possibility of a select the disenfranchising of voters by deleting them from the database. it's really easy in oregon to check whether they are still the database and getting the ballot early means there would be an early notice that maybe there was a problem assuming somebody did get through a very secure system. >> thank you. oregon and washington have that mail balloting in their states and there are lessons that other states are learning from that. not every state has the same and other states of rich different decisions about their population and that's entirely appropriate that states like california and arizona and some other western states offer the option of becoming a permanent male voter which you have to check a box and after that you receive the ballot for re-election. colorado has experienced and california passed a summer bill that is a hybrid of sorts that

every voter gets a ballot and they can choose to mail that ballot in our drop the ballot off at a site or go went early to an early voting site as mr. wallace mentioned or they can go on election day to a voting center. >> i don't mean to interrupt but to clarify and organize someone wants to vote in the elections office on election day they can stand in the booth and vote. anybody can do that. some people don't because it's easier to mail it. >> i think the states are learning from that experience and trying to figure out what's best for their state. oregon and washington and colorado and other states and their particular systems. also importantly brought up the notes between the voter registration system and the voting machines and tabulation devices themselves and particularly with mail voting it's very important because the voter lists are the way to deliver a ballot to someone

because that's able to generate the mailing to the voters. of course the states where they don't get ballots, they are usually receiving cards as a reminder and a question earlier about chaos i think was a very important question. i think there have been a lot of systems in place to avoid chaos in the last 10 to 15 years. one thing that's true now as particularly in a presidential election it's going to be very hard to avoid information about when the election is and what's going on. in fact i'm guessing a lot of people would like to get a way from information about the election so whether it's the work that facebook is doing pushing information about election day and how to find your polling place or google doing the same way with other tech partners in states partnering with those entities to make sure the information gets out, that's all a great protective measure to ensure that if the voter does run into a problem or might think they

might have a problem they can make sure they are getting it. c briefly talk about what this is doing with the action of living machines. >> your question involves the lifecycle from registration all the way through guidelines for the voting system. the voluntary voting guidelines that we work with involves the voting systems themselves but i think we have a decades long history of security as the management of risk exercise and i think the states have taken that very seriously with election officials in this state suggests that they are managing risks to the voting systems into the registration systems in a way that incorporates the best practices that nist has been promoting for a number of years. >> icy my time has expired could thank you mr. check. >> thank you ms. bonamici and

mr. loudermilk is recognized for his question. >> a very important issue and rightly we should be concerned about the integrity of our election system because we are only as good as the integrity of the selection system. after spending 30 years in the i.t. business this is something that is very important to me and an area that i do understand at least from the tech logical sigh. another area we have to be very conscious of is the federal involvement because typically whatever we get involved with doesn't run as well is that the state is doing it themselves so we are very conscious of the role the federal government plays and is very limited especially in an authority stance. i understand we do have things we can do as far as setting recommended standards but recently the secretary of homeland security has reported saying the dhs is considering whether the state electoral

apparatus should be designated as critical infrastructure. is this appropriate but in your opinion? >> is a policy decision that is way above my pay grade so i can have an impact that i can party for that. >> do you have any idea what the benefits or disadvantages would be of declaring visas critical infrastructure? >> i can't speak to that. i know nist provided a significant benefit in partnership with the error on the development of the cybersecurity framework for improving the cybersecurity of critical infrastructure that is receive a lot of attention and accolades but that's not limit to critical infrastructure. any organization of any size in and any sector is free to adopt that framework. >> you are working with dhs to help the states understand the

critical nature of their electoral systems? >> we are partnering with dhs and the department of justice on trying to understand how we can ensure wide dissemination of best practices and minister pahlavi's and as was mentioned earlier a request to dhs for assistance is not predicated solely on whether you are designated as critical infrastructure. that request can be made without hesitation. >> it does include the request, minder standing if it includes respect to scanning of systems for example but only upon request. >> so would be like a stress test on the system? are we applying lessons learned from the presidential commission on enhancing national cybersecurity and making these recommendations?

for the state's? >> it has not reached the stage of finalizing recommendations. those are not teen inc. in these guidelines. sort of in the reverse in the sense that the commissioners are actually taking a look at best practices and fielding discussions with the i.t. industry and the stakeholders around the country to try to develop the best possible recommendations for the benefit of this administrator in the next. >> so nist's stance on this is to work within the framework of the federal government to come up with recommendations that the states may or may not implement and the flexibility to where they could be customized to the states individual network's? >> that is correct. >> secretary how do you feel about that?

>> i do not think critical of the structures needed at all. as was indicated by mr. romine we can go to homeland security now we can get those tests by fbi. we have a committee and as a matter fact the secretary has been active in this process with several of us. it is one of the committee members we have appointed on nests to serve on homeland security's committee into best practices and the like are you most states are corporate in with their local fbi agents when needed and you know again i don't mean to be flippant but do we want to create a new tsa for elections in this country a new postal service? i just don't think we need that. the constitution says very vividly accepted the states in a time, place and manner in which we conduct elections. it's a constitutional issue and i understand from the rhetoric

that's not the intent but to go and put the national elections along with the banking system and the electrical grid in my position is way overrated, unnecessary and we can accomplish the same goals. it's not that we don't want the support and assistance when we needed that we can accomplish that in a far less intrusive way if we keep things on the past now and again i think the answer is new equipment to improve the systems. we are working on trying to get a system where you can vote anywhere in the state just like was represented earlier so critical infrastructure would be an absolute and i think i speak again, don't know of any secretary of state who has voiced an opinion that they want to be part of that. >> do feel that nist is doing is beneficial to you? >> yes. >> do you feel in any way what

is happening right now with --. >> no. >> thank you. i yield back. >> thank you mr. loudermilk and the gentleman from new york mr. tonka. >> thank you mr. chairman welcome to the palace and thank you for your information. mr. becker of the commission on elections administration recommended audits and voting equipment be conducted after each election as part of a comprehensive audit pro grant. according to verified voting approximately three-quarters of voters in november will be using voting machines with paper records of their vote and i just share concern perhaps about the potential for mishaps or potential hacking that voting machines with no paper trail. can you please describe the role auditability plays in elections in individual voters casting their vote? >> thank you.

we of course are its ability is important. it's very helpful when there is a permanent record that should need to be reviewed for some reason and in fact even if you are not sure whether the county is -- you can discover that and that is what i did postelection audit does. in 2014 about 32 states offered, had a requirement for postelection audits and i will be honest some are better than others. there are very good standard practices were states take random precincts across the state and check the paper count against the electronic count. there's even something called the risk limiting audit where you have a number of ballots you have to count to ensure the results as the election gets started and these are practices that are put in place in many states. what we are seeing it's easier to audit the system when you have a paper record that the

voter has reviewed and more voters are going to be paper than we have seen since hava was at it. states like florida that had used direct recording devices have switched my am an early voter but this is the first presidential election since hava where maryland will be using a paper ballot. i have recommended for years and along with the presidential commission that postelection audits are a good idea and having a system that allows for full and transparent postelection audit temp paper appears to be one the best for that and the best opportunity to ensure the election result are reflecting of the people. some may think you and secretary shepard would you please describe what you have in place in louisiana in terms of postelection auditing and how would you. other states overall? >> well we do have a post-audit

function. now we do not have a paper ballot system. we are looking at that when they go out for rsv -- rsvp but our screen on hava it pops up and gives you everything, every person you voted for in the position he voted for to give you one more opportunity to rectify that if you want to change it or if there was an error. pc a lot on highly sensitive machines an elderly person may be dragging a hand in it inadvertently hits the button below for a lady with long fingernails sometimes will have a problem. she will have the opportunity to rectify that. we audit at the end of each day on early voting to ascertain the correctness of the vote on the bow and sheets so to speak. >> there are paper ballots that you are devising an audit process for.

what whether some of those factors in the audit that you see as essential and have you looked at other states? >> we have actually gone out to denver, the county of denver has a similar situation that is now being used in california and other states with a paper ballot. the majority of folks want to bring that ballot in and put it into a box at a site. we have looked at that system and we have looked at the printing of a paper ballot instead of on the screen and going to a lockbox. i would be personally against the voter taking that ballot out of the precinct. i think there is one state that does that but overall to answer your question i think the systems are sound but everyone has to remember every state is different. that is the uniqueness of the system.

a lot of similarities but each state is very unique in their elections. some may have a week of early voting in some may have 30 days and some states can do early voting. that is the prerogative of the state. >> thank you very much mr. chair i yield back. >> thank you mr. tonka. it john penn from -- mr. davison is recognized from ohio, i'm sorry. >> thank you mr. chairman. dr. wallace or testimony addresses the possibility of inserting nowhere and voting machines themselves. can you elaborate on how malware can be loaded onto machines that are not connected to the internet and further explain what it means each and every voter machine has to be manipulated or is there different way where you can hack one machine and that would transmit about two other machines in the precinct. again even though they are not connected to the internet. >> before we had an internet we

have computers with drives and are computer viruses that could spread from one computer to another. electronic voting machines, some of them use memory cards and some of them have these battery packs. some of them have local area networks. studies conducted by the state of california the state of ohio in the state of florida found security vulnerability could take advantage of these engineered viruses where one compromise voting machine and then in fact eventually an entire fleet of machines for an entire county. >> so it's accurate to say that just because something is not connected to the internet that does not have a vulnerable -- vulnerability to cyberattack? >> being disconnected from the internet helps but is not a panacea. perhaps as secretary of state u. can talk about i spoke with our

secretary of state about their protocols but perhaps you can elaborate on how would you or how do procedures protect against that risk should something like that occur? >> i think it's important to remember that we never linked machines together. i know there are some systems that are being touted like a wi-fi in a multiple precinct site where you have wi-fi. that to me is a little scary but when you consider the concept of each individual machine that is delivered by my office now we are top-down system. so we are vastly different. ..

into that lapto the laptop and a closed-circuit send to my office. so, i mean to my knowledge no state interlocked machines so the concept of getting them in one machine with one cartridge and you miraculously change all 10,000 across the state is ridiculous because you have to go into each machine individually and have the programming. >> so you have one card that goes to one machine.

you mentioned a case study in ohio. maybe you can mentio could menth that vulnerability is. >> there was a similar study in california and each of the studies found ways that regular workers go through their standard procedures and standard operations to be used to transmit viruses from one to another. the election day you remove the memory card to collect the vote totals and can spread a virus and there are other details that vary from machine to machine and. >> host: does it increase or decrease that risk? >> it depends how it was built. i've been working to try to design something new where this wouldn't be a problem.

the reason why is they generate paper backups that could be audited against any electronic results. >> the machine itself has memory and it prints a tape that stays secure inside of the machine and you can audit any one of those, so it is a good system that has been tested a lot and will likely be front and center. doctor romine, you said in your written testimony that they partnered to develop science, tools and standards necessary for the viability and usability and security of the voting equipment for both domestic and overseas voters. how do you measure these improvements, how do you quantify them are there quantitative or qualitative measures? >> they are both. >> they are both. i don't have the details on the

measurement. i would be happy to provide those to you. i think the issue to a large extent than has been listening to the accessibility community, the human factors, the research that we have been able to do demonstrate certain changes that can be made to improve the accessibility and usability of the voting systems and we have documented those in various reports. i can give you pointers for the way in which the systems have been improved. >> my apologies my time has expired. >> ms. edwards is recognized. >> thank you mr. chairman and to the witnesses. i apologize i had to step out for a bit but i came back because it is an important subject.

i just want to be clear do you concur in the belief from the department of homeland security that it was the russian state actors that hacked into the attempted arizona and also the party hacking that occurred earlier in the year? >> i have no information on that. >> the only thing i know is the dnc issue. i don't know if they've ever determine where it came from. >> i don't have any specific information. >> you believe they are capable of making that determination based on the signature. >> i don't have any information to the contrary to support. >> i only know what i've read in the press. >> in fiscal year 2015, you

received about $1.5 million in appropriations from the eac that is down from the budget of two to 3 million in the previous couple of fiscal years. do you think that is sufficient for you to be able to provide the kind of certifications you need in the system's? >> we don't do certifications we do provide support through the development of guidelines and we also provide assistance in the voluntary laboratory accreditation program, the testing laboratories that do test equipment for certain states that choose to do that. obviously you can do more with more, but we believe that the current budget we are receiving

is adequate to continue to provide expert advice in security and interoperability ad security and interoperability for the voting systems. >> in part of your testimony, you indicated that i think it was your testimony that the technologies that we were using for these voting systems is now about a decade old for these systems. can you share with us what you believe if you had analyzed it what would need to be an updated version that would enable us to keep track of the technology development? >> there is a rash of purchasing the new equipment with a funding model that came through as a result of that. we've already seen some state go

to a second system after using the dollars. i think in talking with the state, there is a great desire to be able to leverage new technology that will improve access as well as integrity of the systems that would also be cheaper to maintain a hand i don't have a specific dollar figure if we were to replace all the systems nationwide, it is definitely in the billions. but to encourage systems that are more component-based that he was more off-the-shelf components that are easier to swap in and out so you don't have a system that has a 10-year-old touchscreen you can update as it happens i think i would bthat would be a huge adve to the officials and if they had the resources to do that, you would find them to do some exciting things.

>> i apologize that was your testimony. >> i apologize. >> -working for four years now to try to design a better machine and our intent is to use off-the-shelf hardware with customs hardware to the extent we can for that reason. when you buy a giant touchscreen computer from hewlett-packard and insert your favorite company you can get cheaper foreign key support and replace the machines whenever you need to and that helps reduce the maintenance and ongoing support costs. >> doesn't it increase the vulnerability? >> the design of the systems first and foremost produces a paper ballot so no matter what goes wrong you have these ballots to see and verify and everything else is gravy. >> as a conclusion i want to thank the secretary because i think in your testimony, you indicated the secretaries of thf state across the country have confidence in this election and

that is an important message to convey so we can make sure that we don't put al with all this tk depressed voter turnout so thank you very much. >> we are very concerned about the rhetoric and if i could add on the cost issue i do have just one louisiana currently we have roughly 10,000 voting machines that cost would it cost $5,200 each, so that is to replace them by today's dollars if you could get the machine. if we went to a system similar to what was indicated to you, overly simplifying the concept whether it be proprietary or store-bought less than $300 each. now you do need two to three per machine areas for the hardware cost for us in louisiana, 152 million on the replacement if you could get it, roughly 50

or 60 million. a third of the cost. and 75% of it is in the programming cost. the hardware is only ten or $11 million. >> the gentleman from illinois. >> i want to thank the witnesses for being here today. in my state of illinois, we had a lot of changes in the last several years. we now have the same day voting registration, 40 days of early voting extended grace. , absentee voting has a lengthy period of time, and couple that with some of the issues we had particularly in chicago with issues related to the voting i guess in terms of educating election judges and looking at the methods particularly as it

relates to the integrity of voting on election day and as we look at the potential hacking of machines is there a good model out there that has worked in terms of how we educate folks and i would also mention i was the assistant attorney and we would go out as prosecutors and be there at the voting booth and a lot of times we didn't know what we're looking for or what we were supposed to be doing. secretary, can you maybe shed a little bit of light on a few examples of what we need to be doing in terms of educating and working with our folks at the poll? >> the training is paramount that came out to all commissioners or poll workers whatever you want to refer to

them as. we do a strong component and assist with that and have a very unified videotape we use so we have consistency across the state, but we do have the training and certification and require them to get certified annually. that is a benefit because the better the experience. we also have people in larger precincts for questions promoting that let individuals take a look and actually vote that on the phone to use as a guide to have a better experience in the voting booth and the other thing to me that is the strength of the poll workers and the voting boards in the counties with regards to the subject we are talking about

today, we all know they've been there a long time. if you could think about the greatest deterrent both democratic, republican poll workers together do you realize someone would have to go against that 80-year-old lady that's been there i don't think that's going to happen whether democrat or republican and toomey that is one of the hidden jewels in the system you have the best state-of-the-art equipment or whatever we have you've got people on the ground looking at the process. it's fundamental and it's the same way we did it 240 years ago and i think that's something we need to recognize in this whole

debate. >> what you go through in louisiana, are you confident that type of education and training is consistent across the country? >> that i couldn't speak to. it is dominant across the country but i wouldn't say that every state does it that way >> with all these changes we've seen recently with voting and how we vote coming and i went through the litany there, what does the future of the voting look like? >> what we learned today is all 50 states will be voting differently coming and it's hard to make a broadbrush statement. i think that there will be a lot of hand marked paper ballots and a lot of computer technologies available and some states are tt are voting by ballot and that's okay. >> thank you mr. chairman.

>> i not recognize the gentleman from virginia. >> i think in your comments stated and wrote the 20 states in this electronic registration center found that went up 30. how do we motivate the other 30 to be part of it and is there any suggestion that we would ever require that? >> the electronic registration center is a data center to the states voluntarily choose to join and they share information to show when it's out of date so they can notify to make sure they get the right information and also reach out to all the people that are eligible to vote and to protect them to the easiest way to register. it was founded in 2012 so it's only 4-years-old and now 20 states so i think that's pretty good for pre- k. 4-year-old but

certainly we are working very hard with the states including virginia was one of the founding members to see more states join and many others are spreading the word and that is reducing cost and increasing integrity because they are not sending mail to people that are no longer there. the administration did recommend that systems and that has been a tremendously positive influence and i think by the time we get to the election we will be at more than 30 states as i talk to those around the country. >> in the testimony you talked how the requirement that mandates states is only 32 states right now and you wrote

the mere possibility of the recount o for the audits acts aa deterrent. so what do we need to do with the other 18 states that don't have this post audit reconciliation of paper and electronics? >> i am a big fan of reconciling when you have both. many of the states that isn't an option because you don't have paper records like the entire state of georgia votes without any paper record so there is no way to do a meaningful audit. i would love to see the sunset of the machine and replace them with the next. there wa was the mentioning of e $396 million of authorized. is that enough to replace the old machines? >> i am not sure if we could do this on a shoestring or do better to spend more money and do it properly i don't have a good answer for you today.

>> many of you wrote about how the machines are connected to the internet. if they are not connected to the internet, they are at the point of time in the tabulation and i think someone else pointed out they are usually connected to the database 365 days a year. it'is that actually a strength e can talk about or -- when the most common question ever asked of me is when are we going to be able to vote on the internet and my answer is i hope never because the world is evil thing and we see it everything gets hacked into and that's why i am so adamant to make it much more difficult.

but the day we go on the internet, all bets are off. i want to cathy dot there are a couple of states that do allow the return of an overseas military ballots by the intern internet. alaska being one and i don't remember the other three. that is a small percentage of the overall vote but they do allow for the return. but i will say this in defense of that it is a secure military you don't just send them an e-mail and they have to get access and they have the ability to open the file up and do something with it so it is a little bit different but certainly under the argumentative discussion we have today it could be vulnerable. >> on this requirement of

reconciling paper and digital, is this a suggested standard or should it be? >> part of the system guidelines that we work with was a strong recommendation that there be in audit capability and certainly paper records to provide a robust way to do that but it doesn't mandate specifically. >> i now recognize myself for five minutes. i just spent two days in baton rouge. >> i came back with the representative and came back with them and he had the same expression to me. i represent 36 districts in

texas and we had -- but i had never seen anything like this, 30 inches in some spots and a population center like that. i would like to ask you a question. you said in your testimony that i am happy to report there is no evidence the ballot manipulation ever occurred as the result of a cyber attack. and on the other hand, if the paperless electronic voting systems were attacked we would be unlikely to see evidence of thinthe machines or the system i just want to hear both of your opinions on this matter. i'm pretty simplistic. i ask a simple question and i do not profess to be an expert that icon at the derivative of saying

if you are not on the internet with voting, how do you hack into the machines. i don't know much more than that but if you're not on the internet out in the cloud how do you hack individual machines with cartridges? >> thank you. the example we can look to to understand this is the virus that was engineered to damage the nuclear facility in iran that was also meant to be secure and wasn't connected to the internet, yet somehow it was able to do its job. we don't know many of the details but it's quite clear

where there is a well and a budget and a way i don't know whether that nation's adversaries have chosen to make that investment but i know that it is technically feasible and that's why it's important to take the medications into the steps against them. thank you very much. next question would be for you. is it possible for someone to conduct a cyber attack while pretending to be russian, chinese, north korean to falsely assign blame have you ever come across any instance of such. >> the issue of the cyber attacks broadly speaking is a well-known problem and nationstate actors will pretend to be others for the purpose of trying to throw off the attribution so i'm not privy to

how we have this attribution. i have to assume the people who said that know what they are doing. >> and then one more for you, considering the arrangement of the vulnerabilities and this is what you said a second ago, the range of the vulnerabilities that exist from electronic systems do you think that more states will return to the paper ballots and can you explain how it's the more secure option? >> there seems to be a trend if you consider the four states in five states now and in many cases it's not for the cost reasons. you have to factor that in. i will say this, you have to have some other protections and i think that oregon and some of the others do but i've also said the best and easiest way is right here on my hand. when i mail out a paper ballot,

i have no idea who votes that the ballot. i may be able to verify the signature that i can tell you that we are there and a couple cases in louisiana with a small jurisdiction where the individual campus goes and knocks on the door and says can i help you fill out the ballot and they do. the point being you have to have some checks and balances in the system even if you verify the signature with electronic machines so i always contend this is the easiest way to prevent fraud in the system and it doesn't mean that it's wrong to do it because i'm respectful of the states and how we do it

but in the entire subject manner, we have the $100.10 years ago and i think this would set the stage with the dollars and states in this country at this time we have $396 million of the voter appropriated dollars reportedly still out there. i gave you an example of what it would cost to replace the systems for $394 million may go a long way and if not completely retool all 50 states with the assistance from the federal government. but we can put away your on top of layer and as long as you can write a check, we will do it but at some point, you've got to use practicality and again, i myself and i think i speak for all 50 of us, we are very confident of the system we have.

we have the trifecta back up audits and the like and in the worst-case scenarios i'vworst cd here today, i am still very confident you may not have the results november 9 of the catastrophe hits that if you are a little patient we will get you the result of and you will have a new president of the united states. >> that is a good answer. i know i'm out of time, but what do you consider the chances of the states going back to the paper ballot? >> if for no other reason they are very expensive as the secretary told us earlier and for that reason if nothing else we are moving to paper sort of by default. >> the gentleman from illinois. >> i think all the witnesses for the testimony and i have

questions because some other ideas came to mind. let me ask a couple questions so i better understand. everyone does it differently in the idea of not having the machines directly connected to the internet makes sense but for example, if you do have a voting machine than usually at the end of the day when they closed and ththe clothes andthe votes are e those communicated from the polling place because i would expect that they are done often times over some sort of connection to the nest and then the other part of that is i go online and have the results coming in to see the results

they are displaying so hopefully it isn't a lack of understanding here but aren't there some connections that are going on? .. mac i can tell you if you voted

and i can reconcile the state. even in the transmission of those results even when you referred to there was a delay. there is a reason why we have that delay. to be able to detect interference in that process. even if it had occurred, delay in in getting official results, keep in mind on election night the election nights are unofficial. we know that from been elected. the news media is out there declaring winners before the polls are even close. our job is to make it accurate and effective. >> it's good to hear, is that the common way it is done everywhere? >> yes, pretty much. to my knowledge is way it is done. >> i can't speak to every place but in the places i know of the actually physically transport the cartridges or memory devices with the accounts that occurred in the precinct to the county office which is often a frustration for people who are

looking for election results. if they hit traffic or something like that there will be a delay in getting those results. compl. the problem with his voters get frustrated because there is a delay in in getting it because there's a physical transportation of the memory. >> i think hopefully that helps alleviate the concerns that people do have. it is not being transmitted electronically in a way that can be hacked into. one other question i had, the paper tapes and i certainly agree our great idea, how often, at what point would there be a check of those against the electronic numbers?

>> it usually dictates, it usually dictated will buy the closest of the election. usually a challenge or some major malfunction. typically it is triggered by a challenge by candidate, someone wins by ten votes or loses by ten votes and challenges that in requires a recount to be taken. we also very public with the certification of our machines, as you as a candidate or as a campaign can watch us certify those before hand and also when we reopen those machines to recertify, candidates are allowed to come in or representatives to actually watch process and watch that matching go on. i gave an example, testified last week at the eac on this subject and if you can bear with me a minute it probably is a good representation of your

question. i watched with major networks with an individual claiming he had a handheld device that said he could put early voting cards into them but as many times as you want to. i don't argue the point that you can have a piece of machinery like that. you do it at gasoline pumps and the like. but what i did question was in the early stages and never brought in anybody who brought in an election to dispute that. you have to allow for an early voting site that someone is going to sit there and keep injecting a card how many times are going to vote. we have have time limits in most states. at the end of the day, even if you have that piece of equipment you still have the programming of what engage that card. at the end of the day if there were a hundred people that came in to early vote by signature next to your name and we had 106

votes, we are going to be able to determine fight that number on that card that you don't see, that you voted six times. we don't do how you voted but we know you voted six times. so we will catch it. >> i am for chicago the. i'm from louisiana. so let's clean that up. >> we no longer throw ballot taxes in the mississippi river. >> we have a big lake to do that. >> thank you very much. i you'll i yelled back. >> yes sir, thank you. i now recognize the gentleman from illinois. >> reporter: thank you all for being here. this is such an important subject. i don't know if many more things more important than making sure that our ability to vote is protected and that we feel confident that everything is being done to make it open and accessible to everybody in using

technology to do that and making sure that we are protecting information and protecting that confidence that our polls are accurate, are voting booths are accurate and being abused in any way. i want to thank you for being here, thank you thank you for your work. it is clear the nature of our increasingly connected world has opened up new poll abilities which was on perceived and brought about great new things that we can all agree and improve our lives and functionality of our democracy. it does it in ways that we can exchange goods and services with others as well. a year ago i had a chance to visit with a group my colleague and i saw many of the innovative ways they are integrating technology into their services. they have online voting in many elections in most forms of bureaucratic paperwork are submitted online and more easily searchable for that. while this is encouraging i also realize realize that estonia has as many people as new hampshire or maine so there are things they can do

differently then we as a country of almost 330 million people can do. our states need the flexibility to innovate in the federal government's role should be assisting but not passing down new unfunded mandates which i hear so often from my constituents and from my local government officials on the challenges they face. if i could adjust my first question to doctor. regarding the recent cyber attacks on the voter registration in illinois and arizona, why would an individual organization want to hack into states voter registration information. are they looking for the same kind of information and other data breaches in the retail sector or just personal information? what is the purpose behind these attacks? >> there many different motives to describe. if we're talking about our garden variety, identity theft, they just want to have the

information in the database. if we if we're talking about the nation state actors, their motive could be to get information, but a lot of information is available through other channels. it could be to tamper with information. we have talked at length about the sort of chaos that could potentially cause. >> specifically with tampering, would it be possible to add voters or delete registered voters? >> if it's a database on the computer is simple possible to do all of those things. >> i wonder if i could ask you is the database part of the technical guidelines. [inaudible] >> the voluntary voting systems guidelines are principally for the voting system himself. however, we do have other guidance that my organization has developed over the years to protect information systems of broadly and would fall under that category.

i think yes, separation there is a legitimate way of trying to prevent certain kinds of interactions. >> so that separation is happening,. >> was actually happening in the states is something that i'm not privy to. >> also, from what is know, what kind of guidance for protecting voter registration databases were in place in the two affected states that i mentioned earlier? illinois and arizona. will this consider updates to include water registration databases? >> we will be considering that with regard to our partnership with the eac to provide guidance to the states and municipalities for protecting voting systems with their broader remit perhaps it's one way to look at it. the guidelines that we have in place for it systems have been developed over a number of years. they involve integrity checks,

identity management issues and other things that can protect information. so the cyber security framework that i alluded to earlier helps organizations to craft a way to manage risks in the space. >> again, my time is almost up so thank you for your work. please let us know how we can be helpful going forward. with that i yelled back to the chairman. >> you sir, i now recognize the gentleman from texas, mr. weber. >> thank you gentlemen. i want to do something before we get into this election discussion before we get into this election discussion today regarding the earlier comment of one of the members on the other side of the isle that she was appalled that there was no republican outrage over the russians apparent hacking of the d triple c. i would note that there is probably the same amount of outrage from the democrats over hillary clinton's dumping of a bunch of emails and destroying

evidence in a federal investigation. having said that, in full disclosure, i wasn't election clerk and election judge and a precinct chair a precinct chair for about 16 years in texas. the in missouri county. when we have good old-fashioned paper ballots. as one of the few who raise my hand when we said we want to pass resolution encouraging electronic voting. i said i said i don't i like the paper system, i don't trust the internet now is back in the nineties. it seemed as if we have come full circle. you'll all say that there some states considering going back to paper ballots. so here's a question for i guess all of you, one of one at a time. we'll start with you, what first of all how many states have paper? >> i think there's only five states that are completely without paper. there there some states in the middle that have a mix depending on the county of paper non- paper system.

>> what stays in your opinion has the best system? >> i don't have insight into the system that are being used. >> so you have not formulated an opinion in that regard. >> i don't have the data. >> fair enough. now if you say louisiana, i'm just saying,. >> it well the best system for which the people of that state feel comfortable in voting. >> touché. because, new hampshire, i mean you can just think of the righty that we have had across the board from the east coast to the west coast and oregon. just totally totally different constituencies, totally different comfort zones. and some people still like going to vote in the neighbor's garage. and if that's what they want to do, then that, then that

is good for that state. so, i mean that is the best answer i could give you. i would not, no i would not say that we are the best. although a few years ago they had a set number 18 which would surprise he. because i used to always say if you interview people in the streets of new york on late-night television show they would never mention louisiana as the top 20 but were there. there's not a lot, that's correct, but i think that is probably, i know that is a politically correct answer, but out of respect for all of my colleagues and all of the states. you have to make that decision. >> i would also be diplomatic here. i think if you asked most election officials throughout the country most would say that

the technology they are using, none is on the ideal system yet. they're looking for something new to come around. >> so you don't have an opinion about that. i think the particular state with work being done in los angeles county to come up with a system based on off-the-shelf components that's largely sensible is going to be instructive to the entire field. >> well. >> i'm going to the horn of three different states where i enjoy what they're doing. >> i like california's use of risk limiting audience where you can audit paper and compared to electronic you results. i like what florida has to wear they got rid of the paperless electronic voting machines. my. my parents live in fort lauderdale and they now vote in the later laser print printer on demand so they can have early voting and vote centers. florida is now doing remarkably good stuff. i've course have to say something good about texas. in travis county we are building a really great system and it could potentially be applied in many other places. >> are you from travis county? >> no i live in houston and grew up in dallas. >> okay so let me just also say here, having been the recipient of when a lot of those ballot boxes were carried, missouri

county is a big area and apparently reiger up it's like 40 miles north of the county seat. as an election judge and the general election and we would always take her democratic counterpart in the general election, take them down and turn them into the county. i've been on the receiving end when i took 45 minutes to an hour just for the drive time and people are wanting the results. what, the last question, is that right mr. sherman? >> what is the most critical time of a cyber attack? >> i would say a cyber actor who knows what they are doing is acting months to years in

advance. because they don't necessarily have access. >> i'm saying if they are going to affect the november election coming up, is that something done the night of, the week before? are you saying years that they get into the system years. >> you get in way in advance and then you have whatever effect you're trying to have. if your goal is to create chaos than you want your affect late. and it all depends late. and it all depends on what you're trying to do. >> okay. i yelled back. >> thank you. i appreciate that. i want to thank the witnesses for their testimony and the members for your questions. and the record will remain open for two weeks for additional written comments and written questions from members. with that that this hearing is adjourned. thank you. [inaudible] [inaudible] [inaudible]

[inaudible]