Election Security Presented by MICHELLE K TASSINARI DIRECTOR

Election Security Presented by: MICHELLE K. TASSINARI DIRECTOR AND LEGAL COUNSEL ELECTIONS DIVISION OFFICE OF THE SECRETARY OF THE COMMONWEALTH Date FRIDAY, JUNE 7, 2019

2 Election Security Components of a Voting System: • Voting equipment • Statewide database of registered voters • Electronic poll books

3 Voting Equipment • Federal and state standards for certification of voting equipment • Tabulators not connected to the internet • Public logic and accuracy testing of tabulators • Physical security measures of equipment: • Ballot boxes are locked • Tabulator locks into the ballot box • Program cards locked into tabulator • Paper ballots

4 Statewide Database (VRIS) • Can only be accessed through the closed network that connects each of the local election offices to the SOC • Users can only access VRIS using the workstations and equipment provided by the SOC • Network monitoring • Data is backed up nightly • Back ups are tested • Data audits conducted regularly

5 Electronic Poll Books • MA law allows for use in elections, but must be certified by the SOC • Currently no systems are certified • Used previously for early voting • Currently working on security standards and protocols

6 General Cybersecurity • SOC maintains a full cybersecurity team staffed by experienced professionals • Use of standards and protocols set by the National Institute of Standards and Technology • Passwords, updates, patching, antivirus programs, physical security • Requiring cybersecurity training for all users • Working with state and federal partners • DHS, FBI • MA Fusion Center and Executive Office of Technology Services and Security • MS-ISAC: Multi-State Information Sharing and Analysis Center

7 Challenges • Cybersecurity requires protecting the entire infrastructure, not just elections • Providing support to local election officials • Many do not have IT staff readily available • Technological skills vary • Explaining the threats • Phishing Emails • Clickjacking • DDOS Attacks • DNS Compromise • SQL Injections • Misinformation Campaigns • Social Engineering • Social Media Compromise

8 Contact info: Michelle K. Tassinari Director and Legal Counsel, Elections Division Office of the Secretary of the Commonwealth (617) 727 -2828 Michelle. Tassinari@sec. state. ma. us