 Hello, I'm Secretary of State Kim Wyman from Washington State and I want to first say thank you for inviting me to be part of DEF CON 2020 and share a little bit about Washington's experience with vote by mail and the challenges that we have with election security and how we've tried to overcome them and how we're preparing for the upcoming August primary and November general elections here in Washington State. So I'm going to real quick share my screen and walk you through kind of what Washington State has done to prepare for the 2020 election cycle and how we are dealing with all of the things that are coming at us in 2020. So first and foremost I'm pretty certain each one of you has been very aware of Russians trying to hack into the election system in the 2016 elections and I've been an election official for many years and have watched this kind of progression that we've had in the election community for election security and in the 1990s we instituted cutting-edge technology like using the driver's license information to register voters and put election night results online and from that moment to today election security has been something we've been aware of and have worked really hard to try to make sure our systems are secure and I think right up until 2016 most election officials felt pretty good about the level of security that we had in our industry and today what I want to do is share with you kind of what a Washington State's election system looks like how we inspire public confidence in our process and what our kind of triad of election security is and then talk a little bit about the impacts of COVID-19 on our election system and quite frankly the nation's election system. So I got into election administration in the 1990s, early 1990s and I can tell you when I started in this field my goal was to become an elections expert to learn and understand how the election process works and to be able to conduct elections in a secure and accessible manner and then the 2000s that evolved because suddenly the demands on our system were so great that we had to rely on technology to be able to produce election results quickly and to serve our voters well by providing a lot of information on the internet so we now suddenly not only had to become an elections expert but also had to be an IT expert and understand at least how systems work and how to use technology in a way to help us oversee our election systems and about the time I started feeling like I knew what I was doing in the IT world and I say that because I'm just dangerous enough to know how to use technology but certainly not to any of the levels that any of you are but by 2016 it became very apparent that not only did we need to be election experts and understand IT systems but we needed to know how to secure them and cybersecurity for the last four years has certainly been front and center in election administration so let me start kind of with the the basics of why I think the United States election system is very secure just because of the decentralized nature of it so when people think of elections I think oftentimes they think of the national that there's some sort of national election administration when in fact it's a really decentralized network made up of 10,000 election officials nationwide who like me are either appointed or are elected to office they take an oath to uphold the constitution and the constitution and laws in their state and I think the overall strength of this system is that no single person or group has total control of the overall operation well and so when you you get down to election systems in each individual state and I bear with me here I'm having a challenge operating my own PowerPoint system you have the same similar threads we have a decentralized system here in Washington and each state is going to be different and unique and Washington is certainly one of five vote by mail states but I think you can look at the the individual makeup of each state and know that this decentralization is actually happening within the states as well so here in Washington we have the secretary of state myself my office is the overseer of elections in Washington and I'm the chief election officer I have the rulemaking authority to put into put into effect rules that adapt our laws that our legislature passes so this is how counties implement the day-to-day operations on the ground we manage a statewide voter registration database and oversee the election initiative and referendum process as well as do election night reporting we do voter outreach and education and we certify and train our election officials as well as the election tabulation systems that are used in each of our 39 counties our system is decentralized in that 39 county election officials are the chief election officials in their county and they are elected they oversee the voter registration processing and the management of elections in their counties so they're the ones who are actually issuing ballots and operating the tabulation systems and any kind of other tech like ballot sorting equipment or the actual facilities that process ballots they also provide voter outreach and education to their voters and manage all of that information usually through social media and their web pages now I imagine most of you are aware that in 2016 the federal government designated elections as critical infrastructure and this is significant because it put us on the same national security level as the power grid or the banking system and so what it has done in our state it is really helped us reinforce what I like to think of as our triad of security for Washington and our vote by mail system I forgot to mention that earlier in 2011 Washington state became a vote by mail state and at that point every single one of our counties had had to conduct elections entirely by mail and mail out a ballot to each of their voters so this process didn't happen overnight we really started back in the 1990s and in allowing any voter to be a permanent absentee voter which meant they received a ballot every election and that evolved to the early 2000s when we had the closest governor's race in the country's history and following that and following a lot of things that went wrong both at the polling place and in the absentee balloting we determined that we couldn't do both elections well and the legislature allowed counties to move to vote by mail voluntarily in 2005 many of the counties in the state did move to vote by mail but it still took our state five years to completely become a vote by mail state and that's because it took time to get the equipment and facilities to really provide for processes and procedures that we could conduct elections well so which is what leads us to the triad of security for Washington vote by mail elections so there's three real pieces to this this election model it's the physical security the logical security things you would just do innately and the digital security that we provide so let me start by just talking through kind of the physical security elements that are inherent in a vote by mail election first and foremost I think the strength is that we are we rely on paper ballots even the ballots that are issued in a vote center and voters use to use an assistive device to vote them all of those ballots are paper ballots that are printed by those machines that the voter actually does mark and our process so we can always go back to those paper ballots and do a risk limiting audit or a full recount if we need to to really inspire that confidence that voters need to have in the election results we have ballot drop boxes here in Washington state in addition to the the blue mail boxes provided by the usps these ballot drop boxes are throughout the state and they're managed by our county election officials they we have about 470 of them statewide and they open at the beginning of the voting period which is 20 days before election day anytime they are emptied they are emptied by two employees of the county and I know that sometimes they try to have that be a democrat and a republican when when possible but they are staffed by they are they are staffed that are employed by the county and take a note to uphold the laws and the procedures and policies for the county so they are held accountable for that processing they seal they lock and seal those boxes and they do that with individual numbers numbered seals that are actually logged and kept track of two so pretty much all of the steps I'm going to talk about are what we use to build an electronic and physical audit trail that we have in place in case we ever get into a recount or a situation where anyone is calling into question our processes we can go back and show which employees had access to which ballots at any given time and we have dual control environments throughout this so it's it's just really important that those audit logs and dual controls are in place to inspire confidence again this is true throughout all of our election processing facilities as well we have secured storage for ballots and ballot materials that involve physical locks in some of our counties it may be keycard access servers the server room for example for ballot tabulation equipment is in a secured room and has very limited access and again is log or keycard controlled so we have a record of anyone who has access to it and then we have security systems and keycard access throughout these facilities as well to just have that physical layer of security on top of any cyber security elements that we have in place the second I guess group of security measures are those sort of logical ones things that just make sense of course the first one would be that our tabulation systems aren't connected to the internet and I know this is something that came under fire in the last few years nationally but our county election officials have made sure that their tabulation systems not only are air gapped from the internet in every way but there's no modems operating or even installed in those systems and that any connection that needs to be made with the vendor or with with election officials is done onsite in that air gapped environment we we have a real love of transparency in elections and certainly that was true in any processing facilities or courthouses across our state that all of the activities are observable we we like it when it's bipartisan when we have democrats and republicans overseeing that process we actually asked the local county parties to appoint observers to come in and represent each of the parties if that can happen and of course in the COVID-19 environment that's becoming a bit of a problem for just space reasons our county courthouses oftentimes do not have a lot of extra space in the smaller counties so a lot of counties have used their security money to install cameras that run 24 7 during the voting period during that entire 20 days and then the 20 days or so after when we're certifying the election so that people can watch it online from safety and comfort at their home but also have that transparency so you can show that we're not we're not trying to hide anything or do anything uh kind of under the table um ballot reconciliation is a really important part as well um this would be you know counting the number of ballots that are received each day in the mail and then through the process reconciling them and being able to show whether a ballot was counted that was issued to a voter or not and if it wasn't counted why it wasn't and the only people that can reject a ballot are our bipartisan canvassing boards uh we also have um election night reporting and we have failsafe measures and and checks and balances that my CISO told me to to say is out of band communication verification and what we do on election night is counties are uploading their results to our state election night reporting system and we compile those results for offices that go across county lines and we take that initial file that they send us and then we verify it by a fax or an email that is sent by the county as well separately to just make sure that the information that we're putting up online is accurate and is the way that the county's reported it in the first place so all of these systems you know this logical element of our election security is really just trying to create that sense of transparency and provide a lot of checks and balances both physical and electronic that makes sense and are easy to explain to the average voter so that they can understand what it is we're doing of course the final leg of that uh that try that uh stool would be the digital security and for us we we really started working on this probably five ten years ago by modernizing our election system and now we have a highly segmented network system that employs multi factor authentication for all of our users we have um really tried to to increase and expand our user training and um outreach to just make them aware of cyber security issues and things that they need to do to make sure our overall system is secure and we've done robust testing and that happens on an ongoing basis and as as all of you are aware you know it's it's a constant battle to stay ahead of of hackers and people trying to get into our system so I think just that user awareness has increased in the last four years on a level on a scale that we just weren't doing before 2016 we're currently part of the national sensor network and this is not only the state system but counties across the state are part of it as well and we we built and have created a dedicated um election security operation center that is in my office but it also supports the 39 county election offices because what we found is that many of the smaller and medium sized counties are lucky if they have an IT professional for their entire county let alone in their their elections division and let alone a cyber security expert so um this partnership has also helped us have good communication and training with those election officials and do assessments in their counties that help them strengthen their system as well we also played an active role in the critical infrastructure build out of the election sector so these are all kind of the the key parts of of our system and I think that critical infrastructure designation also allowed us to create partnerships with our own state SISO and CIO but also our Washington National Guard who is a very strong cyber security team and they've come in and done assessments and monitor our system and and give us feedback and ways to improve our system they've also helped us do tabletop exercises and trainings for our users which again just continues to raise the awareness level and prepare to solve the level of our election officials we've worked with them also to build out our continuity of operation plans which have obviously a digital component to in the security of our system but also how are we going to not only detect and and defend our system or protect and defend our system but how are we going to detect an intrusion and recover and respond in case that does happen we've also worked with the state auditor's office department of homeland security and the FBI with similar threats to those activities so we've been focusing on all of this for the last four years pretty intently and as if that wasn't enough in early in the early part of this year we had to throw in a global pandemic because you know why not so what Washington was in the middle of our presidential primary when COVID-19 began to spike and we started having the first deaths in the country actually for COVID-19 and it did affect and impact our March 10th presidential primary we were on track to have turnout of about 60% and the weekend right before election day was when COVID really started spiking and the governor started to issue stay-at-home orders so we ended up with a turnout of 49% and I think we're running about the third highest in the country for presidential primary turnout and a lot of that has to do with vote by mail because our our voters were still able to drop ballots off and didn't have to go into a polling place or vote center on election day we've seen of course across the country presidential primaries canceled or postponed there has been incredible interest nationally on vote by mail and I've given many many talks and been on panels and and talk to media about our experience here in Washington and what I can tell you is that that our state is well we're implementing a primary right now our regular primary is on August 4th so we'll be in the middle of of the we're right in the middle of processing ballots for that election and certifying it and of course we're gearing up for the general election and my colleagues across the country are doing the same in their states trying to expand absentee voting or vote by mail as best they can because congress hasn't allocated money and as if that wasn't enough you know the usps is in financial distress and congress has just allocated an additional 10 billion dollars of potential loans so we're hoping that they they remain stable between now and november i think they're going to but the usps is a critical element for elections this year across the country because so many elections offices are expanding voting by mail to give you kind of perspective of how significant this is if you look at this map the states in blue are the states at the end of 2019 we're already vote by mail including washington oregon utah colorado and hawaii as you can see as you move east in the country fewer and fewer states either are vote by mail or even have access to absentee voting and so the grayer or the wider the states as you move east those are going to be the states that have the hardest time moving to expanded absentee usage and vote by mail because they don't have the systems in place high-speed ballot sorters envelope openers even just the physical space to socially distance and process those ballots as efficiently as we can here in washington or the other four states that do vote by mail elections so um we're we're trying to help those states gear up and they're working very hard to expand that capacity and capability and i think you're going to see a hybrid model across the country including my state here in washington of um voting at home and voting um in person because even here in washington one to two percent of our voters will vote in person so so it's going to be a heavy lift but election officials are working hard to make sure it's going to happen and in that environment of course we introduce the politics and uh it's bipartisan i like to talk about these things in terms of bipartisanship but we have republicans on on the right certainly the president and senator mcconnell and some of their associates who are concerned about voter fraud and on the left we have members of congress like senator widen and senator klobuchar who are really trying to expand vote by mail access and voting at home and and unfortunately out of the white house and department of justice we're hearing about voter fraud on a level that is implying and his point blank said that there's going to be rampant fraud and vote rigging and you know this is the environment that election officials are operating in and trying to inspire confidence in and so i say that because um we're seeing success stories already in in the primaries that have been held in the last month or so i think kentucky is a great example of um the innovation that that election officials are trying to bring to the covid environment and make voting the same experience with a lot of other persons all of them um so you can see in these pictures these are things that happen on election day in kentucky they have a huge supportage as we have seen across the country uh election workers because many of our election workers are senior citizens for the last month for 2019 so they have a lot of life is making these mega polling centers and i think this was right in their uh right in the next room i see in that next room right here in noxington uh i believe it's where these pictures are uh when they made massive uh noxenters before they come and socially distance and receive their votes and they were able to process these as well um the other thing of course is i was talking about is election officials they have a lot of offices throughout the state that are that are service daily by a lot of offices so um you know what we're really trying to do right now here in what i know we're doing here in washington i think what we're trying to do across the country is provide voters options and make sure that those are secure options that i can believe in and try to inspire confidence in elections and so i think with the the biggest thing i'm concerned with is all of the arts and charter about voters in russia if you don't have either russia vote i mean complete poll site voting um is uh really dealing with the misinformation and disinformation that are out there um not only from the president or from members of congress or whoever but you know from foreign actors like russia uh we have a national movement or national movement national hashtag trusted info 2020 and what we're really trying to do is drive um voters to trusted sources like secretaries of state offices or county election departments or local election departments that are going to provide info that you can believe in and know is true and uh you know different jurisdictions have different other hashtags and taglines like ours is the vote starts with you and really trying to empower voters to um to to know where to go to get information on social media and uh online so some of the security measures and practices we've implemented here in washington state i'm sorry that we can't be together in person but i i guess i want to leave me all with uh a sense uh for all of the work that you're doing to try to find the vulnerabilities in election cyber security and giving us feedback so we can make the system better i i think as i looked back a few years ago to uh to see early back on voting measures uh where you know you are pointing out some pretty bad things and i think that it was it was difficult for election officials like myself to hear and are a major reaction to push back and say we're wrong and what i love about datacom now and what i understand more is that we're to work together and we need to um help us find those vulnerabilities and give us some help in the insecure election system because at the end of all of this no matter where we are in the political spectrum no matter what job we have in this process we need to inspire confidence in the public that our elections are accessible and secure and that the election results are fair and accurate and we look forward to working with you in the future i hope in 2021 that that you'll invite me back to uh to death gone and we can have these conversations in person but feel free to reach out to me uh the Secretary of State's office and uh here in Washington uh my email address because this is certain fashion probably put to the script it was kim dot wyman that's k-o-m dot w-y-m-a-n m-a-n at s-o-s dot law dot gov s-o-s dot w-a-n dot g-o-v so thank you so much for giving me time at the conference i hope you have a great conference remotely and we hopefully can be all together next year so take care