable of doing to
support our elections, not just mail voting, but every aspect
of our election process that relies on the Post Office to do
it.
The final piece, I would say, is that after administering
elections for as long as I did, I would encourage everyone to
rely on experts that have actually run these election
processes, know where the vulnerabilities are, know how to fix
those vulnerabilities, know how to address issues. There is a
reason best practices have been developed over time in various
States that have done this well. We didn't have that 10 years
ago. We didn't have many examples of States where this
procedure has operated at a very good level, has--many of those
States, including Colorado where I am from, was deemed the
safest place to vote in the country a couple of years ago by
the Homeland Security Secretary. That is an important and
critical aspect of all the different steps we did to make our
system secure and make it work properly.
The one final thing I would say is I also believe it is a
security risk when people can't access the voting process. If
you show up, and there is a 5-hour line, or your mail ballot
doesn't come to you, or you face other barriers or challenges,
that is also a security problem with the election
infrastructure.
So we really need to be focused on building our processes
this year, and responding to all of those critical factors that
prevent or inhibit the voting process from being fair for
everyone.
Mr. Richmond. Thank you. I will--I will yield back.
I will now recognize the gentleman from Pennsylvania, Mr.
Joyce, for 5 minutes.
Mr. Joyce. Thank you very much, Mr. Richmond, for holding
this hearing. There could not be a more important time as we
face election 2020 in the midst of the pandemic.
I think that there are many questions, but, Mr. Gilligan, I
am going to start with you. Do you feel that election officials
are receiving enough information from their election system
vendors about the vulnerabilities in their systems so that they
can make sound purchase and maintenance decisions?
Mr. Gilligan. Thank you, Congressman Joyce, for the
question. I think the elections officials are getting more
information today than they have in the past about what are
potential vulnerabilities. The--I think in years past, the
election vendors didn't spend as much energy on looking at the
types of cyber threats that we now know exist. So, there has
been a significant sea change within the election vendors. The
dilemma is, as you well know, is that many of the elections
components are years old. So, there has been increased dialog
between the elections vendors and the elections offices. There
have been independent assessments of the elections
infrastructure components to determine what vulnerabilities
exist, and that has resulted in some improvements in the
software and the capabilities of the deployed election systems.
Then, I think, finally, the newer elections infrastructure
components tend to be ones that have more better defenses
against cyber threats.
Mr. Joyce. Do you find that individual States are actually
reaching out and increasing those protective mechanisms,
particularly helping their election systems to set up the
firewalls that are necessary to decrease those vulnerabilities?
Mr. Gilligan. Yes. So--thank you. The previous question
focused on what the relationship between the elections vendors
and the elections offices. What I--what I would say is there
has probably been a lot more progress in the area that your
current question addresses, which is the elections offices
themselves. The contractor supporting them, many elections
offices have gone through a cyber-navigator-type concept where
they, either internally or externally, have hired individuals
to come in and not only do a training, but also to do
assessments of the elections' infrastructure components. CIS
has actually produced some guidebooks and some tools in this
area.
So that is an area that, I think, we have seen in many
States that there has been a very concerted effort, there has
been an effort to assess, and then to fix.
So, for example, two-factor authentication, which was not
something that was popular in place in years past, is now
increasingly in place. Now, what that does is it makes it far
more difficult for a cyber threat actor to be able to gain
access to an elections component. Redesigning of systems--you
mentioned firewalls--redesigning of systems to strengthen
things like firewalls, to put virtual barriers, to go into
virtualization that puts barriers between the elections
components, and other elements that might be on the network.
So all of these types of improvements, there has been, in
my assessment, a fairly dramatic shift and resulting in, I
think, a much more resilient elections infrastructure.
Mr. Joyce. I share that enthusiasm. I think there has been
a shift. But let's look at it conversely. What is the worst-
case scenario, in your mind, that can occur?
Mr. Gilligan. Well, I actually think that, to some extent,
we saw the worst-case scenario in 2016. Let me explain what I
mean by that. I think the actual vote capture and vote tally
systems, which is where the actual vote is captured, and then
it is--is counted, those systems tend to be highly resilient,
and they are not easily accessible. You almost have to get
physical access to them, which makes the threat--to execute the
threat fairly difficult.
The other elements, many other elements of the elections
infrastructure are accessible through the network and,
therefore, they share the types of vulnerabilities that we see
in all network-connected systems.
So back to 2016, the--I recall, vividly, discussions with
elections officials in the aftermath of 2016, and their
question and comment was, Wait a minute, no votes were changed.
In their mind, that was their objective is to ensure that the
vote was cast, and was, in fact, counted properly. That as we
all know, it wasn't just that the vote was cast and counted
properly, it is what is the confidence level that the American
public has in the system? Therefore, a--an attack against the
voter registration system, which did not result in anyone not
being able to vote or any, you know, changes to votes, became a
symbol to our American public that there is something going on
here and, therefore, I am losing confidence.
So I think--I believe that the biggest challenge that we
continue to have into 2020 is to--and I think some of the other
speakers commented on it--is to be able to ensure that the
American public has clear information about what is being done
to protect the system, and if there is any particular event, to
be able to very clearly identify what is the impact? That there
have been lots of procedures put in place that if there is a
small glitch, that that will not impact the counting of the
vote or their ability to cast a vote.
Mr. Joyce. Thank you very much for your answer. Chairman
Richmond, thank you, again, for holding this important hearing
today. My time has expired. I yield.
Mr. Richmond. The gentleman from Pennsylvania has yielded
back.
I now recognize the Chairman of the full committee, the
gentleman from Mississippi, Mr. Thompson.
Mr. Thompson. Well, I am glad to see that our witnesses
have pretty much put forth the confidence in our current
system.
I don't know any system that can't be improved upon. But,
by and large, the Democrats on this committee have supported
more funding. We have offered additional funding to secretaries
of state. We have coordinated our comments with the National
secretaries of state organizations and others. Because this is
how we choose our leaders. Our system of democracy affords
individuals the right to choose.
The State of Michigan, for instance, sent out mail
applications for absentee ballots to every registered voter.
That was a decision the State of Michigan made. But it is, as
you said, it is an individual State's prerogative to do the
process that they think works best. There is no real cookie-
cutter approach. So we recognize the funding.
One of the things that I am concerned about is all of what
we do for November, given the COVID-19 environment, is
predicated on our Postal Service being functional.
So, Ms. McReynolds, postal workers and election officials
have raised concern that changes in the Postal Service's
standards could jeopardize the timely delivery of ballots. Are
you concerned that changes in these standards could result in
voters being disenfranchised? How should State and local
election officials coordinate with the Postal Service to ensure
vote-by-mail deadlines align with Postal Service standards?
Ms. McReynolds. Yes, Mr. Chairman. Thank you for the
question.
I am concerned about the changes that the postal system has
made recently. Coordination between election officials and the
post office is absolutely critical before every single
election.
As you pointed out, every system can improve. There is not
a single perfect government system or government entity that
exists. So there are opportunities to improve.
I have made various suggestions, frankly, from being an
election official, but also being from a State where we
implemented a system of mail-in ballots to every elector. So
that coordination with the post office was critical.
During that time, as an election official, I not only
learned about the post office, but spent time digging into
their processes, their procedures, their time lines, everything
about it that impacted elections. With my understanding of how
all of that works, the post office is absolutely critical to
the conduct, the running, and the successful conduct of
elections in this country.
As I mentioned, it is not just mail ballots. It is all of
the other legally-required notices--ballot issue notices,
polling place notices, poll worker appointment letters,
candidate notices. Official certified mail is usually how
candidates are deemed to be certified on the ballot. So there
are just critical elements to this.
One of the suggestions that, if you look at sort-of how the
post office has operated, how it has supported elections
overall, one thing that a lot of people miss is that right now,
for military and overseas ballots, postage is paid for outbound
and inbound ballots in every single State for every single
military and overseas voter that engages with the election
process.
So there is a Federal indicia right on those military and
overseas ballots that that payment happens through the
Department of Defense to the post office.
I have suggested a similar type of model for domestic
voters because it would actually streamline a lot of the
processes. The post office wouldn't have to accept payments
from 7,000 or 8,000 different local election offices. It would
actually be much more efficient if we had a Federal process and
indicia for mail ballot postage to be paid on the outbound
process and the inbound process.
So that is just one example of an administrative efficiency
that I think would not only enhance service, but also
streamline operations for both sides of things, election
officials as well as the post office.
So those are a couple of things, and I am happy to answer
more questions.
Mr. Thompson. Well, thank you. My time has expired.
But, Mr. Chairman, I want to highlight that any tampering
with the current system puts the process at risk. There is no
question we can improve it. But because we are about 90 days
away from an election, it is absolutely critical that we make
the current system work. Any finagling with that system puts
the process in jeopardy, and I want to keep the confidence
factor where it is.
With that, Mr. Chairman, I yield back. Thank you.
Mr. Richmond. The gentleman from Mississippi yields back.
I now recognize the gentlelady from Texas, Ms. Sheila
Jackson Lee, for 5 minutes.
Well, I will now--we will get to Ms. Jackson Lee when she
comes back. I will now recognize the gentleman from Rhode
Island, Mr. Jim Langevin.
Mr. Langevin. Thank you. Thank you, Mr. Chairman.
Ms. Jackson Lee. Oh, I am here.
Mr. Langevin. Oh, Sheila is there. Should I yield to her?
Mr. Richmond. Continue.
Mr. Langevin. OK. Thank you, Mr. Chairman.
I want to thank our witnesses for their testimony today.
Very helpful insights into your views on election security and
being able to conduct successful elections this November.
Obviously, this is a cornerstone of our democracy and we
want to make sure that our elections are both accessible, free,
and secure, and your insights are very helpful.
The Cyberspace Solarium Commission also made several strong
recommendations regarding media literacy and civics education
and ways to build resiliency to disinformation campaigns.
We have seen some nascent efforts at the Federal level. For
instance, CISA's principle, CISA's, they call it, pineapple
pizza campaign. But the commissioners believe that much more
needs to be done, that some level of dis- or misinformation is
inevitable, given our commitment as a society to free speech.
Do you agree with this assessment?
Also, the Solarium Commission recommends that civics media
literacy education needs to be spread out across a lifetime. It
can't be a single class one takes in high school. We emphasize,
for instance, the need to help seniors better understand the
changing media landscape.
Do you agree with this assessment? How should we think
about voter resilience as a part of our broader election
security strategy? For any of the witnesses that want to start.
Mr. Gilligan. So, Congressman Langevin, this is John
Gilligan.
Although my focus and my organization's focus is on
cybersecurity, I would echo the remarks that you made and
endorse the recommendations made by the Solarium Commission.
My assessment is, when I look at the risks that we have to
the voting process, today I think that the potential of mis-
and disinformation having an impact on the voting is greater in
many regards than the potential of cyber threats.
So I think the approach that is recommended by the Solarium
Commission, in part, to improve awareness among the public of
mis- and disinformation, to help, especially our youth, begin
to understand how to look at social media and how to look at
multiple sources of information, I think is particularly
important.
I believe that this issue, as I mentioned in my testimony,
will be an area that will require some Congressional focus in
the future, because we don't have the norms and the legislative
rules that I think would be helpful going forward.
Mr. Langevin. Thank you.
We have largely been talking about the November election,
but the Solarium Commission's work was not necessarily specific
to this year's contest as well. Indeed, we should be thinking
about now the longer-term challenges, in addition to the short-
term.
Can you talk about what concerns should the EAC be
preparing for now to safeguard elections beyond 2020? For any
of our witnesses.
Ms. McReynolds. Sure, I can jump in there. I agree with
endorsing that commission's report. I think civics and
disinformation, security, all of these things are really going
to be life-long things that we are going have to adjust and
learn to.
I am actually a single mom of two. When my ballot comes
every election, it is a civics lesson for my 7- and 9-year-old,
and they understand very clearly how to find good information
about the voting process and we walk through that every single
time.
I think in terms of the EAC, again, this is going to be a--
it is a continuum of improvements over time, and we are going
to have threats that we face this year that are going to be
different than next year.
But this misinformation and disinformation has been
plaguing the election system for the past few years and we
haven't come up with a very good solution.
So I think civics education, educating voters about how to
find good information and how to find trusted sources of
information, is going to be absolutely critical. Then
continually improving how we identify that, how we create
systems that can flag those issues so that voters can clearly
get the information that they need.
Mr. Langevin. Thank you.
Mr. Levine, beyond the 2020 elections, any thoughts about
what the EAC should be focused on?
Mr. Levine. Sure, Congressman, yes. To Ms. McReynolds and
Mr. Gilligan's point, I think the Solarium Commission's remarks
and recommendations with regards to civic education is a
critical piece.
I think there are a few things that are worth noting. No.
1, we know that there are other countries that have done this
in some respects better than we have. We can look to countries
like Sweden and the Netherlands who also have been dealing with
sort-of foreign interference threats for some time, who have
more comprehensive approaches to deal with some of the threats
that are outlined in terms of mis- and disinformation.
I would also underscore, to your point as well, that the
Election Assistance Commission recently got some additional
funding which paralleled or went in concert nicely with the
Commission's recommendation and that you are seeing the EAC
begin to ramp up in terms of some of the hires that they have
brought on. They now have more people with a cyber background.
So I think there is a real opportunity for them to be able
to step up and continue to provide cyber resources that enable
State and local election officials to prepare for those
evolving threats.
So I think, to your point, being able to bring people on
who can assist State and local election officials who are
always strapped is important. I think being able to look
outward for best practices from other States who are doing this
kind of work, as well as other countries, is also really
important as well.
Mr. Langevin. Thank you.
I know my time has expired. I just want to thank all of our
witnesses for your testimony. I didn't have time to get to what
we need to do to protect people with disabilities and ensuring
barriers are brought down for them, but perhaps we can submit
those questions for the record. But thank you for your
testimony.
Mr. Chairman, thank you for holding this hearing. It is
very important as we get ready for the 2020 election and
beyond. Thank you for your leadership.
Mr. Chairman, I yield back.
Mr. Richmond. Thank you.
The gentleman from Rhode Island yields back.
I now recognize the gentlelady from Texas, Ms. Sheila
Jackson Lee.
Ms. Jackson Lee. Thank you, Mr. Chairman, and thank you to
the Ranking Member, for this important hearing.
We know that The New York Times said that John Lewis risked
his life for justice. In his op-ed he indicated that the vote
is precious, but we will lose it if we do not use it.
The Constitution also acknowledges that local elections and
State elections are that of those jurisdictions, but it does
not deny Congress the right to involve itself by law or
regulation, which I believe is extremely important in the
process of which we are dealing with at this moment.
It is important to give confidence to the American people
so that misinformation and disinformation and voter suppression
will not keep the majority of Americans, all of Americans, from
the right to vote.
So I pose this question first to our witnesses, please.
Over the last couple of days there have been statements about
the election should be moved. I believe there is no law and no
right to move the November election, no Constitutional right to
move that election. But that has been in the public atmosphere.
So I raise the question, in your professional opinions, how
does the current President's persistent rhetoric about
increased fraudulent ballots and changing the date of the
elections--and, by the way, two Federal elections were held
during the Civil War--how would that impact voter confidence?
I would raise that question with Ms. Sylvia Albert to
answer that question.
Ms. Albert. Well, thank you for the question, Congresswoman
Jackson Lee.
We have seen already that the President's rhetoric is
affecting the confidence that voters have both in vote-by-mail,
particularly, and also in elections in general.
I think we can be buoyed by the fact that elections
officials around the country uniformly have responded to the
misinformation that the President has shared with the right
information.
I think what is important, and as we speak about elections
going forward, is not to be thinking about defensive
procedures, but offensive. We need to engage our communities in
the civic education and inoculation that would protect them
from being affected by this misinformation.
Ms. Jackson Lee. Thank you very much.
In 2016, Russia was blamed for breaching 21 local and State
election systems. In fact, Robert Mueller released indictments
of 13 Russians regarding interference in our 2016 elections.
Mr. Levine, what should we be focusing on? What, if any,
has the Marshall Fund seen that should be done regarding the
outside international interference in our elections which is
predicted to be extensive in 2020? Mr. Levine.
Mr. Levine. Sure, Congresswoman, thank you for that
important question. I will make a couple of points to your
question that I think are worth noting.
No. 1, I think that election officials need to have Plan A
and Plan B. For almost every cyber component of our election
infrastructure there can be an analog piece that can be
available to use so that in the event of any kind of cyber
event we have something to fall back on.
We have seen this happen a number of ways. We know that for
those States and communities that use electronic poll books or
electronic lists of voters to check in, if there is either a
technical glitch or, in fact, a nefarious act, we know that if
people have paper poll books they can continue that voting
process.
We know that with regards to election night reporting
websites, we know if that a website is to go down, for example,
because of a denial-of-service attack, that if folks can have
redundant websites where they can have other means to be able
to share that information, that could help ensure that there is
voter confidence.
So making sure that folks have things like additional
ballots, paper poll books, redundant websites. As we look now,
we probably are seeing an increase in folks that, for example,
are requesting absentee ballots on-line. Making sure that, in
fact, if you can't make such a request, that maybe you have a
fillable PDF form so that you are still able to have that
request through. I think that is really, really important.
I think the second piece that I think is worth noting
really quickly is that it is really important that the
information from the intelligence and law enforcement community
about the threats as much as possible is being shared with
State election officials and subsequently with the American
public so that as much as possible the American public has the
opportunity to prepare accordingly, whether it is the
misinformation and any other threats.
Ms. Jackson Lee. Thank you so very much.
Mr. Gilligan, if you would just give quickly one
significant action that Congress can take regarding internet
security in the voting process. Mr. Gilligan?
Mr. Gilligan. Thank you, Congresswoman.
Let's see. If I were to think of one thing that Congress
could do, I think what I would suggest is the following, and we
have seen indications of it in some of the comments from the
Members. That is, when we address the security of local
elections offices, we have to realize that they are
underresourced and don't have the talent that the State level
and the larger elections jurisdictions do.
So what I think is going to be important going forward is
we cannot assume that local elections offices are ever going to
be able to protect themselves. We actually have to do it for
them.
This is a discussion that we are having with the State-
level organizations. I mentioned in my testimony some
capabilities that we are working to deploy with CISA and the
elections community.
That, in fact, is sort-of we can do it and we can deploy it
without a whole lot of support from the local elections offices
and actually protect them. One of them is this endpoint
detection and response. The other is this malicious domain
blocking and reporting.
So I think what then the recommendation that I would make
to Congress is, if Congress could help in the funding of these
initiatives to get them off the ground, to get enough of it
deployed, ultimately what we have seen in other situations, the
States will start to kick in funding over time. But to get the
ball rolling, Federal funding is very helpful.
So thank you.
Ms. Jackson Lee. Thank you very much, Mr. Chairman. Thank
you. I yield back.
Mr. Richmond. The gentlelady from Texas has yielded back.
I now recognize the gentlelady from New York, Miss Rice,
for 5 minutes.
Miss Rice. Thank you, Mr. Chairman.
I would ask, put this question out to all of the witnesses.
I believe, Ms. McReynolds, you were talking about how things
are done in your State of Colorado. What State or locality does
mail-in-ballot voting really well? Like what system can we
emulate?
We in New York have done this for a long time, but we had a
historically very difficult time in our June primary. It
actually took 5 weeks to certify one of--a Congressional
primary. We think of ourselves in New York as pretty
progressive when it comes to these issues.
So who can we look to? We still have 3\1/2\ months before
people go to the--September, October--no, 3, 3 months before
people go to the polls. So maybe if you could just expound on
who you think does it really well.
Ms. McReynolds. Sure. Thank you for the question,
Congresswoman.
Yes, I mean, we saw issues in New York. I think that New
York actually has lagged behind many States in terms of
updating policies around voting access. There hasn't been early
voting. There wasn't no-excuse absentee up to this point. There
have really been a lot of issues in New York. Exorbitantly long
lines actually back in 2018 and even prior to that. So there
have been issues there, and I think there is some updating of
policies that definitely needs to happen.
In terms of my expert opinion on sort-of the work I did in
Colorado and then the work I have now done with various States,
I think no State--it is not necessarily a cookie-cutter
approach. However, what we have in front of us is a good
example of a slew of States that have implemented various
policies in the last few years that have improved their
processes, improved the system for voters, and also enhanced
security.
Colorado is one of them. California adopted a model that
looks very much like Colorado. Utah has expanded their voting-
at-home program to be now for the entire State, and they have
emulated some of those good practices from Colorado, as well as
Oregon and Washington.
Miss Rice. So what are those practices, if you can just
tell us? What are those, just if you can give us----
Ms. McReynolds. Sure. So a couple of things that we did in
Colorado that I think are good to emulate.
One is modernizing registration. So we have automatic
registration. We automatically update addresses based on moves
that we get from the motor vehicle locations or from the United
States post office. We literally consume that data monthly,
update addresses. So Colorado, for instance, and many of the
States in the West, have the cleanest voter files in the
country.
We also have created systems like ballot tracking. So
ballot tracking started in Denver, Colorado, way back in 2009.
That is a notification system just like tracking a package
where you get a text or email about when your ballot goes out,
when it is on its way to you, and then confirmation when the
election official receives it.
That is one of the top-level recommendations that States
can do right now. There is technology available. It doesn't
require a lot of change in any State. You can literally adopt
it as a service to voters and it enhances security, and it is
one of our top-level recommendations.
The final recommendation I would say is expanding drop-off
options for voters. So at secure 24-hour drop boxes, at drive-
up drop-off, there are examples of drive-up drop-off just like
a drive-thru line at a restaurant. You can drop off your ballot
through the window of your car and not have to get out, not
have to interact with anybody.
Then, finally, expanding drop-off options to accept mail
ballots at all voting locations. Not every State allows you to
drop your ballot off at a polling place.
Those are examples. Those drop-off options and ballot
tracking can be done now, can be adopted now across the
country, and there is time to do that.
Miss Rice. Can I also ask you, because there are going to
be some people who actually want to go to the polls.
Ms. McReynolds. Yes.
Miss Rice. I know New York is not unique. Most of our poll
watchers are people who are in that vulnerable age bracket who
may not want to be sitting at a poll for 12 hours in November,
God forbid that we are where we are still with this virus.
So what would you suggest to improve. I mean, obviously, it
doesn't help that people are closing down polling locations.
Other than keeping as many open as possible, what would you
suggest to secure people who prefer to vote in person?
Ms. McReynolds. Yes. I mean, in-person voting has to exist,
but we have to think about it in a different way than we have
ever thought about it before. What I mean by that is we need,
for instance, the business community to step up and offer
locations.
One of the things that is happening now, which I am sure
many of you have seen, is there is this concept of arenas,
large sports facilities being used as polling places. Kentucky
used their State fairgrounds and were able to serve tens of
polling places all in one place with social distancing.
So these sort-of large locations are really important. I
have suggested car dealerships. I think car dealerships in the
showrooms and the accessibility of them, given where they are
usually located, would be excellent locations in many of the
big cities.
So we have to be creative. I think the business community
can really help solve a lot of these challenges, whether they
offer a polling place, offer their workers to help on election
day, or offer their location to be even a drive-up drop-off.
Even a drive-up drop-off would be tremendously helpful in
States.
So this is kind-of an all-of-community type of response
that we really need to see happen to make sure that our vote is
protected.
Miss Rice. Thank you very much.
Mr. Chairman, I yield back.
Mr. Richmond. The gentlelady from New York has yielded
back.
I now recognize the gentlelady from Illinois, Ms.
Underwood, for 5 minutes.
Ms. Underwood. Thank you, Mr. Chairman.
The integrity of our elections is essential to the
preservation of our Republic. Securing our elections is a major
concern for my constituents in Illinois, where the personal
information of 76,000 voters was accessed by Russian operatives
in 2016.
We must immediately invest in our election infrastructure
to protect our democracy against on-going attempts to
interfere.
On top of those preexisting threats, the COVID-19 pandemic
has heightened the need for greater flexibility in how, when,
and where people vote. Nobody should be forced to choose
between protecting their health and exercising their
Constitutional rights.
Elections security is National security, and I am grateful
to our witnesses for advising this committee on how to protect
it, whether that means preventing foreign interference or
conducting safe and accessible elections during a pandemic.
Ms. Albert, one result of the pandemic--or rather a result
of this administration's failure to adequately respond to the
pandemic and support families during this crisis--is a surge in
housing instability. Many Americans are out of work and at risk
of losing their homes, whether they rent or own. Suddenly a lot
of people's addresses may soon be out of date.
How can we protect the voting rights of people experiencing
housing instability during this crisis and make sure that they
are not subject to unnecessary voter registration purges?
Ms. Albert. Thank you for the question, Congresswoman.
As we have talked about before, H.R. 1 contains many
different provisions that would be beneficial in moments like
this. I think the thing that we have seen in this pandemic is
that our system is not as flexible and comprehensive as it
could be in order to meet the needs of different communities.
So, for example, communities who are experiencing housing
displacement right now, homeless communities, they are strongly
benefited by same-day registration or, in addition, provisions
that allow for updating registration at the polling location.
To be clear, I mean real same-day registration, which means
you can go to your voting polling location and update your
address and it is not you have to go downtown to the main
office that is only open between 9 and 3 on election day in
order to update your address.
Ms. Underwood. Right.
Ms. Albert. Really what we are seeing is that those
vulnerable communities are just more vulnerable in this
situation and are really dealing with much more than they ever
have before.
So not only do we need to be looking at this now, but we
really should be modernizing our system for the next disaster,
for the next pandemic, for the next hurricane to really meet
the needs of our constituents.
Ms. Underwood. Mr. Levine and Ms. McReynolds, do you
believe voting from home could help these displaced voters? If
so, what does the Federal Government need to do right now to
make sure that Americans are able to vote from home, even if
their address changes within the next few months?
Ms. McReynolds. Sure. I can answer that.
One thing I would say about what we did in Colorado is we
created this system of same-day registration, combined with
automatic registration, combined with mailing a ballot to all
electors. So we have a process and tried to create and fill all
those gaps.
But then we also created the concept of vote centers, and
that started in Colorado, as well as an innovation that allows
a voter to go to any of the locations and update their address
or what have you.
That really reduced provisional ballots by 98 percent and
converted those to normal ballots, because most of the people
that would show up at the wrong polling place was because of an
address change.
So we created a new way to deal with in-person voting that
has significantly improved the voting experience.
So vote centers is also a really great concept. The one
thing I would say about vote centers is it does require
technology. It is going to be a much bigger lift to set up
ahead of November because there is a short period of time. But
there still is a way to handle provisionals and all of those
sorts of things should somebody not receive their mail ballot.
The other aspect I would say is that it is critically
important before every election that voters check their
registration, make sure they are active, make sure their
address is up-to-date. Then if something does go awry with
their mail ballot not arriving, that they utilize the processes
that are in place in various States--and I am from Illinois, so
I am also familiar with the Illinois provisions--and make sure
that voters are familiar with what they can do to take action
should they not receive their ballot.
In every single State you can still vote in person, you
still have that provisional ballot as a safeguard should
something happen that makes it difficult for you to receive
your ballot.
Ms. Underwood. Well, Mr. Levine, I am out of time.
But thank you so much to all of our witnesses for being
here. We appreciate this information and your testimony before
our committee.
Mr. Chairman, I yield back.
Mr. Richmond. The gentlelady from Illinois has yielded
back.
I want to thank the witnesses for their valuable testimony
and the Members for their questions.
The Members of the subcommittee may have additional
questions for the witnesses, and we ask that you respond
expeditiously in writing to those questions. Without objection,
the committee record shall be kept open for 10 days.
Hearing no further business, the subcommittee stands
adjourned.
Thank you all.
Ms. Jackson Lee. Thank you very much, Mr. Chairman.
[Whereupon, at 11:40 a.m., the subcommittee was adjourned.]
A P P E N D I X
----------
Questions From Honorable James R. Langevin for Sylvia Albert
Question 1a. In your testimony, you raised the issue of
accessibility for voters with disabilities and expressed that voters
with disabilities in Pennsylvania had difficulty casting their votes in
the 2020 primary.
What barriers to voting exist for people with disabilities, and how
have barriers increased since the public health crisis began?
Answer. Response was not received at the time of publication.
Question 1b. What solutions should we be considering now to avoid
denying people with disabilities the right to vote in November?
Answer. Response was not received at the time of publication.
Questions From Honorable James R. Langevin for John Gilligan
Question 1. I have been convinced for some time that cybersecurity
concerns associated with on-line voting are simply too great and the
stakes too high to be comfortable with that idea. Yet a handful of
States are considering this in light of the challenges that come with
voting in person during a global pandemic.
What is your position on on-line voting?
Answer. On-line voting, which we define as the electronic return of
a voted ballot from a voter's device, poses unique and complex
technical challenges. At present, the technologies needed to ensure on-
line voting is not susceptible to malicious or inadvertent compromise
do not exist. As such, presently or in the near future, CIS does not
recommend the use of on-line voting for U.S. elections. The exception
to this recommendation would be in very limited circumstances where the
risks of on-line voting are outweighed by other risk factors such as
the potential disenfranchisement of eligible voters who have no other
means to cast their vote, e.g., the voting of overseas military
personnel. Even in these limited circumstances, extraordinary care must
be applied to ensure confidentiality and integrity of the electronic
ballot as well as proper identification and authentication of the
voter.
In the longer term, the potential of secure on-line voting to
increase voter participation is appealing, if done securely. However,
the unique requirements for secure on-line voting exceed those required
for on-line banking or other on-line transactions whose threats and
mitigations have been tested over time. This is driven by several
factors; the most difficult is ensuring that the contents of a cast
ballot are a secret to everyone except the voter while verifying that
it is received and tabulated correctly. Identifying and correcting an
error is particularly difficult as the election office can only know
that the voter cast a ballot and not its contents. This is
substantially more complicated than a financial transaction and unlike
any other transaction commonly conducted on-line. As such, on-line
voting must be addressed with new and different approaches.
Fortunately, there is a group of researchers from academia and
industry who are working on technical solutions to make on-line voting
secure. While there remain issues, the currently preferred technical
approach promoted by these researchers is known as End-to-End
Verifiable (E2E-V) solutions. With this approach, voters and the public
are provided assurances that the votes were cast, recorded, and counted
properly regardless of the medium used. Otherwise, the voter or an
auditor is alerted. As such, E2E-V provides hope that on-line voting
can be done securely at some point in the future.
Question 2. What would need to happen in order for this on-line
voting to be a viable solution? Can these steps be implemented before
the 2020 elections?
Answer. As noted above, further research, development, and testing
using end-to-end verifiable on-line voting approaches, or alternative
technical approaches, will be necessary before on-line voting can be
considered viable. In particular, researchers need to solve conflicts
between the verifiability of the voting process and other requirements
such as usability and accessibility. This will take time and
significant investment. Moreover, given the critical nature of voting,
extensive piloting and transparent examination by experts must be
accomplished before on-line voting solutions can be deemed safe and
secure. It is not possible to accomplish these efforts prior to the
November 2020 election.