[House Hearing, 116 Congress]
[From the U.S. Government Publishing Office]



 
   SECURE, SAFE, AND AUDITABLE: PROTECTING THE INTEGRITY OF THE 2020 
                               ELECTIONS

=======================================================================

                                HEARING

                               before the

                            SUBCOMMITTEE ON
                     CYBERSECURITY, INFRASTRUCTURE
                       PROTECTION, AND INNOVATION

                                 of the

                     COMMITTEE ON HOMELAND SECURITY
                        HOUSE OF REPRESENTATIVES

                     ONE HUNDRED SIXTEENTH CONGRESS

                             SECOND SESSION

                               __________

                             AUGUST 4, 2020

                               __________

                           Serial No. 116-81

                               __________

       Printed for the use of the Committee on Homeland Security
                                     


[GRAPHIC(S) NOT AVAILABLE IN TIFF FORMAT] 

                                     

        Available via the World Wide Web: http://www.govinfo.gov
        

                               __________
                               
                               
                 U.S. GOVERNMENT PUBLISHING OFFICE 
43-954 PDF               WASHINGTON : 2021                                
                               
                               

                     COMMITTEE ON HOMELAND SECURITY

               Bennie G. Thompson, Mississippi, Chairman
Sheila Jackson Lee, Texas            Mike Rogers, Alabama
James R. Langevin, Rhode Island      Peter T. King, New York
Cedric L. Richmond, Louisiana        Michael T. McCaul, Texas
Donald M. Payne, Jr., New Jersey     John Katko, New York
Kathleen M. Rice, New York           Mark Walker, North Carolina
J. Luis Correa, California           Clay Higgins, Louisiana
Xochitl Torres Small, New Mexico     Debbie Lesko, Arizona
Max Rose, New York                   Mark Green, Tennessee
Lauren Underwood, Illinois           John Joyce, Pennsylvania
Elissa Slotkin, Michigan             Dan Crenshaw, Texas
Emanuel Cleaver, Missouri            Michael Guest, Mississippi
Al Green, Texas                      Dan Bishop, North Carolina
Yvette D. Clarke, New York           Jefferson Van Drew, Texas
Dina Titus, Nevada                   Mike Garcia, California
Bonnie Watson Coleman, New Jersey
Nanette Diaz Barragan, California
Val Butler Demings, Florida
                       Hope Goins, Staff Director
                 Chris Vieson, Minority Staff Director
                                 ------                                

     SUBCOMMITTEE ON CYBERSECURITY, INFRASTRUCTURE PROTECTION, AND 
                               INNOVATION

                Cedric L. Richmond, Louisiana, Chairman
Sheila Jackson Lee, Texas            John Katko, New York, Ranking 
James R. Langevin, Rhode Island          Member
Kathleen M. Rice, New York           Mark Walker, North Carolina
Lauren Underwood, Illinois           Mark Green, Tennessee
Elissa Slotkin, Michigan             John Joyce, Pennsylvania
Bennie G. Thompson, Mississippi (ex  Mike Rogers, Alabama (ex officio)
    officio)
               Moira Bergin, Subcommittee Staff Director
           Sarah Moxley, Minority Subcommittee Staff Director
           
                            C O N T E N T S

                              ----------                              
                                                                   Page

                               Statements

The Honorable Cedric L. Richmond, a Representative in Congress 
  From the State of Louisiana, and Chairman, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Oral Statement.................................................     1
  Prepared Statement.............................................     3
The Honorable John Katko, a Representative in Congress From the 
  State of New York, and Ranking Member, Subcommittee on 
  Cybersecurity, Infrastructure Protection, and Innovation:
  Oral Statement.................................................     4
  Prepared Statement.............................................     5
The Honorable Bennie G. Thompson, a Representative in Congress 
  From the State of Mississippi, and Chairman, Committee on 
  Homeland Security:
  Oral Statement.................................................    33
  Prepared Statement.............................................    34

                               Witnesses

Mr. David Levine, Elections Integrity Fellow, Alliance for 
  Securing Democracy, German Marshall Fund of the United States:
  Oral Statement.................................................     7
  Prepared Statement.............................................     9
Ms. Sylvia Albert, Director of Voting and Elections, Common 
  Cause:
  Oral Statement.................................................    15
  Prepared Statement.............................................    17
Ms. Amber McReynolds, Chief Executive Officer, National Vote at 
  Home Institute:
  Oral Statement.................................................    21
  Prepared Statement.............................................    24
Mr. John M. Gilligan, President and Chief Executive Officer, 
  Center for Internet Security, Inc.:
  Oral Statement.................................................    26
  Prepared Statement.............................................    27

                                Appendix

Questions From Honorable James R. Langevin for Sylvia Albert.....    49
Questions From Honorable James R. Langevin for John Gilligan.....    49


   SECURE, SAFE, AND AUDITABLE: PROTECTING THE INTEGRITY OF THE 2020 
                               ELECTIONS

                              ----------                              


                        Tuesday, August 4, 2020

             U.S. House of Representatives,
                    Committee on Homeland Security,
                            Subcommittee on Cybersecurity, 
                                 Infrastructure Protection,
                                            and Innovation,
                                                    Washington, DC.
    The subcommittee met, pursuant to notice, at 10:02 a.m., 
via Webex, Hon. Cedric L. Richmond (Chairman of the 
subcommittee) presiding.
    Present: Representatives Richmond, Jackson Lee, Langevin, 
Rice, Underwood, Slotkin, Thompson (ex officio), Katko, and 
Joyce.
    Also present: Representatives Demings, and Green of Texas.
    Mr. Richmond. The Subcommittee on Cybersecurity, 
Infrastructure, Protection, and Innovation will come to order.
    Good morning. I want to thank the witnesses for 
participating in today's hearing. We all have a stake in 
ensuring a safe, secure election in November. This hearing 
comes a week after we laid to rest a giant in the right for 
voting rights--in the fight for voting rights. Before he died, 
Congressman Lewis reminding us that the vote is the most 
powerful, nonviolent change agent you have in a Democratic 
society. You must use it because it is not guaranteed. You can 
lose it. We must vigorously defend our right to vote, our 
access to the ballot box, and the integrity of our election.
    In less than 90 days, Americans across the country will 
participate in an election unlike any other in our history. The 
COVID-19 pandemic is forcing State and local election officials 
to rapidly expand vote-by-mail, early voting, and other crowd-
reducing election policies so no voter has to choose between 
their democratic rights and their health.
    As States scramble to administer safe primary elections 
this spring, seemingly, administrative decisions related to the 
number and location of polling sites had substantive impacts on 
people's right to vote. Long lines and crowded polling 
locations in predominantly Black and Brown neighborhoods raise 
the stress levels in communities disproportionately impacted by 
COVID-19. Police violence that underscored that existence of 
systematic racism as an injustice that we must still overcome.
    We have a President who has repeatedly tried to manipulate 
a news cycle, going so far as to falsely suggest he can move 
the election date, and, more insidiously, making baseless 
claims about the security of vote-by-mail. This behavior is in 
service to his own narcissistic political ends, softens the 
turf for dangerous foreign influence campaigns, and puts 
Americans who want to exercise the franchise at risk.
    For the record, the President does not have the power to 
move the date of the election from November. Moreover, last 
Friday, the Cybersecurity Infrastructure Security Agency 
released a risk assessment of vote-by-mail. CISA concluded that 
while there are risks associated with mail-in voting, just as 
with every other method of voting, those risks can be 
mitigated.
    Further, I am not a voyeur of any intelligence assessment 
indicating that foreign actors have expressed interest or 
capability to successfully interfere with vote-by-mail 
processes. We must learn the lessons of our recent elections 
and do better in November.
    First, we must prepare Americans for the reality that 
elections will be administered differently this fall. We must 
educate voters about vote-by-mail, its related deadlines, and 
how expanded vote-by-mail might affect the timing of election 
results. We must encourage participation in vote-by-mail while 
inoculating the public from disinformation campaigns aimed at 
undermining confidence in election results.
    Second, we must ensure that changes to the USPS service 
standards do not jeopardize vote-by-mail, and that the election 
officials seeking to expand vote-by-mail coordinate with the 
Postal Service to coordinate vote-by-mail policies and 
deadlines.
    Third, we must ensure election officials do not use COVID-
19 as a pretext for making administrative decisions that could 
disenfranchise voters.
    Time and time again, the impacts of dysfunctional and 
chaotic election administration falls hardest on Black and 
Brown communities. Election officials must be deliberate in 
their efforts to ensure that no community is disenfranchised.
    Fourth, we must not forget the lessons of 2016. It was 
around this time in 2016 when a Russian foreign interference 
campaign engaged in hack-and-dump-operations against one 
candidate, and targeted election systems in all 50 States.
    We must continue to improve the election--the security of 
election infrastructure and campaign organizations, and improve 
the public resilience to foreign influence campaigns.
    Finally, we need to be honest with ourselves about what it 
will take to administer safe, secure, and auditable elections 
this fall. It has been over 10 weeks since the House passed the 
HEROES Act, which would have provided $3.6 billion in funding 
to support State and local election officials. Despite urgent 
requests for additional resources from State and local election 
officials across the country, the Senate never voted on the 
HEROES Act, nor did it include any election administration 
funding in the COVID response package it released last week.
    As the House and Senate negotiations on COVID relief 
package continues, I urge my Senate colleagues to step up and 
provide State and local election officials the funding they 
need to administer safe, secure, and auditable elections this 
November.
    I look forward to hearing from the witnesses today, their 
recommendations for Congress on ways to give Americans more 
opportunities to vote this November, and to ensure the safety 
and integrity of the election.
    [The statement of Chairman Richmond follows:]
                Statement of Chairman Cedric L. Richmond
                             August 4, 2020
    We all have a stake in ensuring safe, secure, and auditable 
elections in November. This hearing comes a week after we laid to rest 
a giant in the fight for voting rights. Before he died, Congressman 
Lewis reminded us that ``[t]he vote is the most powerful nonviolent 
change agent you have in a democratic society. You must use it because 
it is not guaranteed. You can lose it.'' We must vigorously defend our 
right to vote, our access to the ballot box, and the integrity of our 
elections.
    In less than 100 days, Americans across the country will 
participate in an election unlike any other in our history. The COVID-
19 pandemic is forcing State and local election officials to rapidly 
expand vote-by-mail, early voting, and other crowd-reducing election 
policies so no voter has to choose between their democratic rights and 
their health.
    As States scrambled to administer safe primary elections this 
spring, seemingly administrative decisions related to the number and 
location of polling sites had substantive impacts on people's voting 
rights. Long lines and crowded polling locations in predominantly black 
and brown neighborhoods raised the stress levels in communities 
disproportionately impacted by COVID-19 and police violence and 
underscored that the existence of systemic racism as is an injustice 
that we must still overcome. We have a President who has repeatedly 
tried to manipulate a news cycle, going so far as to falsely suggest he 
can move the election date and, more insidiously, making baseless 
claims about the security of vote-by-mail.
    This behavior, in service to his own narcissistic political ends, 
softens the turf for dangerous foreign influence campaigns and puts 
Americans who want to exercise the franchise at risk. For the record, 
the President does not have the power to move the date of the November 
election. Moreover, last Friday the Cybersecurity and Infrastructure 
Security Agency released a risk assessment of vote-by-mail.
    CISA concluded that while there are risks associated with mail-in 
voting--just as there with every other method of voting--those risks 
can be mitigated. Further, I am not aware of any intelligence 
assessment indicating that foreign actors have expressed interest or 
capability to successfully interfere with vote-by-mail processes. We 
must learn the lessons of our recent elections and do better in 
November.
    First, we must prepare Americans for the reality that elections 
will be administered differently this fall. We must educate voters 
about vote-by-mail, its related deadlines, and how expanded vote-by-
mail might affect the timing of election results. We must encourage 
participation in vote-by-mail while inoculating the public from 
disinformation campaigns aimed at undermining confidence election 
results.
    Second, we must ensure that changes to USPS service standards do 
not jeopardize vote-by-mail, and that election officials seeking to 
expand vote-by-mail coordinate with the Postal Service to coordinate 
vote-by-mail policies and deadlines. Third, we must ensure election 
officials do not use COVID-19 as a pretext for making administrative 
decisions that could disenfranchise voters. Time and again, the impacts 
of dysfunctional and chaotic election administration fall hardest on 
black and brown communities. Election officials must be deliberate in 
their efforts to ensure that no community is disenfranchised.
    Fourth, we must not forget the lessons of 2016. It was around this 
time in 2016 when the Russian foreign interference campaign engaged in 
hack-and-dump operations against one candidate, and targeted election 
systems in all 50 States. We must continue to improve the security of 
election infrastructure and campaign organizations, and improve the 
public's resilience to foreign influence campaigns.
    Finally, we need to be honest with ourselves about what it will 
take to administer safe, secure, and auditable elections this fall. It 
has been over 10 weeks since the House passed the HEROES Act, which 
would provide $3.6 billion in funding to support State and local 
election officials. Despite urgent requests for additional resources 
from State and local election officials across the country, the Senate 
never voted on the HEROES Act, nor did include any election 
administration funding in the COVID response package it released late 
last month.
    As House and Senate negotiations on COVID relief package continue, 
I urge my Senate colleagues to step up and provide State and local 
election officials the funding they need to administer safe, secure, 
and auditable elections this November. I look forward to hearing from 
the witness today their recommendations for Congress on ways to give 
Americans more opportunities to vote this November, and to ensure the 
safety and integrity of the election.

    Mr. Richmond. I ask unanimous consent that Mrs. Demings of 
Florida and Mr. Green of Texas be permitted to participate in 
today's hearing without objection.
    With that, I would like to recognize the Ranking Member of 
the subcommittee, Mr. Katko of New York, for any opening 
statements he may have.
    Mr. Katko. Thank you, Mr. Chairman. I want to echo your 
sentiment at the outset about John Lewis. He truly was a giant 
in American politics and American leadership, and I considered 
him a friend, and his legacy will live on long after his 
passing, that is for sure.
    I want to thank the CAT staff for accommodating the 
schedule today. I have another example of how bad 2020 is. My 
best friend's son is being laid to rest this morning, and so it 
is, it is another awful--another awful example of this awful 
year.
    I want to thank Chairman Richmond for holding this 
important hearing. Election security is something that I am 
very concerned about. I have been working hard to ensure that 
all Americans are able to vote securely and have their vote 
counted.
    Although we have made significant progress since 2016, 
elections security remains a major concern of mine. Secure 
voting systems and accurate reporting of votes are fundamental 
to our democracy. Americans should have full confidence in 
every aspect of our election process.
    I want to applaud the elections security efforts by the 
Cybersecurity and Infrastructure Agency that are known as CISA, 
and its partnerships with State, local, territorial, and Tribal 
governments that have resulted in a marked improvement of 
election security over 2016. CISA provides State and local 
officials the technical assistance, playbooks, and exercises, 
shares information on threats, and assists us responding to 
cyber incidents.
    The pandemic has injected new elements of uncertainty into 
the 2020 election that have forced many local election 
officials to reinvent the process by which citizens vote. These 
changes will keep citizens and poll workers safe while 
maintaining citizens' faith in the process.
    In March, Congress provided $400 million in the new Help 
America Vote Act or HAVA funds to States to prepare for and 
conduct a 2020 election during the pandemic. Aided by this 
infusion of funding, State and local election officials are 
adjusting to huge increases in voting-by-mail and the 
consolidation of voting locations.
    CISA is also working with State and local election 
officials to head off disinformation campaigns engineered by 
adversaries. A key component of this strategy is countering the 
opportunity for adversaries to spread disinformation on remote-
voting procedures and changes in polling locations.
    CISA has assisted State and local officials with methods to 
drive voters to reliable sources of information, and how to 
communicate changes to election procedures, polling locations, 
and times.
    Election security for 2020 has also improved as a result of 
the growing participation in the Election Infrastructure ISAC 
by State and local officials. The Election ISAC has provided 
thousands of election offices with the cyber resources they 
need to maintain the reliability of their election 
infrastructure, including best practices, tools, training, and 
perhaps, most important, information sharing and analysis.
    However, many election offices don't have the IT knowledge 
or resources necessary to take advantage of this information. 
Some of them feel deluged with information that they simply 
cannot sift through or handle from the ISAC. These local 
election offices are not equipped to handle the cyber threats 
to the election infrastructure alone. This is why I introduced 
my Cyber Navigators Bill, which authorizes grants for State and 
local governments to hire cybersecurity experts to provide risk 
management, resiliency, and technical support in the 
administration of elections. My bill enables the State to hire 
a cybersecurity expert familiar with the State's unique 
election systems. The regional nature of the assistance ensures 
that those navigators are able to establish relationships with 
their regional and State election officials. By targeting this 
assistance at the administration of elections, State election 
officials aren't forced to compete with other State priorities. 
Election security has a history of bipartisan cooperation and 
support. Ensuring that our election process is uncompromised 
during the upcoming election must remain a top priority from 
both sides of the aisle.
    Together, I look forward to continuing to work toward the 
goal with my colleagues on the subcommittee. I thank the 
witnesses for providing the subcommittee with their testimony, 
and I look forward to hearing their ideas in how we can further 
improve the security of our election systems. With that, Mr. 
Chairman, I yield back.
    [The statement of Ranking Member Katko follows:]
                 Statement of Ranking Member John Katko
                             August 4, 2020
    Thank you, Mr. Chairman.
    I want thank Chairman Richmond for holding this important hearing.
    Although we have made significant progress since 2016, election 
security remains a major concern of mine. Secure voting systems and the 
accurate reporting of votes are foundational to our democracy. 
Americans should have full confidence in every aspect of our election 
process.
    I want to applaud election security efforts led by Cybersecurity 
and Infrastructure Security Agency (CISA) and its partnerships with 
State, local, territorial, and Tribal governments that have resulted in 
a marked improvement of election security over 2016. CISA provides 
State and local officials with technical assistance, playbooks, and 
exercises, shares information on threats, and assists with responding 
to cyber incidents.
    The pandemic has injected new elements of uncertainty into the 2020 
elections that have forced many local election officials to reinvent 
the process by which citizens vote. These changes will keep citizens 
and poll workers safe while maintaining citizens' faith in the process. 
In March, Congress provided $400 million in new Help American Vote Act 
(HAVA) funds to States to prepare for and conduct the 2020 Election 
during the pandemic. Aided by this infusion of funding, State and local 
election officials are adjusting to huge increases in voting-by-mail 
and the consolidation of voting locations.
    CISA is also working with State and local election officials to 
head off disinformation campaigns engineered by adversaries. A key 
component of this strategy is countering the opportunity for 
adversaries to spread disinformation on remote voting procedures and 
changes in polling locations. CISA has assisted State and local 
officials with methods to drive voters to reliable sources of 
information, and how to communicate changes to election procedures, 
polling locations, and times.
    Election security for 2020 has also improved as a result of the 
growing participation in the Election Infrastructure ISAC (EI-ISAC) by 
State and local election officials. The EI-ISAC has provided thousands 
of election offices with the cyber resources they need to maintain the 
reliability of their election infrastructure including best practices, 
tools, training, and information sharing and analysis.
    However, many local election offices don't have the IT knowledge or 
resources necessary to take advantage of this information. These local 
election offices are not equipped to handle cyber threats to their 
election infrastructure alone.
    This is why I introduced my Cyber Navigators bill which authorizes 
grants for State and local governments to hire cybersecurity experts to 
provide risk management, resiliency, and technical support in the 
administration of elections. My bill enables a State to hire a 
cybersecurity expert familiar with a State's unique election systems. 
The regional nature of the assistance ensures that these navigators are 
able to establish relationships with their regional and State election 
officials. By targeting the assistance at the administration of 
elections, State election officials aren't forced to compete with other 
State priorities.
    Election security has a history of bipartisan cooperation and 
support. Ensuring that our election process is uncompromised during the 
upcoming election must remain a top priority for both sides of the 
aisle. I look forward to continuing to work toward this goal with my 
colleagues on the subcommittee.
    I thank the witnesses for providing the subcommittee with their 
testimony and I look forward to hearing their ideas on how we can 
further improve the security of our election systems.
    I yield back.

    Mr. Richmond. The gentleman from New York yields back.
    Mr. Katko, we will all be saying prayers for you as you 
attend the funeral, and we thank you for your attendance.
    Mr. Katko. Thank you. Say a lot of prayer. I have got to 
deliver the eulogy, and it is going to be a tough one. So thank 
you, Mr. Chairman.
    Mr. Richmond. Thank you. Members are reminded that the 
subcommittee will operate according to the guidelines laid out 
by the Chairman and Ranking Member in the July 8 colloquy. With 
that, I ask unanimous consent to waive Committee Rule 882 for 
the subcommittee during remote proceedings under the covered 
period designated by the Speaker under the House Resolution 
965. Without objection, so ordered.
    The Chair now recognizes the Chairman of the full 
committee, the gentleman from Mississippi, Mr. Thompson, for an 
opening statement.
    Maybe we don't. Do we have Mr. Thompson here?
    The Chair will now--we will go on to the Ranking Member of 
the full committee, and then we will come back to the Chairman.
    So now the Chair recognizes the Ranking Member of the full 
committee, the gentleman from Alabama, Mr. Rogers, for an 
opening statement. Mr. Rogers is not here.
    So let's do this, let's go straight to our amazing 
witnesses. So I will now welcome our panel of witnesses. First, 
I would like to welcome David Levine, an elections integrity 
fellow at the Alliance for Securing Democracy. Mr. Levine 
previously served in a range of positions administering and 
observing elections and advocating for election reform, 
including as the Ada County, Idaho elections director and as 
the director of elections for the city of Richmond, Virginia.
    Next, Ms. Sylvia Albert, the director of Voting and 
Elections, Common Cause. Ms. Albert brings more than a decade 
of professional experience in public interest law, and public 
policy campaigns, expanding ballot access, reducing barriers to 
participation, and combating voter intimidation among 
historically disenfranchised communities.
    Next, we will hear from Ms. Amber McReynolds, CEO for the 
National Vote at Home Institute and Coalition. She is the 
former director of elections for Denver, Colorado, and serves 
on a National election task force on election crises. As a 
former election official in a State with universal vote-by-
mail, I look forward to hearing her unique perspective on that 
topic.
    Finally, we have Mr. John Gilligan, the president and CEO 
of the Center for Internet Security, or CIS. Together with 
Elections Infrastructure, Information Sharing, and Analysis 
Center, EI-ISAC, provides many resources to support the 
Cybersecurity needs of the election community.
    I appreciate you all joining us today. Without objection, 
the witnesses' full statements will be inserted for the record. 
I now ask each witness to summarize his or her statement for 5 
minutes, beginning with Mr. Levine.

STATEMENT OF DAVID LEVINE, ELECTIONS INTEGRITY FELLOW, ALLIANCE 
  FOR SECURING DEMOCRACY, GERMAN MARSHALL FUND OF THE UNITED 
                             STATES

    Mr. Levine. Chairman Richmond, Ranking Member Katko, and 
Members of this subcommittee on Cybersecurity, Infrastructure 
Protection, and Innovation. Good morning, and thank you for the 
opportunity to testify today on protecting the integrity of the 
2020 elections during the COVID-19 pandemic.
    My name is David Levine, and I am the elections integrity 
fellow for the Alliance for Securing Democracy, a bipartisan, 
Transatlantic initiative housed within the German Marshall Fund 
of the United States. ASD develops comprehensive strategies to 
defer and defend against authoritarian efforts to undermine and 
interfere with Democratic institutions.
    The 2020 primary election season has been unique with a 
global pandemic, Nation-wide protests, and an on-going threat 
of foreign interference. My testimony today focuses on 6 steps 
that can be taken now to help ensure that the 2020 election is 
safe, secure, and fair.
    State and local election officials with help from their 
partners must continually evaluate their election 
infrastructure to ensure it is as secure as possible. Testing 
and auditing existing systems is essential.
    At a recent meeting of the National Association of 
Secretaries of State, Matt Masterson, an advisor with the U.S. 
Department of Homeland Security, told State officials that DHS 
testing of State and local elections systems have found a 
number of concerning vulnerabilities. These included, No. 1, 
sharing passwords and other credentials, and using default 
passwords commonly known to outsiders; and No. 2, continuing to 
fall for phishing attacks that allow hackers to install 
malware, including ransomware that could paralyze Election Day 
operations.
    As Masterson noted, the good news is that many of these 
issues can be easily fixed by election day. The bad news is 
that many local election offices are unable to make these fixes 
quickly because they lack the necessary resources or IT 
support. The coronavirus has exacerbated the problem by forcing 
a number of States to divert election security funding to cover 
other unanticipated costs stemming from the pandemic.
    As the election infrastructure is modified to account for 
the coronavirus or other intervening events, security and 
resiliency measures must be part of the design and not 
introduced after the fact.
    In its June 2 primary election, the Washington, DC Board of 
Elections, inundated with complaints from voters who did not 
receive absentee ballots in the mail, decided as a last resort 
to allow a number of domestic voters to submit their ballots by 
email, so that their votes could be cast and counted. While the 
effort was well-intentioned, it put election results at risk 
because there is no way either for those voters to verify that 
their votes were recorded accurately, or to ensure that those 
votes were not altered in transmission by bad actors. Even if 
there is no actual interference with email ballots, allowing 
them provides fodder to foreign adversaries who could use such 
actions to sow doubt and confusion about the legitimacy of our 
elections.
    We need to ensure that our elections are run as smoothly as 
possible so that mis- and disinformation is less likely to be 
effective. If our general election is plagued by significant 
problems, inaccurate information is more likely to find a 
receptive audience, as we have seen with Russia and Iran 
already.
    Regardless of how secure our elections are, experts and 
officials are concerned that some voters could dismiss 
November's results as invalid or rigged because of mis- and/or 
disinformation. Voters could argue, for example, that the much-
longer-than-usual time required to count an anticipated surge 
in mail-in ballots is direct evidence of nefarious conduct.
    We must seek to flood the information space with credible, 
consistent election information so that voters are immunized 
against falsehoods. This will admittedly be challenging in 
light of the coronavirus and the constant change it is 
required. But it is doable, particularly, if Federal 
authorities can provide State and local election officials 
additional funding to publicize and explain changes to their 
election processes. It is essential that also partisan politics 
be kept out of election administration to build confidence in 
the integrity of the election process, and it should happen 
long before Election Day.
    For example, Kentucky had a relatively smooth primary 
election, in part, due to a bipartisan agreement reached well 
in advance of the election between a Democratic Governor and a 
Republican Secretary of the State. It took a number of joint 
steps to help the State prepare for its primary, including 
allowing for unprecedented expansion of absentee voting, and 
allowing in-person absentee voting, which is effectively early 
voting.
    Election officials, finally, must also have sufficient 
resources to plan for reasonably foreseeable contingencies. 
Offering robust voting-by-mail, early voting, and election-day 
options to minimize confusion and risks are optimal, but many 
jurisdictions don't currently have the resources and/or 
personnel to offer all of these approaches. Additional 
resources from Federal authorities would help enormously with 
administering and securing the election, but time is of the 
essence.
    The late Congressman John Lewis once said, ``Your vote is 
precious, almost sacred. It is the most powerful, nonviolent 
tool we have to create a more perfect union.''
    I urge Congress to do everything possible to ensure that 
every person who wants to exercise their right to vote can do 
so. Thank you.
    [The prepared statement of Mr. Levine follows:]
                   Prepared Statement of David Levine
                             August 4, 2020
                            i. introduction
    Chairman Richmond, Ranking Member Katko, and Members of the 
Subcommittee on Cybersecurity, Infrastructure Protection & Innovation: 
Thank you for the opportunity to testify today on protecting the 
integrity of the 2020 elections during the COVID-19 pandemic.
    My name is David Levine, and I am the Elections Integrity Fellow 
for the Alliance for Securing Democracy (ASD), a bipartisan, 
transatlantic initiative housed within the German Marshall Fund of the 
United States. ASD develops comprehensive strategies to deter and 
defend against authoritarian efforts to undermine and interfere in 
democratic institutions. Election integrity has been a core priority 
since our inception, and we continue to be at the forefront of efforts 
to raise awareness of threats and recommend legislative and technical 
mitigation measures.
    Prior to joining ASD, I served as the Ada County, Idaho elections 
director, where I collaborated with the county's elected officials to 
plan, oversee, and administer elections for more than 250,000 
registered voters across 150 precincts. Before that, I spent several 
years as a senior election administrator and consultant, helping 
administer elections in Richmond, Virginia and Washington, DC. And on 
behalf of the Organization for Security and Cooperation in Europe, of 
which the United States is a member, I have been privileged to act as 
an observer for a number of elections overseas.
    This year, the United States has had a primary election season 
unlike any other. Since the primaries began, our country has endured a 
public health crisis that has claimed the lives of more than 150,000 
people;\1\ experienced substantial protests and unrest in the aftermath 
of George Floyd's death;\2\ and conducted elections while trying to 
secure them from foreign adversaries, including Russia, China, and 
Iran.\3\ State and local election officials, partner organizations, 
voters and other stakeholders are being forced to grapple with new 
election-related challenges in real time as they strive to hold safe, 
secure, and accessible elections. Changes to voting processes to 
account for the coronavirus impact the security of our elections. The 
steps we take to combat the coronavirus must therefore consider the 
threat of foreign interference, in addition to public health and 
election administration.
---------------------------------------------------------------------------
    \1\ Norah O'Donnell. ``U.S. hits 150,000 deaths,'' CBS News, July 
29, 2020, https://www.cbsnews.com/news/covid-united-states-150000-
deaths-coronavirus/.
    \2\ Derrick Bryson Taylor. ``George Floyd Protests: A Timeline,'' 
The New York Times, July 10, 2020, https://www.nytimes.com/article/
george-floyd-protests-timeline.html.
    \3\ U.S. Department of National Intelligence, Statement by NCSC 
Director William Evanina: 100 Days Until Election 2020, July 24, 2020, 
https://www.dni.gov/index.php/newsroom/press-releases/item/2135-
statement-by-ncsc-director-william-evanina-100-days-until-election-
2020.
---------------------------------------------------------------------------
    My testimony today focuses on steps that can be taken now to help 
ensure that the 2020 general election is safe, secure, and fair. To do 
this, I will address election infrastructure, information, 
administration, and funding.
                      ii. election infrastructure
    One noteworthy success from the 2020 primary elections is that 
there hasn't yet been any confirmed successful attack on our country's 
election infrastructure. I think that is a testament, at least in part, 
to the strides our country has made in improving our election security 
since the 2016 Presidential election, when we had relatively little 
awareness of the threats foreign actors posed to our elections. State 
and local election officials have subsequently become more well-versed 
on cybersecurity issues, and with the assistance of Federal agencies 
like the Department of Homeland Security's (DHS) Cybersecurity & 
Infrastructure Security Agency (CISA), and a whole host of civil 
society organizations and private-sector actors, there is now much more 
information sharing and awareness of potential threats, as well as 
proactive measures to protect our election infrastructure than before.
    That said, the work of securing the 2020 Presidential election is 
far from over. Below are 3 steps that election officials and their 
partners must continue taking to help ensure that November's 2020 
election is a secure one.
    First, State and local election officials, with help from their 
partners, must continually evaluate their election infrastructure to 
ensure it is as secure as possible. Testing and auditing existing 
systems is essential.
    In June 2016, the State of Illinois experienced the first known 
breach by Russian actors of State election infrastructure during the 
2016 election. By the end of 2018, Russian agents had successfully 
penetrated Illinois's voter registration database, accessed as many as 
200,000 voter registration records, and exfiltrated an unknown quantity 
of voter registration data. And while we are not aware of any evidence 
that voter registration data was deleted or changed, the U.S. Senate 
Select Committee on Intelligence found that Russian cyber actors were 
in a position to modify the data they accessed.\4\
---------------------------------------------------------------------------
    \4\ U.S. Congress, Senate, Select Committee on Intelligence, 
Russian Active Measures Campaigns and Interference in the 106 U.S. 
Election, Volume 1: Russian Efforts Against Election Infrastructure 
with Additional Views, 116th Cong., 1st sess., 2019, 4 [sic], https://
www.intelligence.senate.gov/sites/default/files/documents/
Report_Volume1.pdf.
---------------------------------------------------------------------------
    The Colorado Secretary of State's office recently announced that it 
is partnering with a security firm to conduct penetration tests of its 
election systems ahead of the Presidential vote. Trevor Timmons, the 
chief information officer for Colorado Secretary of State Jena 
Griswold, indicated that the firm's ``white-hat'' hackers would examine 
the agency's election infrastructure, including the State-wide voter 
registration database, the Secretary's main website, and electronic 
pollbooks at physical precincts for people who choose to vote in person 
because ``We need to know [vulnerabilities]. We've got enough time that 
if they found anything we'd be able to respond to them.''\5\
---------------------------------------------------------------------------
    \5\ Benjamin Freed. ``Colorado official details plan for 
penetration testing of election systems,'' StateScoop, July 28, 2020, 
https://statescoop.com/colorado-official-details-plans-for-penetration-
testing-of-election-systems/.
---------------------------------------------------------------------------
    While the security of our election infrastructure, including our 
State voter registration databases, appears to have improved since 
2016, this kind of testing still has tremendous value. At a recent 
meeting of the National Association of Secretaries of State, Matt 
Masterson, an advisor with CISA, told State officials that DHS testing 
of State and local election systems had found a number of 
``concerning'' vulnerabilities. These included: (1) Sharing passwords 
and other credentials, and using default passwords commonly known to 
outsiders; and (2) continuing to fall for ``phishing'' attacks that 
allow hackers to install malware, including ransomware that could 
paralyze Election Day operations.\6\ As Masterson noted, the good news 
is that many of these issues can be easily fixed by Election Day. The 
bad news is that many local election offices are unable to make these 
fixes quickly because they lack the necessary resources or IT support. 
The coronavirus has exacerbated the problem by forcing a number of 
States to divert election security funding to cover other unanticipated 
costs stemming from the pandemic.\7\
---------------------------------------------------------------------------
    \6\ Pam Fessler. ``With November Approaching, Election Officials 
Still Face Safety, Security Fears,'' NPR, July 24, 2020, https://
www.npr.org/2020/07/24/894736356/with-november-approaching-election-
officials-still-face-safety-security-question.
    \7\ Matthew Vann. ``Some cash-strapped States turn to election 
security funds to fight COVID-19,'' ABC News, April 6, 2020, https://
abcnews.go.com/Politics/cash-strapped-states-turn-election-security-
funds-fight/story?id=69940136.
---------------------------------------------------------------------------
    Second, as the election infrastructure is modified to account for 
the coronavirus or other intervening events, security and resiliency 
measures must be part of the design and not introduced after the fact.
    In its June 2 primary election, the Washington, DC Board of 
Elections (DCBOE)--inundated with complaints from voters who did not 
receive requested absentee ballots--decided as a last resort to allow a 
number of domestic voters to submit their ballots by email so that 
their votes could be cast and counted.\8\ While the effort was well-
intentioned,\9\ it put the election results at risk because there is no 
way either for those voters to verify that their votes were recorded 
accurately, nor is there a way to ensure that those votes were not 
altered in transmission by bad actors.\10\
---------------------------------------------------------------------------
    \8\ Alexa Corse. ``D.C. Lets Voters Submit Ballots by Email After 
Mail Problems,'' The Wall Street Journal, June 3, 2020, https://
www.wsj.com/articles/d-c-lets-voters-submit-ballots-by-email-after-
mail-problems-11591211518.
    \9\ In addition to trying to ensure that additional voters could 
cast ballots in a timely manner, the DCBOE was reported to have 
required people who voted by email to submit an affidavit verifying 
their identity. The DCBOE also indicated that it planned to call 
everyone who voted by email to verify that was how they submitted a 
ballot. Joseph Marks. ``The Cybersecurity 202: D.C.'s use of email 
voting shows what could go wrong in November,'' The Washington Post, 
June 4, 2020, https://www.washingtonpost.com/news/powerpost/paloma/the-
cybersecurity-202/2020/06/04/the-cybersecurity-202-d-c-s-use-of-email-
voting-shows-what-could-go-wrong-in-november/5ed7dd38602ff12947e83396/.
    \10\ Ibid.
---------------------------------------------------------------------------
    And even if there is no actual interference with emailed ballots, 
allowing them provides fodder to foreign adversaries who could use such 
actions to sow doubt and confusion about the legitimacy of our 
elections. That is not idle speculation--it has been voiced by 
authoritative sources ranging from the Senate's Select Committee on 
Intelligence,\11\ to the National Academies of Science, Engineering, 
and Medicine,\12\ CISA, the Election Assistance Commission (EAC), the 
Federal Bureau of Investigation, and the National Institutes of 
Standards of Technology.\13\
---------------------------------------------------------------------------
    \11\ U.S. Congress, Senate, Select Committee on Intelligence, 
Russian Active Measures Campaigns and Interference in the 106 U.S. 
Election, Volume 1: Russian Efforts Against Election Infrastructure 
with Additional Views.
    \12\ The National Academies of Sciences, Engineering, and Medicine, 
Securing the Vote: Protecting American Democracy, 2018, http://nap.edu/
25120.
    \13\ The Cybersecurity and Infrastructure Security Agency, the 
Election Assistance Commission, the Federal Bureau of Investigation and 
the National Institute of Standards and Technology, Risk Management for 
Electronic Ballot Delivery, Marking, and Return, May 2020, https://
s.wsj.net/public/resources/documents/
Final_%20Risk_Management_for_Electronic-
Ballot_05082020.pdf?mod=article_inline.
---------------------------------------------------------------------------
    While the DCBOE has already said that it does not plan to allow 
email voting in November, the situation it found itself in is one that 
other jurisdictions could face, especially if COVID-19 continues to 
make in-person voting challenging, requests to vote-by-mail continue to 
multiply, and additional funds are not made available.\14\ It is 
important that contingency plans for scenarios such as those above be 
developed well in advance of November and rely on proven, secure, 
resilient voting processes.
---------------------------------------------------------------------------
    \14\ Marks, ``The Cybersecurity 202: D.C.'s use of email voting 
shows what could go wrong in November.''
---------------------------------------------------------------------------
    Finally, State and local officials should continue to be offered 
help in securing their election infrastructure before November.
    Federal agencies such as CISA and the EAC have resources available 
to help detect and fix flaws, provide security training, and share best 
practices for securing our elections. Some civil society organizations 
can act quickly to help secure elections from the bottom up.\15\ With 
fewer than 100 days before November 3, one of the best ways such 
organizations could assist election officials at this juncture would be 
to help identify poll workers who are willing to assist with in-person 
voting at a time when the coronavirus is still expected to be 
circulating.
---------------------------------------------------------------------------
    \15\ U.S. Cyberspace Solarium Commission, March 2020, https://
www.solarium.gov/.
---------------------------------------------------------------------------
    But civic action and commitment are not enough. The single most 
important assistance that election officials could use at this juncture 
is additional Federal funding. Congress provided $400 million to the 
States for election assistance in March as part of the Coronavirus Aid, 
Relief and Economic Security (CARES) Act. That was an important first 
step that has helped enable many States and localities to go to greater 
lengths to try and conduct accessible, secure elections during the 
pandemic. That said, as a recent report put out by a(n) ideologically 
diverse group of organizations, including ASD, Brennan Center for 
Justice at NYU Law, the R Street Institute and University of Pittsburgh 
Institute for Cyber Law, Policy and Security noted, $400 million isn't 
enough to cover the remaining 2020 election costs in Georgia, Michigan, 
Missouri, Ohio, and Pennsylvania, let alone the costs of the other 45 
States and entities like DC, Puerto Rico, and the U.S. Virgin 
Islands.\16\ Without further Federal assistance, the likelihood of 
there being significant issues in the November general election will go 
up. States and local governments across the country are facing severe 
budget challenges as a result of COVID-19.\17\ Not surprisingly, 
dealing with the disease itself gets first priority, but that means 
that many are not in a position to cover the unanticipated election 
costs arising from the virus.
---------------------------------------------------------------------------
    \16\ Christopher R. Deluzio, Elizabeth Howard, David Levine, Paul 
Rosenzweig, Derek Tisler, ``Ensuring Safe Elections: Federal Funding 
Needs for State and Local Governments During the Pandemic,'' Brennan 
Center for Justice, April 30, 2020, https://
securingdemocracy.gmfus.org/wp-content/uploads/2020/05/Ensuring-Safe-
Elections.pdf.
    \17\ Ibid.
---------------------------------------------------------------------------
                 iii. election mis- and disinformation
    Regardless of how secure our elections are, many election experts 
and officials are concerned that some voters could dismiss November's 
results as invalid or rigged because of mis- and/or disinformation. 
Voters could argue, for example, that the much-longer-than-usual time 
required to count an anticipated surge in mail-in ballots is prima 
facie evidence of nefarious conduct. While most of us know that such 
allegations are not true, similar rhetoric is already being amplified 
by foreign adversaries, such as Russia and Iran, to diminish confidence 
in the election results and undermine our democracy.\18\ In response, 
we need to do at least two things.
---------------------------------------------------------------------------
    \18\ Clint Watts. ``Triad of Disinformation: How Russia, Iran & 
China Ally in a Messaging War Against America,'' Alliance for Securing 
Democracy, May 15, 2020, https://securingdemocracy.gmfus.org/triad-of-
disinformation-how-russia-iran-china-ally-in-a-messaging-war-against-
america/.
---------------------------------------------------------------------------
    First, we need to ensure that our elections are run as smoothly as 
possible, so that mis- and disinformation is less likely to be 
effective. If our general election is plagued by significant problems, 
inaccurate information is more likely to find a receptive audience.
    For example, during the February 3, 2020 Iowa Democratic caucuses--
which were administered by political party officials, not election 
officials--the new app that the Iowa Democratic Party used to report 
caucus results did not work as planned,\19\ resulting in a system-wide 
meltdown.\20\ That provided enough of an opening for a conspiracy 
theory to go viral and be amplified by accounts with Russian links. 
This conspiracy theory accused Robby Mook (Hillary Clinton's 2016 
campaign manager) of developing Iowa's mobile app to rig the Democratic 
primary against Senator Bernie Sanders (Secretary Clinton's former 
rival)--even though Mr. Mook had not developed (or even heard of) the 
app.\21\
---------------------------------------------------------------------------
    \19\ David Levine. ``The Election Official's Handbook: Six steps 
local officials can take to safeguard America's election systems,'' 
Alliance for Securing Democracy, February 13, 2020, https://
securingdemocracy.gmfus.org/wp-content/uploads/2020/02/The-Election-
Officials-Handbook-2.pdf.
    \20\ Shane Goldmacher and Nick Corasaniti. `` `A Systemwide 
Disaster': How the Iowa Caucuses Melted Down,'' The New York Times, 
February 04, 2020, https://www.nytimes.com/2020/02/04/us/politics/what-
happened-iowa-caucuses.html.
    \21\ Nicole Perloth. ``A Conspiracy Made in America May Have Been 
Spread by Russia,'' The New York Times, June 15, 2020, https://
www.nytimes.com/2020/06/15/technology/coronavirus-disinformation-
russia-iowa-caucus.html.
---------------------------------------------------------------------------
    Even reasonable decisions about our voting processes can be become 
fodder for foreign adversaries.\22\ In April, New York tried to become 
the first State to cancel its Presidential primary over coronavirus 
concerns, a move that was subsequently overturned \23\ by a Federal 
court. Never wanting to miss an opportunity to cry foul, Russian actors 
seized on the move to highlight domestic ``outrage'' at the change and 
suggest that it constituted a ``blatant coronation'' of Vice President 
Joe Biden at the expense of Senator Bernie Sanders.\24\ Reasonable 
minds can differ about the State Board of Election's (SBE) decision to 
cancel the Presidential primary, but the transparent, legal process 
that played out after that decision stood in stark contrast to the lack 
of recourse or due process offered by authoritarian regimes like 
Russia.
---------------------------------------------------------------------------
    \22\ Jessica Brandt. ``To Ensure a Healthy Election in a Pandemic, 
First Prepare the Information Space,'' Alliance for Securing Democracy, 
May 14, 2020, https://securingdemocracy.gmfus.org/to-ensure-a-healthy-
election-in-a-pandemic-first-prepare-the-information-space/.
    \23\ Katelyn Burns, ``The New York State Presidential primary is 
back on a Federal court ruling,'' Vox, May 6, 2020, https://
www.vox.com/policy-and-politics/2020/5/6/21249108/new-york-state-
presidential-primary-back-on-Federal-court-ruling.
    \24\ Brandt, ``To Ensure a Healthy Election in a Pandemic, First 
Prepare the Information Space.''
---------------------------------------------------------------------------
    Second, we must seek to flood the information space with credible, 
consistent election information so that voters are `immunized' against 
falsehoods.
    This will admittedly be challenging in light of the coronavirus--
because many voters are likely to be voting in a different manner than 
they have previously, and election officials have been forced to make 
continuous changes to their voting processes as the pandemic evolves. 
But it is doable, particularly if Federal authorities can: (1) Provide 
State and local election officials additional funding to publicize and 
explain changes to their voting processes; and (2) communicate as much 
information about election threats as possible to election officials 
and the public. Flooding the space with this kind of information will 
also sensitize journalists, candidates, and the public to the fact that 
we may not know the election results immediately and that this is not, 
in and of itself, proof of malfeasance.
                      iv. election administration
    The 2020 primary elections gave many States an opportunity to 
conduct at least one election during the pandemic prior to November. 
There are at least 3 important takeways from these elections that can 
be applied to November.
    First, it is essential that partisan politics be kept out of 
election administration to build public confidence in the integrity of 
the election process, and this must happen long before Election Day.
    Wisconsin's April 7 primary illustrated what can go wrong when 
State leaders refuse to act on a timely basis, and ended up conducting 
in-person voting in the middle of the State's coronavirus outbreak. 
There were not enough poll workers and dueling court cases sowed 
confusion about absentee voting, contributing to thousands of missing 
or nullified ballots.\25\ In Milwaukee, where roughly 4 in 10 residents 
are Black, officials closed all but 5 of the city's 180 polling places, 
forcing thousands of voters to congregate at a handful of voting sites. 
Many voters were forced to choose between risking their health to cast 
a ballot or staying at home and forfeiting their vote.\26\
---------------------------------------------------------------------------
    \25\ Amber Phillips. ``Wisconsin's decision to hold its primary is 
threatening to become a worst-case scenario for elections amid a 
pandemic,'' The Washington Post, April 6, 2020, https://
www.washingtonpost.com/politics/2020/04/03/wisconsins-decision-go-
ahead-with-its-primary-is-glimpse-worst-case-scenario-elections-during-
coronavirus/.
    \26\ Li Zhou and Ella Nilsen. ``Liberal challenger Jill Karofsky 
wins a seat on the Wisconsin Supreme Court,'' Vox, April 13, 2020, 
https://www.vox.com/2020/4/13/21219284/jill-karofsky-wisconsin-supreme-
court.
---------------------------------------------------------------------------
    Such mishaps provide openings to adversaries such as Russia, which 
has targeted African-Americans with disinformation operations since the 
2016 Presidential election,\27\ as well as China and Iran, both of whom 
have used the coronavirus in an effort to undermine our democracy.\28\
---------------------------------------------------------------------------
    \27\ U.S. Congress, Senate, Select Committee on Intelligence, 
Russian Active Measures Campaigns and Interference in the 2016 U.S. 
Election, Volume 2: Russia's Use of Social Media, 116th Cong., 1st 
sess., 2019, https://www.intelligence.senate.gov/sites/default/files/
documents/Report_Volume2.pdf.
    \28\ Watts. ``Triad of Disinformation: How Russia, Iran & China 
Ally in a Messaging War Against America.''
---------------------------------------------------------------------------
    In contrast, Kentucky had a relatively smooth primary election 
despite early fears of turmoil, in part due to a bipartisan agreement 
reach well in advance of the election between the Democratic Governor, 
Andy Beshear, and the Republican Secretary of State, Michael Adams. 
Beshear and Adams took a number of joint steps to help the State 
prepare for its primary, including allowing for an unprecedented 
expansion of absentee voting and allowing ``in-person absentee 
voting'', which is effectively early voting and does not typically take 
place in Kentucky.\29\
---------------------------------------------------------------------------
    \29\ Zach Montellaro. ``Coronavirus threatened to make a mess of 
Kentucky's primary. It could be a model instead,'' Politico, July 4, 
2020, https://www.politico.com/news/2020/07/04/coronavirus-voting-
kentucky-primary-348611.
---------------------------------------------------------------------------
    Second, election officials must have sufficient resources to plan 
for reasonably foreseeable contingencies.
    From an election administration, election security, and public 
health standpoint, it would be optimal if as many voters as possible 
voted before Election Day, either in person or from home. That 
increases the time and choices available to address any issues that may 
arise, such as malfunctioning voting equipment, long lines at voting 
locations or unexpected delays in the mail service. But whatever 
election officials do, many people will likely insist on voting in-
person on Election Day regardless of the pandemic--a development 
Georgia experienced first-hand during its primary.
    After twice postponing its primary due to the coronavirus, Georgia 
substantially modified its election process to try to account for the 
virus. It took the unprecedented step of mailing out absentee ballot 
applications to all of the 6.9 million active registered voters in 
Georgia to encourage more mail-in voting,\30\ and while a much higher 
percentage of ballots were cast by mail than in previous elections, 
more than half of all votes were still cast in-person;\31\ many of 
those voters had a difficult experience. For example, voters in parts 
of metro Atlanta waited in lines for more than 4 hours on Election Day 
as election officials conducted an election with fewer voting machines 
in polling places, fewer places to vote, and fewer experienced poll 
workers because of the pandemic.\32\
---------------------------------------------------------------------------
    \30\ Alexa Corse. ``Voting by Mail to Face Biggest Test Since 
Pandemic Started,'' The Wall Street Journal, June 1, 2020, https://
www.wsj.com/articles/voting-by-mail-to-face-biggest-test-since-
pandemic-started-11591003801.
    \31\ Mark Niesse, ``Turnout broke records in Georgia primary 
despite coronavirus threat,'' The Atlanta Journal-Constitution, Updated 
July 11, 2020, https://www.ajc.com/news/state--regional-govt--politics/
turnout-broke-records-georgia-primary-despite-coronavirus-threat/
G1JnSflr1YMOU06btlnbVJ/.
    \32\ Stephen Fowler, `` `It Was Very Chaotic': Long Lines, Voting 
Machine Issues Plague Georgia Primary,'' NPR, June 9, 2020, https://
www.npr.org/2020/06/09/873054620/long-lines-voting-machine-issues-
plague-georgia-primary.
---------------------------------------------------------------------------
    Offering robust voting-by-mail, early voting, and Election Day 
options to minimize confusion and risk are optimal, but many 
jurisdictions don't currently have the resources and/or personnel to 
offer these approaches. For example, Maryland Governor Larry Hogan 
decided last month that the State would hold a traditional election in 
November, offering many in-person voting locations and allowing voters 
to vote in their customary precincts. At the end of July, the President 
of the Maryland Association of Election Officials indicated that local 
election boards are experiencing tremendous difficulty in recruiting 
Election Day poll workers, with roughly 13,000 vacant positions State-
wide.\33\ On July 27, Howard County, Maryland Election officials 
reported that 491 people had signed up to serve as Election Judges for 
the general election, about a third of the number needed. By the time 
the county election board met soon thereafter, the number of confirmed 
Election Judges had dropped to 12 as Judges hurriedly withdrew their 
pledges to participate in the face of the pandemic.\34\
---------------------------------------------------------------------------
    \33\ Zach Montellaro, ``Coronavirus creates election worker 
shortage ahead of November,'' Politico, July 31, 2020, https://
www.politico.com/news/2020/07/31/coronavirus-election-worker-shortage-
389831.
    \34\ Emily Opilo and Talia Richman, ``Local election officials in 
Maryland look at slashing number of polling places due to election 
judge shortage,'' The Baltimore Sun, July 29, 2020, https://
www.baltimoresun.com/politics/bs-md-pol-polling-place-consolidation-
Governor-hogan-2020- 0729-4s3j7gq3afb3va57iwxpa24lcy-story.html.
---------------------------------------------------------------------------
    Additional resources from Federal authorities will help enormously 
with the administration of the 2020 Presidential election, but with 
fewer than 100 days to go until November 3, time is of the essence. As 
other experts have noted, more funding could enable election officials 
to procure personal protective equipment (PPE) to make in-person voting 
safer; purchase additional mailing, ballot, and postage supplies in 
preparation for the anticipated surge in absentee voting; conduct 
robust voter education campaigns so that voters are aware of how to 
vote safely; recruit and train needed poll workers; and identify 
additional polling places.\35\
---------------------------------------------------------------------------
    \35\ Statement of Kristen Clarke, Lawyers' Committee for Civil 
Rights Under Law, Senate Committee on Rules and Administration Hearing 
on ``2020 General Elections Preparations,'' July 22, 2020, https://
www.rules.senate.gov/imo/media/doc/Testimony_Clarke.pdf.
---------------------------------------------------------------------------
    New funding could also mitigate any cyber or technical-related 
problems that would impact the administration of the general election. 
While jurisdictions in 41 States and the District of Columbia use 
electronic pollbooks (EPBs) to verify voter eligibility at polling 
places, only 12 States and DC appear to require paper back-ups in case 
the EPBs malfunction.\36\ More funds could help more jurisdictions 
obtain paper back-ups for use if their EPBs become inoperable due to a 
cyber attack or technical glitch.\37\ To cite just one other example, 
localities with electronic voting machines could use funding to 
purchase extra provisional ballots in the event that their voting 
machines go down during the general election so that voters don't have 
to wait for extended periods of time following a system failure.\38\
---------------------------------------------------------------------------
    \36\ Edgardo Cortes, Elizabeth Howard, Lawrence Norden, Gowri 
Ramachandran, and Derek Tisler, ``Preparing for Cyberattacks and 
Technical Problems During the Pandemic: A Guide for Election 
Officials,'' Brennan Center for Justice, June 5, 2020, https://
www.brennancenter.org/our-work/research-reports/preparing-cyberattacks-
and-technical-problems-during-pandemic-guide.
    \37\ David Levine and Matthew Weil. ``20 for 20: 20 Ways to Protect 
the 2020 Presidential Election,'' Alliance for Securing Democracy and 
Bipartisan Policy Center, May 20, 2020, https://
securingdemocracy.gmfus.org/wp-content/uploads/2020/06/20-for-20-20-
Ways-to-Protect-the-2020-Presidential-Election.pdf.
    \38\ Ibid, 6.
---------------------------------------------------------------------------
                             v. conclusion
    Administering and securing a Presidential election is no small feat 
in ordinary times, and these times are anything but ordinary. Success 
will require a coordinated Nation-wide effort. Congress needs to 
provide election officials with additional funding to help them 
administer and secure the November election.
    Federal officials involved in helping secure and administer our 
country's elections need to continue to actively support the efforts of 
State and local election officials to, among other things, mitigate any 
efforts by foreign adversaries to interfere in our elections. And civil 
society and private sector actors need to work with Government entities 
to help fill any remaining gaps.
    Voters have a part to play as well. They must plan now for how they 
will vote in November. And if they want to vote in-person, they should 
give serious thought to serving as a poll worker.
    The late Congressman John Lewis once said, ``Your vote is precious, 
almost sacred. It is the most powerful nonviolent tool we have to 
create a more perfect union.''
    We urge Congress to do everything possible to ensure that every 
person who wants to exercise their right to vote can do so.
    Thank you.

    Mr. Richmond. Thank you, Mr. Levine.
    We now recognize Ms. Albert to summarize her statement for 
5 minutes.

 STATEMENT OF SYLVIA ALBERT, DIRECTOR OF VOTING AND ELECTIONS, 
                          COMMON CAUSE

    Ms. Albert. Good morning. Thank you, Chairman Richmond, for 
inviting me to testify today. Thank you to Chairman Richmond, 
Ranking Member Katko, and all Members of the subcommittee, for 
holding this critically important hearing.
    My name is Sylvia Albert, and I am the director of voting 
and elections at Common Cause, a National nonpartisan watchdog 
organization with 1.2 million supporters and more than 25 State 
chapters. For nearly 50 years, Common Cause has been holding 
power accountable through lobbying, litigation, and grassroots 
organizing. Common Cause fights to get big money out of 
politics, enhance voting rights, foster an open, free, and 
accountable media, strengthen ethics laws to make Government 
more responsive to the people, ensure a fair Census, and stop 
gerrymandering.
    The COVID-19 pandemic presents an unprecedented challenge 
to our democracy. We have long known that our decentralized 
voting systems mean that voters have vastly different voting 
experiences, depending on where they live. While the world 
varies, there is one thing that is uniform. There is no such 
thing as a perfect election. Long-standing disparities, 
including long lines, polling place closures, a ballot 
rejection rate, particularly in Black and Brown communities, 
are now exacerbated by the COVID-19 pandemic. The chasm between 
those with access to ballots and those with significant 
barriers to that access is growing larger. Voters of color, 
young voters, and first-time voters are on the losing end. 
Without proper funding, the problems seen in previous elections 
are going to be just the tip of the iceberg this November.
    While only a small percentage of the electorate 
participates in primaries, the 2020 primary season is a preview 
of the problems to come. There is no single solution to ensure 
a safe and secure election. However, by understanding this 
compounding issue, we can work to eliminate the barriers voters 
face. I want to highlight some of these issues, but for more 
detailed proof in my written testimony.
    In nearly every State that voted since the pandemic, we saw 
a dramatic increase in the use of mail-in ballots. One common 
issue was that ballots were mailed too late and some voters did 
not receive them at all. In many States, the infrastructure to 
process requests and produce ballots did not handle this huge 
increase.
    Expecting voters to vote-by-mail, election officials 
overconsolidated poll locations. When they were unable fulfill 
the requests for absentee ballots, voters were forced to vote 
in person at a small number of polling locations that were, 
therefore, overrun.
    For example, Pennsylvania's 2 most populous counties, 
Philadelphia and Allegheny, shifted for more than 2,100 polling 
places to fewer than 500, resulting in confusion and long 
lines. In addition, the polling places chosen for consolidation 
were not done equitably or with regard to the disparity of 
mail-in ballot applications.
    In addition, voting machine failures led to 
disenfranchisement. Problems were particularly wide-spread in 
Georgia, ranging from machines not working to polling locations 
not having enough machines, or when machines go down, there is 
not--there was not enough paper ballots available to meet the 
demand. As a result, voters had no choice but to wait in line 
or not vote.
    To be clear, with the correct implementation of resources, 
running an election that gives voters safe and secure options 
to vote-by-mail and in person if it is possible, but time is 
running out.
    During an election, officials have long tried to make 
voting more difficult for Black and Brown communities. Impacts 
in these efforts are greater exacerbated in a global pandemic. 
However, there are solutions that will create systemic change.
    Most importantly, it is going to take significantly more 
resources for States to run effective elections in the COVID-19 
environment. To address each of the problems discussed, States 
need not only to adopt the policies, but also to have the funds 
necessary to execute those policies. One study estimates this 
cost to be $4 billion. Senate Republicans must follow the 
House's lead and allocate $3.6 billion in election funding.
    Second, even prior to the pandemic, 70 percent of election 
officials reported that it was difficult to staff polling 
locations. In addition, many traditional polling locations are 
no longer available.
    Members of Congress can help recruit poll workers and find 
new polling locations by putting out requests on social media, 
doing PSAs, and using their extensive network to encourage this 
important civic engagement.
    Third, H.R. 1 includes many strong protections for voters, 
including the Voter Empowerment Act, which Congressman Lewis 
long championed. We appreciate Chairman Richmond cosponsoring 
and voting for H.R. 1 when it passed the House in March 2019, 
and we continue to strongly urge Senator McConnell to bring it 
up for a vote in the Senate.
    Finally, as we approach the 55th anniversary of the Voting 
Rights Act later this week, I can't think of a better way to 
honor the life of Congressman John Lewis than by having the 
Senate follow the House's lead and pass the John Lewis Voting 
Rights Advancement Act.
    Voters should not be forced to choose between their health 
and their right to vote. With the election less than 3 months 
away, we need Congress to act now. In order to ensure the 2020 
election is safe, secure, accessible, and fair, Congress must 
invest so States and localities can implement critical voting 
system changes that this pandemic demands. Thank you.
    [The prepared statement of Ms. Albert follows:]
                  Prepared Statement of Sylvia Albert
                             August 4, 2020
                              introduction
    Thank you, Chairman Richmond, for inviting me to testify before the 
House Homeland Security Subcommittee on Cybersecurity, Infrastructure 
Protection, and Innovation. Thank you to Chairman Richmond, Ranking 
Member Katko, and all Members of the subcommittee for holding this 
critically important hearing. My name is Sylvia Albert, and I am the 
director of voting and elections at Common Cause, a National 
nonpartisan watchdog organization with 1.2 million supporters and more 
than 25 State chapters. For nearly 50 years, Common Cause has been 
holding power accountable through lobbying, litigation, and grassroots 
organizing. Common Cause fights to get big money out of politics, 
enhance voting rights, foster an open, free, and accountable media, 
strengthen ethics laws to make Government more responsive to the 
people, ensure a fair Census, and stop gerrymandering.
    Common Cause was founded by John Gardner, a Republican, at a time 
when Republicans and Democrats worked together on the most pressing 
issues of the day. During the 1970's, Common Cause worked with many 
Members of Congress--Democrats and Republicans alike--who put country 
over party, and we were able to help pass major democracy reforms that 
sought to correct some of the most egregious abuses of power, including 
the Federal Election Campaign Act, the Ethics in Government Act, and 
Voting Rights Act reauthorizations, which are still extremely 
consequential to this day.
    The COVID-19 pandemic presents an unprecedented and different kind 
of challenge to our democracy. Under normal circumstances, conducting 
elections is a collection of choreographed large-scale productions. 
With more than 10,000 election jurisdictions Nation-wide, our 
decentralized voting system is in the hands of local and State election 
officials. While the mechanisms and rules vary across the country, 
there is one thing that is uniform--there is no such thing as a perfect 
election. Voters' experiences reveal the cracks in the foundation that 
infringe on their right to vote. These cracks can be seen in the 
adoption of policies that create significant barriers to voting for 
certain individuals, especially Black and Brown voters. They can be 
seen in election administration choices that lead to long lines, 
polling place closures, and ballot rejections at higher rates in Black 
and Brown communities. These cracks have always existed. The crisis we 
are currently facing is exposing the weaknesses in the system that have 
previously been hidden from much of the electorate. COVID-19 is 
exacerbating these cracks and widening the chasm between those with 
access to the ballot and those with significant barriers to that 
access. Without proper funding, guidance, and preparedness, the 
problems seen in previous elections are going to be just the tip of the 
iceberg this November.
                             2020 primaries
    The 2020 primary season gave us a small preview of the problems to 
come. Keeping in mind that only a small percentage of the electorate 
participates in primaries, we know that the issues we saw will grow 
exponentially if proper preparation isn't made before November. The 
problems we saw did not exist in a vacuum. Each issue, from poor 
election management, to faulty voting machines, to lack of poll 
workers, affects each other. There is neither one problem nor one 
solution to ensure a safe, secure, free, and fair election. However, by 
understanding the compounding issues, we can work to eliminate the 
barriers voters face from making their voices heard.
    As a member of the Election Protection coalition, a National group 
of National and local organizations that help voters who experience 
problems casting their ballots through a suite of vote protection 
hotlines and other tools, we at Common Cause have seen many of these 
issues play out not only in the last few months, but in all recent 
elections. The COVID-19 pandemic has only made problems worse.
Polling place consolidations
    As State and local governments dealt with a dramatic increase in 
mail-in voting, a shortage of poll workers, and attempts to follow 
public health guidelines, we saw many polling place consolidations 
across the country. Overconsolidation in the current environment can 
have drastic results.
    Pennsylvania's two most populous counties, Philadelphia and 
Allegheny, shifted more than 2,100 polling places open in a typical 
election to fewer than 500, resulting in confusion, long lines, and 
inaccessibility for voters with disabilities. In addition, the choices 
with respect to consolidation were not done equitably, or with regard 
to the disparities in mail ballot applications. In some counties, such 
as Allegheny County, mail ballot applications were more likely received 
from white voters, so non-white voters were faced with voting in-person 
at more consolidated locations.
    In New Mexico, only 381 out of the 548 polling locations were open, 
which was particularly challenging for the Native population that is 
suffering from COVID-19 at a much higher rate than the rest of the 
State. In Rhode Island, only 47 polling places of the 144 that were 
open in 2016 were available to voters. In Washington, DC, only 20 of 
the 144 polling places from 2016 were open. In Nevada's June 9 
primaries, which was conducted primarily by mail, only 3 polling places 
were open for the Las Vegas area's 1.3 million voters, contributing to 
long lines. In Richland County, SC, polling place consolidation coupled 
with poll worker shortages led to long lines for the State's June 9 
primary. Polling place consolidations in Wisconsin for the State's 
April 7 elections received wide-spread media coverage because of the 
drastic changes. In Milwaukee, just 5 of the normal 180 voting 
locations were open, and in Green Bay, only 2 out of the normal 31 were 
open.
    These are just not facts and figures either. These problems affect 
real people and voters across the country. Amina M., a Wisconsin voter 
who had given birth only 2 weeks earlier, waited over 2 hours in line 
in Milwaukee, fearing for her health. Layato G, a voter in Fulton 
County, Georgia, told Common Cause her story during our election 
protection efforts, and her story was not unique. She requested an 
absentee ballot, but it never arrived so she was forced to vote in 
person. When she arrived at her polling place, she found out there were 
problems with the voting machines and ended up waiting in line to vote 
for 3 hours. When she was finally able to cast her ballot, she was 
forced to vote on a provisional ballot because she had been marked as 
an absentee voter in the pollbook. Because of this confusion, she left 
the polling place without assurance that her vote would even be 
counted.
    When coupled with the roll-out of new vote-by-mail procedures, 
election officials' inability to process absentee ballot applications 
in a timely manner, new voting machines, a lack of voter education, and 
a global pandemic, long lines and confusion were a foreseeable outcome 
of overconsolidation. Again, no issue exists in a vacuum. Decisions 
around polling place closures must be made in consideration of all of 
the other pieces of election administration, and the needs and wants of 
the community. Closing a polling location should never be the first 
option considered in changes to election administration.
Administration of Increased Vote by Mail Usage
    In nearly every State that voted since the COVID-19 pandemic 
outbreak, we saw a dramatic increase in the use of mail-in ballots. In 
Washington, DC, more than 60 percent of ballots cast in the 2020 
primary were by mail, compared to just 7 percent in the 2016 primary. 
In Iowa, 410,000 people voted absentee in the 2020 primary, compared to 
38,000 in the 2016 primary. In Pennsylvania, more than 1.8 million 
people requested absentee ballots, compared to just over 100,000 from 4 
years ago, thanks to Pennsylvania's recent law expanding absentee 
ballot use. In Georgia, election officials saw a 2,500 percent increase 
in voting-by-mail from the 2016 primary. In West Virginia, more than 
262,000 voters requested an absentee ballot compared to 6,700 requests 
in 2016.
    Unfortunately, States were not equally prepared to handle this 
influx. Voting-by-mail is a solution that has been tried and tested in 
States across the country, but many of the primary States were trying 
to implement and process a level of mail-in voting that took Colorado, 
Oregon, Washington, and Utah years to get to. To be clear, with the 
correct implementation, administration, and resources, running an 
election mostly by mail is possible, but time is running out, and 
States must act now.
    The challenges we saw with voting-by-mail varied from State to 
State. One common issue we saw was that ballots were mailed too late to 
voters and that some voters did not receive them at all. In many of the 
States that recently expanded vote-by-mail options because of COVID-19, 
the infrastructure to process requests and produce ballots was not 
fully implemented to deal with the huge increase of mail-in ballot 
requests. Expecting voters to use the mail, election officials 
overconsolidated polling locations. When they were unable to fulfill 
the requests for absentee ballots, voters were forced to vote in person 
at a small number of polling places that were therefore overrun.
    In Maryland, for example, ballots were mailed to all of the State's 
3.5 million registered voters, but at least 1 million of those ballots 
were delayed in Baltimore City and Montgomery County. In both of those 
localities, people of color make up a majority of the population. In 
Pennsylvania, the complaint heard overwhelmingly from voters was that 
they requested their absentee ballot, had not received it, and were 
risking their health to vote in person. Indiana, Rhode Island, and 
Georgia had similar challenges with ballots being mailed late.
    Another issue with rapidly expanding mail-in voting are the use of 
strict return deadlines, such as Indiana's deadline for voters to drop 
off their ballots that they could or wish not to mail by 12 p.m. on 
Election Day, even though the polls didn't close until 6 p.m. In 
Virginia, over 5 percent of absentee ballots were rejected for arriving 
after Election Day. For Pennsylvania's June 2 primary, the State's 
inability to process absentee ballot applications and provide voters 
with an absentee ballot led Governor Tom Wolf to extend the deadline 
for receiving mail-in ballots in some counties until Tuesday June 9 as 
long as they were postmarked by Election Day. As a result, tens of 
thousands of ballots were counted that would have been rejected.
    As voters exercise their right to vote in a new manner, there are 
bound to be mistakes made. There is a learning curve, and 
implementation which educates and assists voters is vital. 
Unfortunately, without this, voters using mail-in voting saw their 
ballots rejected at high rates. In the April primary in Wisconsin, 
23,000 ballots were rejected, mostly because voters or their witness 
missed one line on the form. These voters did not receive notice of the 
mistake or given an opportunity to address it--their votes were simply 
not counted. Wisconsin's experience is not unique. In New York, as many 
as 28 percent of ballots in parts of Brooklyn were rejected. Seven 
percent of absentee ballots were rejected in Kentucky's primary and 
6,700 Nevada voters had their ballots rejected because officials could 
not verify signatures. These ballot rejections do not affect all 
communities equally. Disproportionate numbers of young people, people 
of color, and first-time voters have their ballots rejected. We must do 
more to ensure that voters can vote a ballot and have confidence that 
it will be counted.
    While all the issues we saw with mail-in voting can be solved by 
November with proper funding, planning, and processes, we should not 
lose sight of the dramatic increases in people wanting to vote-by-mail, 
which is a good thing. It is clear that many people want to vote-by-
mail given the COVID-19 pandemic, and now election officials must make 
the appropriate changes to ensure they are prepared to handle a 
dramatic increase in mail-in ballot requests for November. State and 
Federal lawmakers must also provide the adequate resources to make this 
happen, and implement policies that notify voters of any issues with 
their ballots, and allow them the opportunity to cure.
Technology Problems
    The pandemic also coincided with the rollout of new voting 
equipment in various States, such as Georgia and Pennsylvania. While 
States with new equipment were not the only ones to encounter problems, 
their problems were more severe and wide-spread. In deploying any 
machinery during elections, jurisdictions must have resiliency plans to 
deal with unforeseen events while protecting voters' access. Election 
jurisdictions that only deploy machines to vote must have emergency 
ballots and provisional paper ballots on hand in the event that the 
primary voting system fails and no one can vote or only a few people 
can vote at a time. Unfortunately, during the primary elections, 
machine failures and a lack of paper backup ballots led voters to be 
disenfranchised.
    Several States, including Georgia, Pennsylvania, and Indiana, saw 
voting machine glitches and failures which contributed to further long 
lines. Voting machine problems in Georgia were particularly a wide-
spread problem. Issues ranged from machines not working to polling 
locations not being staffed with enough machines, both which 
contributed to long lines. Unfortunately, election officials were 
warned that this would happen and did not listen. In February, Common 
Cause and the Brennan Center for Justice submitted comments to the 
office of Secretary of State Brad Raffensperger with specific 
recommendations on managing the 2020 elections. Included in these 
comments was both a call for more voting machines in polling locations 
and a clear warning that Georgia's new voting machines could fail on 
Election Day and that emergency back-up paper ballots were needed. 
Regardless of the warning, these actions were not taken. When machines 
went down, there were not enough paper ballots available to meet the 
demand, despite a legal settlement in 2019 that required greater 
numbers of paper emergency ballots be available. Polling places did not 
have ``ballot on demand'' printers that could print out ballots once 
the original supply of paper ballots was depleted. As a consequence of 
the shortage, voters had no choice but to wait in line or not vote.
Lack of Poll Workers
    A dearth of poll workers is a long standing problem in the United 
States that has been exacerbated by COVID-19. In the 2018 Election 
Administration and Voting Survey, 70 percent of election officials 
reported that it was difficult to staff polling locations with an 
adequate number of poll workers. These poll workers, with an average 
age of 60, are overwhelmingly at high risk for COVID-19 and unable to 
work the polls without danger.
    David B. of Kentucky is another voter Common Cause contacted in our 
election protection efforts. David was a long time poll worker, but 
decided he should not work the polls in the 2020 primary election 
because, as an older American, he was more vulnerable to COVID-19. 
David is not alone in the thousands of poll workers across the country 
who rather not expose themselves to this pandemic--and although we 
desperately need poll workers like David, we cannot force people to 
choose between their health and the willingness to volunteer.
    As mentioned earlier, all these problems play off one another. When 
a significant number of voters who requested absentee ballots but did 
not receive them decided to vote in person, they voted in consolidated 
polling places, some with faulty voting equipment and a shortage of 
poll workers, all of which led to long lines for voters. In some cases, 
like in Georgia, the poll worker shortages and confusion over polling 
place consolidation led to voting locations not opening on time on 
Election Day.
                               solutions
    As election experts can attest, the majority of these problems are 
not new. Certain election officials have long tried to make voting more 
difficult for Black and Brown communities. It is especially appalling, 
though, that in the midst of a global pandemic, certain election 
officials are trying to suppress the votes and voices of largely Black 
and Brown communities. In many cases, the coronavirus pandemic is 
simply exposing these problems for all to see. It is also clear that 
there is neither one problem nor one solution to problems witnessed in 
the primaries. However, there are several short-term solutions, as well 
as a number of legislative solutions that would get to the root of many 
of these problems and create systemic change.
    Members of Congress can help recruit poll workers and find new 
polling locations.--Given the significant shortage of poll workers this 
year, Members of Congress are encouraged to use various platforms to 
help recruit new poll workers. Putting out requests on social media, 
doing PSAs, and using their extensive email lists can be effective ways 
to attract new poll workers. Additionally, because some in-person 
polling locations that have previously been used may no longer be 
conducive to social distancing, Members of Congress can play an 
important role in identifying and connecting with venues in their 
district, such as sports stadiums and other large buildings that could 
provide social distancing for voters, that could serve as polling 
locations.
    Additional election funding.--As many States and localities face 
huge budget deficits caused by the pandemic, our democracy is not 
immune. Because many elections officials essentially have to prepare 
for 2 different elections (one conducted by mail and one for in-person 
voting) this November, States and localities need additional resources 
to ensure no one is disenfranchised. To address each of the problems 
discussed above, States need not only to adopt good policies, but also 
have the funds necessary to execute those policies. The CARES Act 
passed and signed into law in March provided $400 million for States to 
administer their elections, but it is going to take significantly more 
resources for States to run efficient elections in the COVID-19 
environment. One study estimates the cost of the 2020 election during 
the COVID-19 pandemic to be $4 billion.
    In May, the U.S. House passed the HEROES Act, which includes an 
additional $3.6 billion in election funding, a modest investment in our 
democracy to help States and localities prepare to run their elections 
during the pandemic. It was unconscionable that the recently released 
``HEALS Act'' from Senate Republicans contained no funding for our 
elections, yet included billions of dollars for fighter jets and other 
extraneous causes. Senate Republicans must immediately pass $3.6 
billion in election funding to ensure that hundreds of thousands or 
even millions of voters are not disenfranchised this year. With less 
than 3 months until the November election, Congress must act now so 
States have enough time to make the necessary changes and plans, 
recruit and train workers, buy equipment, and do outreach to the public 
about new voting processes.
    H.R. 1, the For the People Act.--H.R. 1 includes many extremely 
strong protections for voters, such as on-line voter registration, 
same-day (also known as ``Election Day'') registration, and automatic 
voter registration to ensure that voters can safely and securely 
register to vote during the pandemic. Each of these provisions allows 
for voters to have more opportunities, in the face of challenges 
(brought on by COVID for some, but always in existence for others) to 
be able to vote and have confidence that it will count. The For the 
People Act also includes the Deceptive Practices and Voter Intimidation 
Prevention Act to deter bad actors from trying to spread false 
information about voting. And importantly, the For the People Act 
includes the Voter Empowerment Act, which Congressman Lewis long 
championed. We very much appreciate Chairman Richmond cosponsoring and 
voting for H.R. 1 when it passed the House in March 2019, and we 
continue to strongly urge Senator McConnell to bring it up for a vote 
in the Senate.
    H.R. 4, the John Lewis Voting Rights Advancement Act.--Before 
elections officials close, move, or consolidate polling locations or 
make other changes to voting procedures, covered jurisdictions with a 
history of discrimination would need sign-off from the Department of 
Justice to ensure that these changes aren't being made for 
discriminatory purposes. Five previous Voting Rights Act 
reauthorizations were signed into law by Republican presidents, most 
recently by President George W. Bush in 2006. As we approach the 55th 
anniversary of the Voting Rights Act later this week, I can't think of 
a better way to honor the life of Congressman John Lewis by having the 
Senate follow the House's lead and pass the John Lewis Voting Rights 
Advancement Act.
                               conclusion
    Voters should not be forced to choose between their health and 
their right to vote. With the 2020 election less than 3 months away, we 
need Congress to act now to help protect our elections so all voters 
can have their voices heard and votes counted. In order to ensure the 
2020 elections are safe, secure, accessible, and fair, Congress must 
make modest investments so States and localities can implement critical 
voting system changes that this pandemic demands of us. At a bare 
minimum, we urge Senate Republicans to listen to the hundreds of 
thousands of Americans who have contacted their offices to urge them to 
support additional election funding.
    And if there's a more reform-minded Senate and administration next 
year, Congress must pass critical reforms like H.R. 1 and H.R. 4. As 
President Obama made plain just last week, the fight for a more just 
and responsive democracy demands we continue the march of John Lewis. 
We must ensure all voices can be heard in our democracy by restoring 
voting rights, enacting automatic voter registration, and ending 
partisan gerrymandering, as H.R. 1 and H.R. 4 would do. And if 
Republicans refuse, we must cast aside the filibuster as the ``Jim Crow 
relic'' it represents. Thank you.

    Mr. Richmond. Thank you, Ms. Albert, for your testimony.
    I now recognize Ms. McReynolds to summarize her statement 
for 5 minutes.

   STATEMENT OF AMBER MC REYNOLDS, CHIEF EXECUTIVE OFFICER, 
                NATIONAL VOTE AT HOME INSTITUTE

    Ms. McReynolds. Thank you, Mr. Chairman, Members, and 
staff. Thank you for inviting me to provide testimony about the 
resiliency and readiness of our election systems during this 
unprecedented public health crisis.
    The pandemic has appended all aspects of our lives, and the 
voting process is no different. Simply put, our democracy is 
essential, and we must do everything we can to ensure our 
election system is ready, resilient, and secure. Let me be very 
clear: Election officials are working each and every day to 
make this happen, even in extraordinary and extremely 
challenging circumstances, and often with one hand tied behind 
their backs, due to outdated laws and a lack of funding and 
resources.
    Extraordinarily long lines or other challenging 
circumstances that voters often face, even prior to this year, 
are usually the most visible symptoms of a policy or resource 
problem.
    Election officials have responded to difficult 
circumstances with little support, and will attempt to do so 
again this year, but this year is unprecedented. They need 
support from elected leaders that have the power to help. They 
are on the front lines delivering democracy to all voters in 
small towns and metro areas across the United States. It is 
only right that policy makers, not only at the Federal level, 
but also at the State level, respond to their needs. 
Extraordinary challenges call for extraordinary solutions.
    What is clear to me during this pandemic and other 
challenges we have faced as a Nation is that Americans are 
resilient, and we need a voting process that is proven, 
resilient from a pandemic, from unfairness, from barriers, from 
foreign adversaries, from administrative deficiencies, and from 
outdated policies that create challenges. We need a system that 
can withstand all of those issues.
    The fact is the pandemic has exposed challenges in most 
States historical reliances on in-person voting on one single 
day that requires a large number of people and resources to 
manage. In too many primary States this year, the closure of 
polling places, poll worker shortages, long lines, insufficient 
training, and voters' reluctance to enter crowded environments, 
along with surges, unprecedented surges in absentee ballot 
requests that went unfilled due to the administrative burdens 
to process, left many voters unable to safely exercise their 
fundamental right to vote.
    It is our elected leaders' responsibility to ensure that 
our democracy functions, and that all voters have access to 
participate. Enabling voting-at-home options is one way to 
solve the challenges election officials, and by extension, 
voters, face during this pandemic. Voting-by-mail is proven, 
time-tested, and secure, and it dates all the way back to the 
Civil War.
    The mail ballot model, as designed, puts voters first, and 
has proven to be resilient during both natural disasters and 
the current pandemic. It is possible to improve to improve the 
voting experience, streamline administrative processes, enhance 
security, all while conserving valuable resources, increasing 
turnout, and increasing trust in Government. Voters have been 
voting this way at home, safely and securely for decades, in 
many States. From Utah to Colorado, California, Oregon, 
Washington, now Washington, DC, Vermont, and now Nevada, after 
this weekend, policy makers have acted to ensure voters have a 
clear range of options to vote safely and securely, because no 
one should have to choose between voting and protecting their 
health.
    What does this process look like? In the 8 States plus 
District of Columbia, as of August of this year, just recently 
Nevada passed, voters will be mailed a ballot in advance of the 
election and have multiple options to return that ballot.
    In the rest of the States, voters can request a ballot to 
be mailed to them. A small number of those States still require 
an excuse to be provided with the ballot request, and even 
fewer still limit options based on the voter's age.
    But every single State offers an option to vote at home. 
Whether you call it absentee, vote-by-mail, mail-in ballots, it 
means that a ballot is being sent to the voter by mail, the 
voter completes the ballot, and the ballot is returned. This 
method of voting has been proven to be safe and secure, and it 
includes strong safety measures to ensure the authenticity of 
the ballots, and in some States, this includes ballot tracking 
from the day the ballots are mailed all the way through when 
they are processed.
    Now, as a couple of notable considerations, and as you 
mentioned the CISA report, the CISA report that was released on 
Friday that talked about the importance of securing vote-by-
mail systems noted that disinformation risks to mail-in voting 
infrastructure and processes is similar to that of in-person 
voting while utilizing different content. Threat actors may 
leverage limited understanding regarding mail-in voting to 
mislead and confuse the public. This includes casting doubt 
without evidence about the mail ballot process, thus combating 
disinformation and misinformation is a critical aspect of 
election officials' work to secure the election. Expanding 
vote-at-home options is nonpartisan and supported by leaders on 
both sides of the aisle.
    A second notable consideration is the recent changes to the 
USPS processes and delivery time lines that will have a 
significant impact on our election process, regardless of the 
voting method. Mail ballots are just one piece of how the Post 
Office supports election infrastructure. Federal and State laws 
have legal mandates with regards to sending voter registration 
information, ballot issue notices, election information, poll 
worker appointment letters, polling place notification cards, 
signature cards, address update notifications, and other 
required mailings.
    All of these legally required mailings are at risk if the 
Post Office is not able to process mail effectively, or 
experiences delays.
    Some States have also not updated their laws with regards 
to processing, ensuring adequate time to process ballots. These 
States include Michigan, Pennsylvania, Wisconsin, New York, 
Maryland, and Alabama, and others. This is exactly why we have 
seen delays in election results because election officials 
don't have adequate time to process ballots in advance of 
Election Day.
    As with every part of our election system, we must be able 
to deter, detect, and hold accountable any bad actor who tries 
to interfere with our election process.
    While voter fraud is exceedingly rare in elections 
regardless of voting method, it is critical for election 
officials to detect malicious activity, and for voters to 
report suspicious activity to the appropriate authorities.
    Our democracy functions when every eligible voter is able 
to exercise their right to vote. Voters have already chosen to 
vote at home in record numbers in the primaries, and they will 
continue to do so.
    Our democracy is essential, and we need to be sure that our 
systems are secure from any interference and any misinformation 
and disinformation as noted in the CISA report on Friday.
    No election system is perfect, and this is why it is 
critical to continually review and improve systems by enhancing 
security access transparency, particularly in this 
unprecedented time. An example of the necessary improvement is 
the implementation ballot tracking system that many States are 
working on right now. Another example is advanced auditing 
techniques, such as risk-limiting audits. We cannot settle for 
when this moment and this unprecedented crisis calls us to do 
better.
    Democracy is the shared DNA of our Nation, to our people, 
to our communities. We must do everything we can to ensure that 
the elections are secure. Going into November, election 
administration must be about who votes, not who wins. You have 
the authority to create a path for the American people and for 
the American Democratic method that voters of all stripes can 
be confident in. Let's do that together. Thank you.
    [The prepared statement of Ms. McReynolds follows:]
                 Prepared Statement of Amber McReynolds
                             August 4, 2020
    Chairman, Members & staff, thank you for inviting me to provide 
testimony about the resiliency and readiness of our election systems 
during this unprecedented public health crisis.
    The pandemic has upended all aspects of our lives and the voting 
process is no different. Simply put, our democracy is essential and we 
must do everything we can to ensure our election system is ready, 
resilient, and secure. Let me be clear: Election officials are working 
each and every day to make this happen, even in extremely challenging 
circumstances and often with one hand tied behind their backs due to 
outdated laws and a lack of funding and resources. Extraordinarily long 
lines or other challenging circumstances that voters often face are 
usually the most visible symptoms of a policy or a resource issue. 
Election officials have responded to difficult circumstances with 
little support and will attempt to do so again this year. But this year 
is unprecedented. They need support from elected leaders that have 
power to help. They are on the front lines, delivering democracy to all 
voters in small towns and in metro areas, and it is only right that 
policy makers respond to their needs. Extraordinary challenges call for 
extraordinary solutions.
    What is clear to me during this pandemic and other challenges we 
have faced as a Nation is that Americans are resilient, and we need a 
voting process that is proven--resilient from a pandemic, from 
unfairness, from barriers, from foreign adversaries, from 
administrative deficiencies, and from outdated policies that create 
challenges. We need a system that can withstand all.
    The fact is the pandemic has exposed challenges in most States' 
historical reliances on in-person voting on one single day that require 
a large number of people and resources to manage. In too many primary 
States this year, the closure of polling places, poll worker shortages, 
long lines, insufficient training, and voters' reluctance to enter 
crowded environments threaten the ability to vote in-person, and surges 
in absentee ballot requests that went unfulfilled left many voters 
unable to safely exercise their fundamental right to vote. It is our 
elected leaders' responsibility to ensure our democracy functions and 
all voters have access to participate. Enabling voting at home options 
is one way to solve the challenges election officials and by extension, 
voters face during this pandemic. Voting-by-mail is proven, time-
tested, and secure, and it dates back to the Civil War.
    The mail ballot model puts voters first and has proven to be 
resilient during both natural disasters and the current pandemic. It is 
possible to improve the voting experience, streamline the 
administrative process, enhance security, all while conserving valuable 
resources, increasing turnout, and increasing trust in Government. 
Voters have been voting this way at home safely and securely for 
decades in many States. From Utah, to Colorado, California, Oregon, 
Washington, DC, Vermont, and now Nevada, policy makers have acted to 
ensure voters have a clear range of options to vote safely and 
securely. No one should have to choose between voting and protecting 
their health.
    What does the process look like?
    1. In 8 States plus DC (CA, CO, DC, HI, NV, OR, UT, VT, and WA, all 
        as of August 2020) voters will be mailed a ballot in advance of 
        the election and have multiple options to return their ballot 
        at a secure drop box, voting location, or by mailing the ballot 
        back through the postal service.
    In the rest of the States, voters can request that a ballot be 
        mailed to them. A small number of those States still require an 
        excuse to be provided with the ballot request, and even fewer 
        still limit options based on a voter's age.
    Every State offers an option to vote from home. Whether you call it 
        absentee, vote-by-mail, mail-in ballots--it means that a ballot 
        is being sent to the voter by mail, the voter completes the 
        ballot, and the ballot is returned.
    2. Voting at home is a safe and secure method of voting and the 
        process includes strong security measures that ensure the 
        authenticity of ballots. In some States, the process includes 
        tracking ballots from the day they are printed to the day they 
        are processed. Just like tracking a package ordered on-line.
    3. Accurate voter information is key, which requires that election 
        officials have the latest address information for each voter. 
        Most States share information on voter movement across State 
        lines, others directly contact voters based on mail forwarding 
        designations, death records, motor vehicle registrations, and 
        more to make sure voter information is accurate.
    4. Your ballot is as unique as you are: Every voter gets a ballot 
        with barcodes on the envelope that correspond to the individual 
        voter and the voter's address. The ballot itself has a 
        removable stub, the information for the specific election, 
        precinct style, and other variables depending on the State.
    5. Once ballots are dropped off, they go through a verification 
        process: During the process, election officials make sure that 
        the voting record of each voter is marked and that the ballot 
        envelope is verified before the ballot is counted, much like 
        when a voter checks in at their polling location.
    6. The ballot is then extracted from the envelope. The extraction 
        process protects voter privacy, while maintaining the voter's 
        identity in the barcoding process for security. Audits are 
        conducted at each step and these audits ensure that every 
        eligible vote received in the designated time frame is counted.
    7. Then the ballots are sent to the counting room and at this 
        point, state-of-the-art scanning equipment counts each batch of 
        ballots. Voter intent issues on ballots (such as stray marks) 
        are flagged for review and resolved by election officials.
    8. Signature verification is a best practice security measure when 
        combined with appropriate processes: Voters sign their ballot 
        the same way they sign other legal documents, and that 
        signature is verified against other official signatures on 
        record. When done according to best practices like 
        demographically blind review, signature verification is an 
        important security measure that leads to greater election 
        confidence. Also voters with signature issues are given the 
        opportunity to ``cure'' their ballots, meaning that they are 
        able to directly verify the authenticity of their ballot.
    Notable considerations:
    1. As noted in the CISA Report released on Friday, ``Disinformation 
        risk to mail-in voting infrastructure and processes is similar 
        to that of in-person voting while utilizing different content. 
        Threat actors may leverage limited understanding regarding 
        mail-in voting to mislead and confuse the public.''
        a. This includes casting doubt without evidence about the mail 
            ballot process.
    Thus, combatting disinformation and misinformation is a critical 
        aspect of election officials' work. Expanding vote-at-home 
        options is nonpartisan and supported by leaders on both sides 
        of the aisle.
    2. Changes to USPS processes and delivery time lines will have a 
        significant impact on our election process, regardless of 
        voting method. Mail ballots are just one piece of how the USPS 
        supports election infrastructure. Federal and State laws have 
        legal mandates with regards to sending voter registration 
        information, ballot issue notices, election information, poll 
        worker appointment letters, polling place notification cards, 
        signature cards, address update notifications, and other 
        required mailings. All of these legally required mailings are 
        at risk if the post office is not able to process mail 
        effectively or experiences delays.
    3. Some States, such as MI, PA, WI, NY, MD, and AL, have not 
        updated certain election laws and processes to ensure adequate 
        time to process mail ballots, hence recent delays with election 
        results. Local election officials have repeatedly highlighted 
        this gap, and policy makers have not made these necessary 
        adjustments even though they are simply operational, and not 
        partisan. States still have time to close these holes, and 
        support election officials.
    4. As with every part of our election system, we must be able to 
        detect, deter, and hold accountable any bad actor who tries to 
        interfere with the election process or with an individual 
        voter. While voter fraud is exceedingly rare in elections 
        regardless of voting method, it is still critical for election 
        officials to detect malicious activity and for voters to report 
        suspicious activity to appropriate authorities.
    Our democracy functions well when every eligible voter is able to 
exercise their right to vote.
    Voters have already chosen to vote at home in record numbers in the 
primaries. Recent surveys show that an extraordinary number of voters 
are choosing to vote from home this November as well. Voters--the 
customers of our democracy--are sending a very clear message about how 
they want to vote; policy makers must respond to the needs of election 
officials to ensure they have the resources to serve voters 
effectively.
    No election system is perfect, and this is why it is critical to 
continually review and improve systems by enhancing security, access, 
and transparency, particularly in this unprecedented time. An example 
of a necessary improvement is the implementation of ballot tracking 
systems that provide accountability to voters about the status of their 
ballot and give election officials an ability to track ballots through 
the process. Another example is advanced auditing techniques such as 
risk-limiting audits. We cannot settle when the moment calls for us to 
do better.
    Democracy is the shared DNA of our Nation, to our people, to our 
communities. We must do everything we can to ensure that it works for 
all, even in this most trying time. Going into November, election 
administration must be about who votes, not who wins. You all have the 
opportunity to create a path forward for the American people, and for 
an American democratic method that voters of all stripes can be 
confident in. Let's do that together.

    Mr. Richmond. Thank you for your testimony.
    Finally, I recognize Mr. Gilligan to summarize his 
statement for 5 minutes.

 STATEMENT OF JOHN M. GILLIGAN, PRESIDENT AND CHIEF EXECUTIVE 
          OFFICER, CENTER FOR INTERNET SECURITY, INC.

    Mr. Gilligan. Chairman Richmond, Ranking Member Katko, and 
Members of the subcommittee, thank you for the invitation to 
appear before this important committee.
    My name is John Gilligan. I am the chief executive officer 
of a nonprofit Center for Internet Security, or CIS. For the 
past 10 years, CIS has had the privilege of operating the 
monthly State Information Sharing and Analysis Center, the 
cyber threat and best practice sharing organization consists of 
nearly 10,000 State, local, Tribal, and territorial government 
organizations.
    In 2018, CISA was asked to establish a parallel 
organization focused on U.S. election organizations. The 
Elections Infrastructure Information Sharing and Analysis 
Center or EI-ISAC is now fully operational, and has more than 
2,600 State and local organizations as members. Today, I will 
share my views about the progress that has been made in 
protecting our Nation's elections' infrastructure from cyber 
threats.
    In the summer of 2016 and into 2017, many elections' 
jurisdictions had immature technology security capabilities, 
limited cybersecurity awareness and education, and insufficient 
collaboration among key stakeholders at the Federal, State, and 
local levels. In early 2018, DHS, the Elections Assistance 
Commission, or EAC and the State and local elections officials 
came together to jointly take on a series of actions to improve 
the security of our elections' infrastructure. Information of 
the EI-ISAC was one of these actions.
    In addition to the cybersecurity activities that State and 
local election officials undertake on their own, today the 
technical protections deployed across the elections' 
infrastructure have significantly improved since 2018. I will 
highlight 3 of these technologies, comprising a layered, cyber-
defense approach, each funded, at least in part, to 
Congressional appropriation.
    First is the deployment of the Albert Network Monitoring 
sensors at every State-level elections organization and a total 
of 270 Albert Network Monitoring devices deployed to local 
elections offices.
    Second, an endpoint detection and response program with the 
deployment of cyber sensors for individual systems in the 
elections infrastructure. Thousands of these sensors are being 
deployed as we speak.
    Third, a capability called malicious domain blocking and 
reporting that prevents elections offices' computers from 
connecting to known malicious sites.
    In the area of cyber awareness and education, a set of 
broad initiatives has enhanced elections officials' 
understanding of cyber attacks and what they should do to 
assess their organization's cyber readiness. Conferences, 
webinars, tabletop exercises, State-sponsored cyber education 
events, educational materials, and situational updates from EI-
ISAC, as well as on-line courses sponsored by DHS's CISA 
organization, the EAC, and third-party organizations, have 
resulted in a dramatic improvement in the cybersecurity 
awareness of elections official.
    In addition to Federally-funded activities, CIS continues 
to invest our own funds and seeks private grant support to 
develop best practice guidance and tools for elections 
officials.
    While elections officials are not cybersecurity experts, 
they now better understand the nature of cyber threats, the 
available technical solutions, and what to do in response to a 
cyber event.
    Finally, with regard to the critical area of collaboration, 
the working relationships and partnerships among Federal, 
State, and local organizations have shown a remarkable 
maturation. CISA, the EI-ISAC, associations representing the 
secretaries of state or NASS, State elections directors, or 
NASED, local elections officials, IGO, the EAC and the 
elections center, as well as elections vendors and other 
private and public organizations have been working 
collaboratively with elections offices for the past several 
years to improve the office's cybersecurity posture, and 
relationships continue to improve.
    Simply put, compared to 2016 and 2018, the security of the 
election's infrastructure looks quite different in 2020. While 
there are no guarantees on cybersecurity, I can assure you that 
the security defenses that we have in place for November 2020 
are vastly improved over those in place a short 4 years ago.
    Congress, the elections officials, CISA, and a host of 
public and private organizations, should be rightfully proud of 
the progress that has been made in this area.
    I close by respectfully recommending that Congress continue 
to emphasize the importance of collaboration and cyber 
technology innovation. I also encourage you to focus on the 
attention on this and disinformation in American elections, 
major vulnerability through November, and beyond.
    In this last period, CIS has developed a misinformation 
reporting portal for elections officials in order to simplify 
reporting of elections-related lists and disinformation. We 
piloted the system with elections officials in 5 States, and 
have engaged with DHS, NASS, NASED to promote this capability 
to social media platform. We believe that this capability will 
be a valuable tool of increasing visibility of elections-
related mis- and disinformation. This concludes my oral 
remarks, I look forward to your questions.
    [The prepared statement of Mr. Gilligan follows:]
                 Prepared Statement of John M. Gilligan
                             August 4, 2020
    Chairman Richmond, Ranking Member Katko, and Members of the 
subcommittee, thank you for inviting me today to this hearing. My name 
is John Gilligan, and I serve as the president and chief executive 
officer of the nonprofit Center for Internet Security, Inc. (CIS). I 
have spent most of my career in service to the Federal Government, 
including serving as the chief information officer of both the U.S. 
Department of Energy, and the U.S. Air Force. I appreciate the 
opportunity today to share our thoughts on the current state of 
American election security. I look forward to offering our ideas on how 
we can collectively build on the progress being made in this important 
area of critical National security.
    Free and fair elections are essential to our democracy. In the 
United States, elections are highly decentralized with more than 8,000 
jurisdictions across the country responsible for the administration of 
elections. While the Federal Government provides some laws and 
regulations, the Federal Government does not administer elections and 
has a limited role in dictating how the process is conducted. States 
act as the primary authority for the laws and regulations that govern 
the process of conducting an election and, accordingly, States have 
substantial discretion on the process of conducting elections through 
Secretaries of State and State election directors. State and local 
officials have been defending our elections for over 2 centuries. The 
2016 election was less about a new threat and more about the breadth 
and depth of threat activity. Fortunately, since 2016 we have 
collectively learned a great deal about how best to respond to these 
cyber risks and to prepare for the 2020 election.
    In short, I would like to: (1) Provide you a short background about 
CIS; (2) describe the role and functions of the Elections 
Infrastructure Information Sharing and Analysis Center (EI-ISAC), which 
we operate in conjunction with the U.S. Department of Homeland Security 
(DHS) Cybersecurity and Infrastructure Security Agency (CISA) with 
funding from Congress; (3) describe our collaboration with elections 
offices and key stakeholder organizations; (4) describe CIS's other, 
significant best practice work in this area; and (5) respectfully make 
3 recommendations.
         (1) background about the center for internet security
    Established in 2000 as a nonprofit organization, the primary 
mission of CIS is to advance cybersecurity readiness and response. CIS 
was instrumental in establishing the first guidelines for security 
hardening of commercial Information Technology (IT) systems at a time 
when there was little on-line security leadership. Today, CIS works 
with the global security community using collaborative deliberation 
processes to define security best practices for use by Government and 
private-sector entities. The approximately 250 professionals at CIS 
provide cyber expertise in 3 main program areas: (1) The Multi-State 
Information Sharing and Analysis Center (MS-ISAC) and, more recently, 
the EI-ISAC; (2) the CIS Benchmarks; and (3) the CIS Critical Security 
Controls. I describe each briefly below.
    The CIS Benchmarks \1\.--CIS produces the largest number of 
authoritative, community-supported, and automatable security 
configuration benchmarks and guidance. The CIS Benchmarks (also known 
as ``configuration guides'' or ``security checklists'') provide highly-
detailed security setting recommendations for a large number of 
commercial IT products, such as operating systems, database products 
and networking systems. These benchmarks are vital for any credible 
security program. The CIS Benchmarks are developed through a global 
collaborative effort of public and private-sector security experts. 
Over 200 consensus-based Benchmarks have been developed and are 
available in PDF format free to the general public on the CIS or NIST 
websites. An automated benchmark format along with associated tools is 
also available through the purchase of a membership. CIS has also 
created a number of security configured cloud environments, called 
``hardened images'' that are based on the benchmarks that we are 
deploying in the Amazon, Google, Oracle, and Microsoft cloud 
environments. These hardened images help ensure that cloud users can 
have confidence in the security provided within the cloud environment 
they select. The CIS Hardened Images are used world-wide by 
organizations ranging from small, nonprofit businesses to Fortune 500 
companies.
---------------------------------------------------------------------------
    \1\ Find out more information about the CIS Benchmarks here: 
https://www.cisecurity.org/cis-benchmarks/.
---------------------------------------------------------------------------
    The CIS Benchmarks are referenced in a number of recognized 
security standards and control frameworks, including:
   NIST Guide for Security-Focused Configuration Management of 
        Information System
   Federal Risk and Authorization Management Program (FedRAMP) 
        System Security Plan
   DHS Continuous Diagnostic Mitigation Program
   Payment Card Industry (PCI) Data Security Standard v3.1 
        (PCI)
   CIS Controls
   U.S. Department of Defense Cloud Computing Security 
        Requirements Guide.
    The CIS Controls \2\.--CIS is also the home of the CIS Critical 
Security Controls (or the CIS Controls), the set of internationally-
recognized, prioritized actions that form the foundation of basic cyber 
hygiene and essential cyber defense. They are developed by an 
international community of volunteer experts and are available free on 
the CIS website.
---------------------------------------------------------------------------
    \2\ Find out more information about the CIS Controls and download 
them for free here: https://www.cisecurity.org/critical-controls.cfm.
---------------------------------------------------------------------------
    The CIS Controls act as a blueprint for system and network 
operators to improve cyber defense by identifying specific actions to 
be done in a priority order--achieving the goals set out by the NIST 
Cybersecurity Framework (CSF). Moreover, the CIS Controls are 
specifically referenced in the NIST CSF as one of the tools to 
implement an effective cybersecurity program.\3\
---------------------------------------------------------------------------
    \3\ NIST Framework, Appendix A, page 20, and throughout the 
Framework Core (referred to as ``CCS CSC''--Council on Cyber Security 
(the predecessor organization to CIS for managing the Controls) 
Critical Security Controls).
---------------------------------------------------------------------------
    To bring another level of rigor and detail to support the 
development and implementation of the CIS Controls, CIS leveraged the 
industry-endorsed ecosystem that is developing around the MITRE ATT&CK 
(Adversarial Tactics, Techniques, and Common Knowledge) Framework.\4\ 
The ATT&CK Model comprehensively lists attack techniques that an 
attacker could use at each step of an attack. Our analysis shows that 
implementing the CIS Controls mitigates approximately 83 percent of all 
the techniques found in ATT&CK.\5\ This implies that application of the 
CIS Controls provides significant security value again a very wide 
range of potential attacks, even if the details about those attacks are 
unknown.
---------------------------------------------------------------------------
    \4\ MITRE ATT&CK Framework, https://attack.mitre.org/.
    \5\ CIS Community Defense Model v 1.0, the Center for Internet 
Security, August 2020.
---------------------------------------------------------------------------
    MS-ISAC \6\.--In late 2002, the Multi-State Information Sharing and 
Analysis Center (MS-ISAC) was created by the State of New York with the 
recognition that the State government community needed an information-
sharing mechanism (i.e., an information sharing and analysis center or 
``ISAC'') to coordinate cybersecurity efforts and promote best 
practices. In January 2003, the MS-ISAC had its first meeting, formally 
launching an ISAC for State governments. DHS first reached out to the 
MS-ISAC in September 2004 and began providing some funding. In 2010, 
DHS officially designated the MS-ISAC as the key resource for cyber 
threat prevention, protection, response, and recovery for the Nation's 
SLTT governments and issued the first Cooperative Agreement. This 
designation [sic] Also, in 2010, the MS-ISAC moved to its current 
organizational home within CIS, where it has since resided.
---------------------------------------------------------------------------
    \6\ Find out more information about the MS-ISAC here: https://
msisac.cisecurity.org/. A list of MS-ISAC services here: https://
www.cisecurity.org/wp-content/uploads/2018/02/MS-ISAC-Services-Guide-
eBook-2018-5-Jan.pdf.
---------------------------------------------------------------------------
    The members of the MS-ISAC, the largest ISAC in the world, include 
all 56 States and territories, and over 10,000 other SLTT government 
entities including local governments, schools, hospitals, and publicly-
owned water, electricity, and transportation elements of the U.S. 
critical infrastructure. MS-ISAC's 24x7 cybersecurity operations center 
provides: (1) Cyber threat intelligence that enables MS-ISAC members to 
gain situational awareness and prevent incidents, consolidating and 
sharing threat intelligence information with the DHS National 
Cybersecurity and Communications Information Center (NCCIC); (2) early 
warning notifications containing specific incident and malware 
information that might affect them or their employees; (3) incident 
response support; and (4) various educational programs and other 
services. Furthermore, MS-ISAC provides around-the-clock network 
monitoring services with our Albert network monitoring devices for many 
SLTT networks, analyzing over 1 trillion event logs per month. Albert 
is a cost-effective Intrusion Detection System (IDS) that uses open 
source software combined with the expertise of the MS-ISAC 247 
Security Operations Center (SOC) to provide enhanced monitoring 
capabilities and notifications of malicious activity. In 2019, MS-ISAC 
analyzed, assessed, and reported on over 72,000 instances of malicious 
activity for over 8,500 MS-ISAC members. CIS is installing a layered 
set of cyber defense capabilities for the elections infrastructure that 
results what is often referred to as ``defense-in-depth.'' The Albert 
IDS capabilities are being complemented with end-point protection 
capabilities, as well as automated blocking of known malicious internet 
sites.
               (2) the role and functions of the ei-isac
    After the interference in the 2016 election, DHS, the National 
Association of Secretaries of State (NASS), the National Association of 
State Election Directors (NASED), the Elections Assistance Commission 
(EAC), as well as local elections organizations, and CIS discussed the 
possibility of creating an ISAC devoted solely to the Nation's 
elections infrastructure. In 2017, DHS agreed to conduct a pilot 
elections ISAC with 7 States. This pilot group developed and tested a 
range of products geared toward communicating cybersecurity issues to 
State and local election officials. Upon the success of that pilot, in 
2018, DHS and the Election Infrastructure Subsector Government 
Coordinating Council tasked CIS to stand up the Elections 
Infrastructure ISAC (EI-ISAC). Leveraging the services offered and 
experience gained through the MS-ISAC, the EI-ISAC is now fully 
operational \7\ with all 50 States and the District of Columbia 
participating, and over 2,600 total members, including the election 
vendor community. The EI-ISAC provides elections officials and their 
technical teams with regular updates on cyber threats, cyber event 
analysis, and cyber education materials.
---------------------------------------------------------------------------
    \7\ Find out more information about the EI-ISAC here: https://
www.cisecurity.org/ms-isac/. A list of EI-ISAC services can be found 
here: https://www.cisecurity.org/ei-isac/ei-isac-servic- 
es/.
---------------------------------------------------------------------------
    Deploying More Albert Sensors.--As part of the initial launch, CIS 
was also tasked with deploying a network of Albert sensors to all 50 
State election offices and the 5 largest counties in States that have 
bottom-up and hybrid voter registration processes. Since then, all 50 
States have deployed and many States have leveraged HAVA funding to 
procure additional Albert sensors for every county election office. CIS 
now processes data from 269 Albert sensors monitoring State and local 
election networks, which support on-line elections functions such as 
voter registration and election night reporting. The Albert sensors 
processed 30 petabytes of data in the first half of 2020, resulting in 
nearly 2,000 cyber event notifications to elections offices.
    Improving Situational Awareness.--Starting with the 2018 primaries 
and mid-term elections, the EI-ISAC has hosted the Election Day Cyber 
Situational Awareness Room, an on-line collaboration forum to keep 
elections officials aware of cyber and non-cyber incidents and 
potential cyber threats for any State-wide or National election. More 
than 600 elections officials, Federal partners, and election vendors 
have participated in these forums. It is expected that participation in 
the situation room will likely grow to all 50 States for the November 
2020 General Election.
    Piloting New Technology.--Earlier this year, the EI-ISAC, in 
cooperation with DHS CISA and Congressional appropriators, expanded our 
protection of elections through 2 new programs aimed at addressing the 
needs of lower-resourced organizations. These new programs also provide 
a defense-in-depth capability where multiple cyber defense capabilities 
working together improve threat situational awareness and increase 
effectiveness in defeating malicious threats:
    The Endpoint Detection and Response (EDR) Pilot for Elections 
        Infrastructure provides a sophisticated cybersecurity 
        technology that complements the network monitoring performed by 
        the Albert network sensors for the elections community. The EDR 
        sensors also expand and enrich the threat intelligence 
        available to the MS- and EI-ISAC. The EDR solution has the 
        capability to monitor internal network traffic, and the EDR 
        agents can programmatically block malicious activity and 
        quarantine compromised systems, shifting the immediate 
        cybersecurity response effort from election offices to the CIS 
        SOC. This will allow smaller or less mature offices to take 
        advantage of the same protections as larger offices improving 
        the community's cybersecurity. CIS is currently deploying EDR 
        sensors, focusing on critical systems in the elections 
        infrastructure, like voter registration, election management, 
        and election night reporting.
    The Malicious Domain Blocking and Reporting (MDBR) Pilot provides a 
        commercial secure Domain Name System (DNS) service to block 
        access from SLTT member organizations to known malicious 
        domains. In effect, the capability prevents the execution of 
        the majority of malicious attacks associated with ransomware, 
        malware, command and control, and phishing domains. Anonymized 
        data from this offering will be correlated with other threat 
        intelligence feeds and provided in threat reporting to CISA and 
        the broader SLTT community. The MDBR capability can be 
        implemented in minutes and recent NSA analysis indicates that 
        this solution can reduce the ability for 92 percent of malware, 
        from a command-and-control perspective, to deploy malware on a 
        network.\8\ CIS began deploying this capability in early July. 
        While the capability is available to all SLTT organizations, 
        the priority is to deploy to elections organizations prior to 
        November.
---------------------------------------------------------------------------
    \8\ ``The NSA is piloting a secure DNS service for the defense 
industrial base'', Cyberscoop, June 18, 2020, https://
www.cyberscoop.com/nsa-secure-dns-service-pilot-defense-industrial-
base/.
---------------------------------------------------------------------------
     (3) collaboration with elections offices and key stakeholder 
                             organizations
    Both as a part of CIS's role in operating the EI-ISAC as well as 
efforts not funded by the Government, we have placed emphasis on 
establishing a trusted relationship with elections officials and other 
key stakeholders. CIS has participated and conducted cyber exercise for 
elections offices, conducted numerous cyber webinars, and made in-
person visits to almost every State and many local elections 
jurisdictions, many of these activities in partnership with DHS CISA. 
In addition, we have worked closely with other key organizations 
supporting the elections community such as the National Association of 
Secretaries of State (NASS), the National Association of State 
Elections Directors (NASED), the Elections Assistance Commission (EAC), 
the Election Center, and the International Association of Government 
Officials (IGO). Finally, we have also worked closely with private-
sector organizations such as Harvard's Belfer Center, Microsoft, 
elections vendors, and other organizations who are working to improve 
the security of our elections infrastructure.
     (4) cis's other, significant election security best practices
    CIS also makes significant investment is Election Security Best 
Practices and related tools. Since the release of our Handbook for 
Election Infrastructure Security in 2018, CIS has become the leading 
non-Government provider of election security advice to SLTT election 
authorities, election technology vendors, and the elections community 
at large.
    The Handbook for Election Infrastructure Security provides 88 best 
practices covering the entirety of the election administration 
technology. These best practices have been widely adopted by the 
election community with State and local offices in 34 States using them 
as a metric for assessing the security of elections systems. To assist 
States and local election officials assess and adopt these best 
practices, CIS developed and maintains the Election Infrastructure 
Assessment Tool (EIAT). The EIAT is a free on-line tool designed to 
help election officials assess their IT infrastructure against the 88 
best practices from the Handbook. We have had over 600 users 
representing 34 States and 265 local election jurisdictions take 
advantage of the EIAT.
    A Guide for Ensuring Security in Election Technology Procurements 
was released in May 2019 to assist election officials with ensuring 
security is properly accounted for in their election technology 
procurements. This guide provides 33 recommended questions to ask of 
election technology providers and assist election officials assess 
responses by providing descriptions of good and bad responses.
    CIS released its Security Best Practices for Non-Voting Election 
Technology in October 2019 to address internet-connected election 
technology such as electronic poll books, electronic ballot delivery, 
and election night reporting systems. This guide covers 5 areas of 
technology: Network and Architecture, Servers and Workstations, 
Software Application, Data, and Administration. The areas were chosen 
carefully based on similarities in threats, mitigations, and 
governance.
    CIS has followed up these election technology best practices with 
an on-going pilot project on how to verify systems against these best 
practices. Traditional voting systems are verified against large 
monolithic standards using lengthy and expensive certification 
campaigns. Our alternative approach, known as Rapid Architecture-Based 
Election Technology Verification (RABET-V), focuses on the need for 
internet-connected election technology to be responsive and adapt 
quickly to changes in the threat landscape. RABET-V is addressing this 
with a process model that provides assurances of security, reliability, 
and functionality in a risk-based, flexible, change-tolerant process. 
We are currently piloting this process with several election technology 
vendors and a steering committee consisting of the Election Assistance 
Commission, DHS CISA, Federal Voting Assistance Program, and the States 
of Wisconsin, Ohio, Maryland, Texas, Pennsylvania, and Indiana. We 
anticipate a report following the November General Election.
    Misinformation Reporting Portal Pilot.\9\ CIS is currently 
producing a better means for election officials to report election 
infrastructure misinformation and disinformation to the social media 
platforms for their investigation and adjudication. Currently, a 
limited set of election officials can report to Facebook and Twitter 
using the means provided directly by the social media platform. 
Elections officials must pre-register with the platform and report 
independently to each one. CIS is working to facilitate a single 
reporting portal where election officials can report the suspected 
misinformation and disinformation once, and have it distributed to the 
various social media platforms. We have been working closely with DHS, 
NASS, and NASED, along with 5 States to vet and promote this concept to 
the social media platforms.
---------------------------------------------------------------------------
    \9\ The RABET-V and Misinformation Reporting Portal are projects 
being funded by the nonprofit Democracy Fund.
---------------------------------------------------------------------------
    The Misinformation Reporting Portal will provide elections 
officials with a single place (i.e., the portal) for reporting mis- and 
disinformation across multiple social media platforms with a 
streamlined, consistent user experience. In addition, the entire 
elections community will have visibility of what's going on with mis- 
and disinformation in the elections community within and outside their 
jurisdictions, including to see trends and be able to strategically 
respond. The portal will also streamline and standardize reporting for 
the social media organizations. In addition, voters will have the 
benefit of more rapid correction of erroneous information, leading to 
improved voter confidence.
        (5) three recommendations to continue securing elections
    While much progress has been made over the last 4 years, we know 
that the threat remains, and, as a Nation, we must continue to address 
these new risks and vulnerabilities. We respectfully recommend 3 
courses of action to keep our elections safe and secure. We must: (1) 
Continue to emphasize the importance of collaboration and foster 
collaboration across all elections stakeholders; (2) continue to 
innovate and leverage evolving security and applicable commercial 
technologies; and (3) consider how best to address the impact of mis- 
and disinformation on American elections.
    Emphasize Collaboration.--We hear much of the importance of 
resilience in the homeland security context. When you look back on it, 
the post-2016 response to securing our elections is an excellent 
example of a successful public-private partnership. The recognized 
shortfalls in 2016 have helped highlight a National crisis that has 
been responded to by many organizations working together.
    NASS, NASED, the Election Center, IGO and their respective members 
remain central in running American elections. Collectively, they 
continue to provide the deep expertise in exactly how the complicated 
function of operating elections works, and how new processes and 
technology can best be used in each jurisdiction. Other State and local 
associations like the National Governors Association (NGA), the 
National Conference of State Legislatures (NCSL), the National 
Association of State Chief Information Officers (NASCIO), the National 
Association of Counties (NACo), the National League of Cities (NLC), 
the National Emergency Management Association (NEMA), and others have 
stepped up and collaborated to identify and facilitate the best 
approaches to improving security of the elections infrastructure within 
their jurisdictions.
    On the Federal side, Congressional appropriators were several times 
able to provide significant funding for critical election security 
grants that were, simply put, essential to help prepare elections 
offices with limited resources across the country. An active and 
engaged DHS CISA enthusiastically accepted the role of the Nation's 
Risk Advisor on elections, used their convening power and bully pulpit 
as the lead Federal agency to good effect, and CISA continues to be an 
excellent partner in the MS- and EI-ISACs. Despite having one of the 
smallest budgets in the Federal Government and new leadership, the 
Election Assistance Commission (EAC) efficiently distributed $825 
million in grants to the States, helped develop guidance around voting 
as safely as possible during the COVID-19 pandemic, and stood up a 
RABET-V (with CIS as described above).
    Further, the elections vendors, private sector, public and private 
universities, think tanks and foundations, as well as nonprofit 
corporations like CIS have come together to help address the technical, 
process, and educational challenges facing the U.S. elections 
community. The result is that the protection capabilities of our 
elections infrastructure are enormously improved from 2016 and even 
where they were in 2018. However, it is recognized that we are not yet 
where we want to be and the threat continues to increase. It will take 
continued collaboration to sustain and hopefully even accelerate the 
progress that we have seen over the past 3 years.
    Continue to Innovate.--As noted above, the progress made in 
deploying additional technical measures and in education and training 
since November 2016 is impressive. However, there are opportunities to 
improve in each area. A danger when addressing the sensitive area of 
elections is to be overly cautious in assessing and piloting new 
methods and technical solutions. CIS was grateful to be given funding 
from Congress and tasking from CISA to pilot EDR and the MDBR 
technology. We are already seeing that these technologies will be 
important capabilities to protect our elections infrastructure. Working 
with the EAC, we are piloting what we hope will be a much quicker and 
less costly process for verifying elections systems. We encourage 
Congress to continue to support experimentation and innovation so that 
we can continue to leverage the best talent and capabilities that the 
country has to offer in a way that produces the most value for the 
American taxpayer.
    Address the impact of mis- and disinformation on elections.--While 
we have made great strides in improving resilience against cyber 
threats, perhaps the biggest challenge that we face as a Nation going 
forward is how we address the impact of mis- and disinformation on 
elections. While we treasure our rights granted to all citizens by the 
First Amendment, the power of social media in shaping opinions and 
attitudes is expanding rapidly. CIS is working to help address the 
challenge of identifying and reporting deliberate or accidental 
misinformation or disinformation that might prevent voters from 
exercising their right to vote. This is a first step. However, the 
broader challenge is to establish norms and conventions that will help 
voters understand what is factual and what is opinion or even 
deliberate attempts to mislead. We would encourage Congress to take an 
incremental approach to addressing this challenge.
                               conclusion
    Securing American elections is a complex, decentralized enterprise 
that is fundamental to preserving our democracy. Fortunately, our State 
secretaries of state, State elections directors, and elections 
officials have been successfully defending our elections for over 2 
centuries. Furthermore, since 2016, we have learned much about how this 
new risk can be defended. CIS is proud to have developed and to operate 
the Elections Infrastructure ISAC (EI-ISAC), and to have devised 
several other significant best practices to help the with this vital 
task.
    To that end, CIS is committed to a long-term effort to continuously 
advance and promote best practices for elections security as part of a 
National response to threats against election infrastructure.

    Mr. Richmond. Thank you. I want to thank all the witnesses 
for their testimony. I see that we have been joined by the 
Chairman of the full committee. I will recognize the gentleman 
from Mississippi, Mr. Thompson, for his opening statement.
    Mr. Thompson. Thank you very much. Thank you very much, Mr. 
Chairman. I appreciate the opportunity to speak. As you know, 
we are less than 100 days away from the election, and House 
Democrats are working hard to persuade Senate leadership to 
provide additional election assistance to help States 
administer safe, secure, and auditable elections during the 
COVID-19 pandemic. This hearing could not come at a more 
appropriate time.
    Last week, we celebrated the life of Congressman John 
Lewis. As we mourned our loss, we grappled with the tremendous 
task of how best to honor his legacy. In his final days, 
Congressman Lewis committed a lifetime of fighting for justice 
to parting advice to guide us through this turbulent time. He 
challenged us to stand up for injustice. He called each of us 
to use our talents to build a better country than the one we 
inherited. We are reminded that democracy is not a state. It is 
an act.
    This November, our Nation will participate in an election 
that would look like no other in our history. The COVID-19 
pandemic will demand that we adopt our voting procedures to 
ensure that no American must choose between exercising their 
democratic right to vote and protecting their health. At the 
same time, we must defend our democracy against adversaries who 
will use our differences of opinion to sow irreparable division 
among us.
    We must remain vigilant in defending the truth and keep the 
public informed to deny our adversaries the opportunity to fill 
information vacuums with lies. Now more than ever, we each have 
a role to play in defending our democracy.
    As Chairman of the Homeland Security Committee, I have 
fought to protect the voting rights of all Americans, and to 
secure funding to help State and local election officials 
replace outdated, unsecured election equipment. Last March, the 
House passed H.R. 1, which included the Election Security Act, 
which will provide funding to States to improve election 
security and direct a whole-of-Government response to counter 
foreign influence campaigns aimed at undermining confidence in 
our democratic institutions.
    On May 15, the House passed the HEROES Act, which would 
provide $3.6 billion to help States navigate the challenges 
associated with administering November elections during COVID-
19 pandemic. That is in addition to the $800 million already 
made available this year. Both bills are languishing in the 
Senate.
    The recent COVID-19 relief package proposed by the Senate 
Majority provides no resources to help States afraid of costs 
of administering Federal elections. As my Senate colleagues 
post their tributes to Congressman Lewis, I call on them to 
remember the cause that was so dear to him. Access to the 
ballot box, and fight to include necessary voting reforms and 
funding to implement them in the next COVID-19 package.
    Our State officials must adopt by changing outdated voting 
rules that prohibit no-excuse absentee voting and the early 
voting, both of which would release lines and crowding, making 
it safe to vote. The also has a role to play. They must seek 
out reliable sources of accurate information and engage in 
election process. The integrity of the November elections 
depend on a whole-of-Nation commitment to our democracy.
    I look forward to our conversation today on that effort, 
and I yield back the balance of my time.
    [The statement of Mr. Thompson follows:]
                Statement of Chairman Bennie G. Thompson
                             August 4, 2020
    We are less than 100 days away from the election, and House 
Democrats are working hard to persuade Senate leadership to provide 
additional election assistance to help States administer safe, secure, 
and auditable elections during the COVID-19 pandemic. This hearing 
could not come at a more appropriate time.
    Last week, we celebrated the life of Congressman John Lewis. As we 
mourned our loss, we grappled with the tremendous task of how best to 
honor his legacy. In his final days, Congressman Lewis committed a 
lifetime of fighting for justice to parting advice to guide us through 
this turbulent time. He challenged to us to stand up to injustice. He 
called on each of us to use our talents to build a better country than 
the one we inherited. And he reminded us that ``Democracy is not a 
state. It's an act.''
    This November, our Nation will participate in an election that will 
look like no other in our history. The COVID-19 pandemic will demand 
that we adapt our voting procedures to ensure that no American must 
choose between exercising their democratic right to vote and protecting 
their health.
    At the same time, we must defend our democracy against adversaries 
who will use our differences of opinion to sow irreparable divisions 
among us. We must remain vigilant in defending the truth and keep the 
public informed to deny our adversaries the opportunity to fill 
information vacuums with lies. Now more than ever, we each have a role 
to play in defending our democracy.
    As Chairman of the Homeland Security Committee, I have fought to 
protect the voting rights of all Americans and secure funding to help 
State and local election officials replace outdated, unsecure election 
equipment. Last March, the House passed H.R. 1, which included The 
Election Security Act, which would provide funding to States to improve 
election security and direct a whole-of-Government response to counter 
foreign influence campaigns aimed at undermining confidence in our 
democratic institutions.
    On May 15, the House passed the HEROES Act, which would provide 
$3.6 billion to help States navigate the challenges associated with 
administering November elections during the COVID-19 pandemic. That is 
in addition to the $800 million already made available this year. Both 
bills are languishing in the Senate.
    The recent COVID-19 relief package proposed by the Senate Majority 
provides no resources to help States defray the costs of administering 
Federal elections. As my Senate colleagues post their tributes to 
Congressman Lewis, I call on them to remember the cause that was so 
dear to him--access to the ballot box--and fight to include necessary 
voting reforms and the funding to implement them in the next COVID-19 
package.
    Our State officials must adapt by changing outdated voting rules 
that prohibit no-excuse absentee voting and early voting, both of which 
would reduce lines and crowding, making it safer to vote. The public 
also has a role to play. They must seek out reliable sources of 
accurate information and engage in the election process. The integrity 
of the November elections depends on whole-of-Nation commitment to our 
democracy.

    Mr. Richmond. Thank you, Chairman, for this opening 
statement.
    I will remind the subcommittee that we will each have 5 
minutes to question the panel. I will now recognize myself for 
questions. My first question will be to all witnesses.
    As you know, the President and Attorney General, who I had 
an opportunity to question last week, have repeatedly tried to 
cast mail-in voting as fraudulent, illegal, or tantamount to 
rigging an election. On Friday, however, CISA released a mail-
in voting and 2020 infrastructure risk assessment, which 
considered a number of risks to vote-by-mail, but ultimately 
found that, ``All forms of voting, in this case mail-in voting, 
brings variety of cyber and infrastructure risks. Risk to mail-
in voting can be managed through various policies, procedures, 
and protocols, and controls.''
    No. 1, what were your takeaways from the risk assessment? 
No. 2, is there more that CISA or other Federal agencies can be 
doing to promote confidence in safe, secure, mail-in voting 
this November? Any of you? Mr. Levine, I see that you are 
ready.
    Mr. Levine. Chairman, thank you for that question. You 
know, in terms of the takeaways, the CISA report, I think, was 
a really important document. I think it really showed a 
blueprint, like for the kinds of things, security-wise, that 
folks ought to consider, right, when they are administering an 
election via vote-by-mail.
    Facts matter. This document is littered with facts that 
unambiguously state that vote-by-mail is a safe and secure 
process. But it does also walk through, right, some really 
important pieces that I think are worth mentioning. No. 1, some 
of the factors to consider with vote-by-mail are a bit 
different, right? It is worth noting that, you know, in terms 
of doing vote-by-mail, if the voter registration database is 
not as accurate, your ability after the fact to go show up at a 
polling place and cast a ballot, right, takes on a different 
kind of thing than if, in fact, you are able to go to a polling 
place, right, on Election Day.
    I think the second thing that is really worth noting, 
though, is that--it was pointed out in this report is also the 
notion that if people spread mis- and disinformation about the 
vote-by-mail process, if they say that the process is easily 
rigged, that is the kind of thing that can be easily amplified 
by foreign adversaries.
    In my testimony, I pointed out that authoritarian actors, 
like Russia and Iran, have already done that.
    So, you know, I think what is really important in terms of 
the takeaways are No. 1, people take a look at this report so 
that they can understand what things they need to do to make 
sure they can utilize vote-by-mail in as a successful manner as 
possible. No. 2, I think they need to make sure, right, that 
they understand how that vote-by-mail process works so that 
they can be disseminating information to the public about how 
that needs to be done.
    In terms of Federal authorities, you know, I think one of 
the things that they can be--continue to do, which they have 
already done, is they were reaching out in an affirmative 
manner, to State and local election officials as well as to 
civil society organizations to talk them through, right, how 
they can best communicate with the American public about how 
the vote-by-mail process can be done so that voters can have 
confidence, that even though voting will be different in 
November than previously, it is still going to be a safe and 
secure process.
    Mr. Richmond. Anybody else want to join in on that answer? 
Ms. Albert. Mr. Gilligan.
    Ms. McReynolds. Sure. Thank you, Mr. Chairman. So as I am--
as previously stated, I was an elections official in Colorado, 
ran elections for 13 years, ran 3 different Presidential 
elections, along with many others, and also, transitioned 
various systems as--from in-person polling places, to early 
voting, to vote centers, to the system in Colorado.
    The fact is, there is not a single State that is all vote-
by-mail, or universal vote-by-mail, even though those terms get 
used a lot. The States that do this mail-in ballot and still 
preserve in-person voting options, should voters want to do 
that. So you really have all choices on the table.
    But I was struck in the CISA report that came out, I think 
it included many of the best practices that my organization has 
recommended, but also that many States have actually adopted in 
recent years with regards to the vote-by-mail program. I--what 
struck me in the CISA guidance also was the highlight for 
disinformation and misinformation as being a critical risk to 
our elections systems. That it goes--that is true for in-person 
voting, it is true for early voting, and it is true for the 
vote-by-mail program.
    So whatever we can do to combat that is critically 
important. We have to boost and make sure our election 
officials and our official State websites and local websites 
have and contain the best information so that voters know what 
to do.
    But one other security risk, or actually 2 other security 
risks that I want to highlight is postal operations. I 
mentioned this in my testimony. I think it absolutely is a 
critical factor here. It is critical infrastructure to not only 
the vote-by-mail program, but elections overall, especially 
given all of the notices required, legal notices that are not 
only at the Federal level, but also at the State level in terms 
of making the election run, not just mail ballots, but voter 
notifications, ballot-issued notices, polling place notices, 
all of those pieces of mail that go out through the 
infrastructure that is literally the only entity that serves 
every single customer and citizen daily, along with every 
election office.
    The United States Post Office is literally the only entity 
that provides that kind of service to every American and every 
election office daily. We need it to be operating at full 
capacity. We need it to be doing what it is capable of doing to 
support our elections, not just mail voting, but every aspect 
of our election process that relies on the Post Office to do 
it.
    The final piece, I would say, is that after administering 
elections for as long as I did, I would encourage everyone to 
rely on experts that have actually run these election 
processes, know where the vulnerabilities are, know how to fix 
those vulnerabilities, know how to address issues. There is a 
reason best practices have been developed over time in various 
States that have done this well. We didn't have that 10 years 
ago. We didn't have many examples of States where this 
procedure has operated at a very good level, has--many of those 
States, including Colorado where I am from, was deemed the 
safest place to vote in the country a couple of years ago by 
the Homeland Security Secretary. That is an important and 
critical aspect of all the different steps we did to make our 
system secure and make it work properly.
    The one final thing I would say is I also believe it is a 
security risk when people can't access the voting process. If 
you show up, and there is a 5-hour line, or your mail ballot 
doesn't come to you, or you face other barriers or challenges, 
that is also a security problem with the election 
infrastructure.
    So we really need to be focused on building our processes 
this year, and responding to all of those critical factors that 
prevent or inhibit the voting process from being fair for 
everyone.
    Mr. Richmond. Thank you. I will--I will yield back.
    I will now recognize the gentleman from Pennsylvania, Mr. 
Joyce, for 5 minutes.
    Mr. Joyce. Thank you very much, Mr. Richmond, for holding 
this hearing. There could not be a more important time as we 
face election 2020 in the midst of the pandemic.
    I think that there are many questions, but, Mr. Gilligan, I 
am going to start with you. Do you feel that election officials 
are receiving enough information from their election system 
vendors about the vulnerabilities in their systems so that they 
can make sound purchase and maintenance decisions?
    Mr. Gilligan. Thank you, Congressman Joyce, for the 
question. I think the elections officials are getting more 
information today than they have in the past about what are 
potential vulnerabilities. The--I think in years past, the 
election vendors didn't spend as much energy on looking at the 
types of cyber threats that we now know exist. So, there has 
been a significant sea change within the election vendors. The 
dilemma is, as you well know, is that many of the elections 
components are years old. So, there has been increased dialog 
between the elections vendors and the elections offices. There 
have been independent assessments of the elections 
infrastructure components to determine what vulnerabilities 
exist, and that has resulted in some improvements in the 
software and the capabilities of the deployed election systems. 
Then, I think, finally, the newer elections infrastructure 
components tend to be ones that have more better defenses 
against cyber threats.
    Mr. Joyce. Do you find that individual States are actually 
reaching out and increasing those protective mechanisms, 
particularly helping their election systems to set up the 
firewalls that are necessary to decrease those vulnerabilities?
    Mr. Gilligan. Yes. So--thank you. The previous question 
focused on what the relationship between the elections vendors 
and the elections offices. What I--what I would say is there 
has probably been a lot more progress in the area that your 
current question addresses, which is the elections offices 
themselves. The contractor supporting them, many elections 
offices have gone through a cyber-navigator-type concept where 
they, either internally or externally, have hired individuals 
to come in and not only do a training, but also to do 
assessments of the elections' infrastructure components. CIS 
has actually produced some guidebooks and some tools in this 
area.
    So that is an area that, I think, we have seen in many 
States that there has been a very concerted effort, there has 
been an effort to assess, and then to fix.
    So, for example, two-factor authentication, which was not 
something that was popular in place in years past, is now 
increasingly in place. Now, what that does is it makes it far 
more difficult for a cyber threat actor to be able to gain 
access to an elections component. Redesigning of systems--you 
mentioned firewalls--redesigning of systems to strengthen 
things like firewalls, to put virtual barriers, to go into 
virtualization that puts barriers between the elections 
components, and other elements that might be on the network.
    So all of these types of improvements, there has been, in 
my assessment, a fairly dramatic shift and resulting in, I 
think, a much more resilient elections infrastructure.
    Mr. Joyce. I share that enthusiasm. I think there has been 
a shift. But let's look at it conversely. What is the worst-
case scenario, in your mind, that can occur?
    Mr. Gilligan. Well, I actually think that, to some extent, 
we saw the worst-case scenario in 2016. Let me explain what I 
mean by that. I think the actual vote capture and vote tally 
systems, which is where the actual vote is captured, and then 
it is--is counted, those systems tend to be highly resilient, 
and they are not easily accessible. You almost have to get 
physical access to them, which makes the threat--to execute the 
threat fairly difficult.
    The other elements, many other elements of the elections 
infrastructure are accessible through the network and, 
therefore, they share the types of vulnerabilities that we see 
in all network-connected systems.
    So back to 2016, the--I recall, vividly, discussions with 
elections officials in the aftermath of 2016, and their 
question and comment was, Wait a minute, no votes were changed. 
In their mind, that was their objective is to ensure that the 
vote was cast, and was, in fact, counted properly. That as we 
all know, it wasn't just that the vote was cast and counted 
properly, it is what is the confidence level that the American 
public has in the system? Therefore, a--an attack against the 
voter registration system, which did not result in anyone not 
being able to vote or any, you know, changes to votes, became a 
symbol to our American public that there is something going on 
here and, therefore, I am losing confidence.
    So I think--I believe that the biggest challenge that we 
continue to have into 2020 is to--and I think some of the other 
speakers commented on it--is to be able to ensure that the 
American public has clear information about what is being done 
to protect the system, and if there is any particular event, to 
be able to very clearly identify what is the impact? That there 
have been lots of procedures put in place that if there is a 
small glitch, that that will not impact the counting of the 
vote or their ability to cast a vote.
    Mr. Joyce. Thank you very much for your answer. Chairman 
Richmond, thank you, again, for holding this important hearing 
today. My time has expired. I yield.
    Mr. Richmond. The gentleman from Pennsylvania has yielded 
back.
    I now recognize the Chairman of the full committee, the 
gentleman from Mississippi, Mr. Thompson.
    Mr. Thompson. Well, I am glad to see that our witnesses 
have pretty much put forth the confidence in our current 
system.
    I don't know any system that can't be improved upon. But, 
by and large, the Democrats on this committee have supported 
more funding. We have offered additional funding to secretaries 
of state. We have coordinated our comments with the National 
secretaries of state organizations and others. Because this is 
how we choose our leaders. Our system of democracy affords 
individuals the right to choose.
    The State of Michigan, for instance, sent out mail 
applications for absentee ballots to every registered voter. 
That was a decision the State of Michigan made. But it is, as 
you said, it is an individual State's prerogative to do the 
process that they think works best. There is no real cookie-
cutter approach. So we recognize the funding.
    One of the things that I am concerned about is all of what 
we do for November, given the COVID-19 environment, is 
predicated on our Postal Service being functional.
    So, Ms. McReynolds, postal workers and election officials 
have raised concern that changes in the Postal Service's 
standards could jeopardize the timely delivery of ballots. Are 
you concerned that changes in these standards could result in 
voters being disenfranchised? How should State and local 
election officials coordinate with the Postal Service to ensure 
vote-by-mail deadlines align with Postal Service standards?
    Ms. McReynolds. Yes, Mr. Chairman. Thank you for the 
question.
    I am concerned about the changes that the postal system has 
made recently. Coordination between election officials and the 
post office is absolutely critical before every single 
election.
    As you pointed out, every system can improve. There is not 
a single perfect government system or government entity that 
exists. So there are opportunities to improve.
    I have made various suggestions, frankly, from being an 
election official, but also being from a State where we 
implemented a system of mail-in ballots to every elector. So 
that coordination with the post office was critical.
    During that time, as an election official, I not only 
learned about the post office, but spent time digging into 
their processes, their procedures, their time lines, everything 
about it that impacted elections. With my understanding of how 
all of that works, the post office is absolutely critical to 
the conduct, the running, and the successful conduct of 
elections in this country.
    As I mentioned, it is not just mail ballots. It is all of 
the other legally-required notices--ballot issue notices, 
polling place notices, poll worker appointment letters, 
candidate notices. Official certified mail is usually how 
candidates are deemed to be certified on the ballot. So there 
are just critical elements to this.
    One of the suggestions that, if you look at sort-of how the 
post office has operated, how it has supported elections 
overall, one thing that a lot of people miss is that right now, 
for military and overseas ballots, postage is paid for outbound 
and inbound ballots in every single State for every single 
military and overseas voter that engages with the election 
process.
    So there is a Federal indicia right on those military and 
overseas ballots that that payment happens through the 
Department of Defense to the post office.
    I have suggested a similar type of model for domestic 
voters because it would actually streamline a lot of the 
processes. The post office wouldn't have to accept payments 
from 7,000 or 8,000 different local election offices. It would 
actually be much more efficient if we had a Federal process and 
indicia for mail ballot postage to be paid on the outbound 
process and the inbound process.
    So that is just one example of an administrative efficiency 
that I think would not only enhance service, but also 
streamline operations for both sides of things, election 
officials as well as the post office.
    So those are a couple of things, and I am happy to answer 
more questions.
    Mr. Thompson. Well, thank you. My time has expired.
    But, Mr. Chairman, I want to highlight that any tampering 
with the current system puts the process at risk. There is no 
question we can improve it. But because we are about 90 days 
away from an election, it is absolutely critical that we make 
the current system work. Any finagling with that system puts 
the process in jeopardy, and I want to keep the confidence 
factor where it is.
    With that, Mr. Chairman, I yield back. Thank you.
    Mr. Richmond. The gentleman from Mississippi yields back.
    I now recognize the gentlelady from Texas, Ms. Sheila 
Jackson Lee, for 5 minutes.
    Well, I will now--we will get to Ms. Jackson Lee when she 
comes back. I will now recognize the gentleman from Rhode 
Island, Mr. Jim Langevin.
    Mr. Langevin. Thank you. Thank you, Mr. Chairman.
    Ms. Jackson Lee. Oh, I am here.
    Mr. Langevin. Oh, Sheila is there. Should I yield to her?
    Mr. Richmond. Continue.
    Mr. Langevin. OK. Thank you, Mr. Chairman.
    I want to thank our witnesses for their testimony today. 
Very helpful insights into your views on election security and 
being able to conduct successful elections this November.
    Obviously, this is a cornerstone of our democracy and we 
want to make sure that our elections are both accessible, free, 
and secure, and your insights are very helpful.
    The Cyberspace Solarium Commission also made several strong 
recommendations regarding media literacy and civics education 
and ways to build resiliency to disinformation campaigns.
    We have seen some nascent efforts at the Federal level. For 
instance, CISA's principle, CISA's, they call it, pineapple 
pizza campaign. But the commissioners believe that much more 
needs to be done, that some level of dis- or misinformation is 
inevitable, given our commitment as a society to free speech.
    Do you agree with this assessment?
    Also, the Solarium Commission recommends that civics media 
literacy education needs to be spread out across a lifetime. It 
can't be a single class one takes in high school. We emphasize, 
for instance, the need to help seniors better understand the 
changing media landscape.
    Do you agree with this assessment? How should we think 
about voter resilience as a part of our broader election 
security strategy? For any of the witnesses that want to start.
    Mr. Gilligan. So, Congressman Langevin, this is John 
Gilligan.
    Although my focus and my organization's focus is on 
cybersecurity, I would echo the remarks that you made and 
endorse the recommendations made by the Solarium Commission.
    My assessment is, when I look at the risks that we have to 
the voting process, today I think that the potential of mis- 
and disinformation having an impact on the voting is greater in 
many regards than the potential of cyber threats.
    So I think the approach that is recommended by the Solarium 
Commission, in part, to improve awareness among the public of 
mis- and disinformation, to help, especially our youth, begin 
to understand how to look at social media and how to look at 
multiple sources of information, I think is particularly 
important.
    I believe that this issue, as I mentioned in my testimony, 
will be an area that will require some Congressional focus in 
the future, because we don't have the norms and the legislative 
rules that I think would be helpful going forward.
    Mr. Langevin. Thank you.
    We have largely been talking about the November election, 
but the Solarium Commission's work was not necessarily specific 
to this year's contest as well. Indeed, we should be thinking 
about now the longer-term challenges, in addition to the short-
term.
    Can you talk about what concerns should the EAC be 
preparing for now to safeguard elections beyond 2020? For any 
of our witnesses.
    Ms. McReynolds. Sure, I can jump in there. I agree with 
endorsing that commission's report. I think civics and 
disinformation, security, all of these things are really going 
to be life-long things that we are going have to adjust and 
learn to.
    I am actually a single mom of two. When my ballot comes 
every election, it is a civics lesson for my 7- and 9-year-old, 
and they understand very clearly how to find good information 
about the voting process and we walk through that every single 
time.
    I think in terms of the EAC, again, this is going to be a--
it is a continuum of improvements over time, and we are going 
to have threats that we face this year that are going to be 
different than next year.
    But this misinformation and disinformation has been 
plaguing the election system for the past few years and we 
haven't come up with a very good solution.
    So I think civics education, educating voters about how to 
find good information and how to find trusted sources of 
information, is going to be absolutely critical. Then 
continually improving how we identify that, how we create 
systems that can flag those issues so that voters can clearly 
get the information that they need.
    Mr. Langevin. Thank you.
    Mr. Levine, beyond the 2020 elections, any thoughts about 
what the EAC should be focused on?
    Mr. Levine. Sure, Congressman, yes. To Ms. McReynolds and 
Mr. Gilligan's point, I think the Solarium Commission's remarks 
and recommendations with regards to civic education is a 
critical piece.
    I think there are a few things that are worth noting. No. 
1, we know that there are other countries that have done this 
in some respects better than we have. We can look to countries 
like Sweden and the Netherlands who also have been dealing with 
sort-of foreign interference threats for some time, who have 
more comprehensive approaches to deal with some of the threats 
that are outlined in terms of mis- and disinformation.
    I would also underscore, to your point as well, that the 
Election Assistance Commission recently got some additional 
funding which paralleled or went in concert nicely with the 
Commission's recommendation and that you are seeing the EAC 
begin to ramp up in terms of some of the hires that they have 
brought on. They now have more people with a cyber background.
    So I think there is a real opportunity for them to be able 
to step up and continue to provide cyber resources that enable 
State and local election officials to prepare for those 
evolving threats.
    So I think, to your point, being able to bring people on 
who can assist State and local election officials who are 
always strapped is important. I think being able to look 
outward for best practices from other States who are doing this 
kind of work, as well as other countries, is also really 
important as well.
    Mr. Langevin. Thank you.
    I know my time has expired. I just want to thank all of our 
witnesses for your testimony. I didn't have time to get to what 
we need to do to protect people with disabilities and ensuring 
barriers are brought down for them, but perhaps we can submit 
those questions for the record. But thank you for your 
testimony.
    Mr. Chairman, thank you for holding this hearing. It is 
very important as we get ready for the 2020 election and 
beyond. Thank you for your leadership.
    Mr. Chairman, I yield back.
    Mr. Richmond. Thank you.
    The gentleman from Rhode Island yields back.
    I now recognize the gentlelady from Texas, Ms. Sheila 
Jackson Lee.
    Ms. Jackson Lee. Thank you, Mr. Chairman, and thank you to 
the Ranking Member, for this important hearing.
    We know that The New York Times said that John Lewis risked 
his life for justice. In his op-ed he indicated that the vote 
is precious, but we will lose it if we do not use it.
    The Constitution also acknowledges that local elections and 
State elections are that of those jurisdictions, but it does 
not deny Congress the right to involve itself by law or 
regulation, which I believe is extremely important in the 
process of which we are dealing with at this moment.
    It is important to give confidence to the American people 
so that misinformation and disinformation and voter suppression 
will not keep the majority of Americans, all of Americans, from 
the right to vote.
    So I pose this question first to our witnesses, please. 
Over the last couple of days there have been statements about 
the election should be moved. I believe there is no law and no 
right to move the November election, no Constitutional right to 
move that election. But that has been in the public atmosphere.
    So I raise the question, in your professional opinions, how 
does the current President's persistent rhetoric about 
increased fraudulent ballots and changing the date of the 
elections--and, by the way, two Federal elections were held 
during the Civil War--how would that impact voter confidence?
    I would raise that question with Ms. Sylvia Albert to 
answer that question.
    Ms. Albert. Well, thank you for the question, Congresswoman 
Jackson Lee.
    We have seen already that the President's rhetoric is 
affecting the confidence that voters have both in vote-by-mail, 
particularly, and also in elections in general.
    I think we can be buoyed by the fact that elections 
officials around the country uniformly have responded to the 
misinformation that the President has shared with the right 
information.
    I think what is important, and as we speak about elections 
going forward, is not to be thinking about defensive 
procedures, but offensive. We need to engage our communities in 
the civic education and inoculation that would protect them 
from being affected by this misinformation.
    Ms. Jackson Lee. Thank you very much.
    In 2016, Russia was blamed for breaching 21 local and State 
election systems. In fact, Robert Mueller released indictments 
of 13 Russians regarding interference in our 2016 elections.
    Mr. Levine, what should we be focusing on? What, if any, 
has the Marshall Fund seen that should be done regarding the 
outside international interference in our elections which is 
predicted to be extensive in 2020? Mr. Levine.
    Mr. Levine. Sure, Congresswoman, thank you for that 
important question. I will make a couple of points to your 
question that I think are worth noting.
    No. 1, I think that election officials need to have Plan A 
and Plan B. For almost every cyber component of our election 
infrastructure there can be an analog piece that can be 
available to use so that in the event of any kind of cyber 
event we have something to fall back on.
    We have seen this happen a number of ways. We know that for 
those States and communities that use electronic poll books or 
electronic lists of voters to check in, if there is either a 
technical glitch or, in fact, a nefarious act, we know that if 
people have paper poll books they can continue that voting 
process.
    We know that with regards to election night reporting 
websites, we know if that a website is to go down, for example, 
because of a denial-of-service attack, that if folks can have 
redundant websites where they can have other means to be able 
to share that information, that could help ensure that there is 
voter confidence.
    So making sure that folks have things like additional 
ballots, paper poll books, redundant websites. As we look now, 
we probably are seeing an increase in folks that, for example, 
are requesting absentee ballots on-line. Making sure that, in 
fact, if you can't make such a request, that maybe you have a 
fillable PDF form so that you are still able to have that 
request through. I think that is really, really important.
    I think the second piece that I think is worth noting 
really quickly is that it is really important that the 
information from the intelligence and law enforcement community 
about the threats as much as possible is being shared with 
State election officials and subsequently with the American 
public so that as much as possible the American public has the 
opportunity to prepare accordingly, whether it is the 
misinformation and any other threats.
    Ms. Jackson Lee. Thank you so very much.
    Mr. Gilligan, if you would just give quickly one 
significant action that Congress can take regarding internet 
security in the voting process. Mr. Gilligan?
    Mr. Gilligan. Thank you, Congresswoman.
    Let's see. If I were to think of one thing that Congress 
could do, I think what I would suggest is the following, and we 
have seen indications of it in some of the comments from the 
Members. That is, when we address the security of local 
elections offices, we have to realize that they are 
underresourced and don't have the talent that the State level 
and the larger elections jurisdictions do.
    So what I think is going to be important going forward is 
we cannot assume that local elections offices are ever going to 
be able to protect themselves. We actually have to do it for 
them.
    This is a discussion that we are having with the State-
level organizations. I mentioned in my testimony some 
capabilities that we are working to deploy with CISA and the 
elections community.
    That, in fact, is sort-of we can do it and we can deploy it 
without a whole lot of support from the local elections offices 
and actually protect them. One of them is this endpoint 
detection and response. The other is this malicious domain 
blocking and reporting.
    So I think what then the recommendation that I would make 
to Congress is, if Congress could help in the funding of these 
initiatives to get them off the ground, to get enough of it 
deployed, ultimately what we have seen in other situations, the 
States will start to kick in funding over time. But to get the 
ball rolling, Federal funding is very helpful.
    So thank you.
    Ms. Jackson Lee. Thank you very much, Mr. Chairman. Thank 
you. I yield back.
    Mr. Richmond. The gentlelady from Texas has yielded back.
    I now recognize the gentlelady from New York, Miss Rice, 
for 5 minutes.
    Miss Rice. Thank you, Mr. Chairman.
    I would ask, put this question out to all of the witnesses. 
I believe, Ms. McReynolds, you were talking about how things 
are done in your State of Colorado. What State or locality does 
mail-in-ballot voting really well? Like what system can we 
emulate?
    We in New York have done this for a long time, but we had a 
historically very difficult time in our June primary. It 
actually took 5 weeks to certify one of--a Congressional 
primary. We think of ourselves in New York as pretty 
progressive when it comes to these issues.
    So who can we look to? We still have 3\1/2\ months before 
people go to the--September, October--no, 3, 3 months before 
people go to the polls. So maybe if you could just expound on 
who you think does it really well.
    Ms. McReynolds. Sure. Thank you for the question, 
Congresswoman.
    Yes, I mean, we saw issues in New York. I think that New 
York actually has lagged behind many States in terms of 
updating policies around voting access. There hasn't been early 
voting. There wasn't no-excuse absentee up to this point. There 
have really been a lot of issues in New York. Exorbitantly long 
lines actually back in 2018 and even prior to that. So there 
have been issues there, and I think there is some updating of 
policies that definitely needs to happen.
    In terms of my expert opinion on sort-of the work I did in 
Colorado and then the work I have now done with various States, 
I think no State--it is not necessarily a cookie-cutter 
approach. However, what we have in front of us is a good 
example of a slew of States that have implemented various 
policies in the last few years that have improved their 
processes, improved the system for voters, and also enhanced 
security.
    Colorado is one of them. California adopted a model that 
looks very much like Colorado. Utah has expanded their voting-
at-home program to be now for the entire State, and they have 
emulated some of those good practices from Colorado, as well as 
Oregon and Washington.
    Miss Rice. So what are those practices, if you can just 
tell us? What are those, just if you can give us----
    Ms. McReynolds. Sure. So a couple of things that we did in 
Colorado that I think are good to emulate.
    One is modernizing registration. So we have automatic 
registration. We automatically update addresses based on moves 
that we get from the motor vehicle locations or from the United 
States post office. We literally consume that data monthly, 
update addresses. So Colorado, for instance, and many of the 
States in the West, have the cleanest voter files in the 
country.
    We also have created systems like ballot tracking. So 
ballot tracking started in Denver, Colorado, way back in 2009. 
That is a notification system just like tracking a package 
where you get a text or email about when your ballot goes out, 
when it is on its way to you, and then confirmation when the 
election official receives it.
    That is one of the top-level recommendations that States 
can do right now. There is technology available. It doesn't 
require a lot of change in any State. You can literally adopt 
it as a service to voters and it enhances security, and it is 
one of our top-level recommendations.
    The final recommendation I would say is expanding drop-off 
options for voters. So at secure 24-hour drop boxes, at drive-
up drop-off, there are examples of drive-up drop-off just like 
a drive-thru line at a restaurant. You can drop off your ballot 
through the window of your car and not have to get out, not 
have to interact with anybody.
    Then, finally, expanding drop-off options to accept mail 
ballots at all voting locations. Not every State allows you to 
drop your ballot off at a polling place.
    Those are examples. Those drop-off options and ballot 
tracking can be done now, can be adopted now across the 
country, and there is time to do that.
    Miss Rice. Can I also ask you, because there are going to 
be some people who actually want to go to the polls.
    Ms. McReynolds. Yes.
    Miss Rice. I know New York is not unique. Most of our poll 
watchers are people who are in that vulnerable age bracket who 
may not want to be sitting at a poll for 12 hours in November, 
God forbid that we are where we are still with this virus.
    So what would you suggest to improve. I mean, obviously, it 
doesn't help that people are closing down polling locations. 
Other than keeping as many open as possible, what would you 
suggest to secure people who prefer to vote in person?
    Ms. McReynolds. Yes. I mean, in-person voting has to exist, 
but we have to think about it in a different way than we have 
ever thought about it before. What I mean by that is we need, 
for instance, the business community to step up and offer 
locations.
    One of the things that is happening now, which I am sure 
many of you have seen, is there is this concept of arenas, 
large sports facilities being used as polling places. Kentucky 
used their State fairgrounds and were able to serve tens of 
polling places all in one place with social distancing.
    So these sort-of large locations are really important. I 
have suggested car dealerships. I think car dealerships in the 
showrooms and the accessibility of them, given where they are 
usually located, would be excellent locations in many of the 
big cities.
    So we have to be creative. I think the business community 
can really help solve a lot of these challenges, whether they 
offer a polling place, offer their workers to help on election 
day, or offer their location to be even a drive-up drop-off. 
Even a drive-up drop-off would be tremendously helpful in 
States.
    So this is kind-of an all-of-community type of response 
that we really need to see happen to make sure that our vote is 
protected.
    Miss Rice. Thank you very much.
    Mr. Chairman, I yield back.
    Mr. Richmond. The gentlelady from New York has yielded 
back.
    I now recognize the gentlelady from Illinois, Ms. 
Underwood, for 5 minutes.
    Ms. Underwood. Thank you, Mr. Chairman.
    The integrity of our elections is essential to the 
preservation of our Republic. Securing our elections is a major 
concern for my constituents in Illinois, where the personal 
information of 76,000 voters was accessed by Russian operatives 
in 2016.
    We must immediately invest in our election infrastructure 
to protect our democracy against on-going attempts to 
interfere.
    On top of those preexisting threats, the COVID-19 pandemic 
has heightened the need for greater flexibility in how, when, 
and where people vote. Nobody should be forced to choose 
between protecting their health and exercising their 
Constitutional rights.
    Elections security is National security, and I am grateful 
to our witnesses for advising this committee on how to protect 
it, whether that means preventing foreign interference or 
conducting safe and accessible elections during a pandemic.
    Ms. Albert, one result of the pandemic--or rather a result 
of this administration's failure to adequately respond to the 
pandemic and support families during this crisis--is a surge in 
housing instability. Many Americans are out of work and at risk 
of losing their homes, whether they rent or own. Suddenly a lot 
of people's addresses may soon be out of date.
    How can we protect the voting rights of people experiencing 
housing instability during this crisis and make sure that they 
are not subject to unnecessary voter registration purges?
    Ms. Albert. Thank you for the question, Congresswoman.
    As we have talked about before, H.R. 1 contains many 
different provisions that would be beneficial in moments like 
this. I think the thing that we have seen in this pandemic is 
that our system is not as flexible and comprehensive as it 
could be in order to meet the needs of different communities.
    So, for example, communities who are experiencing housing 
displacement right now, homeless communities, they are strongly 
benefited by same-day registration or, in addition, provisions 
that allow for updating registration at the polling location.
    To be clear, I mean real same-day registration, which means 
you can go to your voting polling location and update your 
address and it is not you have to go downtown to the main 
office that is only open between 9 and 3 on election day in 
order to update your address.
    Ms. Underwood. Right.
    Ms. Albert. Really what we are seeing is that those 
vulnerable communities are just more vulnerable in this 
situation and are really dealing with much more than they ever 
have before.
    So not only do we need to be looking at this now, but we 
really should be modernizing our system for the next disaster, 
for the next pandemic, for the next hurricane to really meet 
the needs of our constituents.
    Ms. Underwood. Mr. Levine and Ms. McReynolds, do you 
believe voting from home could help these displaced voters? If 
so, what does the Federal Government need to do right now to 
make sure that Americans are able to vote from home, even if 
their address changes within the next few months?
    Ms. McReynolds. Sure. I can answer that.
    One thing I would say about what we did in Colorado is we 
created this system of same-day registration, combined with 
automatic registration, combined with mailing a ballot to all 
electors. So we have a process and tried to create and fill all 
those gaps.
    But then we also created the concept of vote centers, and 
that started in Colorado, as well as an innovation that allows 
a voter to go to any of the locations and update their address 
or what have you.
    That really reduced provisional ballots by 98 percent and 
converted those to normal ballots, because most of the people 
that would show up at the wrong polling place was because of an 
address change.
    So we created a new way to deal with in-person voting that 
has significantly improved the voting experience.
    So vote centers is also a really great concept. The one 
thing I would say about vote centers is it does require 
technology. It is going to be a much bigger lift to set up 
ahead of November because there is a short period of time. But 
there still is a way to handle provisionals and all of those 
sorts of things should somebody not receive their mail ballot.
    The other aspect I would say is that it is critically 
important before every election that voters check their 
registration, make sure they are active, make sure their 
address is up-to-date. Then if something does go awry with 
their mail ballot not arriving, that they utilize the processes 
that are in place in various States--and I am from Illinois, so 
I am also familiar with the Illinois provisions--and make sure 
that voters are familiar with what they can do to take action 
should they not receive their ballot.
    In every single State you can still vote in person, you 
still have that provisional ballot as a safeguard should 
something happen that makes it difficult for you to receive 
your ballot.
    Ms. Underwood. Well, Mr. Levine, I am out of time.
    But thank you so much to all of our witnesses for being 
here. We appreciate this information and your testimony before 
our committee.
    Mr. Chairman, I yield back.
    Mr. Richmond. The gentlelady from Illinois has yielded 
back.
    I want to thank the witnesses for their valuable testimony 
and the Members for their questions.
    The Members of the subcommittee may have additional 
questions for the witnesses, and we ask that you respond 
expeditiously in writing to those questions. Without objection, 
the committee record shall be kept open for 10 days.
    Hearing no further business, the subcommittee stands 
adjourned.
    Thank you all.
    Ms. Jackson Lee. Thank you very much, Mr. Chairman.
    [Whereupon, at 11:40 a.m., the subcommittee was adjourned.]



                            A P P E N D I X

                              ----------                              

      Questions From Honorable James R. Langevin for Sylvia Albert
    Question 1a. In your testimony, you raised the issue of 
accessibility for voters with disabilities and expressed that voters 
with disabilities in Pennsylvania had difficulty casting their votes in 
the 2020 primary.
    What barriers to voting exist for people with disabilities, and how 
have barriers increased since the public health crisis began?
    Answer. Response was not received at the time of publication.
    Question 1b. What solutions should we be considering now to avoid 
denying people with disabilities the right to vote in November?
    Answer. Response was not received at the time of publication.
      Questions From Honorable James R. Langevin for John Gilligan
    Question 1. I have been convinced for some time that cybersecurity 
concerns associated with on-line voting are simply too great and the 
stakes too high to be comfortable with that idea. Yet a handful of 
States are considering this in light of the challenges that come with 
voting in person during a global pandemic.
    What is your position on on-line voting?
    Answer. On-line voting, which we define as the electronic return of 
a voted ballot from a voter's device, poses unique and complex 
technical challenges. At present, the technologies needed to ensure on-
line voting is not susceptible to malicious or inadvertent compromise 
do not exist. As such, presently or in the near future, CIS does not 
recommend the use of on-line voting for U.S. elections. The exception 
to this recommendation would be in very limited circumstances where the 
risks of on-line voting are outweighed by other risk factors such as 
the potential disenfranchisement of eligible voters who have no other 
means to cast their vote, e.g., the voting of overseas military 
personnel. Even in these limited circumstances, extraordinary care must 
be applied to ensure confidentiality and integrity of the electronic 
ballot as well as proper identification and authentication of the 
voter.
    In the longer term, the potential of secure on-line voting to 
increase voter participation is appealing, if done securely. However, 
the unique requirements for secure on-line voting exceed those required 
for on-line banking or other on-line transactions whose threats and 
mitigations have been tested over time. This is driven by several 
factors; the most difficult is ensuring that the contents of a cast 
ballot are a secret to everyone except the voter while verifying that 
it is received and tabulated correctly. Identifying and correcting an 
error is particularly difficult as the election office can only know 
that the voter cast a ballot and not its contents. This is 
substantially more complicated than a financial transaction and unlike 
any other transaction commonly conducted on-line. As such, on-line 
voting must be addressed with new and different approaches.
    Fortunately, there is a group of researchers from academia and 
industry who are working on technical solutions to make on-line voting 
secure. While there remain issues, the currently preferred technical 
approach promoted by these researchers is known as End-to-End 
Verifiable (E2E-V) solutions. With this approach, voters and the public 
are provided assurances that the votes were cast, recorded, and counted 
properly regardless of the medium used. Otherwise, the voter or an 
auditor is alerted. As such, E2E-V provides hope that on-line voting 
can be done securely at some point in the future.
    Question 2. What would need to happen in order for this on-line 
voting to be a viable solution? Can these steps be implemented before 
the 2020 elections?
    Answer. As noted above, further research, development, and testing 
using end-to-end verifiable on-line voting approaches, or alternative 
technical approaches, will be necessary before on-line voting can be 
considered viable. In particular, researchers need to solve conflicts 
between the verifiability of the voting process and other requirements 
such as usability and accessibility. This will take time and 
significant investment. Moreover, given the critical nature of voting, 
extensive piloting and transparent examination by experts must be 
accomplished before on-line voting solutions can be deemed safe and 
secure. It is not possible to accomplish these efforts prior to the 
November 2020 election.