So after the, the two thousand election, the US Congress passed the Help America Vote Act, which established the Election Assistance Commission, which is a very small federal agency to, help run elections better in this country. And one of the things that the EAC does is produce the voluntary voting systems guidelines, which is, it's a set of guidelines that states can choose to require that their election officials, follow when they're purchasing equipment. So it sets standards on security, usability, accessibility, and things like that. And, the first version was, was adopted in 2005, and, the the latest version was was just adopted. And it it includes some, some pretty interesting changes that could could really improve security in, our election systems in this country.

So there there's a a lot that's new. They they really kind of overhauled the the whole thing, to to make it more flexible in some ways and make it more modern in some ways. And, you know, really, it implements, more modern security standards than than we've seen in the past. One of those those big standards that people in the election security community have been pushing for for a long time is software independence. That's a really important principle that, any system that is certified to VVS g two is gonna have to follow. So so what does that mean? Well, it's it's related to auditability. It's it's clearest if I just you know, maybe I should just read you the definition really quick. The definition of software independence is a voting system is software independent if an undetected change or error in its software cannot cause an undetectable change or error in an election outcome. This is a a definition that was, written by computer scientists Ronald Rivest and John Wack in 2006. Okay. So so what does that mean? Well, so a lot of election equipment is just computers. Right? So, some jurisdictions use ballot marking devices to print out ballots, and almost everyone uses, scanners or tabulators, which, read hand marked paper ballots. So, you know, how do you make sure that the tabulators are are doing their job and aren't hacked? Well, lots of states have these logic and accuracy tests to make sure that they work, but it's very hard to test software to the point where you can have a high degree of trust that, no one has messed with it. So even if a system appears that it's working during testing, you can't actually know that a hacker hasn't altered the software in some way so that it appears normal while you're testing it and then performs badly on election day, kind of like the the Volkswagen, Dieselgate testing scandal. So it would it would be better to just have a system where you don't have to trust that, where you don't have to trust that, election officials have been doing a great job keeping the, the system safe from hackers. So that's what software independence is about. It means that, if there were some change that was made to the software without you knowing it, you would still have an indicator of that later. It would come out, in the paper trail. And, that's really important for, voting system auditability. So I think that that's and that's something that if you have this this property, the software independence, it makes it so you you just don't have to worry so much about all of the other things that could go wrong, in, the software related to, to voting, and there is a lot of software that gets involved. So that's just one thing that, the VVSGs do, and that's a that's a major improvement to auditability. But another thing is, making it a little bit easier for smaller competitors to enter the market, the voting machine market, by allowing some commercial, off the shelf hardware. So, that's gonna be a really big boost to, smaller vendors who have had some trouble competing in the market, which, you know, is is dominated by just a few key players. So, hopefully, that will loosen up competition in the or increase competition in the market and and allow, the companies to and encourage them to be a little bit more nimble in terms of responding to, some of the latest improvements in cybersecurity that we really need for our election systems. So backing up a bit, fifteen years. That that seems like a really long time to go between updates. Why do you think it's taken us so long? Yeah. That's a really good question. And it it is a long time, especially in cybersecurity where you always have to be thinking about potential adversaries who are always updating their methods. It's not great to go this long between, updates to these guidelines, which are so critical for security. That leaves, you know, a lot of onus on election officials to make sure that they, are doing what they can to to, to stay up to date. Now updating the VVSGs is just really complicated. It, it requires a lot of different bodies, a bunch of different boards with various experts and government officials. It requires them to coordinate. There's, then you need to allow time for public comment in this process. You need to incorporate the public comments. There are testing labs who, the the drafters of the VVSGs have to work with to make sure that the principles laid out in the VVSGs are actually testable. They have to work with vendors to make sure that, these these are testable and reasonable. It's just a really, really complicated process. One hold up has been that the the EAC has, been really starved for funding for, much of the last for much of its, its existence in the last fifteen, twenty years. There have been long periods where there have been, no commissioners or no quorum. So, you know, they've they've really had had some trouble. And, you know, it it would be it would be really important to, to try to improve the functioning of the EAC and make sure that it has the resources that it needs to do the job that congress has given it. So in the report I mentioned earlier, you cover some cybersecurity issues that are beyond the scope of the EAC's voting guidelines.

So the the voluntary voting system guidelines are are great, and they're really important, and they cover a really important part of elections. But they're just limited to what congress has defined as voting systems. So, you know, they only cover the period just before, during, and after voting. So and and that's at a polling place. So, you know, when, the technology required to allow a voter to have a ballot, to fill out that ballot, and for that ballot to be counted and then officially reported. And they do a really comprehensive job of that, but they're not the whole story by any means. Election infrastructure is is complicated, and there's a lot of different components to it. So, you know, think about voter registration systems. Those are Internet connected databases. They need to be Internet connected in some way because, you wanna make it easy for people to register to vote or to update their registration online. But, you know, what if an attacker were to target a voter registration system? We saw in 2016 that, that, Russian hackers scammed and in some cases gained access to voter registration systems. What if they were able to alter the content of those systems? That would be potentially disastrous for, for the administration of the election depending on, how it happened, when it happened, and whether, officials had proper backups. Another system that is Internet connected is e poll books. So, you know, the traditional way of in person voting is, you know, with with big paper binders that say, you know, with the the information for voters that are expected to show up at that polling place. But we've seen a move to e poll books because that streamlines, check-in. It allows people to update their registration same day. It allows, jurisdictions to use a vote center model where voters can show up anywhere in their county or in their city rather than at one particular polling place. So these e poll book systems, when people come in, they can, you know, say who they are, and they can just be checked in on on these, Sometimes they're just, you know, tablets or computers. But that creates another opportunity for, an attacker to disrupt, in person voting. So there's a there's a lot that, election officials need to do to secure those systems from attack and to make sure that those are are always running. And, you know, another system that needs to be secured is election night reporting system. The the the systems that officials use to, share their unofficial results before they're certified. We saw a lot of disinformation this year about supposed irregularities in the way, those those ballots were reported. Now most of those claims you know, all of those claims amounted to to basically nothing. But, again, what if an attacker did disrupt those unofficial reporting systems to create, strange patterns in the result? You could, you know, we've shown we we saw this last year that people, are looking at those very closely and willing to spread false narratives, and they catch on really effectively. But an attacker could actually exploit, you know, our, susceptibility to those kinds of claims and actually make those election night reporting systems, misbehave, and that could really spread chaos too. So there's a lot to election infrastructure besides voting systems that we really need to make sure,

Yeah. So like I said earlier, one thing they could do is make sure that the EAC has the resources it needs to to do its job. And, you know, now that the VVSG two point o is out, it's not the concern is not so much about, you know, making sure that those can get out more quickly. Although, you know, I hope that the next version comes before, 2036. But, you know, there's there's other work for the EAC to do to make sure that states, vendors, the testing labs, are are, able to comply with the with the new guidelines to really move things along and make sure that, elections are secure before 2022. Congress could also expand the scope of the definition of voting systems in law. There have been some proposals to do that that would, could potentially expand the VVSGs in the future to include some of these systems that I've talked about, like, voter registration or like e poll books or like, election net reporting systems, that kind of thing. Congress could, give more grants to states and to local election officials that are specifically intended to improve security. So, grants to help some jurisdictions move to paper ballot. Some many jurisdictions are still using paperless systems, and they need to to make the move towards paper ballots for for better auditability. They can provide grants to do risk limiting audits, which are a great way to boost confidence that the the ballots were tallied properly, improve their cyber hygiene. They could need you know, all of this stuff takes money and congress could could allocate that for, states and local officials. And lastly, there are things that Congress can do. And, you know, some of this has shown up in the For the People Act, which, passed the house two years ago and is is up for consideration again. There are measures that both increase access and security, like expanding early in person voting and expanding, access to mail in ballots. So, you know, focusing on election day voting, is is risky in some ways because it concentrates the use of all of these systems, like I mentioned, on election day, like e poll book systems. So you have a big disaster on your hands if e poll book systems go down for a state that has a lot of election day voting. And we've seen this before in the past, not necessarily due to an attack, but because these e poll books, aren't set up properly or because workers aren't trained properly on how to use them. When that happens, you can have hours long lines because people are unable to get checked in. Now an attacker could make that same thing happen if they were to make, an e poll book system go down on election day for a state that really depended on that. So rather than focusing all of this all of these voters and all of this usage, on election day, it it's better to spread voting out over space and time. So allowing people to vote early and allowing people to vote from their homes. You know, and that that really is a win win because, in in some ways, it benefits the cure the security of the system, but it also massively increases voter accessibility, which is so important. We we wanna have turnout be as high as possible. And and those are are are just some ways to do it.

Yeah. It's you know, the the lack of confidence that, some people have in this country in our election infrastructure is really it's really disheartening in some ways because during this pandemic, election officials did an amazing job running this election, which so many experts have called the most secure presidential election, you know, in our recent history. And there was huge voter turnout, and yet you have these huge levels of distrust, which you can see by the, January where people were really fueled by disinformation, about election integrity. So there's really a lot of work to be done here, which is why we released a report, along with David Levine of the Alliance for Securing Democracy. And the idea is this is such a a massive issue that we need to confront, and then it it is about issues of not just, you know, is our election system secure and how do we get people to know that, but how does misinformation spread across the Internet and what can we do about that? It's a really huge, really complicated problem. And we think that one first step to address it is to have president Biden appoint a bipartisan commission to study electoral resilience and trust and see how we can get Americans to have more confidence in in our election system. It's been done this this bipartisan presidential commission, has been done in the past to, to success. So in 2013, president Obama created the presidential commission on election administration, which, looked at some of the administrative issues that we saw in the twenty twelve election and before that, such as long lines at at polling places, and stuff like that. But, you know, what we're facing now is is really, really complicated, and, it's about the media. It's it it involves, you know, social media. What are what are social media companies' policies about, disinformation and deplatforming? It's really, really sweeping, and we think that, bipartisan president commission is is the first step to to get started on trying to understand these problems and what we can do about them. So with this presidential commission, what specifically should they look into? So we broke up what we think the commission should do into three different buckets. So first is actual substantial improvements to our, election integrity. So, you know, even though this was a a safe and secure election, there's always room to improve. So, you know, like I said, there are too many jurisdictions that are still using paperless voting systems, and those jurisdictions need to move to, paper ballots that are auditable. And, you know, one way to do that is through, compliance with the BVSGs, but there are still other ways that we think, states and localities could be encouraged to improve the security of their systems. Second, the commission needs to think about the role of the media and tech companies in curbing the spread of disinformation, which, you know, is so dangerous. And lastly, we think the commission should look at whether to make permanent the policy changes that some states made in response to the pandemic, like the expansion of absentee voting. So, you know, that's something that Congress can do as we discussed, but, there are other ways to encourage, states to do that, and that's another thing that the commission should consider. It could look back on the changes that states did make and, you know, say what worked and or what could be improved about the way, states do, mail in voting, for instance.

Well, a democratic government is the best way that we know to make decisions collectively as a country, and it's a messy process. But if people don't even trust the mechanics by which we make decisions about how to run our government, the way we cast and count the ballots, then the whole enterprise just doesn't work. So, you know, when there's a lack of trust, whether it's because something actually went wrong in the election or because of repeated lies about election fraud like we saw last year, you know, it provokes a violent or deadly response, and we saw that in the capital siege in response to disinformation. We've seen violent uprisings after other elections in history where people rightly or wrongly didn't trust the process. Obviously, it's terrible to have reactions like that after an election, especially when there are no real issues with the election like this time. But beyond that, it's important that even the losers after an election can at least agree that the government is legitimate. And that's why we have to do everything that we can to improve our democracy to build trust. That includes improving election security so people know that ballots are counted fairly. It includes changing our democracy that it so that it more accurately represents the will of the people, such as by ending gerrymandering. And it improves it's about improving voter access so that more people, have a stake and and feel invested in our democracy.