 Thanks for coming in everybody. This is ambassador Doug Luth the most recent US ambassador to NATO He would have loved to attend, but I think slipped a disk in his back and couldn't get on the plane So he's he's talking to us from his home in Washington So without further ado, I will put the microphone down Our houses down now. Yeah Okay, we should probably stop right here and consider this success Look Thanks. First of all for gathering today. I have to apologize I'm in Arlington, Virginia could not make the trip to Def Con this year Although I was very much looking forward to it So this has to pass for my opportunity to share some time with you Jake mentioned that I most recently served as US ambassador to NATO in Brussels for the last three and a half years But actually I've spent my entire adult life in the national security arena I served in Europe as an army officer during the Cold War in the Balkans in the mid 1990s In the Middle East and South Asia since 9-11 I've served in the Pentagon in the White House and most recently at NATO headquarters in short I've studied national security issues my entire life beginning at West Point Through my army career my time at the White House and with a degree at Harvard So you might ask what why am I piped in to Def Con? What am I doing talking to you this audience of cybersecurity experts? I have really just one simple main point and that is that last year's attacks on the American voting process are as serious a threat to our democracy as Any I have seen in over 40 years The attacks last year may prove to be more serious than any physical attack But the core of our nation Now physical attacks obviously incur loss of life Damage to material and those losses are tragic But ultimately America is a rich strong country we can recover from those attacks. We're resilient However, if we were to lose confidence in the security of our voting process The voting process this most fundamental link between the American citizen and His and her government if we lost confidence in that The damage could be much more severe In short in my view as a national security guy This is a serious national security issue Now my remarks this afternoon are not about what happened last year I think you've heard other speakers talk about that you've read about this and I frankly think that the forensics on last year's Russian attacks Will come fully to light by way of the several investigations that are currently underway And I think frankly we should have confidence That the investigations in the Senate and with the special Consul will bring out the facts But some things are already clear While these investigations are underway first of all Russia tried to influence the election outcome in favor of one candidate and Second at a very minimum Putin tried to discredit the process he tried to discredit the election outcome by casting doubt on its legitimacy on its credibility So why is this so serious? Why should we act now? I've got essentially five points And let me run through these five and then I hope we have a bit of time for questions So first of all, this is a serious national security issue Because Putin has demonstrated Successfully that he can use cyber tools against the US election process This is not academic theory This is not hypothetical It is real He influenced our election process He cast doubt on our democracy and he has gridlocked Washington DC at a very low cost to Russia Now in military terms if you go to the military dictionary, there's actually a very clear definition of what constitutes a threat And what that definition says is that a threat has two components There must be a capability and There must be intent so a threat is capability plus intent and Russia's attack last year meets very clearly that Dictionary definition So this is a proven credible threat. And that's the first reason that we have to take this seriously second This is a national security issue because Russia is not going away Putin himself Can be in office until 2029 2029 Even when he is replaced someday any Russian successor leader Would likely use similar tactics To inflame Russian nationalism that is to cause Russians to rally around the flag and To weaken international opponents especially if they could do it at such low cost Why would Russia do this? What are Putin's objectives once he actually up to I want to get into this in a bit of detail here So let me spend a couple minutes on this question. What is Putin up to? Very simply the Russian experts. I know and have worked with a Believe that he has one overriding objective and that is simply to stay in power atop the Russian state But he knows that in the long run he has a very weak hand Russia is a state in steady decline Decline economically. It's a single resource economy oil and gas It produces nothing else that anybody else wants to buy It's in decline by way of all health indicators By way of demographics By way of all political social indicators Russia is a state in decline So in order to stay in control of such a state Putin centralizes power very narrowly around himself and he plays to a few key supporters the Russian military The intelligence services at a relatively small set of Russian oligarchs the very rich Meanwhile, he suppresses all internal opposition. He inflames Russian nationalism Russian pride The Russian sense of greatness the Russian sense of being victimized over the last 25 years after the fall of the Soviet Union if You are Putin and you'll want to stay in power you eliminate internal opposition And if you don't have a real external enemy you're create one and that is exactly what he has done This is all to stay in power Now beyond staying in power himself. He has other objectives not as primary as staying in power, but closely related He also wants to create a geographic buffer zone around Russian This buffer zone be a friendly or at least weak and compliant countries along Russia's periphery This is why he invaded Georgia in The Caucasus in 2008 and why he still occupies Georgian territory This is why he sees the Crimean Peninsula from Ukraine and 2014 just three years ago. This is why he continues to this day To destabilize eastern Ukraine by sponsoring proxy militias Providing military support and so forth all of this activity on his border on his periphery is To destabilize these neighbors so that they will not lean towards the West They will not lean towards the European Union or Towards NATO Because if Georgia or Ukraine were successful as democracies Integrated into the EU and NATO that example would be disastrous for poop It would be an example to the Russian people that they don't have to live in a state of decline That there is greater opportunity if their next-door neighbors demonstrate this opportunity Russia would be at risk Putin would be at risk Russians would essentially ask why not us and Putin will not tolerate that question and then finally Putin has even broader objectives He would like to take advantage of any opportunity to crack the solidarity the cohesion of the West that is the cohesion of The Atlantic Alliance NATO the cohesion of the European Union and ultimately the cohesion of the United States as a member of NATO and As a partner of the European Union He wants the sanctions imposed by the European Union in the US to end These sanctions are an insult to him and they're further weakening his already weak economy He will try to divide the West create cracks fissures He rode cohesion That's why he conducts large military exercises on the borders of NATO While he sort of rattles his military saber even with nuclear threats That's why he supported Marie Le Pen and her party in the French elections Just a couple months ago and that's fundamentally why he tried to interfere with US elections last year He is very pleased He is very pleased today that the White House is in snarl in this controversy In snarl by this issue that Washington is all gridlocked By the controversy that he promoted if he can weaken the West at low cost He sees himself as strengthening Russia and he will do so every single time So when I say that Russia is not going away I mean that Russian leaders will continue to centralize power and do what they can to stand power They will continue to weaken their next-door neighbors and they will take every opportunity To crack the cohesion of the West So the Russian threat is real and it's here to stay even beyond the person of Vladimir Putin Now the third reason that election security here in the States Should be a national security issue is because other states are watching If Russia can attack the US election and others are saying so can we think here of Iran North Korea even non-state actors like the so-called Islamic State and perhaps others So others are watching The fourth reason out of five that this is a national security issue is because our next election the 2018 off-cycle elections and the 2020 presidential elections are actually just around the corner and These will be lucrative targets to any cyber opponent Time is actually quite short To repair our vulnerabilities. We have to have a sense of urgency Now and that's one of the messages that we're trying to communicate with our partners. They're at DEF CON this week this sets of urgency and Finally fifth and finally this is a national security issue because other Democracies beyond the United States are also vulnerable Putin tried to vote quote unquote. He tried to vote in the US elections last fall He voted in favor of one party in the French elections just a couple months ago He will likely try to vote in the German elections in several months now Earlier past years. He has voted in Georgia Ukraine and Montenegro So this is a threat to the United States. This is United States national security issue But beyond us alone It's a national security issue because friends and allies are also under threat. So for these five reasons The security the US election process is a top National security issue And that's what brings me to DEF CON this afternoon. Now look I'm not the expert on securing on how to secure our voting process But there are well established in that room with you today and elsewhere around DEF CON in the community There are well established experts on what needs to be done in particular I would point to two nonprofit efforts of verified voting and the Center for Internet Security as providing standards and well thought out well reasoned a Remedial steps that need to be taken to ensure we never have a repeat of last fall the good news here Despite all that sort of bleak Outlook the good news here is that we actually know what needs to be done to secure our 50 states and the over 6,000 Voting jurisdictions around the country one of the challenges of course is that we do have so many Points of entry so many potential vulnerabilities It is now time-helping in my view To elevate this issue to the level of a national campaign a National campaign that is bipartisan or frankly non-partisan I've served under presidential administrations of both parties George Bush hired me into his White House in 2007 Barack Obama invited me to stay in 2009 I'm about as bipartisan and non-partisan as one can be This campaign needs to have that same feature. This is not about which party was attacked or which party Be vulnerable or which benefit this is about our American election process and the very foundation of our democracy It is the fundamental link Just think about it is the fundamental link between everyone who lines up on voting day and cast his ballot his or her ballot and His role in the democracy and the elected government officials that follow That fundamental lean is under assault So look for over 40 years as a military officer as a government official I didn't even line up to vote. I voted by absentee ballot From wherever I was stationed around the world. I filled out the ballot. I sealed it I signed it and I assumed that when I mailed it that voting security Was somebody else's job? Someone else was going to take care of this. I frankly didn't worry about I Felt that my ballot when I posted it in the mail was secure After last year's experience I Don't feel that way anymore I'm convinced that I personally as a citizen have to get involved in this and I am involved in this and I hope you will come to a similar conclusion and that you will join this effort either as technical experts Committed to finding good remedies and appropriate safeguards or simply as Concerned citizens Let's get involved Let's get this fixed Look, I'm happy now to take your questions and I hope that we could actually engineer that with this sort of Video connection. So thanks. Sorry Jacqueline Yeah, this is a this very fundamental question that was at the centerpiece of my Work at NATO beginning 2013 Let me take you back a little bit and give you a little context So NATO came into being in 1949 and the key clause in the treaty that brought those original 12 allies together is article five. It's the fifth paragraph, right? And basically it says an attack on one is an attack on all and the treaty defines an attack Which gets to this question as an armed attack and of course in 1949 four years after the end of World War two Everybody knew what armed attack looked like persisted all the way up to 2014 and at a summit with Barack Obama in the chair the then 28 allies Updated the Washington treaty by way of a policy decision and what they decided was that NATO will treat the 1949 language now that usually followed what kind of cyber attack So did the cyber attack on the United States last year for example, or the cyber attack on Estonia in 2007 Georgian 2008 or where Ukraine repeatedly over the last couple years do those constitute Article five and therefore a NATO response NATO left it ambiguous And not well defined and the idea here was wanted to be on the record a signaling that Cyber could trigger the treaty And a response it wanted to be ambiguous about exactly where that wanted to be ambiguous in terms of the nature of NATO's response So NATO has not taken the decision that cyber attacks will be responded to by cyber responses Uh, so ambiguity in the sense of signaling to potential opponents That first of all you can't get away with a cyber attack Kind of impact and an armed attack might have and that second that feels certain about how NATO exactly will respond Well, first of all, uh, I mean I take it by the question that you like me think that this will be a challenge and that there will be partisan politics um That some try to play On this issue. I mean you have only to look at the other contentious issues in um in terms of updating our democracy voting districts partisan um candidate selection partisan campaign financing Limits very partisan, right? So there are other issues underway. There are other initiatives underway all of which have drawn partisan fire in terms of The pros and cons the winners and the losers on those issues the reason I think there's a shot here for this issue the election of our voting system to be nonpartisan or bipartisan is because of the national security act It's really only by way of the sorts of assaults that we saw last year That an outside hypocrisy from inside all those other issues districts candidates financing Term limits those are all internal issues russia doesn't get to vote on those issues And our system will deal with those issues and they will draw partisan pros and cons This one though our voting system security I think has the potential to rise above that partisanship And that's why in my remarks I emphasize over and over and over again that this is a national security issue national security typically Over the long history of our democracy has been a bipartisan issue. So that's that's my hope, but I take your It's a very partisan atmosphere. Now. This is another tool in putin's kit bag, right in his toolbox And again, he can do this Sometimes with fingerprints and sometimes not for attribution He can do it at scale. It's relatively inexpensive Use especially modern social media platforms To amplify these messages. I mean if you think back to the time that you know sort of The the media post-war post-war war two period 1950s and 60s You're at russia at that time russia leaders at that time tried to influence western election campaigns But they had to do it with you know Communist parties and those countries and posters and pamphlets and flyers and so forth, right? Well, consider the difference today where bots and social media And disinformation misinformation gets flooded onto our airplanes. So this is a big challenge. Don't list this Uh as the same national security level challenge as that there is a rush of attempt It influenced the way of this ass Uh misinformation campaigning So for me and this is as much a personal judgment as anything else I still have confidence in the american public's ability to discriminate distinguish between real news and fake news And to be a pretty sophisticated consumer of news um, I think right now is flooded with misinformation and and Disinformation and I think social media platforms amplify that. So it's it's a challenge I think it's more difficult today to get the facts because there are so many Contrary facts or competing facts quote unquote If you will uh in opposition But fundamentally, I believe that Americans can distinguish the reason I separate that challenge from the voting security challenge Is because if the voting process if the security of the voting process is believed to be Sacrificed Jeopardy what I'm concerned about is that Americans could draw the conclusion that their vote no longer counts And then draw implications. It's not worth going To the polls. It's not worth bothering. It's not worth paying attention to election campaigns um And and at that link Between the voter his or her elected officials is broken I'm not sure how you repair it So there is a line that's crossed if the credibility process Is compromise. So for me, it's a different Intelligence So look, um, like most things in life, uh, the track record here is not clean cut And I'm not suggesting By way of my pointed and maybe even passionate remarks about what happened to us I'm not suggesting that our track record is clean as you go back into history Um, what I am suggesting is that this assault last year Is the first serious assault at the heart of our election process And because we have another election in 18 months And one after that in 2020 That we don't have much of forensics on this and view the history Before we actually take the practical steps required To repair the vulnerabilities. So reader of history as well history that all americans should Take a moment to think about but this country is not perfect We made mistakes in the past But this would be a mistake of huge historic proportions If we imagine this threat is so corrupted That we break the confidence of the american people in the full progress process of democracy That's what's at risk here And the process has been at such a risk ever in the over 200 years of american voting The voting asking me for a personal view. I'm no longer in the government if you're asking me for a personal view I think it's really outside power to try to manipulate or Delegitimize to the extent that we can uh attribute The the leader the specific individuals or organizations within the russian government That are responsible for last year's activities against us Then those should be included and and some of those are included in the current sanctions regime But if this situation becomes more clear And we can further attribute then obviously those organizations or individuals should be added Meanwhile, what else can we do? Well, first of all, we should do exactly what we've been talking about for the last hour here We should become a much harder target right now, uh in Look classic military terms. We're a soft target The american election system is a soft target. Why because we're still operating voting machines connected to the internet We're still in some jurisdictions Conducting elections without the ability to Audit them by way of a paper audit trail We still have voter registry databases hanging on the internet and everybody there Obviously knows how vulnerable those databases are so what happens when? um, we Just talk about this for the next 18 months or 36 months and then it happens again And and so I think much of what we've talked about and I think but the voting the voting as I recall the voting village I think it's called. Sorry. I'm not voting village What that's all about Is simply to take this thing seriously this threat seriously So we obviously should do that And then the other thing we should do is as much as possible Share with like-minded democracies a conversation not only among ourselves And sharing information among the 50 states Among the secretaries of state Typically the senior voting officials in every one of our 50 states, but also down to the individual jurisdictions So we have to do that sharing internally, but we should share information Externally internationally as well So for example a good example of this is that the u.s. Intelligence community When it reached its conclusion last fall After the russian activities came to nato headquarters and brief all 27 other uh down to the russian activity That's a good example the kind of sharing that we should have them around the world Because as I mentioned in my in my remarks, we have a responsibility to fix us We have a we have an at-home responsibility But we also as a leading democracy have a responsibility beyond that to be the standard bears For other democracies many of which are not as wealthy not as well off And not as historically grounded as ours So there's a big responsibility here to get this right for us But to get it right as the standard bears for democracies around the world Not the technical expert here, and I'm sure there may be others in the room Perhaps representatives of the department of homeland security who ultimately has federal responsibility To assist the states And local authorities And this assistance can come in number of forms. I mean first of all it can come by way of funding assistance And for a relatively modest amount of federal funding We could do away with these vulnerable electronic machines A modest funding for modest funding from the federal government. We could mandate Or make possible a paper audit trail for every election Which assures us that the outcome is credible and responsible We should and DHS homeland security has taken a decision that among other critical infrastructure systems around the country So nuclear power plants electrical power grids our financial infrastructure. There's a whole set of There's a whole set of critical infrastructure that our voting systems are among those. That's a good step And what that means is that federal funding is available to help state and local jurisdiction voting officials A big thing that could be done here and here. I think the center for internet security is is a very credible voice Is to share information on tactics techniques procedures and threats That the even the smallest voting district And all 50 of the states are subject to so there's a combination of setting standards Sharing information providing funding all of which fall Directly into the basket of DHS. So I think there are probably some DHS officials there who would Who would agree now my understanding of the experience last fall Or last year during our election cycle is that DHS the federal government in some instances offered assistance Only to be turned down I think this is a two-way street. This is this is on the one hand The potential of the federal government to help this is what's so important organizations like DEF CON cool authorities Who are not paying as close attention to this and may not be as connected To the to the internet and voting systems Riding along the internet that those systems that those players below the federal level Become more aware and be open and welcoming to federal support So this has got to be a two-way street and and by the way that goes back to the fundamental point that this campaign Needs to be national and it needs to be bipartisan We need to do this as americans For america and that's probably a point on which to end