[House Hearing, 117 Congress]
[From the U.S. Government Publishing Office]


                   SECURING DEMOCRACY: PROTECTING AGAINST 
                    THREATS TO ELECTION INFRASTRUCTURE AND 
                    VOTER CONFIDENCE

=======================================================================

                                 HEARING

                               BEFORE THE

                            SUBCOMMITTEE ON
                     CYBERSECURITY, INFRASTRUCTURE
                       PROTECTION, AND INNOVATION

                                 OF THE

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                    ONE HUNDRED SEVENTEENTH CONGRESS

                             SECOND SESSION

                               __________

                            JANUARY 20, 2022

                               __________

                           Serial No. 117-41

                               __________

       Printed for the use of the Committee on Homeland Security
                                     

[GRAPHIC NOT AVAILABLE IN TIFF FORMAT]                                      

        Available via the World Wide Web: http://www.govinfo.gov

                               __________


                    U.S. GOVERNMENT PUBLISHING OFFICE                    
47-316 PDF                 WASHINGTON : 2022                     
          
-----------------------------------------------------------------------------------   

                     COMMITTEE ON HOMELAND SECURITY

               Bennie G. Thompson, Mississippi, Chairman
Sheila Jackson Lee, Texas            John Katko, New York
James R. Langevin, Rhode Island      Michael T. McCaul, Texas
Donald M. Payne, Jr., New Jersey     Clay Higgins, Louisiana
J. Luis Correa, California           Michael Guest, Mississippi
Elissa Slotkin, Michigan             Dan Bishop, North Carolina
Emanuel Cleaver, Missouri            Jefferson Van Drew, New Jersey
Al Green, Texas                      Ralph Norman, South Carolina
Yvette D. Clarke, New York           Mariannette Miller-Meeks, Iowa
Eric Swalwell, California            Diana Harshbarger, Tennessee
Dina Titus, Nevada                   Andrew S. Clyde, Georgia
Bonnie Watson Coleman, New Jersey    Carlos A. Gimenez, Florida
Kathleen M. Rice, New York           Jake LaTurner, Kansas
Val Butler Demings, Florida          Peter Meijer, Michigan
Nanette Diaz Barragan, California    Kat Cammack, Florida
Josh Gottheimer, New Jersey          August Pfluger, Texas
Elaine G. Luria, Virginia            Andrew R. Garbarino, New York
Tom Malinowski, New Jersey
Ritchie Torres, New York
                       Hope Goins, Staff Director
                 Daniel Kroese, Minority Staff Director
                          Natalie Nixon, Clerk
                          
                                 ------                                

     SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND 
                               INNOVATION

                 Yvette D. Clarke, New York, Chairwoman
Sheila Jackson Lee, Texas            Andrew R. Garbarino, New York, 
James R. Langevin, Rhode Island          Ranking Member
Elissa Slotkin, Michigan             Ralph Norman, South Carolina
Kathleen M. Rice, New York           Diana Harshbarger, Tennessee
Ritchie Torres, New York             Andrew Clyde, Georgia
Bennie G. Thompson, Mississippi (ex  Jake LaTurner, Kansas
    officio)                         John Katko, New York (ex officio)
               Moira Bergin, Subcommittee Staff Director
          Austin Agrella, Minority Subcommittee Staff Director
                   Mariah Harding, Subcommittee Clerk
                            
                            
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Yvette D. Clarke, a Representative in Congress From 
  the State of New York, and Chairwoman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable Andrew R. Garbarino, a Representative in Congress 
  From the State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Chairman, Committee on 
  Homeland Security:
  Prepared Statement.............................................     6

                               Witnesses

Ms. Gowri Ramachandran, Senior Counsel, Brennan Center For 
  Justice:
  Oral Statement.................................................     8
  Prepared Statement.............................................    10
Mr. Alex Stamos, Director, Stanford Internet Observatory, and 
  Commissioner, Aspen Institute Commission on Information 
  Disorder.......................................................    24
Mr. Ezra D. Rosenberg, Co-Director, Voting Rights Project, 
  Lawyers' Committee for Civil Rights Under Law:
  Oral Statement.................................................    26
  Prepared Statement.............................................    27
Mr. Matthew Masterson, Private Citizen, Former Senior 
  Cybersecurity Advisor, Cybersecurity and Infrastructure 
  Security Agency, Department of Homeland Security:
  Oral Statement.................................................    36
  Prepared Statement.............................................    38

 
      SECURING DEMOCRACY: PROTECTING AGAINST THREATS TO ELECTION 
                  INFRASTRUCTURE AND VOTER CONFIDENCE

                              ----------                              


                       Thursday, January 20, 2022

             U.S. House of Representatives,
                    Committee on Homeland Security,
                            Subcommittee on Cybersecurity, 
                                 Infrastructure Protection,
                                            and Innovation,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 2:02 p.m., via 
Webex, Hon. Yvette D. Clarke [Chairwoman of the subcommittee] 
presiding.
    Present: Representatives Clarke, Jackson Lee, Langevin, 
Slotkin, Garbarino, Harshbarger, Clyde, and LaTurner.
    Chairwoman Clarke. The Subcommittee on Cybersecurity, 
Infrastructure Protection, and Innovation will come to order. 
The subcommittee is meeting today to receive testimony on 
``Securing Democracy: Protecting Against Threats to Election 
Infrastructure and Voter Confidence.'' Without objection, the 
Chair is authorized to declare the committee in recess at any 
point.
    Good afternoon, everyone. I would like to thank our panel 
of witnesses for participating in today's hearing on how we can 
secure our democracy against threats to election systems, as 
well as efforts to undermine voter confidence and faith in 
democratic institutions.
    So much has changed since this committee held its first 
dedicated election security hearing in 2019, which was already 
about 2 years too late. That is because in 2017, as the rest of 
us were waking up to grave security threats posed to our 
Nation's underfunded, outdated voting systems, Republicans 
controlled the House. Despite multiple requests by the 
committee Democrats to hold hearings on election security, the 
Republican Chairman largely declined to do so, except for a 
single hearing on threats to elections and other critical 
infrastructure.
    Still, Democrats got to work. The Democratic Task Force on 
Election Security worked to find solutions and make investments 
to help State and local officials upgrade and improve systems. 
When Democrats regained control of the House in 2019, this work 
did not cease, it accelerated.
    We secured funding for election upgrades at the State level 
and built up capacity at the Federal level, empowering CISA to 
work with election officials, vendors, and other stakeholders 
to harden voting systems around the country. At the end of the 
day, we made enormous progress. Roughly 96 percent of voters 
used voter-verifiable paper ballots and the results were 
validated by legitimate, credible post-election audits in every 
swing State.
    Election security experts called the 2020 election the most 
secure in American history in a year with historically high 
turnout during a global pandemic. It is hard to square that 
with what happened next. The out-going President ratcheted up 
the disinformation campaign he had been carrying out in the 
open for weeks. Rather than accept his loss gracefully, the 
former President asked his loyalists to subscribe to baseless 
claims of voter fraud at a scale never seen in history to 
explain his defeat.
    Despite the obvious absurdity and total lack of evidence, 
former President Trump was somehow able to parlay this message 
into a campaign so effective that he convinced 145 Republican 
Members of this very chamber to vote against certification of 
the election results. That same day, thousands of Trump 
supporters mobbed the U.S. Capitol with nooses, bear spray, and 
zip ties, inflicting serious or even fatal injuries on Capitol 
Police officers sent here to protect and serve.
    We as a Nation will be dealing with the fallout from the 
2020 election for a long time to come. Today, election 
denialists are running for office across the country and State 
legislatures are pursuing fake, partisan audits and restrictive 
voting laws that will do nothing more than create another 
barrier for voters of color to cross to cast their vote. Recent 
polls suggest that 1 in 3 voters question the legitimacy of the 
2020 election and 1 in 3 election officials feels unsafe in 
their job.
    I began this statement by talking about the efforts of 
Democrats to secure elections, not as a pat on the back or to 
inflame partisan divisions, but rather because I believe we are 
at an inflection point in our Nation's history where terms like 
``election security'' and ``election integrity'' are being 
weaponized in ways that I have never seen before.
    As long as we are opening up the proper scope of those 
terms, let me tell you how I define election security. No. 1, 
making sure that every eligible voter who wants to cast a vote 
is able to cast it; and, No. 2, making sure that vote is 
counted as it was cast. Anything that undermines either of 
these tenets, whether that is restrictive voting laws, 
disinformation that threatens the health of our republic, or 
outdated voting machines that can be exploited by hackers, is a 
threat to election security. That is why this hearing will 
cover the waterfront of issues that threaten secure elections 
today, even those outside the realm of cybersecurity.
    I am also profoundly concerned about the fractured state of 
our information ecosystem and the ability for media consumers 
to simply choose their own reality based on the Facebook groups 
they join and the cable news outlets they choose to watch. This 
is a major existential threat to our democracy, and I look 
forward to hearing from this panel to see how we might start to 
rebuild faith in democratic institutions.
    Finally, I believe the Federal Government, and CISA in 
particular, has a role to play in confronting the mis- and 
disinformation narratives that jeopardize our faith in free and 
fair elections and other issues that threaten our National 
security, public health, and safety. That is why I am 
introducing legislation to authorize CISA to identify, track, 
and address mis- and disinformation through efforts like the 
Rumor Control website.
    The best way to attack a lie is with the truth. I hope my 
colleagues on both sides of the aisle will join me in 
supporting CISA's efforts to prebunk and debunk the kind of 
disinformation that erodes our democracy.
    I thank our panel of witnesses for participating today and 
I look forward to a robust discussion.
    [The statement of Chairwoman Clarke follows:]
                Statement of Chairwoman Yvette D. Clarke
                            January 20, 2022
    Good afternoon. I would like to thank the witnesses for 
participating in today's hearing on how we can secure our democracy 
against threats to election systems, as well as efforts to undermine 
voter confidence and faith in democratic institutions.
    So much has changed since this committee held its first, dedicated 
election security hearing in 2019--which was already about 2 years too 
late.
    That's because in 2017--as the rest of us were waking up to grave 
security threats posed to our Nation's under-funded, outdated voting 
systems--Republicans controlled the House.
    And, despite multiple requests by committee Democrats to hold 
hearings on election security, the Republican Chairman largely declined 
to do so--except for a single hearing on threats to elections and other 
critical infrastructure.
    Still, Democrats got to work. The Democratic Task Force on Election 
Security worked to find solutions and make investments to help State 
and local officials upgrade and improve systems.
    And when Democrats regained control of the House in 2019, this work 
did not cease--it accelerated.
    We secured funding for election upgrades at the State level, and 
built up capacity at the Federal level--empowering CISA to work with 
election officials, vendors, and other stakeholders to harden voting 
systems around the country.
    At the end of the day, we made enormous progress.
    Roughly 96 percent of voters used voter-verifiable paper ballots--
and the results were validated by legitimate, credible post-election 
audits in every swing State.
    Election security experts called the 2020 election the ``most 
secure in American history''--in a year with historically high turnout, 
during a global pandemic.
    It's hard to square that with what happened next.
    The out-going President ratcheted up the disinformation campaign 
he'd been carrying out, in the open, for weeks.
    Rather than accept his loss gracefully, the former President asked 
his loyalists to subscribe to baseless claims of voter fraud, at a 
scale never seen in history, to explain his defeat.
    Despite the obvious absurdity and total lack of evidence--former 
President Trump was somehow able to parlay this message into a campaign 
so effective that he convinced 145 Republican Members of this very 
Chamber to vote against certification of the election results.
    That same day, thousands of Trump supporters mobbed the U.S. 
Capitol with nooses, bear spray, and zip ties--inflicting serious or 
even fatal injuries on Capitol Police officers sent here to protect and 
serve.
    We, as a Nation, will be dealing with the fallout from the 2020 
election for a long time to come.
    Today, ``election denialists'' are running for office across the 
country, and State legislatures are pursuing fake, partisan audits and 
restrictive voting laws that will do nothing more than create another 
barrier for voters of color to cross to cast their vote.
    Recent polls suggest that 1 in 3 voters question the legitimacy of 
the 2020 election. And, 1 in 3 election officials feels unsafe in their 
job.
    I began this statement by talking about the efforts of Democrats to 
secure elections--not as a pat on the back or to inflame partisan 
divisions.
    But rather, because I believe we are at an inflection point in our 
Nation's history--where terms like ``election security'' and ``election 
integrity'' are being weaponized in ways that I have never seen before.
    As long as we're opening up the proper scope of those terms, let me 
tell you how I define election security: (1) Making sure that every 
eligible voter who wants to cast a vote is able to cast it, and (2) 
making sure that vote is counted as it was cast.
    Anything that undermines either of those tenets--whether that's 
restrictive voting laws, disinformation that threatens the health of 
our republic, or outdated voting machines that can be exploited by 
hackers--is a threat to election security.
    That is why this hearing will cover the waterfront of issues that 
threaten secure elections today--even those outside the realm of 
cybersecurity.
    I am also profoundly concerned about the fractured state of our 
information ecosystem--and the ability of media consumers to simply 
choose their own reality based on the Facebook groups they join and the 
cable news outlets they choose to watch.
    This is a major, existential threat to our democracy--and I look 
forward to hearing from this panel to see how we might start to rebuild 
faith in democratic institutions.
    Finally, I believe the Federal Government--and CISA in particular--
has a role to play in confronting the mis- and disinformation 
narratives that jeopardize our faith in free and fair elections, and 
other issues that threaten our National security, public health, and 
safety.
    That is why I am introducing legislation to authorize CISA to 
identify, track, and address mis- and disinformation through efforts 
like the Rumor Control website.
    The best way to attack a lie is with the truth, and I hope my 
colleagues on both sides of the aisle will join me in supporting CISA's 
efforts to ``prebunk'' and debunk the kind of disinformation that 
erodes our democracy.
    I thank the witnesses for participating today, and look forward to 
a robust discussion.

    Chairwoman Clarke. The Chair now recognizes the Ranking 
Member of the subcommittee, the gentleman from New York, Mr. 
Garbarino, for an opening statement.
    Mr. Garbarino. Thank you, Chairwoman Clarke. Thank you very 
much for holding this hearing today. I appreciate our witnesses 
being here to discuss how we can support our State and local 
officials, secure election infrastructure from cyber threats, 
and examine ways to improve the tools and services provided by 
the Cybersecurity and Infrastructure Security Agency.
    In 2021, our Nation experienced an unprecedented number of 
cyber attacks against our critical infrastructure. We began 
2021 by analyzing the impacts of the SolarWinds cyber espionage 
campaign and we ended the year by responding to Log4j, the most 
pervasive vulnerability the cybersecurity community has ever 
seen. This is not to mention the dozens of significant 
ransomware attacks throughout the year.
    On top of spikes in cyber crime, we are seeing a lack of 
faith among voters in our election security. As we enter 2022, 
we must keep a keen eye on the mid-term elections and ensure 
that voters can be confident that their vote will count. Given 
the volume and sophistication of cyber threats we face, we must 
empower CISA with the tools and resources it needs to support 
our State and local election officials so that they can carry 
out their mission to administer free and fair elections.
    CISA's election security mission has greatly evolved since 
election infrastructure was designated as a subsector of our 
Nation's critical infrastructure in 2017. CISA has gone to 
great lengths to build trusted relations with the State and 
local election officials across the country and is providing 
free and voluntary cybersecurity services, tools, and other 
guidance in all 50 States.
    A key part of securing election infrastructure that is 
owned and operated by State and locals is ensuring that CISA 
has the ability to provide situational awareness about 
vulnerabilities across digital footprints. Initiatives like 
CISA's Crossfeed program are a commendable effort in this 
respect. Crossfeed leverages the best available technology to 
attribute public-facing assets to the organizations that own 
them, and provides CISA the ability to quickly detect new 
vulnerabilities. You can't secure what you can't see, and this 
real-time common operating picture, as well as several other 
CISA programs, continue to provide great value to State and 
local officials across the country.
    I am pleased that we are joined today by Matt Masterson, 
who led CISA's election security work in the prior 
administration and built the backbone of the trusted 
relationships that CISA leverages today. Matt is experienced in 
elections at every level, from administering them at the State 
level in Ohio to serving as commissioner of the Election 
Assistance Commission and as senior cybersecurity advisor for 
elections at CISA. I look forward to hearing from Matt about 
the practical, meaningful steps we can take to improve CISA's 
ability to support our State and local officials. I am 
determined to work with the State and local officials and other 
stakeholders in New York's Second Congressional District and 
across the country to improve their cybersecurity posture in 
the wake of increasing threats.
    This past August, I was pleased to host a roundtable 
discussion in my district with local government, critical 
infrastructure stakeholders, and CISA's Region 2 team where 
CISA presented numerous tools and resources that they can 
provide to bolster critical infrastructure security free of 
charge. I am also proud to have been an original cosponsor of 
the Chairwoman's State and Local Cybersecurity Improvement Act, 
which was signed into law last year.
    I hope we can all agree more resources for our State and 
local governments are necessary. We must also ensure these 
funds are spent responsibly and have a meaningful impact on 
risk reduction. CISA plays a vital role. This important bill is 
a tremendous step forward in our fight to enhancing election 
infrastructure security at a local level.
    I look forward to hearing from our witnesses today about 
how Congress can bolster CISA's role in election security and 
how CISA can turn support--in turn support our State and local 
election officials.
    Thank you, Madam Chair, and I yield back.
    [The statement of Ranking Member Garbarino follows:]
              Statement of Ranking Member Andrew Garbarino
    Thank you, Chairwoman Clarke, for holding this hearing today. I 
appreciate our witnesses being here to discuss how we can support our 
State and local election officials, secure election infrastructure from 
cyber threats, and examine ways to improve the tools and services 
provided by the Cybersecurity and Infrastructure Security Agency 
(CISA).
    In 2021, our Nation experienced an unprecedented number of cyber 
attacks against our critical infrastructure. We began 2021 by analyzing 
the impacts of the SolarWinds cyber espionage campaign, and we ended 
the year by responding to Log4j--the most pervasive vulnerability the 
cybersecurity community has ever seen. This is not to mention the 
dozens of significant ransomware attacks throughout the year.
    On top of spikes in cyber crime, we are seeing a lack of faith 
among voters in our election security. As we enter 2022, we must keep a 
keen eye on the mid-term elections and ensure that voters can be 
confident that their vote will count. Given the volume and 
sophistication of the cyber threats we face, we must empower CISA with 
the tools and resources it needs to support our State and local 
election officials so that they can carry out their mission to 
administer free and fair elections.
    CISA's election security mission has greatly evolved since election 
infrastructure was designated as a subsector of our Nation's critical 
infrastructure in 2017. CISA has gone to great lengths to build trusted 
relationships with State and local election officials across the 
country, and has provided free and voluntary cybersecurity services, 
tools, and other guidance in all 50 States.
    A key part of securing election infrastructure that is owned and 
operated by State and locals is ensuring that CISA has the ability to 
provide situational awareness about vulnerabilities across digital 
footprints. Initiatives like CISA's Crossfeed Program are a commendable 
effort in this respect. Crossfeed leverages the best available 
technology to attribute public-facing assets to the organizations that 
own them, and provides CISA the ability to quickly detect new 
vulnerabilities. You can't secure what you can't see, and this real-
time common operating picture, as well as several other CISA programs, 
continue to provide great value to State and local officials across the 
country.
    I am pleased that we are joined today by Matt Masterson, who led 
CISA's election security work in the prior administration and built the 
backbone of the trusted relationships that CISA leverages today. Matt 
has experience in elections at every level, from administering them at 
a State level in Ohio, to serving as commissioner of the Elections 
Assistance Commission, and as senior cybersecurity advisor for 
elections at CISA. I look forward to hearing from Matt about the 
practical, meaningful steps we can take to improve CISA's ability to 
support our State and local officials.
    I am determined to work with State and local officials, and other 
stakeholders in New York's 2nd district and across the country to 
improve their cybersecurity posture in the wake of increasing threats. 
This past August, I was pleased to host a roundtable discussion in my 
district with local government, critical infrastructure stakeholders, 
and CISA's Region 2 team, where CISA presented numerous tools and 
resources they can provide to bolster critical infrastructure security, 
free of charge.
    I am also proud to have been an original cosponsor of the 
Chairwoman's State and Local Cybersecurity Improvement Act, which was 
signed into law last year. While we can all agree more resources for 
our State and local governments are necessary, we must also ensure 
these funds are spent responsibly and have a meaningful impact on risk 
reduction. CISA plays a vital role here. This important bill is a 
tremendous step forward in our fight to enhance election infrastructure 
security at the local level.
    I look forward to hearing from our witnesses today about how 
Congress can bolster CISA's role in election security and how CISA can 
in turn support our State and local election officials. Thank you, 
Madam Chair.

    Chairwoman Clarke. I thank our Ranking Member for his 
opening statement. Just to remind Members that the subcommittee 
will operate according to the guidelines laid out by the 
Chairman and Ranking Member in their February 3 colloquy 
regarding remote procedures. Member statements may be included 
for the record.
    [The statement of Chairman Thompson follows:]
                Statement of Chairman Bennie G. Thompson
                            January 20, 2022
    Good afternoon. I want to thank Chairwoman Clarke and Ranking 
Member Garbarino for holding this important hearing on election 
security as we enter a mid-term election year.
    Ensuring the security of our elections has been a priority for me, 
particularly since 2016, where we witnessed unprecedented foreign 
interference in our electoral process.
    In the 115th Congress, then-House Administration Committee Ranking 
Member Robert Brady and I formed the Congressional Task Force on 
Election Security.
    The Task Force produced a report with 10 recommendations for 
enhancing our Nation's election security and led to the introduction of 
the Election Security Act to implement these important proposals.
    Unfortunately, while the House has passed these critical election 
security provisions as part of broader election reform legislation, 
unified Republican opposition has blocked passage in the Senate.
    Although we have been unable to pass these critical provisions, 
Democrats have been able to secure over $1 BILLION in support to the 
States, including through the CARES Act, to enhance the security of 
voting systems.
    Combined with the work of the Cybersecurity and Infrastructure 
Security Agency and other Federal partners, we were able to have the 
most secure election in American history in 2020, even amidst a global 
pandemic.
    That achievement speaks volumes about the hard work of election 
officials throughout the country and the potential to protect our 
elections when we collaborate to prioritize security.
    We must build on this progress by investing additional resources in 
election security, replacing paperless voting machines with paper 
ballots, conducting evidence-based post-election audits, and ensuring 
the highest security standards for voter registration databases, 
electronic poll books, and other election technology.
    Unfortunately, the aftermath of the 2020 election demonstrated that 
even when an election is highly secure, misinformation can produce 
devastating consequences for our democratic system of government.
    If people are convinced that an election result is illegitimate--no 
matter how baseless that claim may be--we have seen first-hand the 
violence it can produce.
    With social media enabling misinformation to spread at 
unprecedented speeds, developing strategies to respond and contain such 
falsehoods will require innovative solutions to address this very 
complex problem.
    I applaud Chairwoman Clarke for her efforts to authorize CISA's 
disinformation efforts, particularly its Rumor Control website to 
debunk misinformation promptly.
    An essential aspect of addressing misinformation is to promote 
accurate information from trusted sources, and I am confident that this 
legislation can help achieve that goal.
    I look forward to working with her to move this important bill 
forward.
    The past few years has been a troubling time for our democracy.
    We have seen people spread lies about the integrity of our 
elections and use them to justify new restrictive voter laws that do 
nothing to enhance voter confidence.
    Instead, they only make it harder for Americans, and particularly 
people of color, to exercise their fundamental right to vote.
    That only further erodes trust in our institutions and makes our 
democracy more vulnerable.
    Fortunately, there is another way, as reflected in the Freedom to 
Vote: John R. Lewis Act that the House passed last week.
    This approach ensures voting is accessible to all who are eligible 
and invests in meaningful election security, helping to build 
confidence in the integrity of our elections.
    We have not been able to enact this important legislation, but we 
will continue to fight, as the consequences of failure on this issue 
are simply too high.
    The panel of witnesses we have today are all individuals who have 
been working tirelessly in recent years to address these challenges.
    I look forward to hearing their ideas about how we can expand on 
our successes so far, continue to strengthen the security of our 
election infrastructure, and build back public confidence in our 
democratic institutions.
    I yield back.

    Chairwoman Clarke. Right now I am going to move us to our 
panel. When and if our Ranking Member or Chairman arrive, we 
will hear from them.
    I now welcome our panel of witnesses.
    First, I would like to welcome Ms. Gowri Ramachandran, 
excuse me. Ms. Ramachandran serves as senior counsel in the 
Brennan Center's democracy program, where her work focuses on 
election security, election administration, and combatting 
election disinformation. Prior to her role at the Brennan 
Center, Ms. Ramachandran, excuse me, was professor of law at 
Southwestern Law School in Los Angeles, California.
    Second, we will hear from Mr. Alex Stamos, the director of 
the Stanford Internet Observatory. At Stanford he oversaw the 
Election Integrity Partnership, a coalition of researchers, 
civil society groups, and other stakeholders working to track 
and respond to election disinformation in real time. Mr. Stamos 
also serves as a commissioner on the Aspen Institute's 
Commission on Information Disorder and is the former chief 
security officer for Facebook.
    Next we have Mr. Ezra Rosenberg, who has served as the 
codirector of the Voting Rights Project at the Lawyers' 
Committee for Civil Rights Under Law since July 2015. Mr. 
Rosenberg joined the Lawyers' Committee in November 2014 as 
special senior counsel in the Legal Mobilization Project, 
continuing a 40-year career in the public and private sectors.
    Finally, I would like to welcome Mr. Matt Masterson, who 
serves as a nonresident policy fellow with the Stanford 
Internet Observatory. Prior to his current role, Mr. Masterson 
was a senior cybersecurity advisor at the Department of 
Homeland Security, where he focused on election security 
issues. He has also served as the commissioner at the Election 
Assistance Commission and on the staff of the Ohio Secretary of 
State's Office.
    Without objection, the witnesses' full statements will be 
inserted in the record. I now ask each witness to summarize his 
or her statement for 5 minutes, beginning with Ms. 
Ramachandran. Thank you for joining us.

STATEMENT OF GOWRI RAMACHANDRAN, SENIOR COUNSEL, BRENNAN CENTER 
                          FOR JUSTICE

    Ms. Ramachandran. Chairwoman Clarke, Ranking Member 
Garbarino, and Members of the committee, thank you for the 
opportunity to discuss election security.
    The November 2020 election is widely considered the most 
secure in American history. But an anti-democracy movement, 
fueled by the Big Lie, poses serious threats to elections. 
Taking these threats seriously requires expanding upon recent 
improvements to election security.
    In my testimony I will cover 3 topics. First, I will 
describe what went right in 2020. State and local election 
security, CISA, the EAC, and voters themselves all played a 
role with support from Congress helping to make it possible.
    Second, I will describe the threats that the election 
sabotage movement is posing to election infrastructure. Lies 
about the 2020 election not only undermine voter confidence, 
they also lead to tangible security risks to election systems 
and increase the risk of insider attacks.
    Third, I will address how election infrastructure can be 
bolstered against this threat with financial resources and 
incentivizing true election integrity measures, like risk-
limiting audits and rigorous election vendor security 
standards.
    In 2016, 1 in 5 voters cast their vote using a paperless 
voting system. But in 2020, an estimated 96 percent of voters 
used paper ballots. In fact, no swing State used paperless 
voting machines and routine statutory tabulation audits were 
performed in every swing State. None found discrepancies that 
would have been sufficient to alter the outcome of the 
Presidential election.
    In addition to this crucial move away from paperless 
systems, CISA expanded its collaboration with State and local 
election officials. It provided vulnerability testing and 
trainings, shared information, and emphasized public education. 
For instance, in the fall of 2020, some Florida voters received 
threatening emails in the guise of a domestic far-right group 
that has promoted violence. The intelligence community detected 
the true source of the attack, alerted election officials, and 
held a joint press conference to let the public know the truth: 
The emails were actually coming from malicious actors 
associated with Iran.
    Election officials adopted resiliency measures, such as 
stocking emergency paper ballots in case of machine failure, to 
ensure that voters could exercise their rights even when there 
was sporadic polling place problems. In some States, the many 
options for voting served as their own resiliency measure 
against the pandemic. These options allowed voters to spread 
themselves out among different voting methods and days. It also 
meant that money from Congress was crucial.
    After this success, what lies ahead? The continued lie that 
the 2020 election was stolen is not only undermining the 
public's confidence, but is also threatening election 
infrastructure directly through sham partisan reviews and 
insider threat risks.
    Sham partisan reviews have provided unmonitored election 
equipment access to biased, uncertified partisans. In fact, 
decertification or decommission of equipment has been necessary 
after multiple sham reviews across the country. Ballot security 
breaches have also been damaging.
    Anti-democratic forces are also undermining a once broadly-
shared commitment to competent and nonpartisan election 
administration. Many election officials committed to fair 
elections are resigning or being pushed out in the fact of 
myriad attacks and pressures.
    Moreover, given that almost one-third of Americans still 
believe the Big Lie, it is unsurprising that some minority of 
election officials, and likely even some employees and vendors 
who support their work, themselves buy into election conspiracy 
theories. Unprecedented amounts of money are being spent in 
campaigns for election administration jobs with election 
denialism, for and against, being treated as a key issue.
    What happens if officials and election personnel fall 
victim to these falsehoods? We are witnessing the first 
glimpses now. In Colorado, a county clerk with connections to 
election conspiracy theorists gave unauthorized access to the 
county's voting systems. Photos of passwords for the voting 
machine software ended up on-line.
    These security risks are alarming, but they can be 
mitigated. It should go without saying that all levels of law 
enforcement should enforce existing laws against threats, 
especially when election personnel are intimidated. Congress 
can work to combat doxing and provide for physical security and 
training. When it comes to insider threats, well-accepted best 
practices already exist. They include restricting and logging 
access to critical systems, monitoring through video 
surveillance, background checks, and choosing vendors that also 
employ good practices.
    This all costs money and Congress should help. Routine 
tabulation audits in which a sample of ballots are hand-counted 
and compared to machine counts help to guard against a variety 
of threats, including insider threats. Requiring risk-limiting 
audits in Federal elections has received bipartisan support in 
the past.
    Our election infrastructure is strong, but it is facing a 
growing anti-democracy threat from within. Congress can lead 
the way on protecting democracy from that threat by investing 
in true election integrity measures.
    [The prepared statement of Ms. Ramachandran follows:]
                Prepared Statement of Gowri Ramachandran
                            January 20, 2022
    Chairwoman Clarke, Ranking Member Garbarino, and Members of the 
committee: Thank you for the opportunity to discuss the security of our 
Nation's election infrastructure. Despite a global pandemic, the 
November 2020 election saw historic turnout and was widely considered 
the most secure in American history.\1\ But an anti-democracy movement, 
fueled by the Big Lie, poses serious threats to the security of 
elections. Taking these threats seriously means building upon recent 
improvements to election infrastructure security, such as the increased 
use of auditable paper ballots and increased information sharing 
between State and local election officials and the U.S. Cybersecurity 
and Infrastructure Security Agency (CISA).
---------------------------------------------------------------------------
    \1\ U.S. Cybersecurity and Infrastructure Security Agency, ``Joint 
Statement from Elections Infrastructure Government Coordinating Council 
& the Election Infrastructure Sector Coordinating Executive 
Committees,'' November 12, 2020, https://www.cisa.gov/news/2020/11/12/
joint-statement-elections-infrastructure-government-coordinating-
council-election.
---------------------------------------------------------------------------
    The Brennan Center for Justice--a nonpartisan law and policy 
institute that focuses on democracy and justice--appreciates the 
opportunity to report on the security of our election infrastructure, 
threats to that infrastructure, and ways to secure against these 
dangers. At the Brennan Center, I focus on election security, and I 
frequently engage with State and local election officials to advocate 
for and assist with the implementation of election security and 
resiliency measures.\2\
---------------------------------------------------------------------------
    \2\ Reports that I have coauthored include Lawrence Norden, Gowri 
Ramachandran, and Christopher Deluzio, A Framework for Election Vendor 
Oversight, Brennan Center for Justice, November 12, 2019, https://
www.brennancenter.org/our-work/policy-solutions/framework-election-
vendor-oversight; Gowri Ramachandran and Tim Lau, ``How to Keep the 
2020 Election Secure,'' Brennan Center for Justice, June 9, 2020, 
https://www.brennancenter.org/our-work/analysis-opinion/how-keep-2020-
election-secure; Edgardo Cortes et al., Preparing for Cyberattacks and 
Technical Problems During the Pandemic: A Guide for Election Officials, 
Brennan Center for Justice, June 5, 2020, https://
www.brennancenter.org/our-work/research-reports/preparing-cyber-
attacks-and-technical-problems-during-pandemic-guide; Jonathan Bydlak 
et al., Partisan Election Review Efforts in Five States, Brennan Center 
for Justice, July 8, 2021, https://www.brennancenter.org/our-work/
research-reports/partisan-election-review-efforts-five-states; and 
Brennan Center for Justice and Bipartisan Policy Center, Election 
Officials Under Attack, June 16, 2021, https://www.brennancenter.org/
our-work/policy-solutions/election-officials-under-attack.
---------------------------------------------------------------------------
    In my testimony, I will cover 3 topics. First, I will describe what 
went right in 2020. This included the wide-spread use of auditable 
paper ballots, cooperation between State and local election officials 
and CISA, resiliency measures and money from Congress to ensure voters 
could exercise their rights safely in a pandemic, and the resiliency of 
voters themselves, who made thoughtful plans to vote safely and 
securely. This was all followed by routine, statutory tabulation audits 
in every swing State, finding no discrepancies sufficient to change the 
outcome of the Presidential election.
    Second, I will describe the threats that the election sabotage 
movement is posing to election infrastructure. These threats include 
sham partisan reviews that undermine confidence and security,\3\ 
violent threats and intimidation of election officials and workers,\4\ 
and the potential infiltration of election offices, polling places, and 
election vendors by anti-democratic forces.\5\ Of particular concern: 
Candidates for election administration positions are raising 
unprecedented sums as they campaign on election denial.\6\
---------------------------------------------------------------------------
    \3\ Gowri Ramachandran, ``A Year Later, Sham Election Review 
Continue to Undermine Democracy,'' Brennan Center for Justice, January 
7, 2022, https://www.brennancenter.org/our-work/analysis-opinion/year-
later-shamelection-reviews-continue-undermine-democracy.
    \4\ Brennan Center for Justice and Bipartisan Policy Center, 
Election Officials Under Attack; and Linda So and Jason Szep, ``Reuters 
Unmasks Trump Supporters Who Terrified U.S. Election Officials,'' 
Reuters, November 9, 2021, https://www.reuters.com/investigates/
special-report/usa-election-threats/.
    \5\ Lawrence Norden and Derek Tisler, ``Addressing Insider Threats 
in Elections,'' Brennan Center for Justice, December 8, 2021, https://
www.brennancenter.org/our-work/analysis-opinion/addressing-insider-
threats-elections.
    \6\ Ian Vandewalker and Lawrence Norden, ``Financing of Races for 
Offices that Oversee Elections: January 2022,'' Brennan Center for 
Justice, January 12, 2022, https://www.brennancenter.org/our-work/
research-reports/financing-races-offices-oversee-elections-january-
2022.
---------------------------------------------------------------------------
    Third, I will address how election infrastructure can be bolstered 
against this threat. On-line platforms and traditional media should 
work with civil society to ensure they are promoting accurate election 
information.\7\ Existing laws against intimidation, coercion, and 
threats should be enforced,\8\ and States should, with support from 
Congress, consistently adopt traditional guardrails against insider 
threats. These include restricting and logging access to critical 
systems, using transparent procedures such as nonpartisan and 
bipartisan election observation, monitoring for inappropriate activity, 
requiring vendors to follow cybersecurity, personnel, and supply chain 
standards, and removing any officials or workers who actively undermine 
election integrity.\9\ Congress should mandate and provide incentives 
for true election integrity measures, such as risk-limiting audits, 
rigorous election vendor standards, and independent security testing, 
as the Freedom to Vote: John R. Lewis Act does.\10\
---------------------------------------------------------------------------
    \7\ Gowri Ramachandran, ``Twitter is a Cauldron of Misinformation 
about the Arizona 2020 Vote Audit,'' Slate, May 14, 2021, https://
slate.com/technology/2021/05/maricopa-county-arizona-2020-vote-recount-
misinformation.html; and Brennan Center for Justice and Bipartisan 
Policy Center, Election Officials Under Attack, 11.
    \8\ Linda So and Jason Szep, ``Threats of Violence to U.S. Election 
Officials Highlight Legal Gray Area,'' September 8, 2021, https://
www.reuters.com/legal/government/threats-violence-us-election-
officials-highlight-legal-gray-area-2021-09-08/.
    \9\ Elections Project Staff, ``Election Observers are Official 
Actors that Promote Legitimacy and Transparency. They are Typically 
Appointed, Trained, and are Barred from Voter Intimidation by State and 
Federal Laws,'' Bipartisan Policy Center, October 23, 2020, https://
bipartisanpolicy.org/blog/election-observers-are-generally-appointed-
and-are-held-to-strict-standards-of-behavior/.
    \10\ Freedom to Vote: John R. Lewis Act, H.R. 5746 117th Cong.  
3908, 4001 (2021); Elizabeth Howard, Ronald L. Rivest, and Philip B. 
Stark, A Review of Robust Post-Election Audits, Brennan Center for 
Justice, November 7, 2019, https://www.brennancenter.org/our-work/
research-reports/review-robust-post-election-audits; Norden, 
Ramachandran, and Deluzio, A Framework for Election Vendor Oversight; 
and Cortes et al., Preparing for Cyberattacks and Technical Problems 
During the Pandemic: A Guide for Election Officials, 6.
---------------------------------------------------------------------------
                       i. what went right in 2020
    The November 2020 election was the most secure election in American 
history, with the highest turnout since 1900.\11\ This was accomplished 
through the heroic efforts of State and local election officials, their 
staff, and pollworkers, with support from CISA, the Election 
Administration Commission (EAC), Congress, civil society, and voters 
themselves.
---------------------------------------------------------------------------
    \11\ Women, Asian Americans, and Native Americans were not able to 
vote in 1900. U.S. Const. amend. XIX (ratified Aug. 18, 1920); Terry Ao 
Minnis and Mee Moua, ``50 Years of the Voting Rights Act: An Asian 
American Perspective,'' Asian Americans Advancing Justice, August 4, 
2015, https://advancingjustice-aajc.org/report/50years-voting-rights-
act-asian-american-perspective, (``[U]ntil 1952, Federal policy barred 
immigrants of Asian descent from becoming U.S. citizens and having 
access to the vote,''); United States Library of Congress, ``Voting 
Rights for Native Americans,'' accessed July 25, 2021, https://
www.loc.gov/classroom-materials/elections/right-to-vote/voting-rights-
for-native-americans/, (``The Snyder Act of 1924 admitted Native 
Americans born in the U.S. to full U.S. citizenship. Though the 
Fifteenth Amendment, passed in 1870, granted all U.S. citizens the 
right to vote regardless of race, it wasn't until the Snyder Act that 
Native Americans could enjoy the rights granted by this amendment,''); 
Kevin Schaul, Kate Rabinowitz, and Ted Mellnik, ``2020 Turnout is the 
Highest in Over a Century,'' Washington Post, last updated December 28, 
2020, https://www.washingtonpost.com/graphics/2020/elections/voter-
turnout/; and U.S. Cybersecurity and Infrastructure Security Agency, 
``Joint Statement from Elections Infrastructure Government Coordinating 
Council & the Election Infrastructure Sector Coordinating Executive 
Committees.''
---------------------------------------------------------------------------
A. An Estimated 96 Percent of Voters Used Voter-Verifiable Paper 
        Ballots
    In order to demonstrate the trustworthiness of elections, election 
officials need auditable, voter-verifiable paper ballot systems.\12\ 
These allow for routine, statutory post-election tabulation audits, in 
which a sample of paper ballots are compared to the machine-tabulated 
results. These types of audits are designed to catch tabulation errors, 
whether they might be the result of malicious activity or technical 
errors. When these types of audits are routinely performed by competent 
administrators in a transparent manner, they can and should boost 
confidence in the accuracy of electoral outcomes. The Brennan Center 
and others have long advocated for this type of audit.\13\
---------------------------------------------------------------------------
    \12\ U.S. Election Assistance Commission, Voluntary Voter System 
Guidelines 2.0, February 10, 2021, 184, 186, https://www.eac.gov/sites/
default/files/TestingCertification/Voluntary- 
_Voting_System_Guidelines_Version_2_0.pdf; and Kate Polit, ``Former 
CISA Head Krebs Counters GOP Claims, Reassures that 2020 Election was 
Secure,'' MeriTalk, December 16, 2020, https://www.meritalk.com/
articles/former-cisa-head-krebs-counters-gop-claims-reassures-that-
2020-election-was-secure/.
    \13\ Bydlak et al., Partisan Election Review Efforts in Five 
States; U.S. Election Assistance Commission, Best Practice: Chain of 
Custody, July 13, 2021, 15, https://www.eac.gov/sites/default/files/
bestpractices/Chain_of_Custody_Best_Practices.pdf; and Howard, Rivest, 
and Stark, A Review of Robust Post-Election Audits.
---------------------------------------------------------------------------
    In 2016, 1 in 5 voters cast their vote using a paperless voting 
system that could not be subject to a tabulation audit.\14\ But thanks 
to election officials across the country transitioning to more secure 
systems that scan paper ballots, as well as the choice of more voters 
to vote by mail during the pandemic, an estimated 96 percent of voters 
used voter-verifiable paper ballots in the 2020 election. No swing 
State used paperless voting machines.\15\
---------------------------------------------------------------------------
    \14\ Andrea Cordova McCadney, Elizabeth Howard, and Lawrence 
Norden, ``Voting Machine Security: Where We Stand Six Months Before the 
New Hampshire Primary,'' Brennan Center for Justice, August 13, 2019, 
https://www.brennancenter.org/our-work/analysis-opinion/voting-machine-
security-where-we-stand-six-months-new-hampshire-primary.
    \15\ Lawrence Norden and Derek Tisler, ``Our System is Resilient--
but Still has Room for Improvement,'' Brennan Center for Justice, 
September 22, 2020, https://www.brennancenter.org/our-work/research-
reports/our-election-system-resilient-still-has-room-improvement.
---------------------------------------------------------------------------
B. CISA and State and Local Election Officials Cooperated To Prevent, 
        Detect, and Recover from Cyber Attacks
    CISA established a partnership with and supported State and local 
election officials in the years and months leading up to the 2020 
election by providing vulnerability testing,\16\ promoting best 
practices for resiliency,\17\ and providing trainings, such as tabletop 
exercises \18\ in which officials practiced responding to security 
breaches.
---------------------------------------------------------------------------
    \16\ U.S. Cybersecurity and Infrastructure Security Agency, Guide 
to Vulnerability Reporting for America's Election Administrators, last 
accessed January 13, 2022, 2, https://www.cisa.gov/sites/default/files/
publications/guide-vulnerability-reporting-americas-election-admins_- 
508.pdf; and U.S. Cybersecurity and Infrastructure Security Agency, 
``National Cybersecurity Assessments and Technical Services,'' last 
accessed January 13, 2022, https://www.cisa.gov/uscert/resources/ncats.
    \17\ U.S. Cybersecurity and Infrastructure Security Agency, 
``Election Security--Physical Security of Voting Locations and Election 
Facilities,'' last accessed January 13, 2022, https://www.cisa.gov/
sites/default/files/publications/physical-security-of-voting-location-
election-facilities_v2_508.pdf; and U.S. Cybersecurity and 
Infrastructure Security Agency, ``We're in This Together. Mis-, Dis-, 
and Malinformation Stops with You,'' last accessed January 13, 2022, 
https://www.cisa.gov/sites/default/files/publications/election-
disinformation-toolkit_508_0.- pdf.
    \18\ U.S. Cybersecurity and Infrastructure Security Agency, 
Elections Cyber Tabletop Exercise Package: Situation Manual, January 
2020, https://www.cisa.gov/sites/default/files/publications/Elections-
Cyber-Tabletop-Exercise-Package-20200128-508.pdf; and Benjamin Freed, 
``Annual Election Security Tabletop Drill Put Officials through 
`Armageddon-Like' Test,'' StateScoop, July 31, 2020, https://
Statescoop.com/dhs-election-tabletop-exercise-2020/.
---------------------------------------------------------------------------
    CISA also ramped up its information sharing with State and local 
election officials, and the public, and this information sharing paid 
off. For instance, in the fall of 2020, some Florida voters received 
threatening and intimidating emails in the guise of a far-right group 
that has promoted violence.\19\ The intelligence community detected the 
true source of the attack, and CISA, the FBI, and the Office of the DNI 
held a joint press conference to let the public know the truth: That 
the emails were coming from malicious actors associated with Iran.\20\ 
By quickly informing the public, they were able to reduce any 
intimidating effect. As Director Ratcliffe stated on October 21, 2020, 
``These actions are desperate attempts by desperate adversaries . . . 
We ask every American to do their part to defend against those who wish 
us harm. The way you do that is quite simple: Do not allow these 
efforts to have their intended effect. If you receive an intimidating 
or manipulative email in your inbox, don't be alarmed, and don't spread 
it.''\21\
---------------------------------------------------------------------------
    \19\ Ellen Nakashima, Amy Gardner, Isaac Stanley-Becker, and Craig 
Timberg, ``U.S. Government Concludes Iran was Behind Threatening Emails 
Sent to Democrats,'' Washington Post, October 22, 2020, https://
www.washingtonpost.com/technology/2020/10/20/proud-boys-emails-
florida/.
    \20\ Office of the Director of National Intelligence, ``DNI John 
Ratcliffe's Remarks at Press Conference on Election Security,'' press 
release, October 22, 2020, https://www.dni.gov/index.php/newsroom/
press-releases/item/2162-dnijohn-ratcliffe-s-remarks-at-press-
conference-on-election-security.
    \21\ Office of the Director of National Intelligence, ``DNI John 
Ratcliffe's Remarks at Press Conference on Election Security.''
---------------------------------------------------------------------------
    A few days later, CISA and the FBI issued a public alert, notifying 
Americans that malicious actors, including some associated with the 
Iranian government, were scanning multiple States' election webpages 
for vulnerabilities, and that one State's voter registration data had 
successfully been accessed.\22\ Shortly thereafter, Florida closed down 
its State-wide page with a voter information look-up tool and informed 
voter advocates who objected that the closure was due to a security 
vulnerability. Advocates were able to secure modifications to the page 
that did not re-open the security vulnerability, but ensured voters 
with questions could still obtain the information they needed, such as 
their polling place location.\23\
---------------------------------------------------------------------------
    \22\ U.S. Cybersecurity and Infrastructure Security Agency, ``Alert 
(AA20-304A): Iranian Advanced Persistent Threat Actor Identified 
Obtaining Voter Registration Data,'' last updated November 3, 2020, 
https://www.cisa.gov/uscert/ncas/alerts/aa20-304a.
    \23\ Letter from the NAACP Legal Defense Fund et al. to Laurel Lee, 
Florida Secretary of State, November 1, 2020, https://www.naacpldf.org/
wp-content/uploads/2020.11.01-Letter-re-Voter-Information-Lookup-
Tool.pdf; and NAACP Legal Defense Fund Thurgood Marshall Institute, 
Democracy Defended, September 2, 2021, 74, https://www.naacpldf.org/wp-
content/uploads/LDF_2020_DemocracyDefended-1-3.pdf.
---------------------------------------------------------------------------
C. Resiliency Measures and Money from Congress Helped Americans Vote 
        Safely Despite Pandemic
    CISA, election security experts, and voting rights advocates all 
encouraged the adoption of resiliency measures to help election 
officials detect, prevent, and importantly, recover from an attack or 
technical failure.\24\ Many election officials employed these measures, 
including the maintenance of emergency paper ballots, to be used in 
case ballot marking devices malfunctioned,\25\ as well as keeping paper 
pollbook back-ups in polling places that use electronic pollbooks,\26\ 
in case of a malicious attack or malfunction of the electronic books. 
Provisional ballots were also kept on hand in case an attack or 
malfunction prevented pollworkers from confirming a voter's eligibility 
to vote in real time.\27\ Each of these resiliency measures came in 
handy in at least some locations, helping ensure that voting could 
continue and voters did not need to be turned away, even when 
occasional hiccups with equipment occurred.\28\
---------------------------------------------------------------------------
    \24\ U.S. Cybersecurity and Infrastructure Security Agency, 
``#Protect2020,'' last accessed January 14, 2022, https://www.cisa.gov/
protect2020; Cortes et al., Preparing for Cyberattacks and Technical 
Problems During the Pandemic: A Guide for Election Officials; and 
Common Cause, ``Common Cause Georgia Urges Secretary Raffensperger to 
Ensure Georgians Are Not Denied the Right to Vote on November 3,'' 
press release, October 1, 2020, https://www.commoncause.org/press-
release/common-cause-georgia-urges-secretary-raffensperger-to-ensure-
georgians-are-not-denied-the-right-to-vote-on-november-3/.
    \25\ J.D. Capelouto and Ben Brasch, ``Voting Machines Finally 
Working at Fulton Polling Place; Paper Ballots Used,'' Atlanta-Journal 
Constitution, November 3, 2020, https://www.ajc.com/news/atlanta-news/
voting-machines-down-at-one-fulton-polling-place-paper-ballots-in-use/
OC3TGOUEGRDMVFPMZ6X7ONLMNA/; and Michaelle Bond, Julia Terruso, and 
Justine McDaniel, ``Philly Polling Locations Got the Wrong Voting 
Machines, Causing Confusion and Long Lines: `It was a Mess,' '' 
Philadelphia Inquirer, June 2, 2020, https://www.inquirer.com/politics/
election/live/pa-2020-primary-election-philadelphia-live-updates-
results20200602.html.
    \26\ Rick Rouan, ``Election Day: Some Voters See Delays at Polls as 
Franklin County Switches to Paper Pollbooks,'' Columbus Dispatch, 
November 3, 2020, https://www.dispatch.com/story/news/politics/
elections/2020/11/03/franklin-county-shifts-paper-pollbooks-after-data-
upload-problem/6135788002/; see also Michigan Election Security 
Advisory Commission, Report and Recommendations, Michigan Secretary of 
State, October 2020, 14, https://www.michigan.gov/documents/sos/
ESAC_Report_Recommendations_706522_7.pdf.
    \27\ Ben Finley, Alan Suderman, and Denise LaVoie, ``Cut Cable 
Shuts Down Virginia Voter Portal; Lawsuit Filed,'' Associated Press, 
October 13, 2020, https://apnews.com/article/election-2020-us-news-ap-
top-news-media-socialmedia-f6525ef6254a940c91b98d2668c43892/.
    \28\ Andrea Cordova McCadney, Derek Tisler, and Lawrence Norden, 
``2020's Lessons for Election Security,'' December 16, 2020, https://
www.brennancenter.org/our-work/research-reports/2020's-lessons-
election-security.
---------------------------------------------------------------------------
    In addition to these resiliency measures against electronic 
equipment failures, the provision by many States of multiple options 
for voting--in-person Election Day, in-person early, and mail voting--
served as its own resiliency measure against the pandemic. These 
options allowed voters to spread themselves out among different voting 
methods and days, thereby reducing crowds at polling places for the 
increased safety of all. They also allowed voters to, if faced with a 
long line due to some technical issue during early voting, return on 
another day when the problem had been ameliorated.\29\ They also meant 
election officials needed resources--from personal protective equipment 
for pollworkers and voters voting in person, to extra supplies given 
uncertainty about which voting methods voters would use and larger 
facilities for workers to socially distance in while processing and 
tabulating mail ballots.\30\
---------------------------------------------------------------------------
    \29\ Cordova, McCadney, Tisler, and Norden, ``2020's Lessons for 
Election Security.''
    \30\ Yelena Dzhanova, ``The New Challenge for State Election 
Officials? How Much Hand Sanitizer is Enough,'' CNBC, August 10, 2020, 
https://www.cnbc.com/2020/08/10/coronavirus-distributing-masks-and-
sanitizer-a-challenge-for-2020-election.html; Tim Harper, Rachel Orey, 
and Collier Fernekes, Counting the Vote During the 2020 Election, 
Bipartisan Policy Center, August 25, 2020, https://
bipartisanpolicy.org/report/counting-the-vote-during-the-2020-election/
; and Kendall Karson, `` `I Don't Think You Really Can' Make the 
Election Safe: Wisconsin Gears Up for Next Primary Amid Coronavirus,'' 
ABC News, March 31, 2020, https://abcnews.go.com/Politics/make-
election-safe-wisconsin-gears-primary-amid-coronavirus/
story?id=69879453.
---------------------------------------------------------------------------
    The resiliency measures that election officials employed and the 
money that Congress provided to help pay for them was crucial in 
running a safe and secure election.\31\
---------------------------------------------------------------------------
    \31\ Cordova McCadney, Tisler, and Norden, ``2020's Lessons for 
Election Security.''
---------------------------------------------------------------------------
D. Legitimate Post-Election Audits and Recounts Confirmed that Outcomes 
        Were Correct
    Finally, after Election Day came and went, routine, statutory 
tabulation audits were performed in every swing State, with additional 
recounts in some. None found discrepancies that would have been 
sufficient to alter the outcome of the Presidential election, thereby 
providing added confidence in the integrity of the election.\32\
---------------------------------------------------------------------------
    \32\ Bydlak et al., Partisan Election Review Efforts in Five 
States.
---------------------------------------------------------------------------
    Of course, there is room for improvement. Ideally, all States would 
conduct routine, statutory tabulation audits with the opportunity for 
nonpartisan and bipartisan observation. In these audits, a sample of 
ballots would be compared to machine counts, and ideally, they would 
include risk-limiting audits. In a risk-limiting audit, the number of 
ballots sampled varies based on how close the contest being audited is, 
in order to provide a pre-determined statistical level of confidence 
that any discrepancies were not sufficient to alter the outcome.\33\
---------------------------------------------------------------------------
    \33\ Elizabeth Howard, Turquoise Baker, and Paul Rosenzweig, Risk-
Limiting Audits in Arizona, Brennan Center for Justice, February 1, 
2021, 3-4, https://www.brennancenter.org/our-work/research-reports/
risk-limiting-audits-arizona.
---------------------------------------------------------------------------
    Currently, most States have some kind of routine post-election 
tabulation audit, and only a few States conduct risk-limiting 
audits.\34\ Requiring risk-limiting audits is an example of the kind of 
measure that could truly improve upon election integrity, as opposed to 
sham partisan reviews,\35\ laws that make it easier for monitors to 
interfere with and disturb election administration,\36\ or laws that 
make it impossible for election officials to assist and educate voters 
about their rights.\37\
---------------------------------------------------------------------------
    \34\ Derek Tisler, Elizabeth Howard, and Edgardo Cortes, ``The 
Roadmap to the Official Count in an Unprecedented Election,'' Brennan 
Center for Justice, October 26, 2020, https://www.brennancenter.org/
our-work/researchreports/roadmap-official-count-unprecedented-election; 
National Conference of State Legislatures, ``Post-Election Audits,'' 
last updated October 25, 2019, https://www.ncsl.org/research/elections-
and-campaigns/post-election-audits635926066.- aspx#State%20reqs; and 
National Conference of State Legislatures, ``Risk-Limiting Audits,'' 
last updated September 16, 2021, https://www.ncsl.org/research/
elections-and-campaigns/risk-limiting-audits.aspx.
    \35\ Elizabeth Howard and Gowri Ramachandran, ``Partisan Arizona 
Election `Audit' Was Flawed from the Start,'' Brennan Center for 
Justice, September 27, 2021, https://www.brennancenter.org/our-work/
analysis-opinion/partisan-arizona-election-audit-was-flawed-start.
    \36\ Eliza Sweren-Becker, ``Who Watches the Poll Watchers?,'' 
Brennan Center for Justice, April 29, 2021, https://
www.brennancenter.org/our-work/research-reports/who-watches-poll-
watchers.
    \37\ Tyler Buchanan, ``Some Voter Education Programs May Be in 
Jeopardy Due to New Ohio Law,'' Ohio Capital Journal, July 16, 2021, 
https://ohiocapitaljournal.com/2021/07/16/some-voter-education-
programs-may-be-in-jeopardy-due-to-new-ohio-law/; and TX S.B. 1  4.02 
(2021) (omnibus bill with several restrictive provisions).
---------------------------------------------------------------------------
                    ii. threat of election sabotage
    It is imperative that all those who worked to secure our election 
infrastructure against the threat of foreign interference and attacks 
in 2020 continue those efforts. But the events of the past year have 
shown that there is a fast-growing threat of election sabotage from an 
anti-democratic movement within our own country, and that this threat 
also deserves focus. In fact, the two threats could compound each 
other, with home-grown election conspiracies making it easier for 
foreign governments and their agents to accelerate destabilization 
merely by seeding and amplifying doubts and confusion, rather than 
investing in developing sophisticated cyber attacks.
    The domestic anti-democracy movement also threatens election 
infrastructure directly, through sham partisan reviews that undermine 
not only confidence but security, and through a variety of threats to 
the integrity of the people who make up our election infrastructure--
election officials, election workers, and election vendor personnel.
A. Sham Partisan Reviews Undermine Security
    Loyalists of former president Donald Trump invaded the U.S. Capitol 
1 year ago, carrying weapons, waving the Confederate flag, and 
insisting that the 2020 election was fraudulent. There was no credible 
support for the claims of ``Stop the Steal'' advocates. Nevertheless, 
Pro-Trump politicians have spent the past year attempting to fabricate 
that support. They have dented public confidence in the voting process 
and made it harder for voters, in particular voters of color, to vote. 
Less recognized, but no less damaging, is the way they have co-opted 
and undermined a critical tool of our democracy: The post-election 
audit.\38\
---------------------------------------------------------------------------
    \38\ Brennan Center for Justice, ``Post-Election Audits,'' last 
accessed January 14, 2022, https://www.brennancenter.org/issues/defend-
our-elections/election-security/post-election-audits.
---------------------------------------------------------------------------
    Many States have rigorous protocols for post-election audits, 
including randomized selection of the electronic tallies to be checked 
against paper records, a commitment to objectivity throughout the 
process, and conducting the audit in full public view.\39\ When these 
standards are upheld, post-election audits help check that the outcomes 
of elections are accurate, and they maintain or restore public 
confidence in our democracy. The sham reviews following the 2020 
election are, essentially, the opposite of this. They were initiated 
for partisan reasons, as part of an attempt to overturn the will of the 
voters.
---------------------------------------------------------------------------
    \39\ National Conference of State Legislatures, ``Post-Election 
Audits''; and Howard, Rivest, and Stark, A Review of Robust Post-
Election Audits.
---------------------------------------------------------------------------
    They can also undermine security by providing unmonitored access to 
systems to biased partisans,\40\ leading to equipment no longer being 
safe to deploy in future elections. Ballot security breaches are 
another damaging effect, with inexperienced partisans permitting those 
handling the ballots to use pens that could change the vote 
records.\41\ They have also threatened potential voter intimidation 
with plans for biased partisans to knock on voters' doors asking 
questions.\42\ These security problems with partisan reviews are 
exemplified in the movement's most prominent effort to date: The 
partisan review \43\ of Maricopa County's 2020 election, conducted by 
the contractor Cyber Ninjas. Cyber Ninjas finally issued a report in 
September 2021, replacing the outright lies that have triggered 
defamation lawsuits against other Big Lie proponents with copious and 
misleading innuendo.\44\ The Maricopa County Recorder, Stephen Richer 
(R), recently issued a lengthy point-by-point rebuttal, in which the 
county identified 75 claims made by the audit team and debunked them 
all. The county's analysis determined 38 were inaccurate, 25 were 
misleading, and 11 were false.\45\
---------------------------------------------------------------------------
    \40\ Katie Hobbs to Maricopa County Board of Supervisors, May 20, 
2021, https://s3.documentcloud.org/documents/20784519/hobbs-letter-to-
maricopa-supervisors-5-20-21.pdf; and Jeremy Duda, ``Wake Technology 
Services Audited a Pennsylvania Election as part of the#StopTheSteal 
Movement,'' Arizona Mirror, May 21, 2021, https://www.azmirror.com/
2021/05/21/wake-technology-services-audited-a-pennsylvania-election-as-
part-of-the-stop-the-steal-movement/.
    \41\ Felicia Sonmez and Rosalind S. Helderman, ``Observers of 
Arizona's GOP-Led Election Audit Document Security Breaches, Prohibited 
Items on Counting floor,'' Washington Post, June 2, 2021, https://
www.washingtonpost.com/politics/trump-election-arizona-audit/2021/06/
02/56de9282-c3af-11eb-9a8df95d7724967c_story.html.
    \42\ Pamela S. Karlan to Karen Fann, May 5, 2021, https://
www.justice.gov/crt/case-document/file/1424586/download; and Fredreka 
Schouten, ``Trump Loyalists are Knocking on Voters' Doors in the Latest 
Quest to Find Fraud in the 2020 Election,'' CNN, December 18, 2021, 
https://www.cnn.com/2021/12/18/politics/trump-supporters-knock-on-
doors-in-search-for-2020-fraud/index.html.
    \43\ Bydlak et al., Partisan Election Review Efforts in Five 
States.
    \44\ Howard and Ramachandran, ``Partisan Arizona Election `Audit' 
Was Flawed from the Start.''
    \45\ Jeremy Duda, ``Maricopa County Rebuts `Audit' Findings, GOP's 
Bogus Election Claims,'' Arizona Mirror, January 5, 2022, https://
www.azmirror.com/2022/01/05/maricopa-county-rebuts-audit-findings-
bogus-election-claims.
---------------------------------------------------------------------------
    The contractors' most attention-grabbing findings fit the pattern 
\46\ that purveyors of voter fraud myths have long followed: Willful 
ignorance \47\ of basic probability, common election laws, and routine 
election administration procedures in order to raise baseless 
suspicions about fellow voters \48\ and the dedicated public servants 
\49\ who count their votes and certify the results. The report claims 
it is suspicious that some voters share the same full name and birth 
year--it isn't.\50\ It uses a commercial move tracking service to raise 
suspicions about voters who, according to the commercial service, moved 
before the election. But even leaving aside the accuracy of the 
commercial service's data, temporary moves do not alter eligibility to 
vote in Arizona.\51\ Unsurprisingly, the Cyber Ninjas audit was 
promptly used in the continuing disinformation campaign against our 
elections, with Trump citing its ``critical''--and false--``finding'' 
that 23,344 ballots were somehow impacted by the voters purportedly 
moving.\52\
---------------------------------------------------------------------------
    \46\ Brennan Center for Justice, Analysis of the September 15, 2005 
Voter Fraud Report Submitted to the New Jersey Attorney General, 
December 2005, 1, https://www.brennancenter.org/sites/default/files/
analysis/Analysis%20of%20the%2091505%20Voter%20Fraud%20Report.pdf.
    \47\ Gowri Ramachandran, ``The Arizona's Senate's Contractors Fail 
to Understand Basic Probability and Voter Data,'' Brennan Center for 
Justice, October 1, 2021, https://www.brennancenter.org/our-work/
analysis-opinion/arizona-senates-contractors-fail-understand-basic-
probability-and-voter.
    \48\ Brennan Center for Justice to Cobb County Board of Elections 
and Registration, December 18, 2020, https://www.brennancenter.org/
sites/default/files/202012/2020.12.18%20- 
Brennan%20Center%20Letter%20to%20Cobb%20County%20Board%20of%20Elections.
pdf.
    \49\ Reuters Staff, ``Fact Check: Massachusetts Election Officials 
Have Not Destroyed Ballots or Committed Election Fraud,'' Reuters, 
October 2, 2020, https://www.reuters.com/article/uk-factcheck-election-
ballot-massachuset/factcheck-massachusetts-election-officials-have-not-
destroyed-ballots-or-committed-election-fraud-idUSKBN26N2AF.
    \50\ Ramachandran, ``The Arizona's Senate's Contractors Fail to 
Understand Basic Probability and Voter Data.''
    \51\ Howard and Ramachandran, ``Partisan Arizona Election `Audit' 
Was Flawed from the Start.''
    \52\ Daniel Funke, ``Fact Check: Arizona Audit Affirmed Biden's 
Win, Didn't Prove Voter Fraud, Contrary to Trump Claim,'' USA Today, 
September 28, 2021, https://www.usatoday.com/story/news/factcheck/2021/
09/28/fact-check-arizona-audit-affirms-biden-win-doesnt-prove-voter-
fraud/5846640001/; and Maricopa County (@MaricopaCounty), ``CLAIM: 
23,344 mail-in ballots voted from a prior address. BOTTOM LINE: Cyber 
Ninjas still don't understand this is legal under Federal election law. 
To label it a ``critical'' concern is either intentionally misleading 
or staggeringly ignorant. AZ senators should know this too,'' Twitter, 
September 24, 2021, 2:32 p.m., https://twitter.com/maricopacounty/
status/1441470631787200514.
---------------------------------------------------------------------------
    The push to conduct partisan reviews continues to spread.\53\ State 
legislators in Pennsylvania have proposed conducting their own partisan 
review that would use the Arizona Senate's actions as a model. Assembly 
members in Wisconsin have launched a partisan effort there, targeting 
\54\ officials in its largest cities: Milwaukee, Madison, Racine, 
Kenosha, and Green Bay. Despite the dismissal of a lawsuit seeking to 
gain access to ballots in Fulton County, GA, for a partisan review,\55\ 
gubernatorial candidate David Perdue has sued Fulton County officials 
seeking a review.\56\ Now, even in States that President Trump won, 
such as Texas, Florida, and Idaho, local party activists have demanded 
these reviews over the objections of local election supervisors of both 
major parties.\57\
---------------------------------------------------------------------------
    \53\ Allan Smith, ``Not Just Arizona: Republicans Push More 
Partisan Election `Audits,' '' NBC News, June 4, 2021, https://
www.nbcnews.com/politics/donald-trump/not-just-arizona-republicans-
push-more-partisan-election-auditsn1268644.
    \54\ Christine Hatfield, ``Election Officials Across Wisconsin 
Receive Subpoenas in GOP 2020 Election Probe,'' Wisconsin Public Radio, 
October 1, 2021, https://www.wpr.org/election-officials-across-
wisconsin-receive-subpoenas-gop-2020-election-probe.
    \55\ Nicholas Reimann, ``Georgia Judge Dismisses Lawsuit Seeking 
Election Audit,'' Forbes, October 13, 2021, https://www.forbes.com/
sites/nicholasreimann/2021/10/13/georgia-judge-dismisses-lawsuit-
seeking-electionaudit/?sh=3e4f2df3107f.
    \56\ Mark Niesse, ``Perdue Sues to Inspect Absentee Ballots From 
2020 Georgia Election,'' Atlanta Journal-Constitution, December 10, 
2021, https://www.ajc.com/politics/perdue-sues-to-inspect-absentee-
ballots-from-2020georgia-election/ERS26VWUQ5AZRAFRCLBPMFINUY/.
    \57\ Alexa Ura and Allyson Waller, ``First Part of Texas' 2020 
Election Audit Reveals Few Issues, Echoes Findings From Review 
Processes Already in Place,'' Texas Tribune, December 31, 2021, https:/
/www.texastribune.org/2021/12/31/secretary-state-texas-election-audit/; 
Mitch Perry, ``DeSantis Appointee Dismisses Election `Forensic Audit' 
For Hillsborough, Orange, 3 Other Counties,'' Spectrum News: Bay News 
9, July 28, 2021, https://www.baynews9.com/fl/tampa/news/2021/07/28/
there-will-be-no-audits-of-florida-s-election-says-sec-of-state?web=1- 
&wdLOR=cAFEC4A74-114C-47B8-9D94-A1FC306B6BED; Idaho Secretary of State, 
``Idaho Declares `Big Lie' Allegations `Without Merit,' Confirms Idaho 
Election Integrity,'' October 6, 2021, https://sos.idaho.gov/2021/10/
06/idaho-declares-big-lie-allegations-without-merit-confirms-idaho-
election-integrity; and Lawrence Mower, `` `Tone Down the Rhetoric': 
Florida Election Officials Tell Politicians to Chill Out,'' Tampa Bay 
Times, October 21, 2021, https://www.tampabay.com/news/florida-
politics/2021/10/21/tone-down-the-rhetoric-florida-elections-officials-
tell-politicians-to-chill-out/.
---------------------------------------------------------------------------
B. Violent Threats and Intimidation, Along with Partisan Attacks, Are 
        Pushing Out Personnel Committed to Free and Fair Elections
    The Brennan Center for Justice commissioned a national survey of 
election officials this spring, which found that roughly 1 in 3 
election officials feel unsafe because of their job, and approximately 
1 in 6 listed threats to their lives as a job-related concern.\58\ This 
is unacceptable in a functioning democracy. The people who risked their 
lives during a pandemic to ensure that all eligible voters could vote, 
that they could vote safely, and that their votes would be counted 
accurately, cannot be subject to attacks and intimidation. Not only do 
they deserve better, but our democracy cannot survive when dedicated, 
honest people who provided the most secure election in American 
history, with the highest turnout since 1900 are subjected to death 
threats, simply for doing their jobs well.\59\
---------------------------------------------------------------------------
    \58\ Thirty-two percent of election officials surveyed said that 
they felt unsafe because of their job. Seventeen percent of local 
election officials surveyed said that they had been threatened because 
of their job. Benenson Strategy Group, ``The Brennan Center for 
Justice: Local Election Officials Survey,'' April 7, 2021, https://
www.brennancenter.org/our-work/research-reports/local-election-
officials-survey.
    \59\ Women, Asian Americans, and Native Americans were not able to 
vote in 1900. U.S. Const. amend. XIX (ratified Aug. 18, 1920); Minnis 
and Moua, ``50 Years of the Voting Rights Act: An Asian American 
Perspective''; United States Library of Congress, ``Voting Rights for 
Native Americans''; Schaul, Rabinowitz, and Mellnik, ``2020 Turnout is 
the Highest in Over a Century''; and U.S. Cybersecurity and 
Infrastructure Security Agency, ``Joint Statement from Elections 
Infrastructure Government Coordinating Council & the Election 
Infrastructure Sector Coordinating Executive Committees.''
---------------------------------------------------------------------------
    The Department of Justice has created a task force to address the 
situation, but the overall lack of accountability for these bad actors 
continues to be dispiriting for the public servants who make our 
democracy function,\60\ and the impetus to step down is strong.\61\ In 
one recent example, despite having the support of at least one 
Republican Board of Elections member, Jeannetta Watson, the first Black 
elections director in Macon-Bibb County, Georgia, stepped down last 
week.\62\ Board of Elections member Mike Kaplan said it was ``a sad day 
for our country and especially Macon-Bibb,'' as he ``traced Watson's 
troubles back to allegations of improper vote counting during the 
Presidential election. Kaplan said workers were `followed home every 
night' and under round-the-clock surveillance. `The stress and fear is 
too much,' Kaplan said, adding that he believes Watson went through `a 
very contentious election where she was in fear of her life.' ''\63\
---------------------------------------------------------------------------
    \60\ So and Szep, ``Reuters Unmasks Trump Supporters Who Terrified 
U.S. Election Officials''; and U.S. Department of Justice, ``Justice 
Department Launches Task Force to Combat Threats Against Election 
Workers,'' July 29, 2021, https://www.justice.gov/opa/blog/justice-
department-launches-task-force-combat-threats-against-election-workers-
0.
    \61\ Tom Barton, ``Scott County Auditor Cites Lack of Supervisor 
Support in Announcing Early Retirement,'' Quad-City Times, March 10, 
2021, https://qctimes.com/news/local/scott-county-auditor-cites-lack-
of-supervisor-support-in-announcing-early-retirement/article_1d6e9afb-
9f10-5e97-9037-7cc4a42516e6.html; Andy Kroll, ``They Helped Save 
Democracy--and Are Being Tormented for It,'' Rolling Stone, January 6, 
2022, https://www.rollingstone.com/politics/politics-features/jan6-
election-workers-trump-biden-2020-democracy1279027/; John Myers, 
``California's Elections Official Exodus,'' Los Angeles Times, April 
12, 2021, https://www.latimes.com/politics/newsletter/2021-04-12/
california-elections-officials-exodus-essential-politics; Fredreka 
Schouten and Kelly Mena, ``High-Profile Elections Officials Leave Posts 
After a Tumultuous 2020,'' CNN, February 19, 2021, https://www.cnn.com/
2021/02/19/politics/election-officials-lose-and-leave-jobs/index.html; 
Marie Albiges and Tom Lisi, ``Pa. Election Officials are Burnt Out and 
Leaving Their Jobs After 2020 `Nightmare,' '' Spotlight PA, December 
21, 2020, https://www.spotlightpa.org/news/2020/12/pennsylvania-
election-2020-officials-retiring-nightmare/; and Michael Wines, ``After 
a Nightmare Year, Election Officials Are Quitting,'' New York Times, 
July 2, 2021, https://www.nytimes.com/2021/07/02/us/politics/2020-
election-voting-officials.html.
    \62\ Liz Fabian, ``Macon-Bibb Elections Supervisor Resigns, Cites 
Stress, Workload, New Election Laws,'' Georgia Public Broadcasting, 
January 10, 2022, https://www.gpb.org/news/2022/01/10/macon-bibb-
elections-supervisor-resigns-cites-stress-workload-new-election-laws.
    \63\ Fabian, ``Macon-Bibb Elections Supervisor Resigns, Cites 
Stress, Workload, New Election Laws.''
---------------------------------------------------------------------------
    As one might expect, partisan attacks compound the many other 
pressures that election officials committed to nonpartisan election 
administration face, and many are being pushed out or resigning in the 
face of this pressure.\64\ Others are being stripped of their powers by 
partisan actors, in retaliation for certifying election results, or 
simply for being the face of nonpartisan election administration.\65\
---------------------------------------------------------------------------
    \64\ Wines, ``After a Nightmare Year, Election Officials Are 
Quitting.''
    \65\ Michael Wines, ``In Arizona, GOP Lawmakers Strip Power from a 
Democrat,'' New York Times, June 25, 2021, https://www.nytimes.com/
2021/06/25/us/Arizona-Republicans-voting.html; Jeremy Schwartz, ``Trump 
Won the County in a Landslide. His Supporters Still Hounded the 
Elections Administrator Until She Resigned,'' ProPublica, October 12, 
2021, https://www.propublica.org/article/trump-won-the-county-in-a-
landslide-his-supporters-still-hounded-the-elections-administrator-
until-she-resigned; Laurel White, `` `Partisan Politics at Its Worst': 
Wisconsin Elections Head Meagan Wolfe Refuses to Step Down,'' Wisconsin 
Public Radio, November 1, 2021, https://www.wpr.org/partisan-politics-
its-worst-wisconsin-elections-head-meagan-wolfe-refuses-step-down; and 
Stephen Fowler, ``State Election Board Meets for First Time Since 
Raffensperger Stripped as Chair,'' Georgia Public Radio, April 29, 
2021, https://www.gpb.org/news/2021/04/29/state-election-board-meets-
for-first-time-raffensperger-stripped-chair.
---------------------------------------------------------------------------
    These attacks on election officials are a threat to the security of 
our election infrastructure, as officials who are committed to 
conducting free elections and respecting the will of the voters are 
themselves a crucial element of that infrastructure.
C. Elections Personnel Who Buy Into Conspiracies May Pose an Insider 
        Threat
    Unfortunately, almost one-third of Americans still believe the 
false narrative that the 2020 election was stolen, ``a number that has 
not budged across five polls in which Monmouth [University Polling 
Institute] asked this question during the past year.''\66\ Given this 
fact, we shouldn't be shocked that among the more than 8,000 local 
election officials \67\--and tens of thousands of additional public and 
private-sector employees that support their work--there are some who 
will also buy into these conspiracy theories. In fact, there has been 
an active effort to recruit and convince \68\ election officials to 
facilitate these conspiracy theories and push the goals of election 
deniers. There is reason to worry these efforts could gain traction and 
followers in the election official community, posing yet another threat 
to the integrity of the human component of our election infrastructure. 
Those who work for election vendors may also be at risk.\69\
---------------------------------------------------------------------------
    \66\ Monmouth University Polling Institute, ``Doubt in American 
System Increases,'' November 15, 2021, https://www.monmouth.edu/
polling-institute/reports/monmouthpoll_us_111521/; and Chris Cillizza, 
``1 in 3 Americans Believe the `Big Lie,' '' CNN, June 21, 2021, 
https://www.cnn.com/2021/06/21/politics/biden-voter-fraud-big-lie-
monmouth-poll/index.html.
    \67\ Paul Gronke, et al., ``Amplifying the Perspectives of 
Officials at the Front Lines of Elections,'' Democracy Fund, April 19, 
2021, https://democracyfund.org/idea/amplifying-the-perspectives-of-
officials-at-the-front-lines-of-elections/.
    \68\ Amy Gardner, Emma Brown, and Devlin Barrett, ``Attempted 
Breach of Ohio County Election Network Draws FBI and State Scrutiny,'' 
Washington Post, November 19, 2021, https://www.washingtonpost.com/
politics/attempted-breach-ohio-election/2021/11/19/12417a4c-488c-11ec-
b8d9232f4afe4d9b_story.html.
    \69\ Norden, Ramachandran, and Deluzio, A Framework for Election 
Vendor Oversight.
---------------------------------------------------------------------------
    Officials who have promoted election denialism may be especially 
susceptible to entreaties that they give unauthorized access. We are 
witnessing the first glimpses now. In Colorado, a county clerk with 
connections to election conspiracy theorists gave unauthorized access 
to the county's Dominion voting systems--a vendor targeted by many 
proponents of the Big Lie.\70\ This access allowed the unauthorized 
person to take photos of passwords for the voting machine software, 
which then ended up on-line. The secretary of state decertified the 
county's voting equipment and ordered the county to replace the 
machines before the next election.\71\
---------------------------------------------------------------------------
    \70\ Bente Birkeland, ``After Data is Posted on Conspiracy Site, 
Colorado County's Voting Machines are Banned,'' National Public Radio, 
August 12, 2021, https://www.npr.org/2021/08/12/1027225157/after-data-
is-posted-on-conspiracy-website-colo-countys-voting-machines-are-bann; 
Elise Viebeck, ``Trump Campaign Debunked Dominion Conspiracy Theories, 
Internal Memo Shows, Days Before Backers Kept Spreading Them,'' 
Washington Post, September 22, 2021, https://www.washingtonpost.com/
politics/2021/09/22/trump-dominion-giuliani-powell-memo/.
    \71\ Justin Wingerter, ``Mesa County Must Replace Election 
Equipment Due to Security Breach, Secretary of State Says,'' Denver 
Post, August 21, 2021, https://www.denverpost.com/2021/08/12/election-
security-colorado-mesa-county-jena-griswold/; and Faith Miller, ``Mesa 
County Commissioners Vote to Replace Dominion Voting Equipment,'' 
Colorado Newsline, August 24, 2021, https://coloradonewsline.com/
briefs/mesa-county-commissioners-vote-to-replace-dominion-voting-
equipment/.
---------------------------------------------------------------------------
    In Michigan, a town clerk who shared election conspiracies on 
social media and who took office in 2021 refused to allow a vendor to 
perform routine maintenance on a voting machine because the clerk 
falsely believed the maintenance would erase old data that could prove 
the machines were rigged.\72\ When a central component of that machine 
went missing, the State police opened a criminal investigation into the 
clerk to locate the since-found equipment and determine whether the 
equipment had been tampered with.\73\
---------------------------------------------------------------------------
    \72\ Jonathan Oosting, ``Clerk Decries `Tyranny' After Michigan 
Strips Her of Running Election,'' Bridge Michigan, October 27, 2021, 
https://www.bridgemi.com/michigan-government/clerk-decries-tyranny-
after-michigan-strips-her-running-election; Jonathan Oosting, ``Voting 
Machine Missing after Michigan Clerk Stripped of Election Power,'' 
Bridge Michigan, October 28, 2021, https://www.bridgemi.com/michigan-
government/voting-machine-missing-after-michigan-clerk-stripped-
election-power; and Secretary of State Jocelyn Benson to Adams Township 
Clerk Stephanie Scott, October 25, 2021, https://
content.govdelivery.com/attachments/MISOS/2021/10/25/file_attachments/
1976229/Letters%20to%20Adams%20Township%20Clerk.pdf.
    \73\ Oosting, ``Voting Machine Missing After Michigan Clerk 
Stripped of Election Power''; and John Tunison, ``Missing Hillsdale 
County Voting Equipment Found, State Checking Whether Tampering 
Occurred,'' Michigan Live, October 29, 2021, https://www.mlive.com/
news/ann-arbor/2021/10/missing-hillsdale-county-voting-equipment-found-
state-checking-whether-tampering-occurred.html.
---------------------------------------------------------------------------
    In Ohio, an individual inside a county commissioner's office 
connected a private laptop to the county network in an attempted breach 
that State officials believe a government employee may have 
facilitated.\74\ While the connection did not allow access to voting 
systems, and no sensitive data appears to have been obtained, network 
traffic captured by the laptop was nonetheless shared at a conference 
hosted by election conspiracist Mike Lindell--the same conference where 
information from the Colorado breach was released. Officials in both 
counties had previously discussed baseless claims about the 2020 
election with associates of Lindell.\75\
---------------------------------------------------------------------------
    \74\ Lauren Aratani, ``FBI Investigates Attempted Breach of Local 
Election Network in Ohio,'' Guardian, November 20, 2021, https://
www.theguardian.com/us-news/2021/nov/20/fbi-investigates-attempted-
breach-local-election-network-ohio; and Gardner, Brown, and Barrett, 
``Attempted Breach of Ohio County Election Network Draws FBI and State 
Scrutiny.''
    \75\ Gardner, Brown, and Barrett, ``Attempted Breach of Ohio County 
Election Network Draws FBI and State Scrutiny.''
---------------------------------------------------------------------------
D. Candidates Are Running for Election Administration Positions with 
        Big Lie Messaging
    The magnitude of the insider threat that anti-democracy forces 
could pose is clarified by examining races for Governor, secretary of 
state, and local election administrator positions. There are thousands 
of local election jurisdictions in the United States, and in the vast 
majority of them, an elected individual is in charge.\76\ In past 
years, the question of who ran and certified our elections has 
traditionally been of little interest to most. But now, there is an 
alarming trend of candidates running on (and against) ``election 
denialism.''\77\
---------------------------------------------------------------------------
    \76\ Gronke, et al., ``Amplifying the Perspectives of Officials at 
the Front Lines of Elections''; and David C. Kimball and Martha Kropf, 
``The Street-Level Bureaucrats of Elections: Selection Methods for 
Local Election Officials,'' Review of Policy Research 23 (2006): 1257-
1268, https://editions.lib.umn.edu/wpcontent/uploads/sites/3/2016/02/
Kimball.Kropf_.Street.Level_.Bu- reaucrats.of_.Elections.pdf.
    \77\ Vandewalker and Norden, ``Financing of Races for Offices that 
Oversee Elections: January 2022.''
---------------------------------------------------------------------------
    A preliminary Brennan Center analysis of campaign finance 
disclosures and messaging by candidates in swing States has found that 
much of the political discussion this year, 2022, is shaping up to be 
about 2020 and 2024: Specifically, the Big Lie that the election was 
``stolen'' from former President Trump in 2020, and that if he runs 
again and loses in 2024, those election results should be overturned.
    So far, across 3 States with data available, fundraising in 
secretary of state races is 2\1/2\ times higher than it was by the same 
point in either of the last two election cycles. And campaigns are 
making election denial--and opposition to it--a key campaign issue in 
all 6 of the battleground States with elections for secretary of state 
in 2022--Arizona,\78\ Georgia,\79\ Michigan,\80\ Minnesota,\81\ 
Nevada,\82\ and Wisconsin.\83\
---------------------------------------------------------------------------
    \78\ Mary Jo Pitzl, ``Mark Finchem, Election Conspiracy Promoter, 
Gets Trump's Endorsement for Secretary of State,'' Arizona Republic, 
September 13, 2021, https://www.azcentral.com/story/news/politics/
elections/2021/09/13/trump-endorses-mark-finchem-arizona-secretary-
state-election/8322839002/.
    \79\ Jeremy Herb and Fredreka Schouten, `` `We Won': Trump and His 
Allies Barrel Ahead with Election Lies Despite Arizona Review 
Confirming His Loss,'' CNN, September 27, 2021, https://www.cnn.com/
2021/09/27/politics/arizona-trump-election-lies/index.html.
    \80\ Jeremy Herb and Sara Murra, ``Trump-Backed Michigan Secretary 
of State Candidate Spread False Election Claims and January 6 
Conspiracy Theories,'' CNN, November 16, 2021, https://www.cnn.com/
2021/11/16/politics/kristina-karamo-michigan-secretary-of-state-
candidate/index.html.
    \81\ Miles Parks, ``Here's Where Election-Denying Candidates are 
Running to Control Voting,'' National Public Radio, January 4, 2022, 
https://www.npr.org/2022/01/04/1069232219/heres-where-election-deniers-
and-doubters-are-running-to-control-voting.
    \82\ Tim Reid, Nathan Layne, and Jason Lange, ``Special Report: 
Backers of Trump's False Fraud Claims Seek to Control Next Elections,'' 
Reuters, September 22, 2021, https://www.reuters.com/world/us/backers-
trumps-false-fraud-claims-seek-control-next-us-elections-2021-09-22/.
    \83\ Vandewalker and Norden, ``Financing of Races for Offices that 
Oversee Elections: January 2022.''
---------------------------------------------------------------------------
    In the contest for Georgia secretary of state, 4 candidates have 
each raised more than the 2018 winner had at this point, and the 
candidate raising the most money has refused to acknowledge that Joe 
Biden won the 2020 election. The Georgia election also features an 
early indication that these contests are being nationalized. The 
portion of funding in the race from out-of-state donors so far, 22 
percent, is a marked increase over 2018, when it was 13 percent, and 
more than 4 times the amount from 2014, which was only 5 percent.\84\
---------------------------------------------------------------------------
    \84\ Vandewalker and Norden, ``Financing of Races for Offices that 
Oversee Elections: January 2022.''
---------------------------------------------------------------------------
    In Michigan, the incumbent has raised $1.2 million--6 times what 
the last incumbent had raised at this point in 2014. This candidate is 
running against election denialism, against an opponent who has said 
voting machines in the State could have flipped 200,000 votes to Joe 
Biden.\85\
---------------------------------------------------------------------------
    \85\ Vandewalker and Norden, ``Financing of Races for Offices that 
Oversee Elections: January 2022.''
---------------------------------------------------------------------------
    Regardless of who enjoys a fundraising advantage in any particular 
State, voters are likely to be exposed to unprecedented amounts of 
political spending on the issue of election denialism, with it no 
longer being taken as a given that elections will be administered in a 
nonpartisan manner, regardless of the identity of the administrator.
                         iii. what can be done
    Lawmakers should support the excellent work that CISA, the EAC, and 
State and local election officials have done to further election 
integrity. But they should also act now to further mitigate these 
growing security risks posed by domestic anti-democracy forces. There 
are a variety of broadly-accepted methods for mitigating insider 
threats, which State and local jurisdictions should adopt, and on which 
Congress can lead by providing the needed financial support. Congress 
can also provide support for the physical safety and security of 
elections personnel and elections offices, as well as for risk-limiting 
audits--a true election integrity measure. Others can do their part as 
well: On-line media platforms and traditional media can work with civil 
society to ensure they are promoting the most accurate information, and 
law enforcement at all levels of government can take threats against 
election administration seriously, enforcing the laws that exist to 
deter these crimes.
A. Congress Should Provide Support for Mitigating Insider Threats, 
        Including Against Vendors
    Insider threat risks have been a central focus of security efforts 
in other sectors, and best practices, such as those from the 
Cybersecurity and Infrastructure Security Agency, exist to prevent and 
respond to this activity.\86\
---------------------------------------------------------------------------
    \86\ U.S. Cybersecurity and Infrastructure Security Agency, 
``Insider Threat Mitigation,'' last updated January 6, 2022, https://
www.cisa.gov/insider-threat-mitigation.
---------------------------------------------------------------------------
    Among other things that can be done to both secure election systems 
from insider threats and build public confidence that those systems can 
be trusted, States and counties should take the following actions, and 
Congress should provide resources to support these mandates, many of 
which require financial resources to implement consistently.
            1. Restrict access to election systems.
    Election officials should ensure that an individual only have 
access to critical systems--both physical and digital--if access is 
necessary for that individual to perform their official 
responsibilities, and only to the extent that those responsibilities 
require it (this is known as the ``principle of least privilege''\87\). 
In addition, election officials should require all individuals that 
access critical systems to first complete a background check. A recent 
regulation in Colorado,\88\ for example, restricts voting system access 
to individuals who have passed a background check and are employees of 
the county clerk, voting system provider, or secretary of state's 
office.
---------------------------------------------------------------------------
    \87\ Center for Internet Security, ``Election Security Spotlight--
Principle of Least Privilege,'' last accessed January 13, 2022, https:/
/www.cisecurity.org/spotlight/ei-isac-cybersecurity-spotlight-
principle-of-least-privilege/.
    \88\ Office of the Colorado Secretary of State, ``Notice of 
Temporary Adoption,'' June 17, 2021, https://www.sos.state.co.us/pubs/
rule_making/files/2021/20210617ElectionsNoticeTemp- Adoption.pdf.
---------------------------------------------------------------------------
    Where possible, official procedures should require two people and/
or bipartisan teams to be present when accessing election systems, 
ballots, and election records. Election staff should also be on-site 
with private vendors at all times.\89\
---------------------------------------------------------------------------
    \89\ Norden and Tisler, ``Addressing Insider Threats in 
Elections.''
---------------------------------------------------------------------------
            2. Establish transparent procedures and monitor for 
                    inappropriate activity.
    Transparency protocols helped officials in Colorado identify the 
source of leaked voting system information.\90\ A State investigation 
found that the county clerk gave an unauthorized person a key card, and 
this card was logged when the individual entered the election facility. 
The clerk had also blatantly flouted another transparency measure by 
turning off video surveillance of the voting machines before the 
breach. But if the information obtained from the breach had not been 
discussed so publicly, it's possible the State would have missed this 
activity.
---------------------------------------------------------------------------
    \90\ Emma Brown, ``An Elections Supervisor Embraced Conspiracy 
Theories. Officials Say She Has Become an Insider Threat,'' September 
26, 2021, https://www.washingtonpost.com/investigations/an-elections-
supervisor-embraced-conspiracy-theories-officials-say-she-has-become-
an-insider-threat/2021/09/26/ee60812e-1a17-11eca99a-
5fea2b2da34b_story.html.
---------------------------------------------------------------------------
    Election officials must adopt and actively review transparency 
protocols to ensure that every person who accesses election systems is 
authorized to do so. Funding should be provided for election officials 
to install key card access to facilities that hold voting systems, so 
that a log of every entry can be created. All election offices should 
be equipped with and require 24-hour surveillance of voting systems and 
ballots, that can be reviewed and compared with access logs in the 
event of unauthorized activity. Where possible, that footage should be 
stored for at least 2 years. Both the access logs and surveillance data 
should be made available to the State, and State officials should 
ensure that local offices have sufficient procedures in place to detect 
unauthorized access.
            3. Remove and prosecute officials and workers who actively 
                    undermine election integrity.
    When officials do discover wrongdoing, these individuals must be 
held accountable. States have different processes for removing election 
officials. In some cases, the entity that appointed an election 
official may simply fire that individual. In others, State officials 
may hold power to remove election administrators or strip them of 
election responsibilities.\91\ Officials may also seek permission from 
courts to do so.\92\ State and local officials, as well as their 
attorneys, should be familiar with the removal options available and be 
prepared to take the steps necessary to protect our election 
infrastructure from insider threats.
---------------------------------------------------------------------------
    \91\ Oosting, ``Clerk Decries `Tyranny' After Michigan Strips Her 
of Running Election.''
    \92\ Colorado Secretary of State, ``Mesa County Court Judge Rules 
in Favor of Removing Peters as Designated Election Official,'' press 
release, October 13, 2021, https://www.sos.state.co.us/pubs/newsRoom/
pressReleases/2021/PR20211013Mesa.html.
---------------------------------------------------------------------------
    Where appropriate, law enforcement officials should also pursue 
prosecution against election workers who tamper with or allow 
unauthorized access to voting systems and election materials. State 
laws may require updating to address this conduct.
            4. Increase resiliency against insider threats to vendors.
    Private vendors are involved at every stage of an election, from 
registering voters to counting ballots to reporting results. States can 
act now to establish standards on cybersecurity, personnel security, 
and supply chain integrity for their election vendors.\93\ Congress 
should, as the Freedom to Vote: John R. Lewis Act does, directly 
incentivize vendors to adopt these standards by limiting expenditures 
of Federal funds to those vendors that conform to best practices, which 
can be promulgated by CISA.\94\
---------------------------------------------------------------------------
    \93\ Norden, Ramachandran, and Deluzio, A Framework for Election 
Vendor Oversight.
    \94\ Freedom to Vote: John R. Lewis Act  3908.
---------------------------------------------------------------------------
            5. Build in contractual safeguards.
    Local election offices can also build in safeguards through 
contracts when purchasing equipment and services.\95\ As a rule, 
vendors should be held to the same or higher level of standards for 
access and transparency as county or State employees. This can include 
background checks and the requirement to always have a State or county 
employee present when vendors access critical systems. This can also 
mean restricting or eliminating remote access by vendors.
---------------------------------------------------------------------------
    \95\ Christopher Deluzio, ``A Procurement Guide for Better Election 
Cybersecurity,'' Brennan Center for Justice, March 22, 2019, https://
www.brennancenter.org/our-work/policy-solutions/procurement-guide-
better-election-cybersecurity.
---------------------------------------------------------------------------
    Some of these solutions require statutory or regulatory changes at 
the State level, but Congress can take a leading role in providing 
additional resources for election offices that implementing these 
changes will necessitate. Congress can also lead on building resiliency 
of election vendors, at a minimum by limiting the expenditure of 
Federal funds to those vendors that agree to comply with best practices 
in security, including resiliency to insider attacks.
B. Congress Should Provide Support for the Security of Election 
        Officials and Workers
    Congress should provide resources to States, via the Election 
Assistance Commission, that can be used for safety training, including 
prevention and de-escalation training for election workers. Funds could 
also be provided for education and training for officials on how to 
protect one's personal information, as well as for States to expand 
their address protection services to cover election officials and 
workers. The Freedom To Vote: John R. Lewis Act additionally makes it a 
crime to reveal the personally identifying information of election 
officials and pollworkers with the intent to threaten or intimidate 
them.\96\ Resources could also be used to improve the physical security 
of election offices.\97\
---------------------------------------------------------------------------
    \96\ Freedom to Vote: John R. Lewis Act  3102.
    \97\ Brennan Center for Justice and Bipartisan Policy Center, 
Election Officials Under Attack, 4, 6.
---------------------------------------------------------------------------
C. Online Platforms and Traditional Media Should Work with Civil 
        Society
    The Brennan Center, along with many others, encourages social media 
and other on-line speech platforms, along with traditional media, to 
amplify and promote trusted, accurate information about elections.\98\ 
Typically, election officials are and will be trustworthy sources of 
information about elections. But given the threats to the integrity of 
election officials posed by candidates who actively promote election 
disinformation, on-line platforms and traditional media must prepare 
for the possibility of a high-level election official promoting 
disinformation. Nonpartisan and bipartisan civil society groups can 
serve as an additional trusted resource, to help social and traditional 
media be sure they are promoting the most accurate information.
---------------------------------------------------------------------------
    \98\ Brennan Center for Justice and Bipartisan Policy Center, 
Election Officials Under Attack, 10-15.
---------------------------------------------------------------------------
D. Existing Laws Should Be Enforced
    The Department of Justice, and local and State law enforcement and 
prosecutors, should enforce existing laws against intimidation, 
coercion, and threats. There must be consequences for attempting to 
interfere with free and fair elections. The Department of Justice has 
launched a task force to combat threats against election workers.\99\ 
State and local prosecutors should take these threats seriously as 
well.
---------------------------------------------------------------------------
    \99\ U.S. Department of Justice, ``Justice Department Launches Task 
Force to Combat Threats Against Election Workers.''
---------------------------------------------------------------------------
    For a recent example of law enforcement bringing charges against 
someone making threats against an election official, in Genesee County, 
MI, the chair of the County GOP has recently pled guilty to harassing 
the Houghton County clerk during her bid for re-election. The clerk 
initially reported that he called her at 1 a.m., threatening to kill 
her dogs. The call was traced, a warrant was obtained for his phone 
records, and eventually he was charged and sentenced to a year of 
probation, 240 hours of community service, and a $650 fine.\100\
---------------------------------------------------------------------------
    \100\ Stephen Borowy, James Felton, and Gray News Staff, ``Michigan 
School Board Member Sentenced to Probation for `Malicious' Phone 
Call,'' WWNY/WNYF, https://www.wwnytv.com/2022/01/12/michigan-school-
board-member-sentenced-probation-malicious-phone-call/.
---------------------------------------------------------------------------
    For an example of charges against someone threatening others over 
their defense of the integrity of the 2020 election, a man in 
California was recently sentenced to 3 years in prison after sending 
threatening messages to approximately 50 victims, ``targeting those 
individuals because of their statements expressing that then-President 
Trump had lost the 2020 Presidential election.''\101\
---------------------------------------------------------------------------
    \101\ U.S. Department of Justice, ``California Man Sentenced To 3 
Years In Prison For Making Threats Against Political Officials And 
Journalists Relating To The Outcome Of The 2020 Presidential 
Election,'' press release, December 20, 2021, https://www.justice.gov/
usao-sdny/pr/california-man-sentenced-3-years-prison-making-threats-
against-political-officials-and.
---------------------------------------------------------------------------
E. Congress Should Promote Legitimate, Risk-Limiting Audits
    Another important security measure that guards against a variety of 
threats, including insider threats, is routine, statutory tabulation 
audits that include the opportunity for nonpartisan and bipartisan 
observation. Such audits can provide added confidence that a cyber 
attack, insider manipulation, or innocent programming error did not 
corrupt ballot scanners in such a way that the outcome of an election 
was altered. In particular, risk-limiting audits can provide a 
consistently high level of statistical confidence in the machine-
tabulated outcome of an election contest.
    Although at least 24 States as of 2020 had laws requiring routine 
post-election tabulation audits, only a few States conduct risk-
limiting audits.\102\ Congress should require--and provide funding 
for--risk-limiting audits of Federal elections.\103\ This would be a 
positive improvement in election integrity, and it has received 
bipartisan support in the past.\104\
---------------------------------------------------------------------------
    \102\ Cordova, McCadney, Howard, and Norden, ``Voting Machine 
Security: Where We Stand Six Months Before the New Hampshire Primary''; 
and National Conference of State Legislatures, ``Risk-Limiting 
Audits.''
    \103\ Freedom to Vote: John R. Lewis Act,  4001.104 SAFE Act, H.R. 
2722,  121-123, 116th Cong. (2019); and Clerk of the U.S. House of 
Representatives, ``Roll Call 428/Bill Number H.R. 2722,'' June 27, 
2019, https://clerk.house.gov/Votes/2019428.
    \104\ SAFE Act, H.R. 2722,  121-123, 116th Cong. (2019); and Clerk 
of the U.S. House of Representatives, ``Roll Call 428/Bill Number H.R. 
2722,'' June 27, 2019, https://clerk.house.gov/Votes/2019428.
---------------------------------------------------------------------------
                             iv. conclusion
    The heroic efforts of many, and in particular State and local 
election officials committed to free and fair elections, gave us a safe 
and secure election in November 2020 with historic turnout. Some 
crucial improvements in security and resiliency had been in the works 
for a number of years, such as States that transitioned to voting 
systems that scan paper ballots, or that took advantage of 
vulnerability assessments provided by CISA. Other resiliency measures 
had to be implemented in response to the pandemic and benefited from 
funding provided by Congress. This included increased mail ballot 
printing to accommodate increased demand from voters, as well as the 
purchase of secure dropboxes to permit those voters to safely drop off 
ballots outside. Long-standing best practices, such as the provision of 
emergency paper ballots, paper pollbook back-ups, and poll workers on 
standby, took long hours and plenty of financial resources to implement 
during an extremely high-turnout election with added pandemic-related 
costs. Carrying out these practices demonstrated a commitment by 
election officials to ensure eligible voters would not be turned away, 
even in the case of malfunctioning equipment or a potential cyber 
attack.
    Now, the disinformation campaign that has sowed distrust in that 
election has seeded an anti-democracy movement that poses significant 
threats to our election infrastructure. The threats include sham 
partisan reviews that undermine ballot and election equipment security, 
while further fueling the disinformation campaign. They also include 
attacks on election officials and workers that push out and disempower 
the very people who administered a historically secure election in 
2020. And there may be insider threats from those who seek to replace 
them. Some who are running for election official positions are 
themselves promoting election conspiracies in their campaigns, 
highlighting how election officials themselves, election workers, or 
election vendor personnel can fall victim to and push conspiracies 
about the 2020 election. These insiders could be susceptible to 
requests for unauthorized access and other security breaches, as we've 
seen occur in a few jurisdictions already.
    Maintaining a secure election infrastructure will require effort 
from many parts of society in the weeks and months to come. Congress 
can lead the way in this effort, by providing resources for States and 
local jurisdictions to implement measures that protect against insider 
threats, such as video surveillance of election equipment and 
background checks for personnel. Congress should also, as the Freedom 
to Vote: John R. Lewis Act does, incentivize election vendors' adoption 
of best practices for personnel and supply chain security, by requiring 
that Federal funds spent on election vendors go to those who agree to 
abide by these security measures, and by requiring risk-limiting audits 
in Federal elections. Unlike sham partisan reviews, these would be true 
election integrity improvements.
    Congress should further provide resources for the physical and 
personal security of election officials, workers, and their offices, 
while State, local, and Federal law enforcement should treat those who 
threaten and interfere with fair election administration as the serious 
threat to democracy that they are. Existing laws must be enforced 
against these bad actors.
    Our election infrastructure is strong, as shown by the 2020 
election, but it is facing a growing anti-democracy threat from within. 
Congress should protect democracy from that threat by investing in true 
election integrity measures.

    Chairwoman Clarke. I thank you, Ms. Ramachandran, for your 
testimony. I now recognize Mr. Stamos to summarize his 
statement for 5 minutes.

     STATEMENT OF ALEX STAMOS, DIRECTOR, STANFORD INTERNET 
 OBSERVATORY, AND COMMISSIONER, ASPEN INSTITUTE COMMISSION ON 
                      INFORMATION DISORDER

    Mr. Stamos. Thank you very much, Chairwoman Clarke and 
Ranking Member Garbarino, for having me here. Ladies and 
gentlemen, thank you so much for holding this hearing.
    It is an honor to be here with these incredible experts in 
election integrity and infrastructure security. I think my part 
today is to talk about election disinformation, about the 
disinformation around elections that can sometimes be tied to 
attacks against infrastructure, although not necessarily, and 
especially our findings and what we learned during 2020, and 
how I think CISA and Congress can react to those things we 
learned.
    In the summer of 2020, we were very fortunate to send a 
team of interns from Stanford to go work with CISA, as all of 
you know, the Cybersecurity and Infrastructure Security Agency. 
Those interns, most of them worked on infrastructure security 
projects, including Crossfeed which the Ranking Member 
mentioned. But a couple of them were working on disinformation. 
One of the experiences they had is that while CISA had really 
strong authorization capabilities and funding to work on the 
infrastructure security, a lot of the capability to understand 
and deal with election disinformation did not exist at the 
time.
    So, as a result, at Stanford we pulled together our friends 
at the University of Washington, at the Atlantic Council, and a 
private company called Graphika, and we put together the 
Election Integrity Partnership. There was about 130 people 
involved in this project operating throughout the summer and 
fall and winter of 2020 into early 2021. The goals of the EIP 
were to identify election misinformation before it went viral, 
to help create clear and accurate counter-messaging, and then 
to increase the transparency of what happened during 2020, 
partially as a reaction to the fact that in 2016, there were a 
number of disinformation events that we didn't really 
understand until years later and even don't truly understand 
now because information was not gathered at the time.
    To be clear, the EIP was very tightly scoped. We explicitly 
did not handle any claims about candidates or arguments about 
policy, the kind of issues that are core to the democratic 
process. So, if one candidate said the other candidate was a 
crook, said something about the other candidate's kids, 
something like that, that was completely out of scope for us. 
Our focus was on disinformation around the election itself.
    Our 4 areas that we defined was: Procedural interference, 
this is when you do things like lie about a poll location or 
say that the election has been canceled to try to get people 
not to vote; participation interference, which is to try 
convince people not to vote through disinformation, such as 
saying warrants are being checked when you vote, you might be 
arrested at the voting booth; fraud, so content that asked 
people to do something illegitimate to try to influence the 
election; and then delegitimization, which is content that 
delegitimizes the results based upon false or misleading 
claims.
    In the end, EIP had partnerships with civil society, with 
CISA, the GEC, the Global Engagement Center at the U.S. State 
Department, with major tech platforms, and then with thousands 
of local election officials via the Multi-State ISAC. If you 
are interested in our results, they are available in a not very 
thin volume that I will wave around multiple times today at 
eipartnership.net. You can get a paper copy there, too. But I 
will summarize a couple of, I think, the key takeaways of what 
we learned in 2020.
    The first is the disinformation around the election and 
then disinformation that led to January 6 was first primed by 
months and months of narrative-building during 2020, mostly, I 
think, people recognize by allies of President Trump basically 
saying this election is likely to be stolen. So, the ground was 
set by months and months of kind-of political messaging that 
this election is likely to be stolen, you should be on the 
lookout for anything that indicates that.
    This led to what we call both top-down and bottom-up 
disinformation. So, there is disinformation that was created by 
elites that then was spread via social media, the normal media, 
and others. Then there is also disinformation that would come 
from the grassroots and that would be amplified by the elites. 
So, you end up with this interesting cycle of kind of the 
overall guidance of this is what our message is going to be 
coming from the top, but then a lot of the details being filled 
in by normal people on social media that amplified the social 
media.
    The vast majority of the election disinformation was from 
Americans. There were a handful of notable incidents. Ms. 
Ramachandran mentioned a really important one around Iran. I am 
sure we will probably talk about that, too. I think that is 
probably the most interesting one from my perspective, the 
Iranian involvement. But for the most part, disinformation is 
an American thing that we are doing to ourselves and doing to 
each other.
    Most of the content that went viral on social media didn't 
go viral organically or because of algorithms or amplification. 
It went viral because a small number of verified influencers 
decided to make it so; that a small number of people that we 
know exactly who they are, who have hundreds of thousands and 
millions of followers decided that that was going to be the 
controversy that day, and they were able to turn that into a 
viral piece of content. We have a number of examples of that 
that we can get into if you would like.
    One of our findings is that disinformation has become a 
real multimedia issue. So, the disinformation we are talking 
about is being spread on social media, but we also see it on AM 
radio, cable news, podcasts, a variety of different outlets. 
So, there is not one single place that you can kind-of choke 
down on this. You have to look at the overall economics of the 
ecosystem.
    Then an interesting finding for us is that live video 
turned out to be a really big deal, and I am happy to talk more 
about that.
    Chairwoman Clarke. Well, thank you, Mr. Stamos. I 
appreciate your testimony. I now recognize Mr. Rosenberg to 
summarize his statement for 5 minutes.

  STATEMENT OF EZRA D. ROSENBERG, CO-DIRECTOR, VOTING RIGHTS 
     PROJECT, LAWYERS' COMMITTEE FOR CIVIL RIGHTS UNDER LAW

    Mr. Rosenberg. Chairwoman Clarke, Ranking Member Garbarino, 
Members of the subcommittee, thank you very much for giving me 
the opportunity to testify today regarding threats to election 
infrastructure and voter confidence. My testimony is going to 
focus on a second part of the equation, the threat to voter 
confidence and, in particular, the danger of fabricated claims 
of lack of voter confidence in our elections being used not to 
ensure that elections are secure or run with integrity, but as 
a pretext to suppress the right to vote of millions of voters, 
predominantly voters of color.
    It is important for this subcommittee to distinguish 
between legitimate, particularized, and supported cybersecurity 
concerns so as to protect against future and, thankfully as 
yet, unrealized security threats on the one hand from the 
unsubstantiated allegations of lack of voter confidence in an 
otherwise secure system on the other. The former can lead to 
protections that will continue to make our elections secure. 
The latter have been used with increasing frequency to make it 
more difficult for voters to cast their votes and have their 
votes counted. In considering these issues we urge the 
subcommittee to not allow the erection of unnecessary obstacles 
to voting built on the specter of false allegations of fraud 
and on self-fulfilling prophesies of lack of voter confidence.
    Although the right to vote is essential to all Americans, 
it is perhaps most important to those populations to whom it 
had been historically denied. As Dr. King put it, it is civil 
right No. 1. Unfortunately, before the ink was dry on the 
ratification of the 15th Amendment that guaranteed the right to 
vote to all Americans regardless of race, there were those who 
used every means at their disposal to stop Black voters and 
other voters of color from voting. It took more Constitutional 
amendments and landmark legislation, like the Voting Rights Act 
of 1965, to stop practices such as poll taxes and literacy 
tests and all-White primaries that had prevented voters of 
color from voting.
    The progress gained by these laws was great, but those who 
wanted to stop voters of color from voting were not deterred. 
For a few decades, they were severely hampered by Section 5 of 
the Voting Rights Act, which prevented those jurisdictions with 
a documented history of discrimination in voting from 
implementing changes in election practices without preclearance 
from the attorney general or the court. But Section 5 was 
effectively gutted by the Supreme Court in its decision in 
Shelby County v. Holder.
    Now, all this is a preface to what is happening today. 
Literally from the second Shelby County was handed down, States 
formally covered under Section 5 have used the supposed lack of 
voter confidence as justification for the implementation of 
election practices that make it demonstrably more difficult for 
voters of color to vote.
    First they claim that their new practices are necessary to 
stop fraud when there were is no evidence of fraud. Indeed, the 
minute number of alleged fraudulent ballots is far outweighed 
by the thousands of voters for whom voting is made 
significantly more burdensome in the name of the fiction of 
fraud.
    Then where they cannot prove fraud they point to public 
opinion surveys, which they say demonstrate the lack of voter 
confidence in the system, necessitating stronger protections. 
But these survey results are themselves the result of the lies, 
both big and small, spun by those who would use such pretexts 
to justify their imposing burdens, making it more difficult for 
certain people, predominantly people of color and lower income 
people, to vote. This happened in Texas in the failed attempt 
to implement a discriminatory photo ID law. It is happening 
today, where spurred by the lies that the 2020 Presidential 
election was stolen, including bogus claims of voting machine 
irregularities, laws have been passed in dozens of States 
making it more difficult for voters of color to vote.
    The biggest threat to voter confidence are these lies. Now 
that every such claim of irregularities in the last 
Presidential election was rejected by the courts is of little 
solace. In the legend of the little boy who cried wolf, when 
real danger came no one came to help him. Here there may be 
legitimate concerns about the security of our election 
infrastructure and Congress should be doing everything it can 
to guard against those dangers where real and substantiated. It 
should not be led off course by the pernicious lies of the boy 
who cried wolf and it should not permit the so-called lack of 
voter confidence fostered by those lies to perpetuate 
discrimination against voters of color. Thank you.
    [The prepared statement of Mr. Rosenberg follows:]
                Prepared Statement of Ezra D. Rosenberg
                            January 20, 2022
                            i. introduction
    Chairwoman Clarke, Ranking Member Garbarino, and Members of the 
U.S. House of Representatives Committee on Homeland Security, 
Subcommittee on Cybersecurity, Infrastructure Protection & Innovation. 
My name is Ezra Rosenberg and I am the co-director of the Voting Rights 
Project of the Lawyers' Committee for Civil Rights Under Law 
(``Lawyers' Committee''). Thank you for giving me the opportunity to 
testify today regarding ``Securing Democracy: Protecting Against 
Threats to Election Infrastructure and Voter Confidence.''
    My testimony will focus on the second part of the equation: The 
threat to voter confidence, and in particular the danger of fabricated 
claims of lack of voter confidence in our election results being used 
as a pretext to suppress the right to vote of millions of voters, 
predominately voters of color, not to ensure that elections are secure 
and run with integrity. It is important for this subcommittee to 
distinguish between legitimate, particularized, and supported 
cybersecurity concerns so as to protect against future--and, 
thankfully, as yet unrealized--security threats on the one hand, and 
blunderbuss and unsubstantiated allegations of lack of voter confidence 
in an otherwise secure system on the other. The former can and should 
lead to protections that can continue to make our election 
infrastructure secure. The latter have been used with increasing 
frequency to make it more difficult for eligible voters to cast their 
votes and have their votes counted. In considering these issues, we 
urge the subcommittee not to conflate the two, and specifically not to 
allow the erection of unnecessary obstacles to voting built on the 
specter of false allegations of fraud and on self-fulfilling prophesies 
of lack of voter confidence.
    I come to the views I offer today after having devoted the bulk of 
the last decade of my career litigating voting rights cases on behalf 
of voters of color for the Lawyers' Committee. The Lawyers' Committee 
is a National civil rights organization created at the request of 
President John F. Kennedy in 1963 to mobilize the private bar to 
confront issues of racial discrimination pro bono. In fact, I first 
became associated with the Lawyers' Committee when I was a partner of a 
large global law firm, and volunteered in 2011 to take on a voting 
rights case pro bono. That case was the challenge to Texas's strict 
photo ID law, which I will discuss in my testimony. After I retired 
from private practice in 2014, the Lawyers' Committee asked me to join 
their staff, and since I became co-director of the Voting Rights 
Project in 2015, I have supervised the filings on behalf of voters and 
civil rights organizations in over 100 cases dealing with voting 
rights, many of them with claims brought by persons of color whose 
ability to vote has been compromised under the guise of insuring voter 
confidence in election integrity.
    The right to vote holds a special place in our democracy. Well over 
a century ago, in trying to provide an example of the essential truths 
of this Nation--that a person's life, liberty, or happiness, cannot be 
subject to arbitrariness and that ours is a Government of laws not of 
people, the Supreme Court described the ``political franchise of 
voting,'' as not ``strictly . . . a natural right,'' but ``as a 
fundamental political right, . . . preservative of all rights.''\1\
---------------------------------------------------------------------------
    \1\ Yick Wo v. Hopkins, 118 U.S. 356, 370 (1886).
---------------------------------------------------------------------------
    Although the right to vote is essential to all Americans, it has 
perhaps an even more special place and is of, if possible, even greater 
importance to people to whom it had been historically denied. As Dr. 
Martin Luther King called it, it is ``Civil Right No. 1.''\2\ 
Unfortunately, before the ink was dry on the ratification of the 
Fifteenth Amendment to the Constitution that guaranteed the right to 
vote to all citizens, regardless of race or color of their skin, there 
were those--often in positions of power--who used every means at their 
disposal to stop Black voters and other voters of color from voting. It 
took more Constitutional amendments and landmark legislation such as 
the Voting Rights Act of 1965 (the ``Act'' or the ``VRA''), to stop 
practices such as poll taxes, literacy tests, all-White primaries, and 
similar means used to prevent voters of color from voting.
---------------------------------------------------------------------------
    \2\ Martin Luther King, Jr., Civil Right No. 1: The Right to Vote, 
THE N.Y. TIMES MAG., Mar. 14, 1965, at 26-27, reprinted in A TESTAMENT 
OF HOPE: THE ESSENTIAL WRITINGS AND SPEECHES OF MARTIN LUTHER KING, JR. 
183 (James M. Washington ed., 1991).
---------------------------------------------------------------------------
    The progress gained by these laws was great. But those who wanted 
to stop people of color from voting have persevered. For a few decades, 
they were severely hampered by Section 5 of the Voting Rights Act, 
which prevented those jurisdictions with a documented history of racial 
discrimination in voting from implementing any changes in election 
practices without preclearance from the United States Attorney General 
or the United States District Court for the District of Columbia. But 
Section 5 was effectively gutted by the Supreme Court's decision in 
Shelby County v. Holder.\3\ Additionally, while we have yet to see the 
full effects of the Supreme Court's more recent decision in Brnovich v. 
Democratic National Committee,\4\ signs point to that decision's making 
it unnecessarily more difficult for plaintiffs to prove that a State's 
election practices result in discrimination against voters of color 
under Section 2 of the Voting Rights Act. (In recent testimony before 
the House Judiciary Committee, I discussed these court decisions at 
greater length.)\5\
---------------------------------------------------------------------------
    \3\ 570 U.S. 529 (2013).
    \4\ U.S. Supreme Court no. 19-1257, decided July 1, 2021.
    \5\ U.S. HOUSE OF REPRESENTATIVES, COMMITTEE ON THE JUDICIARY, 
HEARING ON ``THE IMPLICATIONS OF BRNOVICH V. DEMOCRATIC NATIONAL 
COMMITTEE AND POTENTIAL LEGISLATIVE RESPONSES,'' JULY 16, 2021.
---------------------------------------------------------------------------
    All this is a preface to what is happening today. Literally from 
the second Shelby County was handed down, States formerly covered under 
Section 5 of the Voting Rights Act have used supposed lack of ``voter 
confidence'' as justification for their implementation of election 
practices that make it demonstrably more difficult for people--
predominately people of color--to vote. First, they claim that their 
new practices are necessary to stop fraud--when there is no evidence of 
fraud. The number of actual infractions is infinitesimal and not 
remotely likely to change election outcomes.\6\ Indeed, the minute 
number of alleged fraudulent ballots is far outweighed by the thousands 
of voters for whom voting is made significantly more burdensome in the 
name of the fiction of fraud.
---------------------------------------------------------------------------
    \6\ The Myth of Voter Fraud, THE BRENNAN CTR. FOR JUST., https://
www.brennancenter.org/issues/ensure-every-american-can-vote/vote-
suppression/myth-voter-fraud.
---------------------------------------------------------------------------
    Aware they cannot prove fraud, those enacting such laws point to 
public opinion surveys which, they say, demonstrate lack of voter 
confidence in the system, necessitating stronger protections. But these 
survey results, we will show, are the result of the lies--both big and 
small--spun by those who would use such pretexts to justify their 
imposing burdens making it more difficult for certain people--
predominately people of color and poorer people--to vote. This happened 
in Texas in the failed attempt to implement a photo ID law that made it 
more difficult for Black and Latinx voters to vote than for white 
voters to vote. And it is happening today where, spurred by the lies 
that the 2020 Presidential election was ``stolen'' and bogus claims of 
voting machine irregularities and rogue administrators, laws have been 
passed in dozens of States making it more difficult for voters of color 
to vote. The biggest threats to voter confidence are these lies.
    That every such claim of irregularities in the last Presidential 
election was rejected by the courts is of little solace.\7\ In the 
legend of the boy who cried wolf, when real danger came, no one came to 
help him. Here, there may be legitimate concerns about the security of 
our election infrastructure, and Congress should be doing everything it 
can to guard against those dangers, where real and substantiated. It 
should not be led off-course by the pernicious lies of the boy crying 
wolf. And it should not permit the so-called lack of voter confidence 
fostered by those lies to perpetuate discrimination against voters of 
color.
---------------------------------------------------------------------------
    \7\ Jim Rutenberg et al., Trump's Failed Crusade Debunks G.O.P.'s 
Case for Voting Restrictions: Over and Over, Courts Find No Fraud, but 
Efforts to Limit Rights Persist, N.Y. TIMES, Dec. 27, 2020, https://
static01.nyt.com/images/2020/12/27/nytfrontpage/scan.pdf.
---------------------------------------------------------------------------
ii. the use of the fraud and voter confidence myths to burden the right 
                                to vote
    As I suggested at the outset, my experience with the Texas voter ID 
case provides a good example of the use of specious allegations of 
fraud and lack of voter confidence to justify discriminatory voting 
practices.
    Prior to 2011, Texas had a robust voter identification law, 
allowing voters to vote upon production of any one of multiple, 
commonly-held IDs.\8\ To the extent that the voter ID requirements were 
intended to prevent fraud, they seemed to be working quite well. There 
had been only two convictions for in-person voter impersonation fraud--
the only sort of fraud a voter ID requirement addresses--out of 20 
million votes cast in Texas between 2001 and 2011.\9\
---------------------------------------------------------------------------
    \8\ Veasey v. Abbott, 830 F.3d 216, 225 (5th Cir. 2016) (en banc).
    \9\ Id. at 238-39.
---------------------------------------------------------------------------
    Nevertheless, in 2011, the Texas legislature passed Senate Bill 14 
(``SB 14''), which limited acceptable voter IDs to a handful of photo 
identification documents, namely a current or not expired for more than 
60 days Texas drivers' license or personal identification card issued 
by the Department of Public Safety, U.S. military card, U.S. passport, 
Texas license to carry a concealed handgun, or Texas Election 
Identification Certificate, or a U.S. naturalization paper with a 
photograph.\10\ In the rushed process leading up to the passage of SB 
14, the proponents and drafters of SB 14 were repeatedly made aware 
that, if enacted, the law would have a disproportionate effect on Black 
and Latinx voters. Nevertheless, they rejected dozens of amendments 
that would have lessened the impact of the law, and passed SB 14.\11\
---------------------------------------------------------------------------
    \10\ Id. at 225.
    \11\ Id. at 236, 239.
---------------------------------------------------------------------------
    SB 14 was found by a three-judge panel of the United States 
District Court for the District of Columbia to have a retrogressive 
impact on the rights of Black and Latinx voters in proceedings brought 
by Texas under Section 5 of the Voting Rights Act, seeking preclearance 
of the law.\12\ While Texas's appeal was pending, the Supreme Court 
issued its decision in Shelby County holding unconstitutional the 
coverage formula which defined which jurisdictions were subject to the 
provisions of Section 5, thus freeing Texas from the requirements of 
Section 5. That very same afternoon, Texas announced it would start 
implementing the new photo ID law, forcing the Lawyers' Committee, 
representing the Texas State Conference of the NAACP and the Mexican 
American Legislative Caucus of the Texas House of Representatives who 
had successfully intervened in the Section 5 action, as well as other 
civil rights organizations and the Department of Justice, to file suit 
under Section 2 of the Voting Rights Act.
---------------------------------------------------------------------------
    \12\ Texas v. Holder, 888 F.Supp.2d 113 (D.D.C. 2012).
---------------------------------------------------------------------------
    That suit was successful, and Texas was forced to change its law, 
with the district court ruling--and the Fifth Circuit Court of Appeals 
affirmance en banc--that Texas's photo ID law discriminated against 
Black and Latinx voters under the effects prong of Section 2.\13\ 
Specifically, the plaintiffs proved that Black voters were almost twice 
as likely as White voters, and Latinx voters almost 2 and a half times 
as likely as White voters, to lack the required IDs, and that Black and 
Latinx voters were similarly less likely than White voters to be able 
to obtain the required IDs.\14\ As a result of these findings, the 
court entered an interim remedial order allowing any voter who lacked 
the required ID to vote upon execution of a declaration of a reasonable 
impediment. Ultimately, the Texas legislature replaced SB 14 with SB 5, 
which largely tracked the interim remedial order, and the Fifth Circuit 
Court of Appeals ruled that this provided the plaintiffs with their 
full remedy.\15\
---------------------------------------------------------------------------
    \13\ Veasey v. Abbott, 830 F.3d 216.
    \14\ Id. at 251.
    \15\ Veasey v. Abbott, 888 F.3d 792 (5th Cir. 2018).
---------------------------------------------------------------------------
    For present purposes, however, it is the findings of the 
tenuousness of the justifications provided by the proponents of SB 14--
findings that the Fifth Circuit Court of Appeals ruled were material 
support to a finding of discrimination intent--that are of interest. 
First, the court noted that ``Texas has a history of justifying voter 
suppression efforts such as the poll tax and literacy tests with the 
race-neutral reason of promoting ballot integrity.''\16\ The court 
reasoned that, while the ``Legislature is entitled to set whatever 
priorities it wishes,'' and that ``Ballot integrity is undoubtedly a 
worthy goal,'' there was virtually no evidence of in-person voter fraud 
in Texas.\17\ Second, the court highlighted ``that many rationales were 
given for a voter identification law, which shifted as they were 
challenged or disproven by opponents.''\18\ The first of these was 
fraud prevention; the second was that ``such laws fostered public 
confidence in election integrity and increase voter turnout.''\19\ The 
district court found that ``there was no credible evidence'' to support 
these claim.\20\
---------------------------------------------------------------------------
    \16\ 830 F.3d at 237.
    \17\ 830 F.3d at 238-39.
    \18\ 830 F.3d at 240-41.
    \19\ Veasey v. Perry, 71 F.Supp. 3d 627, 655 (S.D. Tex. 2014), 
affirmed in part and reversed in part on other grounds sub nom. Veasey 
v. Abbott, 830 F.3d 216 (5th Cir. 2016) (en banc).
    \20\ Id.
---------------------------------------------------------------------------
    iii. the next generation of false justifications: the attack on 
                               democracy
    While, as the Fifth Circuit Court of Appeals noted in Veasey v. 
Abbott, the use of fraud as justification for voter suppressive laws is 
not new, the 2020 Presidential election added a new and extraordinarily 
dangerous twist: Using spurious and unsubstantiated voter fraud 
allegations--often directed at voting machine technology and other 
election infrastructure elements--in an attempt to reverse the will of 
the people altogether. This reached a crescendo in the dozens of suits 
brought by former President Donald Trump and his allies--many of which 
we at the Lawyers' Committee participated in, representing the NAACP as 
an intervenor or amicus curiae, as invariably these suits targeted 
areas of large numbers of Black voters in places such as Atlanta, 
Detroit, Milwaukee, and Philadelphia.
A. The 2020 Presidential Election Was Not Perfect, But It Was Secure
    During the 2020 Presidential Election, we witnessed the largest 
voter turnout in American history. 159,633,396 voters turned out in the 
2020 election, 20 million more than in any previous election. Turnout 
was the highest in 120 years in terms of the percentage of voting-
eligible population, with 66.7 percent casting ballots. President 
Joseph Biden became the first U.S. Presidential candidate to receive 
more than 80 million votes, with a final tally of 81,283,098 votes, or 
51.3 percent of all votes cast for President. Former President Trump 
received the second highest total of any U.S. Presidential candidate, 
trailing President Biden by a little over 7 million votes.\21\
---------------------------------------------------------------------------
    \21\ James M. Lindsay, The 2020 Election by the Numbers, COUNCIL ON 
FOREIGN REL., (Dec. 15, 2020), https://www.cfr.org/blog/2020-election-
numbers.
---------------------------------------------------------------------------
    As a result of the pandemic, an unprecedented number of ballots 
were cast through early voting or vote-by-mail. Over 101.4 million 
voters in the Presidential Election cast their ballots before Election 
Day, nearly two-thirds of all ballots cast. Of those early votes, about 
65.6 million were returned via mail-in ballots. Elections security 
experts lauded the 2020 Presidential Election as the ``most secure in 
American history.''\22\
---------------------------------------------------------------------------
    \22\ Sara Cook, Election infrastructure officials: 2020 election 
was ``most secure in American history'' , CBS NEWS (Nov. 20, 2020), 
https://www.cbsnews.com/live-updates/2020-election-most-secure-history-
dhs/.
---------------------------------------------------------------------------
    That conclusion was shared by then-President Trump's own 
appointees. A joint statement issued by the Department of Homeland 
Security's Cybersecurity & Infrastructure Security Agency, or CISA, 
concluded:

``The November 3d election was the most secure in American history . . 
. There is no evidence that any voting system deleted or lost votes, 
changed votes, or was in any way compromised. Other security measures 
like pre-election testing, State certification of voting equipment, and 
the U.S. Election Assistance Commission's (EAC) certification of voting 
equipment help to build additional confidence in the voting systems 
used in 2020. While we know there are many unfounded claims and 
opportunities for misinformation about the process of our elections, we 
can assure you we have the utmost confidence in the security and 
integrity of our elections, and you should too. When you have 
questions, turn to elections officials as trusted voices as they 
administer elections.''\23\
---------------------------------------------------------------------------
    \23\ Joint Statement from Elections Infrastructure Government 
Coordinating Council & The Election Infrastructure Sector Coordinating 
Executive Committees, Nov. 12, 2020, https://www.cisa.gov/news/2020/11/
12/joint-statement-elections-infrastructure-government-coordinating-
council-election.

    This is not to say that the 2020 election--or any election--was 
perfect. The Lawyers' Committee, which helps coordinate the National, 
non-partisan Election Protection coalition, including the 866-OUR-VOTE 
hotline, received numerous reports of voters of color having trouble 
registering to vote, casting their ballot, or having their ballot 
counted. A little over 54 percent of all voters who called the Election 
Protection Hotline and reported their race or ethnicity were voters of 
color. They reported several basic barriers to voting access, which 
disproportionately impacted voters of color:
   Restrictions or lack of information about voter 
        registration;
   Lack of notice about the consolidation or closure of polling 
        places;
   Purging of voter rolls in violation of the National Voter 
        Registration Act;
   Lack of information about how to access vote-by-mail 
        opportunities;
   Unreasonable vote-by-mail deadlines, due to mail delivery 
        and return delays;
   Rejection of absentee ballots through misuse of signature-
        matching procedures;
   Restrictive voter identification laws, which failed to 
        provide alternatives to voters lacking required information 
        (such as those voters with nontraditional mailing addresses) or 
        who do not have reasonable access to Government offices that 
        offer accepted forms of identification; and
   Long lines that resulted in hours-long wait times due to an 
        insufficient number of voting machines or equipment 
        malfunctions.
    We also received reports of violations of Federal law, including 
the failure to provide language assistance in violation of Section 203 
of the Voting Rights Act and the denial of assistance from a person 
chosen by the voter in violation of Section 208 of the Act. Many of 
these problems were exacerbated by overwhelmed election officials who 
were unprepared and under-resourced for the unprecedented levels of 
voter participation, particularly during a pandemic.
B. The ``Big Lie'' Is Not About Election Infrastructure Security
    Thus, particularly in the context of the pandemic, the 2020 
election was an unqualified success insofar as ensuring that cast 
ballots were counted accurately. Nevertheless, lawyers representing the 
interests of former President Trump filed suit after suit in Arizona, 
Georgia, Michigan, Pennsylvania, and Wisconsin, alleging that the 
election was not secure, that it had been ``stolen'' or ``rigged.'' 
Often the allegations took the form of attacks on the election 
infrastructure. These allegations, made in a Michigan suit, are 
representative:
    1. `` `[T]he absentee voting counts in some counties in Michigan 
        have likely been manipulated by a computer algorithm,' and [] 
        at some time after the 2016 election, software was installed 
        that programmed tabulating machines to `shift a percentage of 
        absentee ballot votes from Trump to Biden.' ''
    2. ``Smartmatic and Dominion were founded by foreign oligarchs and 
        dictators to ensure computerized ballot-stuffing and vote 
        manipulation to whatever level was needed to make certain 
        Venezuelan dictator Hugo Chavez never lost another election.''
    3. ``The several spikes cast solely for Biden could easily be 
        produced in the Dominion system by preloading batches of blank 
        ballots in files such as Write-Ins, then casting them all for 
        Biden using the Override Procedure (to cast Write-In ballots) 
        that is available to the operator of the system.''\24\
---------------------------------------------------------------------------
    \24\ Timothy King, et al. v. Gretchen Whitmer, et al., United 
States District Court for the Eastern District of Michigan, case no. 
2:20-cv-13134-LVP-RSW, ECF. No. 172, Aug. 25, 2021, p. 15 (internal 
citations omitted).
---------------------------------------------------------------------------
    All of these claims and other similar claims were summarily 
dismissed by court after court--often by judges who had been appointed 
by President Trump--and some of the attorneys making these claims were 
ultimately subjected to sanctions and disciplinary proceedings for 
advancing claims that were not based on facts.\25\
---------------------------------------------------------------------------
    \25\ See generally Tracking election disputes, lawsuits, and 
recounts, BALLOTPEDIA'S 2020 ELECTION HELP DESK, https://
ballotpedia.org; Jacob Shamsian & Sonam Sheth, Trump and his allies 
filed more than 40 lawsuits challenging the 2020 election results. All 
of them failed, BUSINESS INSIDER (Feb. 22, 2021), https://
www.businessinsider.com/trump-campaign-lawsuits-election-results-2020-
11; Postelection lawsuits related to the 2020 United States 
Presidential election, WIKIPEDIA https://en.wikipedia.org (last 
accessed January 17, 2022).
---------------------------------------------------------------------------
    Congress should ensure that electronic voting machines are both 
secure from interference--domestic or foreign--and provide accessible 
means for all voters that are fully auditable, both by election 
officials to ensure that the votes counted by the machines match the 
votes cast by the voters and by the voters themselves before they leave 
the polling places. But it should do so based on sound, substantiated 
evidence, not political posturing.
    For example, the Lawyers' Committee was co-counsel for plaintiffs 
in a case dealing with cybersecurity issues in Georgia. There, the 
court described the evidence submitted by plaintiffs as ``a mountain of 
evidence demonstrating the burdens to the voting process and to the 
casting of a secure, reliable, counted ballot that some portion of 
voters across Georgia, including Plaintiffs, had experienced as a 
result of the State's continued use of voting equipment, software, 
hardware, election and voter databases, that were demonstrably shown to 
be antiquated, seriously flawed, and vulnerable to failure, breach, 
contamination and attack.''\26\ As a result, in April 2019, the court 
enjoined the use of Georgia's Direct Recording Electronic voting 
machines (DRE) and Global Election Management Systems (GEMS) beyond the 
2019 election cycle. But nowhere in that litigation did the plaintiffs 
suggest that an election had ever been tampered with. Rather, the focus 
of the case was on the real vulnerabilities of the system and the need 
to take reasonable steps to protect against potential threats.
---------------------------------------------------------------------------
    \26\ Donna Curling, et al. v. Brad Raffesnperger, U.S. District 
Court for the Northern District of Georgia, no. 1:2017-cv-02989, Doc. 
768, filed August 7, 2020; Curling v. Raffensperger, 493 F.Supp. 3d 
1264 (N.D.GA. 2020).
---------------------------------------------------------------------------
    That, unfortunately, is not what the ``Big Lie'' is all about. It 
is not tethered to reality, let alone evidence.
C. The ``Big Lie's'' Intent and Effect is to Undermine Voter Confidence
    The ``Big Lie'' that the 2020 Presidential election was stolen has 
become the stock in trade of numerous politicians, including the former 
President, and has become a rallying call for a sector of the 
electorate. This is not merely a matter of partisan politics. Were it 
so, the Lawyers' Committee, as a non-partisan organization, would be 
silent. The sad fact is that the repetition of the ``Big Lie'' eats at 
the core of our democracy.
    Studies have shown that disinformation campaigns such as the ``Big 
Lie'' can have a damaging impact on voters' faith in the system. After 
President George W. Bush won reelection, Republicans had a high level 
of confidence in the accuracy of the election, but this figure dropped 
significantly in the following decade. During that time there was a mix 
of wins by both parties, but also the beginning of a vigorous campaign 
by certain political sectors pressing unsubstantiated claims against 
election systems. As the November 2016 election day approached, then-
Presidential candidate Trump increased the volume:

``Of course there is large scale voter fraud happening on and before 
election day.
``The election is absolutely being rigged by the dishonest and 
distorted media pushing Crooked Hillary--but also at many polling 
places--SAD''.\27\
---------------------------------------------------------------------------
    \27\ US election 2016: Trump says election `rigged at polling 
places', BBC NEWS (Oct. 17, 2016), https://www.bbc.com/news/election-
us-2016-37673797.

    One survey of voting age citizens at the time of the 2016 election 
found that allegations of election rigging changed their belief about 
whether fraud was likely if the fraud would hurt their political party. 
An author of the study concluded, ``Allegations that the election is 
rigged reduce Americans' support for the democratic norms that underlie 
the U.S. system of government.''\28\
---------------------------------------------------------------------------
    \28\ Bethany Albertson, Allegations of Fraud Weakened Voter 
Confidence in the 2016 Election, THE WASH. POST (Oct. 8, 2020), 
Allegations of fraud weakened voter confidence in the 2016 election. 
That could happen again.
---------------------------------------------------------------------------
    In a study of former President Trump's claims of election fraud 
conducted by Brendan Nyhan of Dartmouth and other scholars, researchers 
found the claims undermined faith in elections, especially among his 
supporters.\29\ Saying that confidence in elections may be a ``soft 
target,'' Dr. Nyhan commented, ``It's complicated, hard to observe, 
unintuitive, and relies on trust. Trust in institutions seems to be 
easier to destroy than to build.'' Speaking of the unsubstantiated 
claims, he added that his major worry is the damage to ``institutional 
legitimacy.''\30\
---------------------------------------------------------------------------
    \29\ Nicolas Berlinski et al., The Effects of Unsubstantiated 
Claims of Voter Fraud on Confidence in Elections, J. OF EXPERIMENTAL 
POL. SCI. (2021) 1-1, The Effects of Unsubstantiated Claims of Voter 
Fraud on Confidence in Elections, (cambridge.org); David A. Graham, The 
Damage of Trump's Voter Fraud Allegations Can't Be Undone, THE 
ATLANTIC, Jun. 19, 2020, Study: Trump's Voter-Fraud Allegations Do 
Lasting Damage.
    \30\ David A. Graham, The Damage of Trump's Voter Fraud Allegations 
Can't Be Undone, THE ATLANTIC (June 19, 2020), Study: Trump's Voter-
Fraud Allegations Do Lasting Damage.
---------------------------------------------------------------------------
    Dr. Nyhan's fear is well-founded. In 2006, the same year that we 
saw a strong bipartisan reauthorization of the Voting Rights Act, the 
United States was ranked as a ``Full Democracy'' by the Democracy 
Index. Less than two decades later, much has changed. In 2021, the 
United States was ranked as a ``Flawed Democracy,'' driven by growing 
efforts at the State and local levels to suppress voting and to subvert 
legitimate election results. As the Democracy Index's authors 
explained, ``public trust in the democratic process was dealt a blow by 
the refusal of Donald Trump and many of his supporters to accept the 
election result'' in the 2020 elections.\31\ Just this month, an NPR/
Ipsos poll found that two-thirds of all Republican respondents 
subscribe to the ``Big Lie'' that the election was stolen from former 
President Trump because of rampant fraud, with fewer than half saying 
they are willing to accept the results of the 2020 election.\32\
---------------------------------------------------------------------------
    \31\ Global Democracy Has a Very Bad Year, THE ECONOMIST (Feb. 2, 
2021), https://www.economist.com/graphic-detail/2021/02/02/global-
democracy-has-a-very-bad-year.
    \32\ Joel Rose & Liz Baker, Six in 10 Americans say U.S. democracy 
is in crisis as the ``Big Lie'' takes root, NPR (Jan. 3. 2022), https:/
/www.npr.org/2022/01/03/1069764164/american-democracy-poll-jan-6.
---------------------------------------------------------------------------
D. The Fabricated Loss of Voter Confidence Is Used To Support the 
        Erection of Obstacles To Voting
    Worse still, misguided public sentiment of lost confidence in our 
election system is then used by lawmakers as justification to impose 
changes in election practices. Last spring, the New York Times studied 
what they called a ``feedback loop'' in which falsehoods shape voter 
attitudes and lawmakers ``cite those attitudes as the basis for major 
changes.'' The paper counted 33 States where legislators said low 
public confidence in election integrity was the justification for bills 
to restrict voting. The report noted an instance where a State 
legislator asserted such justifications yet was unable to point to 
evidence supporting the claims about flawed elections, but still 
claimed restrictive laws were needed because the public believed there 
were problems. The Times noted that misgivings about election integrity 
are not new, but the scale of the current effort involves many more 
bills and far reaching restrictions, and the depressed confidence has 
resulted from an organized disinformation campaign.\33\
---------------------------------------------------------------------------
    \33\ Maggie Astor, `A Perpetual Motion Machine': How Disinformation 
Drives Voting Laws, N.Y TIMES (May 13, 2021), Here's How Disinformation 
Drives Voting Laws; Isaac Stanley-Becker, Disinformation Campaign 
Stokes Fears About Mail Voting, THE WASH. POST (Aug. 20, 2020), https:/
/www.washingtonpost.com/politics/disinformation-campaign-stokes-fears-
about-mail-voting-using-lebron-james-image-and-boosted-by-trump-
aligned-group/2020/08/20/fcadf382-e2e2-11ea-8181-
606e603bb1c4_story.html; Rob Kuznia et al., Stop the Steal's Massive 
Disinformation Campaign Connected to Roger Stone, CNN (Nov. 14, 2020), 
https://www.cnn.com/2020/11/13/business/stop-the-steal-disinformation-
campaign-invs/index.html; Jane Mayer, The Big Money Behind the Big Lie, 
THE NEW YORKER (Aug. 2, 2021), https://www.newyorker.com/magazine/2021/
08/09/the-big-money-behind-the-big-lie.
---------------------------------------------------------------------------
    In 2021, 19 States enacted 34 laws making it harder to vote, 
especially for people of color and lower-income people.\34\ As the 
Brennan Center for Justice reported in its most recent summary of 
pending voting legislation:
---------------------------------------------------------------------------
    \34\ Voting Laws Roundup: December, 2021, BRENNAN CTR. FOR JUST. 
(Jan. 12, 2022), https://www.brennancenter.org/our-work/research-
reports/voting-laws-roundup-december-2021.
---------------------------------------------------------------------------
    These numbers are extraordinary: State legislatures enacted far 
more restrictive voting laws in 2021 than in any year since the Brennan 
Center began tracking voting legislation in 2011. More than a third of 
all restrictive voting laws enacted since then were passed this year. 
And in a new trend this year, legislators introduced bills to allow 
partisan actors to interfere with election processes or even reject 
election results entirely.\35\
---------------------------------------------------------------------------
    \35\ Id.
---------------------------------------------------------------------------
    Again, Georgia and Texas are illustrative.\36\ In Georgia, State 
legislators responded to the record-shattering turnout of 2020 by 
passing omnibus legislation, known as SB 202, that restricts the right 
to vote at nearly every step of the process and disproportionately 
affects voters of color. Among its provisions, the law requires voter 
identification in order to request an absentee ballot and vote 
absentee; severely limits access to absentee ballot drop boxes; and 
significantly shortens the period in which voters can apply for and 
cast absentee ballots.\37\ These restrictions were adopted right after 
the November 2020 election where voters of color used absentee ballots 
to an unprecedented degree, and in the cases of Black (29.4 percent) 
and Asian (40.3 percent) voters, at higher rates than White (25.3 
percent) voters.\38\
---------------------------------------------------------------------------
    \36\ See Georgia State Conference of NAACP v. Raffensperger, N.D. 
GA. No. 1:21-cv-1259-JPB, filed March 28, 2021; amended May 28, 2021; 
Texas State Conference of NAACP v. Greg Abbott, et al. District Court, 
Harris County, 189th Judicial District, Case no. 2021-57207, filed 
September 7, 2021. (The Lawyers' Committee is, as are other civil 
rights organizations, challenging the laws passed by Georgia and Texas 
described in this testimony.)
    \37\ SB 202/AP, Section 25, 26 28. https://www.legis.ga.gov/api/
legislation/document/20212022/201498.
    \38\ Georgia State Conference of the NAACP v. Raffensperger, First 
Amended Complaint, at 47.
---------------------------------------------------------------------------
    The high turn-out, particularly by voters of color, is evidently 
part of what prompted the new laws. After the results of the Georgia 
senate races in early 2021, a Gwinnett County elections official in 
suburban Atlanta--a county in which people of color have been a growing 
proportion of the electorate--argued for voter restrictions saying, 
``They don't have to change all of them, but they have got to change 
the major parts of them so we at least have a shot at winning.''\39\ It 
is no surprise, then, that SB 202 also prohibits the providing of food 
and drink to voters waiting in line to vote,\40\ when it is well-known 
that in Georgia, voters of color wait to vote for considerably longer 
periods of time than do White voters.\41\
---------------------------------------------------------------------------
    \39\ Michael Wines, After Record Turnout, Republicans are Trying to 
Make it Harder to Vote, N.Y. TIMES (Mar. 26, 2021), https://
www.nytimes.com/2021/01/30/us/republicans-voting-georgia-arizona.html.
    \40\ SB 202/AP, Section 33, https://www.legis.ga.gov/api/
legislation/document/20212022/201498.
    \41\ Stephen Fowler, Why Do Nonwhite Georgia Voters Have To Wait In 
Line For Hours? Too Few Polling Places, GA. PUB. BROADCASTING (Oct. 17, 
2020), https://www.npr.org/2020/10/17/924527679/why-do-nonwhite-
georgia-voters-have-to-wait-in-line-for-hours-too-few-polling-pl.
---------------------------------------------------------------------------
    Despite the actual motivation for Georgia's new law, throughout the 
debate on SB 202, its supporters attempted to justify the bill using 
language similar to that used by former President Trump and his allies 
concerning non-existent election irregularities in the 2020 Georgia 
Presidential vote. Within days of the election, Representative Barry 
Fleming, Chair of Georgia's House Special Committee on Election 
Integrity, publicly likened absentee ballots to the ``shady part of 
town down near the docks'' where the ``chance of being shanghaied'' is 
significant, and concluded ``Expect the Georgia Legislature to address 
that in our next session in January.''\42\ Among other things, the 
preamble to SB 202 indicates that the overhaul of Georgia's election 
procedures was necessary due to a significant lack of confidence in 
Georgia election systems, with many electors concerned about 
allegations of rampant voter suppression and many electors concerned 
about allegations of ``rampant voter fraud.'' The preamble also asserts 
the law was designed to ``address the lack of elector confidence in the 
election system,'' reduce the burden on election officials, and 
streamline the process of conducting elections by promoting uniformity 
in voting.\43\
---------------------------------------------------------------------------
    \42\ Barry Fleming, Republican Party wins on Election Day, and 
future is bright, THE AUGUSTA CHRONICLE (Nov. 15, 2020), https://
www.augustachronicle.com/story/opinion/columns/guest/2020/11/15/guest-
column-republican-party-wins-on-election-day-and-future-is-bright/
43155971/.
    \43\ SB 202/AP, Section 2, lines 68-148, https://www.legis.ga.gov/
api/legislation/document/20212022/201498.
---------------------------------------------------------------------------
    Although the preamble pays lip-service to concerns about voter 
suppression, SB 202 increases, rather than address, those concerns. 
Others in Georgia were somewhat more candid. Republican Lieutenant 
Governor, Geoff Duncan, told CNN that the law was the fallout from a 
10-week misinformation campaign by the former President and his allies, 
including by his personal attorney, Rudy Giuliani, who ``showed up in a 
couple of committee rooms and spent hours spreading misinformation and 
sowing doubt across, you know, hours of testimony.''\44\
---------------------------------------------------------------------------
    \44\ See Sara Murray and Jason Morris, Georgia's GOP lieutenant 
Governor says Giuliani's false fraud claims helped lead to restrictive 
voting law, CNN (Apr. 8, 2021), https://www.cnn.com/2021/04/07/
politics/geoff-duncan-voter-fraud-cnntv/index.html.
---------------------------------------------------------------------------
    Texas passed a law, SB 1, which, among other things, empowers 
partisan poll watchers with virtually unfettered access in polling 
places, while at the same time tying the hands of election officials to 
stop the poll watchers from engaging in intimidating conduct. Texas has 
a well-documented history of voter intimidation by poll watchers that 
has disproportionately affected voters of color. The courts have 
acknowledged this pattern before. In 2014, a Federal district court 
described this very issue: ``Minorities continue to have to overcome 
fear and intimidation when they vote. . . . [T]here are still Anglos at 
the polls who demand that minority voters identify themselves, telling 
them that if they have ever gone to jail, they will go to prison if 
they vote. Additionally, there are poll watchers who dress in law 
enforcement-style clothing for an intimidating effect to which voters 
of color are often the target.''\45\
---------------------------------------------------------------------------
    \45\ Veasey v. Perry, 71 F. Supp. 3d 627, 636-37 (S.D. Tex. 2014), 
aff'd and reversed on other grounds, Veasey v. Abbott, 830 F.3d 216 
(5th Cir. 2016) (en banc).
---------------------------------------------------------------------------
    When first introduced in early March 2021, one of the predecessor 
bills that would become SB 1 stated that its purpose was ``to exercise 
the legislature's Constitutional authority under Section 4, Article VI, 
Texas Constitution, to make all laws necessary to detect and punish 
fraud and preserve the purity of the ballot box.'' Over the course of 
committee hearings and floor debate on the bill, its sponsor used this 
``purity of the ballot box'' language to defend the Bill. In its final 
form, the bill still referenced Section 4, Article VI of the Texas 
Constitution, stating that its purpose was to ``make all laws necessary 
to detect and punish fraud.'' The final bill included in its first 
pages a series of ``findings,'' which stated that ``fraud in elections 
threatens the stability of a Constitutional democracy,'' ``reforms are 
needed to the election laws of this State to ensure that fraud does not 
undermine the public confidence in the election process,'' and reforms 
to the election laws ``are enacted solely to prevent fraud in the 
electoral process and ensure that all legally cast ballots are 
counted.''\46\
---------------------------------------------------------------------------
    \46\ Tex. Elec. Code Section 1.0015 Legislative Intent; Section 
1.02 Purpose; Section 1.02, Findings, Senate Bill 1, 87th Tex. Legis., 
signed into law Sept. 9, 2021 (effective Dec. 2, 2021).
---------------------------------------------------------------------------
    Harris County, a Texas county with a large number of Black and 
Latinx voters was the county that made the greatest use of drop boxes 
in the 2020 election, and was clearly the target of SB 1's prohibition 
of drop boxes.\47\ But there was no evidence of even minor voting 
irregularities in the 2020 election in Harris Country or anywhere else 
in Texas.\48\ The Harris County Election Security Task Force issued a 
final report on the 2020 election, which concluded: ``In this election 
there were nearly 1.7 million votes cast in Harris County. Despite the 
record turnout, the task force received approximately 20 allegations of 
wrongdoing that needed to be elevated to the level of a formal 
investigation. Despite claims, our thorough investigations found no 
proof of any election tampering, ballot harvesting, voter suppression, 
intimidation or any other type of foul play that might have impacted 
the legitimate cast or count of a ballot.''\49\ The Texas Attorney 
General's office spent 22,000 staff hours in 2020 investigating voter 
fraud--more than double the hours spent prosecuting voter fraud cases 
in 2018.\50\ These efforts resulted in 16 minor findings where voters 
had listed the wrong address on their voter registration card, most of 
which dated back to the 2018 election. None of these cases resulted in 
jail time.\51\
---------------------------------------------------------------------------
    \47\ Jen Kirby, The Battle Over a Texas Order Limiting Ballot Drop-
off Locations, Explained, VOX (Oct. 13, 2020), https://www.vox.com/
2020/10/10/21506522/texas-drop-off-ballot-locations-abbott-harris-
county.
    \48\ Patrick Svitek, Harris County Elections Were Fair and Secure, 
Task Force Finds, THE TEX. TRIBUNE (Dec. 18, 2020), https://
www.texastribune.org/2020/12/18/harris-county-elections-secure/.
    \49\ Id.
    \50\ Daily Kos Staff, Texas Spent Another 22,000 Hours Hunting for 
``Election Fraud'' and Didn't Find a Damn Thing, THE DAILY KOS (June 2, 
2021) https://www.dailykos.com/stories/2021/6/2/2033306/-Texas-spent-
another-22-000-hours-hunting-for-election-fraud-and-didn-t-find-a-damn-
thing.
    \51\ Taylor Goldstein & Austin Bureau, Ken Paxton's Beefed-Up 2020 
Voter Fraud Closed 16 Minor Cases All in Harris County, HOUS. CHRONICLE 
(Dec. 21, 2020), https://www.houstonchronicle.com/politics/texas/
article/Ken-Paxton-s-beefed-up-2020-voter-fraudunit-15820210.php.
---------------------------------------------------------------------------
    It is difficult to overstate the nature of the new bills and laws 
proliferating in the States. Not only do these laws make it more 
difficult for voters to vote--whether early, by mail, or in-person--but 
even more ominously, the new wave of bills and proposals is part of a 
more comprehensive attack on elections, aimed at facilitating the 
overriding of the actual votes of the electorate.\52\ A group of 
scholars observed that an effort is under way to change State election 
rules to ``entrench minority rule.'' They concluded, ``This is no 
ordinary moment in the course of our democracy. It is a moment of great 
peril and risk.''\53\ Against the backdrop of January 6, 2021, these 
statements are not hyperbolic.
---------------------------------------------------------------------------
    \52\ Will Wilder et al., The Election Sabotage Scheme and How 
Congress Can Stop It, BRENNAN CTR. FOR JUST. (Nov. 8, 2021), 
2021_11_ElectionSabotage(1).pdf.
    \53\ 53 Statement in Support of the Freedom to Vote Act, Nov. 2021, 
Democracy letter_November 2021_DocumentCloud.
---------------------------------------------------------------------------
                             iv. conclusion
    All this is not to say that changes in election laws are not 
necessary or that Congress should be complacent about the security of 
election infrastructure. Far from it. The attack on voting rights is a 
key to the larger crisis of American democracy. The attack threatens to 
transform elections into an instrument for a faction seeking to 
monopolize power and exclude others, rather than a means for expressing 
``the consent of the governed'' as a basis for building consensus to 
promote the good for everyone. As the letter from the scholars 
observed, ``Defenders of democracy in America still have a slim window 
of opportunity to act. But time is ticking away, and midnight is 
approaching.''\54\ Congress must reassert its historic role to support 
free and fair elections and preserve democracy in a moment of peril.
---------------------------------------------------------------------------
    \54\ 54 Id.
---------------------------------------------------------------------------
    First, Congress must pass the John Lewis Voting Rights Advancement 
Act (JLVRAA) to restore the strength of the VRA to prevent racial 
discrimination.
    Second, Congress must enact the Freedom to Vote Act (FTVA) to 
establish uniform minimum standards across the States for early voting, 
same day registration, voting by mail, fair redistricting, and other 
essential elements of elections.
    The JLVRAA responds to the Supreme Court decisions weakening the 
VRA, updating the preclearance formula to cover States and localities 
with a recent record of discrimination, and clarifying the grounds they 
can use to justify their election laws when challenged. Further, the 
standards established by the FTVA are common-sense rules prevalent in 
many States, where there was often bipartisan support.
    As Congress proceeds, however, it is important to separate 
frivolous and fanciful fabrications--intended to inflame passions, 
shake voter confidence, justify voter suppression laws, and ultimately 
and perhaps critically injure our democracy--from evidence-based 
concerns addressed not only to election security, but also to ensuring 
that voting is easier and more accessible for all Americans.

    Chairwoman Clarke. I thank you for your testimony, Mr. 
Rosenberg. Finally, I recognize Mr. Masterson to summarize his 
statement for 5 minutes.

STATEMENT OF MATTHEW MASTERSON, PRIVATE CITIZEN, FORMER SENIOR 
    CYBERSECURITY ADVISOR, CYBERSECURITY AND INFRASTRUCTURE 
        SECURITY AGENCY, DEPARTMENT OF HOMELAND SECURITY

    Mr. Masterson. Thank you, Chairwoman, and thank you, 
Ranking Member Garbarino and Members of the committee, for the 
opportunity to testify today. I will skip the introduction as I 
appreciate the Chairwoman and Ranking Member providing my 
background I led the work in election security at CISA.
    The 2020 election placed election officials at the center 
of National attention in a way that we haven't seen for 
decades, if ever. A record turnout and a smooth Election Day 
validated election officials' incredible work. Yet despite 
their heroic work, election officials are facing threats 
against themselves and their systems, their workers, and even 
their families. This environment is not sustainable and 
additional support must be provided to these election officials 
to ensure their safety and the security of our elections.
    Recently, myself and a group of students at Stanford 
published a report on the most pervasive threats facing 
election officials and the steps we can take to mitigate those. 
Those threats included physical threats against election 
officials, the undermining of confidence in election results 
through a now well-defined playbook available to both foreign 
and domestic actors, and inconsistent funding and a lack of 
governance structures around elections' information technology.
    There are mitigations to these threats that can empower 
election officials, further secure our systems, and offer 
voters the types of evidence needed to reject this mis- and 
disinformation. These mitigations fall into 3 broad categories: 
Funding, election officials security, and systems security and 
resilience.
    First, we must fund elections consistently at the State, 
local, and Federal level. Regular and consistent investment in 
our elections is needed. A shared funding structure should be 
implemented in which all levels of government pay for their 
portion of each election.
    Second, we must ensure the physical security of election 
officials, offices, and staff across the country. The recent 
creation of the DOJ Election Threats Task Force is an important 
step, but much more must be done. First, the DOJ Election 
Threats Task Force should provide data after each Federal 
election regarding the scope and scale of threats against 
election officials and the workers. Second, in order to ensure 
comprehensive data is collected, analyzed, and shared local and 
State law enforcement should be required to share activity 
directed against election officials and workers with Federal 
law enforcement in their State. Third, penalties must be 
increased against those who threaten election officials, 
workers, or their families. Congress and State legislatures 
should pass laws offering harsher penalties for threats or acts 
of violence against election officials or workers. Finally, 
CISA should offer training and guidance on physical security 
and doxing prevention measures that election officials can 
take, utilizing the protective security advisors, like those in 
Region 2 that the Ranking Member mentioned, in order to train 
election officials.
    Finally, we must continue to improve the cyber resilience 
of American elections. This starts by encouraging States to 
implement precertification audits of paper ballots. Second, 
CISA and the EI-ISAC should provide more proactive, scalable 
service to election officials, like Crossfeed as was mentioned 
by the Ranking Member, a service that was provided in 2020. 
This should include expanded use of Crossfeed in both scope and 
scale, remote incident response services, and increased 
endpoint protection and email protections for mid-to-small 
counties who struggle to protect their systems.
    Third, we must better define the Federal roles and 
responsibilities in elections. Congress should further clarify 
the roles of CISA and the EAC, making CISA the technical lead 
for election security while empowering the EAC to better focus 
on its other election administration missions. Creating well-
defined responsibilities for CISA and the EAC will allow both 
agencies to fully achieve their core missions, eliminating the 
on-going Federal infighting regarding roles and 
responsibilities, and creating clear lines of communications 
for election officials on these issues. This should include 
moving the Federal voting system testing and certification 
program to CISA.
    Third, CISA and EI-ISAC in partnership with election 
officials should establish core cybersecurity baselines for 
election offices. These baselines should include, at a minimum, 
required multifactor authentication for all critical systems, a 
move of all election websites to .gov, increased access 
controls, more efficient and effective patch management, and 
proper network segmentation of election networks away from 
State and local county networks. In establishing these 
baselines, CISA should leverage its on-going support to 
election offices to inform the scope and scale of 
implementation of these baselines, as well as additional steps 
election offices can be taking to secure their infrastructures.
    Our elections are imperfect. They are massive, messy, 
underfunded, and under-resourced. But they are accurate, 
secure, accessible, and fair because of the tireless work of 
State and local election officials. The only response to the 
on-going threats against our democracy is a sustained 
investment in those working hard to protect it.
    I appreciate the time and I look forward to your questions.
    [The prepared statement of Mr. Masterson follows:]
                Prepared Statement of Matthew Masterson
                            January 20, 2022
    Chairwoman Clarke, Ranking Member Garbarino, and Members of the 
committee, the 2020 U.S. election was unprecedented in American 
history. While many have detailed what went wrong (or right), reports 
have largely overlooked the group most impacted by these changes: State 
and local election officials. Election officials anticipated problems, 
quietly pivoted with each changing health measure and court case, and 
faced many of the worst repercussions of viral and inflammatory 
misinformation. In the end the 2020 election was secure and accurate 
because of their hard work and commitment to our democracy.
    Trust in American elections is under attack from abroad and at 
home. The Federal Government's support framework, while improved, 
remains challenged to effectively ameliorate the issues election 
officials face. The threats are real and evolving. Immediate support 
and investment must be provided to these officials in advance of the 
upcoming mid-term elections and the 2024 Presidential election.
                   threats to election processes \1\
---------------------------------------------------------------------------
    \1\ This testimony is based in large part on a Stanford Internet 
Observatory research paper: ``How to Secure American Elections When the 
Losers Won't Accept They Lost'' by Matt Masterson, Jennifer Depew, 
Katie Jonsson, Shelby Perkins, Alex Zaheer.
---------------------------------------------------------------------------
    1. Election officials' capacity to do their jobs is degraded by 
physical threats and broad distrust fomented by bad-faith actors.--
These threats undermine officials' ability to conduct critical 
community outreach, and could contribute to brain-drain at a time when 
competence at the local level is needed most.
    2. The playbook for undermining confidence in election results is 
well-defined and available for foreign and domestic influence agents.--
The 2020 election prominently featured attempted election interference 
from foreign and domestic actors. Influence agents are emboldened by 
2020, while defenders of election integrity are under-resourced and 
uncoordinated, leaving them vulnerable to repeated tactics.
    3. Inconsistent funding and lack of governance structures around 
elections IT continue to perpetuate vulnerabilities.--Despite marked 
progress since 2016, emerging threats such as ransomware continue to 
expose critical election systems to crippling attacks. In defending 
election systems, under-resourced local governments face off daily 
against well-funded nation-state adversaries, a disparity that 
continually exposes election systems to attack.
                            recommendations
    In light of the aforementioned threats, and others yet to come, 
below is a set of concrete and actionable recommendations to shore up 
election security and ensure election confidence. Each of these 
recommendations will require coordination by relevant stakeholders at 
the local, State, and Federal level.
Fund elections consistently at the State, local, and Federal level
    Every year, State and local election officials across the country 
struggle to obtain the funding needed to run elections. State and local 
governments often push aside pleas in favor of issues perceived as more 
immediate, passing over electoral needs that are commonly viewed as 
seasonal despite elections that are run several times a year in most 
jurisdictions. Almost every election official is commonly asked ``What 
do you do the other 364 days a year?'' when discussing the operational 
challenges of their work.
    Securing election infrastructure is a matter of National security. 
This is precisely why the Department of Homeland Security designated 
election systems as critical infrastructure in 2017. Elections should 
be funded commensurate with their status as critical infrastructure, 
with all levels of government ensuring regular and consistent funding. 
A shared funding structure should be implemented in which all levels of 
government pay for their portion of each election. This practice is 
done locally in several States and is sometimes referred to as ``charge 
backs'' or the ``ballot real estate'' model. The idea is that each 
jurisdiction that appears on a ballot in any given election is charged 
for its portion of that election. For instance, if an election has a 
Congressional race, State house race, mayor's race, and county 
commissioner race, then the Federal Government would pay for the cost 
of the House race, State government for the cost of the State house 
race, city government for the mayor's race and the county for the cost 
of the commissioner's race. This would ensure consistent and regular 
funding of elections, with each level of government paying its share of 
the cost.
    Congress should establish an elections fund, administered by the 
U.S. Election Assistance Commission (EAC), that State election 
officials can draw down from based on the expense to run Federal 
elections in their State. States should be required to pass the 
majority of the money down to their local officials to cover the 
additional costs of running Federal elections. This funding structure 
will incentivize deliberative, planned investment that allows for risk-
based decision making and funding for human capital, systems 
acquisition, and processes to ensure sustainability of those systems 
over time.
Ensure the physical security of election officials, offices, and staff 
        across the country
    Many State and local election officials faced threats of violence 
due to mis- and disinformation about the 2020 election. In many cases, 
officials who reported these threats received little to no support from 
local, State, or Federal law enforcement officials. Many of the threats 
were deemed not serious or imminent enough to necessitate action.
    More must be done to protect the health and safety of election 
officials and election workers, including private-sector employees who 
support elections. The recent creation of an Election Threats Task 
Force at the Department of Justice (DOJ) is an important and 
encouraging first step. The following steps to further protect election 
officials:
    1. Publication and use of threat data.--The DOJ Election Threats 
Task Force should provide data after each Federal election regarding 
the scope and scale of threats against election officials and workers. 
This report should include the number of complaints, number of credible 
threats, number of acts of violence and number of prosecutions for 
those threatening election officials or workers. This data would 
support efforts at the State and local level to prioritize funding for 
physical security, shore up gaps in security and better diagnose on-
going problems. In addition, based on this data, the DOJ task force, in 
coordination with CISA, should release guidance on best practices for 
election officials, counties, States, and the Federal Government to 
better protect those who run elections.
    2. Increased information sharing regarding threats.--From our 
interviews with election officials, it became clear that Federal, 
State, and local law enforcement are not sufficiently coordinated 
regarding the scope, scale, and regularity of threats against election 
officials. This is particularly concerning because existing structures 
are in place, including State fusion centers, to facilitate this 
information sharing. In order to ensure comprehensive data is 
collected, analyzed, and shared, local and State law enforcement should 
be required to share activity directed against election officials and 
workers with Federal law enforcement in their State. In return, Federal 
law enforcement should regularly report back to State and local 
officials regarding the activity in their jurisdiction with full 
transparency regarding any actions taken, including if investigations 
have been initiated.
    3. Penalties.--Congress and State legislatures should pass laws 
offering harsher penalties for threats or acts of violence against 
election officials. Following the 2020 election, there have been few 
consequences for those who threatened election officials. Any potential 
violence against election officials or workers should be treated as a 
threatened attack on the process and democracy itself, and should 
result in criminal liability.
    4. Privacy.--Many threats against election officials and staff 
directly target their homes and families. More must be done to protect 
their private information from would-be malicious agents. Many States 
have passed laws that protect the identity of certain subsets of 
registered voters. These categories typically include law enforcement 
officers, judges, and domestic abuse victims. Election officials should 
be included in this category to ensure that their personal information 
is not readily available publicly.
    5. Prioritizing protection of election officials and workers.--
State and local law enforcement should treat threats against election 
officials as credible. This may mean increasing patrols around offices 
and residences, as well as further investigation into additional 
threats. Because State and local law enforcement often lack sufficient 
funding, State legislatures and county governments should provide 
additional funding to support the protection of election offices and 
workers, especially during and after election periods.
    6. Physical security and doxxing training.--CISA should offer 
training and guidance on physical security and doxxing prevention 
measures. CISA has protective security advisors (PSA) located across 
all 50 States to advise on physical security matters. These PSAs have 
done a great job working with local election officials to evaluate the 
physical security posture of local offices and storage facilities. PSAs 
should offer additional support and training to help election officials 
protect themselves and their staff from doxxing and physical harm away 
from the office.
Encourage States to implement paper-based pre-certification audits
    No single improvement to the security of elections was more 
important in 2020 than the wide-spread use of auditable paper ballots. 
Approximately 95 percent of votes cast in the 2020 election were on an 
auditable paper ballot, up from just over 85 percent in 2016. In 
Georgia, election officials could hand-audit ballots to show the 
accuracy of the election results. In Maricopa County, Arizona, the 
election officials conducted the State-required public hand audit by 
bipartisan recount boards. The results of this hand audit affirmed the 
results of the election in the county.
    States should prioritize implementation of paper ballot audits that 
are completed before vote counts are certified. These audits should 
offer a transparent, bipartisan, and repeatable process by which the 
results of the election as tabulated by the voting systems can be 
evaluated through the review of the paper ballots.
    In pursuing better, more efficient pre-certification audits, States 
should also continue to pursue evidence-based elections. This means 
implementing systems, processes, and procedures that maintain 
transparent records of the integrity of the election. An audit is only 
as good as the integrity of the artifacts to be audited. For elections, 
this means that chain of custody of the ballots and proper ballot 
manifests are imperative to the trustworthiness of the audit. As part 
of the implementation of these post-election audits, States should 
support local election offices in implementing consistently documented 
chain of custody and ballot tracking procedures across the State.
Reform the Federal voting system certification process
    The process for voting system testing and certification must be 
reformed. Election officials have been forced into maintaining outdated 
and unsupported systems for longer than their expected lifespan in part 
because the EAC process has not evolved to support items like component 
certification, regular patching of systems and further deployment of 
commercial off-the-shelf technology. While EAC commissioners have 
committed to the pursuit of these items as part of the roll-out of the 
Voluntary Voting System Guidelines (VVSG) 2.0, the passage of VVSG 2.0 
as the same monolithic standard as the prior VVSG makes it unlikely 
that the process can be reformed enough to be responsive to the needs 
of election officials.
    Congress should further clarify the roles of EAC and CISA in 
elections, making CISA the technical lead while allowing the EAC to 
better focus on its other election administration missions. Both EAC 
and CISA have limited resources and capabilities, so further 
clarification of roles and responsibilities would allow each agency to 
best use its time and money in support of the election community. CISA 
is the more technically capable organization and should be formally 
designated as the lead Federal agency for the physical and 
cybersecurity support of election systems and officials. This should 
include moving the Federal Voting System Testing and Certification 
Program to CISA. The National Institute of Standards and Technology 
(NIST) should remain in its HAVA-created role as technical consultant 
on the development of the VVSG.
    The EAC should be empowered to focus on all other aspects of the 
election process beyond cyber and physical security issues, allowing it 
to build out its clearinghouse function, advancing data collection and 
research efforts, and continuing to disperse election grants provided 
by Congress. Creating well-defined responsibilities for CISA and EAC 
will allow both agencies to fully achieve their core missions, 
eliminating the on-going Federal infighting regarding roles and 
responsibilities and creating clear lines of communication for election 
officials on these issues.
    In addition, regardless of who runs the program, the Federal 
testing and certification process should be reformed to address the 
marketplace challenges it is creating:
    1. Already certified voting systems running unsupported operating 
        systems should be decertified.--Because these systems are 
        running unsupported operating systems, they are unable to be 
        patched to remediate known vulnerabilities. Most of these 
        systems cannot simply be updated because they lack the memory 
        or processing power to run updated operating systems. Many 
        election officials running these systems have expressed the 
        need to replace them, but have not received the necessary 
        funding to do so. Voting system vendors and election officials 
        should be notified of pending decertification and should be 
        given enough time to upgrade or replace their systems.
    2. VVSG 2.0 should be implemented rapidly.--This would mean that 
        all new systems submitted to the certification program must be 
        VVSG 2.0-compliant to receive certification by a date 
        established by the EAC in the near future. The certification 
        program should avoid using metrics like accreditation of the 
        voting system test laboratories to conduct VVSG 2.0 testing or 
        certification of the first voting system to VVSG 2.0 as metrics 
        for sunsetting VVSG 1.0 and 1.1. In setting a date, the 
        certification program should publish a definition of what 
        constitutes a new voting system and make clear that this 
        definition will be enforced. In the past, vendors have avoided 
        certification to the newest standards, such as VVSG 1.1, by 
        modifying already certified systems, allowing them to be tested 
        to the older standard in perpetuity.
    3. The certification program must incentivize patching of voting 
        systems.--Currently, the certification process disincentivizes 
        regular patching of systems by requiring testing (sometimes 
        extensive) of most software updates. This causes voting system 
        vendors to hold off on pursuing modifications to systems until 
        they reach a critical mass of changes that justify the 
        financial and time costs associated with certification. 
        Instead, the certification program should revise its policies 
        to allow vendors to attest to their own testing of critical 
        patches on already certified systems. In allowing for vendor 
        attestation, the certification program should require the 
        voting system test laboratories to review and approve vendor 
        testing documents prior to approval of the patch. This process 
        should be expedited to allow for timely deployment of patched 
        systems to the field, recognizing that the majority of voting 
        systems cannot be remotely patched. This process would be 
        separate from the existing de minimis change process, which 
        requires no additional testing by the vendor or test lab to 
        receive approval.
Provide election offices more scalable and proactive services through 
        CISA and EI-ISAC
    Given the vast and decentralized nature of election administration 
in the United States, the challenge for CISA and the EI-ISAC is 
immense. How do you ensure that information, support, and services 
reach the smallest town in Wisconsin or the most remote county in 
Montana? Even if you reach those places, how do you make the 
information and services relevant and usable for the election official 
in Jackson County, Ohio? CISA and the EI-ISAC have made incredible 
progress on this challenge since the 2016 election. All 50 States, 
Washington, DC, and the 4 territories joined the EI-ISAC; intrusion 
detection sensors were deployed on election infrastructure across all 
50 States; thousands of State and local offices participated in 
tabletop exercises; hundreds of cyber hygiene scans were conducted; and 
virtually every State received a penetration test.
    Even with the success of these offerings, the scalability of the 
services remains a challenge. Due to resource constraints, CISA can 
only perform a finite amount of on-site vulnerability assessments of 
all critical infrastructure, let alone elections. In addition, many 
election offices do not have the necessary IT resources to benefit from 
some of the more in-depth services. Over the last 4 years, CISA has 
learned the intricacies of the election sector and the systems that 
support it. It has worked to prioritize the services that are most 
useful, and it has developed new and scalable services, such as remote 
penetration testing, to better serve the community.
    In 2020, CISA recognized that it needed to be more proactive in its 
work with election officials. In collaboration with the Defense Digital 
Service, the agency developed and released a tool called Crossfeed, 
which is used to gather information about vulnerabilities on public-
facing systems supporting critical infrastructure. Crossfeed 
proactively collects data through a variety of open-source tools, 
publicly-available resources and data feeds, and can operate in a 
``passive'' mode where it relies on unintrusive data-gathering methods.
    Moving forward, CISA and the EI-ISAC should learn from the success 
of Crossfeed to identify and provide additional proactive, scalable 
services to local election offices. Both entities have built a level of 
trust with election officials that means they can afford to be more 
aggressive in the types of support provided. For example:
    1. CISA should expand the Crossfeed program.--Recently CISA 
        announced the continuation of Crossfeed. This is an important 
        first step. The agency should expand the use of the program to 
        include offering all 50 States, the District of Columbia, and 
        the territories active participation in the program with the 
        goal of proactive monitoring of publicly-available aspects of 
        State and local offices' infrastructure. This should also 
        include the use of Crossfeed on other election-specific 
        technology, such as proactively searching for voting systems 
        that may be inadvertently connected to the internet. Further, 
        CISA should offer the service to election vendors, campaigns, 
        and other election-related entities.
    2. CISA should offer remote hunt and incident response to election 
        offices.--Like on-site vulnerability assessments, CISA hunt and 
        incident response services have traditionally involved on-site 
        deployment of responders to an office. This makes both services 
        extremely labor-intensive and difficult to scale. CISA has 
        piloted some remote incident response capabilities in the past, 
        and it is time to expand this effort along with proactive 
        network hunt capability.
    3. EI-ISAC should expand its endpoint protection program.--
        Throughout 2020, EI-ISAC worked with some State and local 
        offices to pilot endpoint protection for their offices. This 
        pilot proved to be useful for both the election officials and 
        EI-ISAC as it worked to gain greater insight into the scope of 
        activity targeting election infrastructure. This program should 
        be expanded to more jurisdictions, with a focus on medium-to-
        small localities that lack the same or similar capabilities and 
        would benefit most from these services.
    4. EI-ISAC should offer cloud-based email as a service to local 
        election offices.--Email security is one of the largest risk 
        areas for local election offices. Many continue to run outdated 
        and unpatched email servers with little ability to upgrade and 
        maintain them. EI-ISAC should partner with Microsoft, Google, 
        or other large cloud-based email providers to explore 
        implementation of email as a service for local election offices 
        and county governments. For counties that are unable or 
        unwilling to implement a State-based solution, the EI-ISAC 
        could be a viable solution from a trusted partner.
    5. EI-ISAC should provide a managed solution for multi-factor 
        authentication (MFA).--Many election offices continue to 
        struggle to implement MFA across their systems. While there are 
        a lot of MFA solutions available in the marketplace, many 
        election offices are unable to implement MFA because of 
        outdated legacy systems and lack of vendor support. EI-ISAC 
        should work with State and local offices to understand the full 
        scope of the challenge and coordinate with a commercial 
        provider to offer a managed solution for local offices to 
        implement MFA on general office systems. In providing this 
        service, EI-ISAC should offer technical support and resources 
        for MFA implementation in existing election legacy systems. In 
        addition, EI-ISAC should partner with common election system 
        vendors to make it easier to implement MFA, as well as 
        encourage these vendors to implement MFA themselves. Election-
        specific systems may be harder to include in this effort 
        because of strict requirements around certification and 
        implementation.
Mandate reporting of election cyber incidents to CISA and the FBI
    Improved and increased information sharing regarding election cyber 
incidents was an incredibly important development for the protection of 
the 2020 election. Federal, State, and local officials worked together 
to understand possible incidents and support response efforts in 
unprecedented ways. Moving from distrust seeded by the fallout of the 
2016 election to this level of partnership is a tribute to the 
professionalism and commitment of State and local officials.
    Building on this progress, Congress should require State and local 
election offices and private-sector election providers to report cyber 
incidents to CISA and the FBI. This is a necessary step for two main 
reasons. First, CISA and the FBI have no ability to mandate this type 
of reporting themselves. While the vast majority of possible incidents 
in 2018 and 2020 were shared with the Federal Government, some were not 
shared with either the Federal Government or State officials. Time is 
of the essence during any cyber incident, but even more so with 
elections as officials work against a hard deadline and with limited 
resources. Required reporting will ensure timely and coordinated 
response from all levels. Second, given the sophisticated and 
persistent nature of the threats against elections, ensuring the 
Federal Government has a full picture of the activity out in the field 
is critical to providing a whole-of-Government response to officials. 
The full capability of the Federal Government can only be brought to 
bear to protect election systems when the agencies charged with support 
of their defense have full visibility into the tactics, techniques, and 
indicators of compromise employed by adversaries.
Establish minimum cybersecurity baselines for State and local election 
        offices and election vendors
    In July 2021, the White House issued a ``Memorandum on Improving 
Cybersecurity for Critical Infrastructure Control Systems.'' The memo 
pushes Federal agencies to work more collaboratively with private-
sector companies that own and operate critical infrastructure systems 
to advance basic cyber practices. The memo requires agencies and the 
private sector to jointly establish voluntary guidance for the 
cybersecurity of critical infrastructure systems.
    CISA, the Government Coordinating Council (GCC) and the Sector 
Coordinating Council (SCC) should work together to publish a set of 
minimum cybersecurity practices that all election offices and companies 
should adopt. These practices should recognize that the majority of 
U.S. election jurisdictions are mid-sized to small counties, cities, 
and townships that lack sufficient funding or IT support. We recommend 
starting with the NIST cybersecurity framework and adding or 
emphasizing the following:
    1. Create and Maintain an Inventory of Assets.--For many election 
offices, items like patch management and incident response are hindered 
by a lack of understanding of what systems and software the office owns 
and operates. Election offices should create and maintain an 
enterprise-wide inventory list with up-to-date information on system 
type and version.
    2. Require Multi-factor Authentication.--All critical systems, 
including business systems like email and voter registration access 
portals, should require MFA for all users.
    3. Ensure Network Segmentation.--All local election networks should 
be properly segmented from each other and other county networks. Proper 
segmentation greatly reduces the ability for malicious actors to access 
or impact election networks after compromising another county 
department or system.
    4. Maintain Access Control.--All election-related systems should 
follow the rule of least privilege. This means that only those that 
need access to a system should be given access, and only the access 
they need to accomplish their work. This should be applied to vendors 
and staff alike.
    5. Utilize Patch Management.--Implementing a patch management 
program reduces the likelihood of an organization having a 
cybersecurity incident particularly as a result of commodity malware.
    6. Move to .gov.--All State and local election websites should be 
moved to a .gov domain name. This is important for both security and to 
help combat mis- and disinformation, as .gov domain names are 
recognized as trusted government websites. CISA is offering .gov 
domains for free and is scaling up support to help States and 
localities move their websites over.
Centralize election IT infrastructure at the State level
    With the passage of the Help America Vote Act (HAVA) in 2002, many 
States took on much more responsibility for election administration. 
HAVA's requirement for the creation of State-wide voter registration 
databases and requirement for the establishment of a chief State 
election official gave election leadership to several States that 
previously had little or no role in the administration of elections. 
For many of these States, it forced a partnership between the State and 
localities that administered elections that never existed before. As 
States worked to implement HAVA, many experienced pushback, and even 
outright hostility, from localities that previously had sole 
responsibility for administering elections.
    In time, local and State election offices have largely worked 
through those challenges and established defined roles and 
responsibilities for the administration of elections, including voter 
registration databases. Some States took full control, running top-
down, State-wide voter registration databases. Others left control 
largely in the hands of the localities, serving simply as an aggregator 
of data at the State level, running bottom-up registration databases. 
Still, others have a hybrid system with a mix of top-down and bottom-up 
characteristics. Over time, these lines were further blurred with 
States taking on additional responsibility for military and overseas 
voters, with many beginning to offer sample ballots, voter look-up 
tools, and ballot tracking.
    The 2016 election permanently changed the threat landscape for 
elections. Russia, a nation-state adversary, was able to research, 
remotely target and, in a small number of cases, access election 
systems. This change in threat level must be met with a change in 
governance structure at the State and local level. Since HAVA, States 
have proven themselves capable of supporting elections by handling more 
responsibility for the administration and corresponding infrastructure 
of elections. In most cases, compared to local governments, States 
possess significantly greater budgets, staff, and capabilities to 
protect from, detect, and recover from cyber attacks against election 
infrastructure. Recognizing this, we recommend the following steps.
    1. Move to top-down voter registration systems.--In many cases, the 
        decentralized nature has served election administration well. 
        It has created flexibility for local election officials to 
        creatively solve challenges unique to their county or township. 
        However, voter registration systems are among the areas of 
        greatest risk, according to a risk assessment release by CISA 
        in 2020. Bottom-up States in particular have an increased 
        attack surface and more risk to manage.
    It is time for States to take on the full responsibility of HAVA 
        and move to top-down voter registration systems. Local election 
        offices should not be asked to bear the responsibility of 
        managing and securing these increasingly complex and important 
        election systems. This move will also free up much-needed 
        resources for local election offices to spend on other areas of 
        election security and administration. A move to top-down voter 
        registration across all States also will create an opportunity 
        for the community to work collaboratively with CISA to create 
        guidelines and new methods for securing and auditing voter 
        registration systems, something that is difficult to do now 
        because of the diversity of systems and infrastructure among 
        county systems.
    2. Provide State-managed email accounts.--Many cyber incidents 
        begin through the compromise of a local email account that is 
        used to compromise other systems. A substantial number of 
        localities maintain their own email servers. In many cases, 
        this results in the administration of an email server within 
        the county, sometimes by the local election office itself. In 
        other cases, the local election office is left without any 
        email support and is forced to use its own email account, 
        sometimes resulting in the use of personal email accounts. 
        States should utilize existing infrastructure to offer local 
        election offices their own email accounts through the State, 
        including cloud-based email services that the State is already 
        using for its own email systems. If State-managed email 
        accounts can't be offered, States should offer localities 
        access to Microsoft or Google cloud-based email services. Both 
        of these companies have offered additional protections and 
        default secure configurations to election customers, and would 
        greatly lower local offices' risk profile.
    3. Broaden implementation of cyber navigator programs.--Following 
        the 2016 election, State election officials and their IT leads 
        quickly came together to evaluate risk, strategize on 
        mitigations and assess next steps in better defending their 
        infrastructure. As they secured their own systems, State IT 
        leads knew that the greatest risk rested across the machines 
        maintained by counties, townships, and cities that are actually 
        responsible for running elections. Most recognized that State-
        level investment in local support would be necessary to 
        properly manage the new risk environment. To shore up 
        capability gaps at the local level, Illinois implemented a 
        program dubbed the ``Cyber Navigator Program'' that provided 
        State-funded IT leads to help localities evaluate risk posture 
        and implement a checklist of steps to improve security and 
        resilience. Several States, including Florida and Minnesota, 
        implemented similar programs. Iowa took a similar approach, 
        partnering with State and county IT leads to help local 
        auditors secure election systems. This included engagement with 
        the Iowa National Guard as well as cross-county support to 
        ensure lesser resourced auditors received services and support. 
        Moving forward, more States should implement similar State-
        funded programs to ensure that all county election offices have 
        consistent and reliable IT support before and during elections.
Support good-faith security research and vulnerability assessments
    Since the passage of HAVA and wide-spread adoption of electronic 
voting systems, security researchers from academia and industry have 
focused their attention on the vulnerabilities in those systems. The 
quality of the relationship between the research community and election 
community has ebbed and flowed from highly contentious to begrudging 
respect.
    Following the 2020 election, as election officials and industry 
were besieged with claims of rigging and hacking, security researchers 
saw their work distorted in pursuit of untoward goals. In an effort to 
defend both their work and the security of the 2020 election, 
researchers spoke out with one voice, making clear that ``[m]erely 
citing the existence of technical flaws does not establish that an 
attack occurred, much less that it altered an election outcome'' and 
calling the claims ``technically incoherent.'' There is an opportunity 
now for these two groups to find common ground and support each other 
in improving both the security of election systems and confidence in 
the process. This can be done in several ways:
            Adopt Vulnerability Disclosure Policies (VDP)
    A strengthened relationship between election administrators and 
security researchers should start with States opening to good faith 
research through further adoption of vulnerability disclosure policies 
(VDP). These policies provide a safe haven for security researchers to 
find vulnerabilities in public-facing election systems and report them 
to the State election office for remediation. The Ohio Secretary of 
State's office was the first election office to implement VDP, with 
Iowa following closely behind. Other States have since announced their 
intention to implement a VDP. In addition, some of the largest voting 
system providers have announced creation of their own VDP, with four of 
the largest vendors currently offering VDPs. In 2020, CISA released a 
``Guide to Vulnerability Reporting For America's Election 
Administrators'' that focuses on empowering election officials to 
create and implement their own VDP programs. VDPs not only build a 
bridge between the two communities, but also provide under-resourced 
election offices access to top-level security assessments at 
essentially no charge.
    Moving forward, all 50 States and election technology providers 
should implement VDPs for their organizations. The VDPs should follow 
industry standard practices and include legal safe harbor to authorize 
testing and protect researchers. States should also consider requiring 
election system providers to have an existing VDP in order to be 
eligible to receive contracts. In addition, EI-ISAC should work with 
its executive board to create and implement a VDP that allows 
researchers to report vulnerabilities in local election infrastructure 
to the EI-ISAC, which would then notify the appropriate vendor or 
office. In serving in this role, EI-ISAC should work with the local 
election offices to determine the validity and severity of a report, as 
well as possible mitigation strategies. EI-ISAC should commit to 
collecting and reporting on the amount and types of vulnerabilities 
reported, and work with CISA to publish guidance on remediation of the 
most common vulnerabilities.
            Expand open-ended vulnerability assessments
    Starting in 2019, CISA began offering election system providers 
access to Critical Product Evaluations. These are open-ended 
vulnerability assessments of the submitted system that is part of 
critical infrastructure. Testers tear apart systems looking for 
hardware, firmware, and software vulnerabilities, issuing a report when 
finished of the discovered vulnerabilities and their severity. This 
type of open-ended vulnerability assessment has been discussed for 
decades, but has never taken hold in part because the Federal testing 
and certification process is not properly structured for it.
    In the aftermath of the 2016 election, DEF CON, the world's largest 
hacking conference, created a Voting Village, self-described as ``an 
open forum to identify vulnerabilities within U.S. election 
infrastructure and to consider mitigations to mitigate these 
vulnerabilities.'' The Voting Village has exposed a broader range of 
security experts to the inner workings of election systems and brought 
election officials into the room with those experts to understand the 
mindset of a hacker. The village has also elevated election system 
security as the National security issue that it is. However, since its 
inception, the Voting Village has been controversial with some within 
the election community because of its unwillingness to provide context 
around the procedural controls that exist in elections. In addition, 
some organizers of the Voting Village openly mocked election officials, 
going so far as to describe them as ``f--ing luddites.''
    Bridging the gap between election officials and the security 
community through open vulnerability assessments is critical to 
continuously improving the security of elections. Doing so will 
increase the number of third-party experts available with exposure to 
election systems, allowing them to credibly affirm and amplify election 
officials' debunking of false claims made regarding the security of the 
systems.
    Moving forward, the following steps should be taken to increase the 
exposure of election systems to third-party security research.
    1. Expansion by CISA of the Critical Product Evaluation Program.--
        For many vendors, this is an important introduction to open-
        ended vulnerability assessments and allows the vendor to 
        understand the level of effort needed to mitigate 
        vulnerabilities found during open-ended testing. CISA had 
        robust participation in the evaluation program throughout 2019 
        and 2020 with many of the largest voting system companies 
        participating. However, due to interest from other areas of 
        critical infrastructure and limited capacity, CISA could not 
        evaluate every system that was requested to go through the 
        program. CISA should prioritize resourcing to allow any 
        election system provider to submit its system to the program 
        and receive an evaluation prior to the 2024 election cycle. In 
        addition, CISA should continue outreach to private-sector 
        election system providers to increase the diversity of the 
        types of systems submitted, including voter registration 
        providers, election night reporting providers and electronic 
        pollbooks. While these evaluations are useful for vendors 
        themselves, making these evaluations public after sufficient 
        review would significantly improve awareness of potential 
        product security concerns for election officials looking to 
        make acquisitions.
    2. Private-sector participation in the DEF CON Voting Village.--The 
        Voting Village has served an important role highlighting the 
        National security importance of election systems. The Voting 
        Village is an important forum for voting technology companies 
        and election officials to engage with the security research 
        community, but its value is currently limited because of the 
        lack of new systems made available at the conference. Moving 
        forward, the Voting Village should work more collaboratively 
        with industry and election officials to secure relevant 
        election systems for the conference. This will likely mean 
        establishing protocols for the village to include vendor 
        participation and responsible disclosure processes when 
        vulnerabilities are discovered. This is typical across many of 
        the villages at DEF CON, including the Aerospace and Healthcare 
        villages. For their part, election technology providers should 
        recognize the value that DEF CON participants can bring to 
        evaluating systems, particularly for systems in development, 
        and actively participate in the village instead of shunning it 
        as unproductive.
    3. Incorporation of vulnerability assessments into the Federal 
        certification process.--Whether vulnerabilities are discovered 
        during CISA's Critical Product Evaluation, at the DEF CON 
        Voting Village, or through other channels, the ability for the 
        Federal certification process to intake those vulnerabilities 
        and work collaboratively to respond to them is critical to 
        deploying mitigations in the field. Currently, the EAC has no 
        formal mechanism to intake reporting from independent third 
        parties regarding voting system vulnerabilities. This leaves 
        the EAC in the dark and unable to respond to discovered 
        vulnerabilities. The certification program must create a 
        process by which it intakes vulnerability reporting for 
        certified systems and works with vendors and election officials 
        to respond. In addition, the certification program must reform 
        its standards development process to nimbly incorporate 
        vulnerability reporting into the feedback loop in order to 
        inform revisions to the VVSG.
    4. Eliminate legal barriers to security research.--Too often, 
        especially in the elections space, security researchers are 
        deterred from testing for or disclosing vulnerabilities due to 
        fear of legal action. Specifically, Section 1201 of the Digital 
        Millennium Copyright Act (DMCA) and the Computer Fraud and 
        Abuse Act present legal risk for security researchers. While 
        the U.S. Copyright Office has added security research 
        exemptions via the triennial rule-making process, the 
        exemptions are too narrow and only temporary. Congress should 
        codify strong security research exemptions for the DMCA into 
        law. Further, Congress should explore similar security research 
        exemptions for the Computer Fraud and Abuse Act, contingent on 
        a good-faith, harm-minimizing research approach and researchers 
        making an attempt to disclose any discovered vulnerabilities.
                               conclusion
    While the progress made in the 4 years between Presidential 
elections was immense, it was only a beginning. Following the 2020 
election, much of election official's energy and attention has turned 
to responding to mis- and disinformation. This is understandable given 
the scope and volume of mis- and disinformation they faced throughout 
2020 and since, but could result in underappreciating the resources or 
attention necessary to improve the security of their systems. In an 
environment where the loser of an election may not accept the result no 
matter the margin of victory, the ability to show the resilience and 
security of the process is more critical than ever. Continuously 
improving security measures, alongside better tools to fight mis- and 
disinformation as it arises, are the keys to building confidence in 
future elections.
    For the foreseeable future, election administrators will be in the 
spotlight, forced to deal with advanced and persistent cyber threats, 
as well as physical threats of violence driven by mis- and 
disinformation targeting our democracy. The spotlight is bright and 
unrelenting, and more must be done to empower election officials with 
the tools to deal with it. The alternative is a world in which the 
hard-won progress of the security and accessibility of our elections is 
a casualty of a caustic political environment driven by greed and a 
thirst for power rather than the higher ideals of our democracy.

    Chairwoman Clarke. I thank you and all of today's witnesses 
for your testimony. I will remind the subcommittee that we will 
each have 5 minutes to question the panel. As I begin, I now 
recognize myself for questions.
    As I said in my opening, if election security means 
anything, it means, No. 1, making sure every voter can cast 
their ballot; and, No. 2, that their ballot will be counted. 
Mr. Rosenberg, you talked about how politicians have exploited 
the perception of low voter confidence as a pretext for laws 
that make voting harder, but not more secure. What do you see 
as the real threat to voter confidence and how has it changed 
since the 2020 election?
    Mr. Rosenberg. Well, thank you for that question, 
Chairwoman Clarke. The real threat we see is the lies. Because 
what happens is the lies create lack of voter confidence. Then 
you have those lawmakers who are intent on suppressing the vote 
of people of color in order to stay in power, using the surveys 
that reflect this so-called lack of public confidence in what 
has been called a feedback loop, that is then used to support, 
to provide justification, they say, for laws. We have seen it 
happen in Georgia, in the passage of S.B. 202, in which, among 
other things, it makes it more difficult to apply for and cast 
absentee ballots at a time when voters of color were using 
absentee ballots more than White voters were using in the 2020 
election. Even prohibiting the provision of food and water to 
people who are waiting in line when it is known that in 
Georgia, for example, Black voters are waiting an average 9 or 
10 times longer in line than are White voters. So, it is those 
kinds of things that we see are the biggest threats.
    Chairwoman Clarke. Well, thank you. Ms. Ramachandran, how 
has this misguided notion of a rigged or stolen election 
actually jeopardized the security of the people and systems 
that run our elections?
    Ms. Ramachandran. Thank you so much for that question, 
Chairwoman Clarke. This Big Lie that has been spread around the 
2020 elections has really endangered our election 
infrastructure in a number of ways.
    One of the primary ways it has endangered our system is 
that it has encouraged and given a boost to this wide-spread 
push for these sham partisan reviews. These sham partisan 
reviews have multiple times resulted in valuable election 
equipment having to be decertified or decommissioned because in 
a legitimate election audit, the ballots and the election 
equipment stay in the custody of the election officials or a 
certified Federal voting system testing laboratory. They are 
not handed over unsupervised to partisan outside contractors. 
Once that happens, then there is a risk that something 
malicious has been inserted into the equipment or that 
something has been done to disrupt it, and that is what has led 
to some of this equipment having to be decommissioned and 
decertified. So, that is a really huge risk that comes from the 
Big Lie, the spread of these partisan reviews.
    Another risk is that all of this disinformation is leading 
to attacks on the election officials and election workers who 
have done such a heroic job in providing us with free and fair 
elections. Those attacks are causing them to be deterred from 
doing their jobs, pushed out, resigning. They are part of our 
election infrastructure. They are the personnel that make the 
system work.
    Then finally, the lie may be leading some small number of 
election officials and workers to actually be susceptible to 
entreaties that they provide unauthorized access to election 
conspiracy theorists. This has happened already a few times in 
some small instances in the United States. I mentioned the one 
in Colorado. There has been some unauthorized access provided 
in Ohio and Michigan, as well.
    Chairwoman Clarke. Well, thank you. Mr. Stamos, you have 
suggested the need for clear Federal authorities around mis- 
and disinformation. I have a bill to do just that, giving CISA 
clear authorities to build on efforts like the Rumor Control 
website. What more do you think CISA could be doing on mis- and 
disinformation?
    Mr. Stamos. Thank you, Chairwoman. I think a key function 
that we need to have somewhere in the Executive branch is the 
ability to understand what kind of misinformation/
disinformation is currently dominating the discussion on-line. 
This is not going to be just around elections. Right? We have 
the same problems around vaccines. If there is a natural 
disaster, we end up with significant disinformation issues. If 
we had a plane crash today, a tragedy, there would be 
conspiracy theories and disinformation being spread. I think 
that is one of the things that Congress should consider is 
where should that capability exist?
    The capability is really just about understanding what is 
going on. But I don't think it is realistic for Health and 
Human Services, the FAA, FEMA, for every part of the Government 
to have a group that can do the kind of deep social media 
analytics that is needed in these kinds of situations, and I 
think CISA is probably the place that you want to at least 
start.
    Chairwoman Clarke. Thank you very much. My time has 
elapsed. I now recognize the Ranking Member of the 
subcommittee, the gentleman from New York, Mr. Garbarino, for 
his questions at this time.
    Mr. Garbarino. Thank you, Chairwoman. I appreciate all the 
witnesses' testimony so far.
    First, I want to start with Mr. Masterson. You have, as we 
have talked about with your bio, you have first-hand experience 
administering elections at the State level. State and local, 
and as you know, State and local election officials play a 
tremendous role in facilitating secure elections. On top of 
this already complex and burdensome responsibility, officials 
in New York are now faced with the difficult task of allowing 
non-citizens to vote, thanks to the new mayor, New York City 
Mayor Eric Adams' decision to grant more than 800,000 non-
citizens the right to vote in municipal elections.
    The New York State constitution is clear. Its citizens are 
the ones who have the right to vote. But my question to you is 
what are your thoughts about allowing non-citizens the right to 
vote in addition to what are your thoughts about how this is 
going to affect the election officials and their ability to do 
their jobs?
    Mr. Masterson. Yes, thank you, Ranking Member. First of 
all, it is important to note that for Federal elections non-
citizens cannot register or vote in Federal elections, which I 
think is appropriate. Any time election officials are presented 
with additional responsibilities that include the use of more 
databases, more registration, separate registration activity, 
that adds a layer of complexity to their work that needs to be 
met both in resourcing and in support. So, any time we talk 
about changes like this and looking at sort-of the risk 
analysis that applies, we have to understand that the benefits 
against what we are asking these election officials to do in an 
increasingly complex environment, that is also made more 
difficult by the constant need to provide factual information 
back out to voters. Right?
    So, as decisions like this are made locally, it is our 
Federal system at work, a deep understanding of what are we 
asking election officials to do, how will they communicate with 
the public, what impact could this have on both the 
administration and confidence in the election process, is 
really, really critical because it is hard work. They have 
little resourcing and they are being asked to do more and more.
    Mr. Garbarino. Yes, and specifically, you know, municipal 
elections, the city council and the mayor only have control 
over the city council, but there are not just city council 
elections. I mean, there are Supreme Court seats that are up 
for election in New York. There are State Court seats, special 
elections to fill State and Congressional seats that are held 
in the off years--in the odd years. So, you know, what are the 
election officials going to have to do? Are they going to have 
to create separate ballots? I mean, what kind of, you know, 
process is this going to do and how confusing can it be?
    Mr. Masterson. Yes, thank you, Ranking Member. I am not 
specifically familiar with all the language in the bill, but 
any time you are asking for sort-of a separate registration 
system, it increases, as you noted correctly, the complexity of 
what databases have to be administered, what the registration 
process looks like, and how you create that separation, and 
then how you are going to create ballots, ballot styles. I 
mean, depending on how the jurisdictions administer elections, 
you are talking about thousands of ballot styles and ensuring 
that the right people get the right ballot styles, all things 
that election officials are used to, but layering on these 
responsibilities is a challenge. When making changes like this, 
understanding the risks that are involved, understanding the 
responsibility and the additional burden that is being placed 
on the administrators is really important, so that they can do 
their job and succeed at it.
    Mr. Garbarino. I appreciate your answer. I know we focus on 
your role as an election official. Now I am going to ask a 
question about your role at the Election Assistance Commission.
    In your report you recommended that Congress reforms the 
EAC and designated CISA as the technical lead for elections, 
which would allow the EAC to focus on its core mission of 
election administration. Can you walk us through how this would 
look in practice?
    Mr. Masterson. Yes. So, I have obviously spent time at both 
agencies and believe deeply in the mission of both agencies, 
the EAC and CISA. Right now what you have is sort-of a muddy 
waters on sort-of the technical responsibilities with the EAC 
administering, for instance, the testing and certification 
program and voting systems, providing guidance through their 
clearinghouse.
    What I would like to see, in order to save valued 
resources, I mean, the EAC is small and has limited resources, 
CISA much larger, but has a huge mission space, is to really 
say, OK, CISA, you are the technical lead. You worry about the 
cybersecurity, the infrastructure, physical security, advice, 
and guidance. You support through the Elections Information 
Sharing and Analysis Center the sharing of threat and risk 
data. EAC, literally, you can now focus on everything else: 
Grant distribution, best practices around things like poll 
worker training, ballot layout. I mean, there is so much more.
    So, CISA has the expertise. CISA is out with the election 
officials providing thousands of assessments, right, throughout 
the year and understands both the maturity, the cybersecurity 
maturity of these offices and the risk framework around them.
    Mr. Garbarino. I appreciate that. I know my time has 
expired, so I will yield back. Thank you, Mr. Masterson.
    Mr. Masterson. Thank you, sir.
    Chairwoman Clarke. Thank you very much, Ranking Member. The 
Chair will now recognize other Members for questions they may 
wish to ask the witnesses. In accordance with the guidelines 
laid out by the Chairman and Ranking Member in their February 3 
colloquy, I will recognize Members in order of seniority, 
alternating between the Majority and the Minority. Members are 
also reminded to unmute themselves when recognized for 
questioning.
    The Chair recognizes for 5 minutes the gentlewoman from 
Texas, Congresswoman Sheila Jackson Lee.
    Ms. Jackson Lee. Madam Chair, if I could be delayed and 
yield to one of the other Members, please.
    Chairwoman Clarke. The gentlelady will yield at this time. 
I now recognize the gentleman from Rhode Island, Congressman 
Langevin, for 5 minutes.
    Mr. Langevin. Thank you, Madam Chair. I want to thank you 
for holding this important hearing. I want to thank our 
witnesses for their testimony and their insights, very helpful. 
If I could, I would like to start with Mr. Masterson.
    Mr. Masterson, in your testimony you suggest a number of 
statutory baselines for State and local election offices and 
election vendors. What is your assessment right now of the 
current technical capacity of relevant State and local 
stakeholders to implement these kinds of cybersecurity 
measures? How can the Federal Government assist to build 
technical capacity where it is needed?
    Mr. Masterson. Yes. Thank you, Representative. Thank you 
for your service and support for cybersecurity work and 
challenging us at CISA throughout the election on the work that 
we are providing and support we are providing election 
officials. I really appreciate it.
    The current state is we have come a long way since 2016 and 
2017 and the declaration of elections as critical 
infrastructure. We see more multi-factor authentication across 
election offices. We see more network segmentation and database 
security access controls in place. That bore out in 2020 with 
the security of the 2020 election.
    But the reality is, as you know, sir, well, this is, you 
know, not something that you ever finish. Right? It is a 
constant and evolving process to secure the systems and on-
going evolving threats.
    So what CISA could do is really reach that last mile, those 
mid-to-small counties that have little to no IT support, that 
are doing the best that they can with the resources they have, 
and really identify, No. 1, those baseline practices, get those 
in place; and then, No. 2, help them respond to emerging 
threats, like we have seen with things like SolarWinds or other 
vulnerabilities. Really push that information out and help them 
mitigate the vulnerabilities that may be present in their 
systems. The way to do that is utilizing their field forces in 
combination with something like Crossfeed, which proactively 
scans and looks for those types of vulnerabilities, so that 
they can alert those jurisdictions you have this, we are here 
to support.
    Mr. Langevin. Very helpful. Thanks for the insights into 
your work at CISA as well.
    To all of our witnesses, I want to just turn to election 
software supply chain, if I could. Again, all of the witnesses, 
what capabilities do State and local entities currently have to 
evaluate the security of the software supply chain and voting 
infrastructure? Are there opportunities for Congress to support 
improvements to those capabilities?
    If we could start with Ms. Ramachandran and then work our 
way down the line, that would be helpful.
    Ms. Ramachandran. Thank you so much for your question. 
Unfortunately, State and local election officials don't have a 
Federal framework for security standards for election vendors 
to rely on to help them ensure that they are choosing vendors 
that are following best practices in terms of supply chain risk 
management. So, one helpful way for Congress to be helpful in 
this would be to either mandate or incentivize rigorous vendor 
security standards.
    For instance, Congress could limit the use of Federal funds 
for elections to those vendors who agree to meet certain 
cybersecurity personnel and supply chain best practices. Those 
could be promulgated by CISA, for instance, with perhaps the 
assistance of the Election Assistance Commission. This would be 
one way to really sort-of help beef up and incentivize the 
choice of good vendors.
    At the same time, States and counties can improve their 
procurement processes, negotiate for contracts in which vendors 
agree to mitigate supply chain risks.
    Mr. Langevin. Thank you. The next witness, if you could----
    Mr. Stamos. Yes. So, I will just say I think the supply 
chain issue is huge overall in cyber right now. I got pulled 
into the SolarWinds investigation. Against an adversary of that 
level, when you have got somebody as skilled as SVR attackers 
who are willing to spend 9 months or a year infiltrating the 
supply chain, I think it is extremely unlikely that we can ask 
either election manufacturers themselves or State and local 
officials to stand up against that level of adversary on their 
own.
    So, I do think there needs to be a real aggressive move on 
collective defense here. I think a ISAC-like model of much more 
aggressive kind of openness by the manufacturers and 
willingness to work with one another and then to work with the 
FBI, CISA, NSA, Cyber Division, and such is going to be 
critical because against attackers like that it is an extremely 
difficult pull.
    Mr. Rosenberg. I defer to Ms. Ramachandran on this issue.
    Mr. Langevin. Thank you.
    Mr. Masterson. Sir, the only other thing I would add is the 
assumption in elections that we shouldn't be reliant on the 
performance of or security of the software and hardware 
counting the votes, which is why paper ballots and post-
election audits are so critical, that we have that check 
precertification to verify the results and to know that the 
votes were counted as cast, and so a continued focus. We have 
seen great improvement. As was noted, 96 percent of votes cast 
in this last election were on auditable paper ballots. A 
continued expansion of the use of those paper ballots and 
auditing them is critical to this.
    Mr. Langevin. Yes, I----
    Chairwoman Clarke. The Chair now recognizes for 5 minutes 
the gentlewoman from Tennessee, Mrs. Harshbarger.
    Mrs. Harshbarger. Thank you, Madam Chair. Thank you 
witnesses here today. This question is for Mr. Masterson.
    You know, numerous polls recently have shown that an 
overwhelming majority of Americans support common-sense 
election security measures, like voter ID laws, including 77 
percent of Black voters, 78 percent of Hispanic voters. And 
many laws because of those things have enacted such laws to 
institute those voter IDs.
    In your view, would Federal legislation that nullifies or 
undermines these popular State election security laws, like 
voter ID, increase or decrease election security, sir?
    Mr. Masterson. Yes. Thank you, Representative. Voter 
confidence, as the research has shown, is a fickle mistress in 
that it is largely dependent on how your candidates faired in 
the prior election. So, for me, legislation, whether at the 
Federal, State, or local level, should be based on, No. 1, what 
information, what data can we provide to voters about the 
process to increase their understanding and confidence in the 
individual security of their vote? No. 2, what do State and 
local election officials need?
    There is a reason and it is appropriate and it is good that 
State and locals run elections, so that they can engage 
directly with voters about the protections they put in place. 
What support, what information do they need in order to secure 
their process and go out and talk directly to their voters 
about the steps that they have taken?
    So, for me, any legislation based in those principles is 
important.
    Mrs. Harshbarger. Yes. Well, you know, cybersecurity, have 
you ever watched the documentary ``Kill Chain'' ?
    Mr. Masterson. Yes.
    Mrs. Harshbarger. OK. Tell me your thoughts on that when he 
delves into voter integrity and cybersecurity world.
    Mr. Masterson. Yes. So, I am no movie critic, so I won't 
weigh in on the cinematic value, but I think ``Kill Chain'' 
and, frankly, work that we did at CISA with the security 
research community raises an important conversation about how 
do we talk about vulnerabilities in critical systems, whether 
that is voter registration, electronic poll books, election 
night reporting, or voting systems? How do we get that 
information in the hands of those who can fix it? Then how do 
we talk to voters about that?
    Then, second, as I mentioned before, what resilience 
measures can we put in place such that if there is actually an 
exploitation of a vulnerability, we are able to recover? We are 
able to maintain the integrity of the process and ensure that 
voters know that their voted was counted as cast. For me, a 
large part of that is post-election audits in the form of paper 
ballots precertification.
    Mrs. Harshbarger. Absolutely. Well, ballot harvesting, what 
are your thoughts on that? Do you think Federal legislation 
that is proposed now that requires unlimited ballot harvesting 
in every State would reduce election integrity and security?
    Mr. Masterson. So, each State has their own requirements, 
as you know, Representative, around how they manage the 
collection and security of ballots. Each State knows what they 
need to do to manage that. So, as I look at the security of our 
ballots, at the security of our votes, ensuring proper chain of 
custody, ensuring proper documentation of that as appropriate.
    With that said, in my home State of Ohio we have had both 
early in-person voting and vote by mail for a number of years. 
The election officials have administered that with integrity 
and security. So, I have confidence in their professionalism, 
the bipartisan nature of the process to do that well.
    Mrs. Harshbarger. Well, you know, at a press conference 
yesterday President Biden did say, he suggested there could be 
problems with the mid-term elections without voting rights 
legislation being passed by the Federal Government. So, 
therefore, you know, basically what he said was it could easily 
be illegitimate in the mid-terms coming up. You know, that 
sends a message now that maybe this won't be done properly with 
these election officials. What are your thoughts on what he 
said?
    Mr. Masterson. Just as in 2020, where the election 
officials heroically performed in the face of a global 
pandemic, record turn-out, and challenges across the board, I 
have full faith and confidence in them. Would hope that nobody 
would use the question of the legitimacy of our elections for 
any, you know, purpose, and understand and work with those 
election officials to understand the steps they take to 
protect, like they did in 2020.
    Mrs. Harshbarger. OK. Well, thank you, sir. Madam Chair, I 
yield back.
    Mr. Masterson. Thank you.
    Chairwoman Clarke. Thank you. The Chair now recognizes for 
5 minutes the gentlewoman from Texas, Ms. Sheila Jackson Lee.
    Ms. Jackson Lee. Thank you very much, Madam Chair. Thank 
you for an important hearing and important statement on the 
importance of voting integrity and security.
    I do my questioning in the backdrop of a tragic and 
unfortunate action on the floor of the U.S. Senate when I think 
those who voted obviously misinterpreted their responsibilities 
in securing democracy. A part of that, of course, is the 
infrastructure. I want to begin the brief time that I have for 
my questions to at least note that the elections representative 
under the past administration clearly made sure that there was 
no fraud in the 2020 election of any sizable amount.
    In addition, there was no fraud of any sizable amount 
indicated by the Republican secretary of state in the State of 
Texas. But yet, we have been the victims of a brutal scheme of 
purging voters, of establishing new crimes in voting, and a 
number of impediments to mail-in voting, impediments to early 
voting. So, even aside from the infrastructure, we are rife 
with the challenges that we would have.
    So, let me indicate for all witnesses, based upon the fatal 
attack on the U.S. Capitol on January 6 that demonstrated the 
very real potential for failed false narratives about stolen or 
rigged elections to incite real-time vigilance, I am sorry, 
violence in the weeks before January 6, former President Trump 
waged an outright, overt disinformation campaign explicitly 
designed to overturn the democratic will of the people.
    To the persons on this panel, how have the events of 
January 6 and corresponding threats of attacks on other State 
capitals or to individual election officials changed the way 
you think about election misinformation? That is obviously 
technology and the Big Lie narrative. How might this narrative 
metastasize over the course of this year and before the 
Presidential election?
    I would appreciate it if, starting with Ms. Gowri 
Ramachandran, if I have it right, starting with you, please, of 
Brennan Center, and then Alex, Ezra.
    Ms. Ramachandran. Thank you so much for that question. It 
is interesting that you note that the misinformation and 
disinformation campaign led to violence on January 6, and asked 
about how it has metastasized. Since January 6, 2021, we have 
seen many election officials also being subject to threats of 
violence, harassment, real physical security risks. When 
Congress was counting the electoral votes on January 6, they 
were, in essence, acting as election administrators, as 
neutrally counting up the votes and declaring--you know, 
certifying the election.
    So, I think it is really a continuous chain of threats of 
physical violence against those who are attempting to respect 
the will of the voters. It really amplifies the need for 
increased physical security protections for election 
administrators.
    Mr. Stamos. You----
    Ms. Jackson Lee. From----
    Mr. Stamos. I am sorry.
    Ms. Jackson Lee. Yes, just proceed. Also emphasize, thank 
you, the issue of disinformation technology that can also be 
threatening. Thank you.
    Mr. Stamos. Yes, Congresswoman. So, something that has 
changed and progressed since January 6 is the actions the major 
platforms took to finally enforce a bunch of rules that were on 
the books, but that were not aggressively enforced before 
January 6 has meant there has been a fracturing of the social 
media landscape upon which these things happen. So, we have a 
really significant growth of alternative platforms that are 
much more radical and that have almost no content moderation at 
all, as well as a move of a lot of this content to point-to-
point messengers, most notably Telegram, which has both kind-of 
small group as well as more amplifying components to it.
    So, the net effect of that is that our ability to 
understand what is going on is actually much reduced versus 
where we were in 2020 because most of these platforms have no 
official way to study them and we don't really have the legal 
frameworks in place to authorize either the Government or 
independent groups like our own to be working on this, which is 
why we have been pushing for transparency legislation that I 
would love for Congress to take up.
    Mr. Rosenberg. I would just add one thing, Congresswoman 
Jackson Lee, and it really has to do with your State of Texas, 
which has this unfortunate history of intimidation against 
people of color when they are voting. S.B. 1, which is Senate 
Bill 1, which was passed this year gives partisan poll watchers 
virtually untrammeled access to polling places that will 
increase the opportunity for that kind of intimidation while, 
at the same time, it criminalizes any obstruction with the 
partisan poll workers by election judges. That, to me, is a 
very serious thing, particularly in light of the events of 
January 6.
    Ms. Jackson Lee. Those are really strong evidences of an 
attack on the election infrastructure and the cyber question, 
and I am grateful to the Chairwoman for this hearing, is out of 
control and will continue to be if we do not, as you have said, 
provide transparency and also some framework for the 
utilization during election periods.
    Chairwoman Clarke. The Chair now recognizes for 5 minutes--
--
    Ms. Jackson Lee. Thank you. I yield back. Thank you.
    Chairwoman Clarke. The Chair now recognizes for 5 minutes 
the gentleman from Georgia, Mr. Clyde.
    Mr. Clyde. Thank you, Madam Chair. The statements that the 
November 2020 election was the most secure an election--a 
secure election in American history, that, in my opinion, is 
the Big Lie.
    You know, that is what we heard in my own State of Georgia, 
but now we are finding out about massive ballot drop box 
stuffing, ballot harvesting happening between 2 a.m. and 5 a.m. 
in the morning. Who takes their ballot down and puts it in the 
drop box between 2 a.m. and 5 a.m. in the morning?
    Where one person has admitted to being paid $45,000 to 
harvest 4,500 ballots. That is $10 a ballot. That is only one 
person. They brought evidence to indicate that over 240 people 
were involved. If they all harvested only 1,000 ballots each 
that would be over 240,000 ballots. The 2020 election is called 
the most secure in American history. No, I am sorry, but that 
is the Big Lie.
    So, I have a couple of questions for you now. Ms. 
Ramachandran, do you believe that photo IDs used to verify 
voter identity increase election security? Just yes or no would 
be fine.
    Ms. Ramachandran. No, I don't believe photo ID is 
necessary.
    Mr. Clyde. So, you don't believe that photo ID increases 
election security. OK, that is fine.
    Mr. Alex Stamos, if you would tell me, do you believe that 
photo ID increases election security?
    Mr. Stamos. It is not really my area, sir. I am sorry, I 
don't have an opinion.
    Mr. Clyde. You don't have an opinion on voter identity, OK. 
All right.
    Mr. Rosenberg, I believe, if I remember correctly, that you 
made a comment in your statement that you called photo ID 
discriminatory against people of color. So, do you believe that 
photo ID increase election integrity or election security, 
i.e., used to verify a voter identity?
    Mr. Rosenberg. Congressman, there is no evidence of in-
person voter fraud, which is the only thing that voter ID 
protects against. In Texas----
    Mr. Clyde. OK. So, just yes or no. Yes or no is my question 
to you.
    Mr. Rosenberg. No, I do not believe it increases security 
because there is no evidence of in-person----
    Mr. Clyde. OK. All right, thank you. So, you are a no.
    Mr. Masterson, do you believe that voter ID increases 
election security by verifying a voter's identity?
    Mr. Masterson. So, each State has their own identification 
requirements for each part of the process, and I trust the 
State and local election officials to understand what they need 
to do.
    Mr. Clyde. OK. So, you don't have an opinion then?
    Mr. Masterson. My--I mean, each State sets it and follows 
it and my opinion is that they understand what their voters 
need and how they have to secure the process for each part of 
the process.
    Mr. Clyde. OK. All right. OK. Well, that definitely tells 
me where each of the witnesses stand when it comes to voter ID. 
You know, we use Government-issued picture ID for many, many 
things to verify exactly who you are. I couldn't fly here 
without showing a valid picture ID to TSA at the airport. In 
fact, even to go eat now in Washington, DC, you have to have a 
valid picture ID and a vaccination card to show who you are and 
the fact that you are vaccinated. The No. 1 thing that our 
Constitution protects, and that is one person, one vote, and, 
you know, for folks not to think that voter ID is important is 
just stunning to me.
    But, Mr. Masterson, during your time at CISA you spent most 
of it speaking directly to State and local election officials 
about their cybersecurity capabilities and what resources they 
need to secure their systems. So, what CISA services had the 
greatest positive effect on election security in your opinion?
    Mr. Masterson. Yes, I appreciate the question, 
Representative. In my opinion, those services that we provide 
at no cost out to those mid-to-small counties, including some 
in your home State, that allow them to identify possible 
vulnerabilities in the systems and mitigate those 
vulnerabilities, so, cyber hygiene scans, penetration testing, 
Crossfeed, those types of services.
    Then the biggest benefit that I think we provided was the 
establishment of an Information Sharing and Analysis Center, 
where all election officials have access to on-going threat and 
risk information.
    Mr. Clyde. OK. Are there any specific services that CISA 
should be looking to expand or end?
    Mr. Masterson. Absolutely. I appreciate that, 
Representative.
    The first is expanding Crossfeed both in scope and scale. 
So, scanning for additional connectivity, including working 
with voting system manufacturers to look on-line if voting 
systems are connected. The second is looking to expand remote 
incident response services and email security. How can they 
help support better email security working with State election 
officials? Because we see email as high-risk and exploited 
often in these mid-to-small counties.
    Mr. Clyde. OK. Thank you very much. I appreciate that. 
Madam Chair, I yield back.
    Chairwoman Clarke. Thank you. The Chair now recognizes for 
5 minutes the gentlewoman from Michigan, Ms. Slotkin.
    Ms. Slotkin. Thank you, Madam Chairwoman. Thanks to all our 
witnesses for joining us.
    The thing I want to talk about is the threats of violence 
to our election officials. That is something that, I am from 
Michigan, it has just been the kind of thing that has really 
infected our electoral process and I fear is actually 
dissuading people for running for clerk, which means people are 
just not going to participate in upholding the democracy.
    So, the example I have here is Tina Barton. She was a 
Republican-elected clerk in Michigan, in one of my bigger 
cities of Rochester Hills. She corrected like a clerical error 
in 2020 on election night. Leaders of her own party claimed 
that there had been wide-spread fraud in Michigan's elections, 
and they tried to pressure her into casting doubt on the 
results of Michigan's election.
    She did the right thing. She literally got on camera and 
refused, publicly rebutting this disinformation. But then like 
the onslaught came. Right? Just by doing that, doing her job, 
her and her husband, who is a sheriff's deputy, began to 
receive death threats. They had to upgrade their own home 
security systems, thousands of dollars. After 8 years of 
serving Rochester Hills, she went on and now she is doing 
bigger and better things at the Election Assistance Commission.
    But she is not alone. We have clerks from Lansing, 
Michigan. Chris Swope, he has received a number of death 
threats. It is just very common. The majority of the clerks in 
my area are Republican, so this isn't like a partisan, you 
know, thing.
    So, I just--I would love maybe, Mr. Masterson, starting 
with you, you have laid out some things that CISA and DOJ can 
do to protect election workers, but just tell us what works. 
Like what actually works to protect the people at the ground 
level who are on the receiving end of this vitriol?
    Mr. Masterson. Yes. Thank you, Representative.
    Accountability works. We need to see those who are 
threatening election officials, their families, workers, 
private industry workers in elections, we need to see them held 
accountable. We have seen surprising little indictments or 
enforcement against these folks. So, it starts with 
accountability.
    Then second, additional resources, allowing these election 
officials, for instance, and judges, law enforcement officers 
get this benefit in many States, but protecting their personal 
information. Right? So, there are laws that could be passed to 
ensure that doxing is at least difficult or hard to do against 
these folks.
    So, those are the two things that I think of immediately 
that would help.
    Ms. Slotkin. Great. Then I think maybe for you and Mr. 
Stamos, you know, I have this--we are all talking about how to 
make sure that our kids know what is real information and what 
is disinformation. I hear all the time from moms like how hard 
it is to tell their kids where they can reliably get 
information and how to teach them. So, I have this--I have a 
bill on digital literacy for kids.
    Again, what works? Like what actually--what are the tools 
that I should be telling moms to use to help their kids, you 
know, tell fact from fiction? Mr. Stamos, do you want to start?
    Mr. Stamos. Sure. So, you know, I mean, for the work I do, 
when we talk about kids, I think a key thing to work with your 
kids is who they are interacting with on-line and to keep kind-
of a presence in their on-line browsing experience. I think 
there is way too many, you know, I am a parent of 3. It is 
really easy for us to give our kids kind-of free range and 
access. That is both risky from kind-of an interpersonal 
perspective and some of the things that happen to kids when 
they run into bad folks on-line, but then also their 
consumption of information. You know, my sons watch a lot of 
YouTube and there are a lot of videos there that aren't so 
accurate, and we have to have discussions about it.
    So, I think just being part of your kid's life and being--
looking over their shoulders is a big thing.
    The other issues really are parents, for those of us in 
this rough age range, and that is when we talk about the 
disinformation around elections and such, there is actually a 
real issue about older folks there. For that I don't have any 
good solutions.
    Ms. Slotkin. Mr. Masterson, any quick comments?
    Mr. Masterson. Yes, just the other thing is establishing 
the trusted sources, the trusted voices. Secretary Benson in 
Michigan has done a tremendous job with this, pushing out 
factual information about the elections. But then we need 
amplifiers, those trusted voices in communities, including 
getting kids involved. We know there are lots of opportunities 
at the State and local level across the United States for kids 
to serve as poll workers or to volunteer, depending on age. So, 
how do we get them into the elections process, into our 
democracy early, so that they can understand how it works, have 
more confidence, and be participants as they reach voting age?
    Ms. Slotkin. Great. Thank you, Madam Chair. My time is up. 
I yield back.
    Chairwoman Clarke. Thank you. With that, I would like to 
thank our expert witnesses for their valuable testimony and the 
Members for your questions today. There is still a lot more to 
unpack in this space. I want to thank the Ranking Member for 
his partnership in, you know, this endeavor.
    Let me just say that the Members of the subcommittee may 
have additional questions for the witnesses. I ask that you 
respond expeditiously and in writing to those questions. The 
Chair reminds Members that the subcommittee record will remain 
open for 10 business days.
    Without objection, the subcommittee today stands adjourned. 
Everyone stay safe and stay healthy.
    [Whereupon, at 3:18 p.m., the subcommittee was adjourned.]

                                 [all]