.@EACgov commissioners are meeting now to vote on whether to adopt a major overhaul of federal voting system guidelines, which includes many new security, privacy, and accessibility provisions. eac.gov/sites/default/…
@EACgov “VVSG 2.0 is a major step forward to ensure the next generation of voting equipment is more secure and accessible and ensures a better voting experience for all Americans," says Chairman @benhovland.
@EACgov @benhovland Hovland: “Election security has been a major topic and focus during these efforts, and I'm proud that the VVSG 2.0 includes provisions to ensure that we will have more paper ballots and built-in support for election officials to conduct more efficient post-election audits.”
Hovland: "These gains, along with the many other benefits to security, usability, and accessibility that come with a 15-year technological leap forward, are all part of what makes this update so critical."
EAC Vice Chair @VotingGuy: “The VVSG 2.0 represents a significant leap forward in each state's ability to modernize their own standards and acquire new voting systems with the latest technology to ensure the most secure, transparent, and accurate elections possible.”
Commissioner @RedBlue2024 says VVSG 2.0 "reflects the push and pull" of different stakeholders but "represents reasonable compromise" that lets vendors start designing systems, gives guidance to test labs, and "positions the EAC for considering enhancements in the future.”
Commissioner Christy McCormick: "I appreciate the effort that went into the work over the last year and the years preceding it, and I'm looking forward to this vote today and the work required to fulfill the next step in the process."
EAC Executive Director Mona Harrington is presenting a summary of the VVSG 2.0 process and changes to the commissioners and recommending that they adopt the documents.
Of the 1,659 public comments that the EAC acknowledges receiving (activists say it's not counting a bunch citizen.org/news/groups-of…):

66% accepted

16% rejected (not deemed relevant or not accepted)

18% marked as noted (did not provide specific suggestions, were more general)
Breakdown of the categories of requirements in VVSG 2.0.
VVSG 2.0 adds a requirement for penetration testing of voting systems during the certification process. This is in addition to vulnerability scanning and other security testing.
Hovland asks Harrington to discuss changes to the wireless ban, which I wrote about here: politico.com/news/2021/02/0…

Harrington says the changed language "does not diverge substantially" from what was in the public comment draft, as the intent was never to ban wireless hardware.
“The added language goes beyond airplane mode," Harrington says. "I’ve heard that criticism, that we're essentially asking for voting machines to be in airplane mode … and I don’t believe that’s the case."
McCormick asks Harrington how the EAC can avoid a lack of a commissioner quorum delaying future VVSG updates.

Harrington says that criticism ignores another major factor delaying updates: lack of sufficient EAC staff to do research, work with NIST, and produce final language.
Harrington: The long delay since the last time the EAC voted on VVSG language "tells me, predominantly, one of the major delays to get VVSG 2.0 completed was a staffing or resource-related issue rather than a quorum issue alone.”
The EAC got a big budget boost at the beginning of 2020, and Harrington says that without those resources, "the work" to complete VVSG 2.0 "wouldn’t have been possible."
Harrington says EAC testing program manual was updated to require vendors to report if new systems sold to customers are EAC-certified. Vendors also have to report all anomalies in voting systems, not just those experienced in EAC-certified systems during federal elections.
Breaking: All four EAC commissioners vote to adopt VVSG 2.0 and its associated testing manuals, clearing a major hurdle in the process of designing, testing, and certifying new voting machines with improved security and accessibility.
Sign of possible friction to come: In new statement, voting tech vendors ask EAC to create a "framework" for applying newly approved VVSG 2.0 guidelines to their existing products.

Some of the new guidelines could make this tricky. How hard will the EAC try to appease vendors?
I misread this statement. The vendors are talking about the need to maintain current equipment, which has been certified to the existing VVSG. Thanks @eddieperezTX
for setting me straight. TBH I didn't realize this would even be a worry for vendors — seems like a no-brainer.

• • •

Missing some Tweet in this thread? You can try to force a refresh
 

Keep Current with Eric Geller

Eric Geller Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @ericgeller

10 Feb
Every new detail about 1/6 reinforces both how bad it was and how much worse it could have been.
This is correct and just reinforces how obvious the facts of this whole story are to every single person, even if many of them won't admit it.
Read 8 tweets
10 Feb
The House Homeland Security Committee is kicking off a cyber hearing right now: homeland.house.gov/activities/hea…

Half of the witnesses (@C_C_Krebs and former Principal Deputy DNI Sue Gordon) were pushed out by Trump.
One theme from hearing so far: interest in making CISA the civilian fed govt's network defender. Not just helping, but actually supervising improvements to agencies' networks.

One suggestion made: let agencies offload accountability to CISA in exchange for giving up authority.
Another notable moment: @C_C_Krebs noted how little $ CISA had for IR and for CI operator engagement and said his "biggest regret" as director was inability to "plow additional resources" Into CI community engagement.

$800m of CISA's $1.2b cyber budget went to CDM and EINSTEIN.
Read 4 tweets
10 Feb
In her first public remarks since becoming Biden's deputy natsec adviser for cyber, Anne Neuberger tells a federal advisory board that one of the admin's priorities will be "to build back better from the SolarWinds incident with modernized defenses in cyberspace."
"President Biden has immediately shown leadership with saying we've got to get a handle on the SolarWinds incident," Neuberger says.
Neuberger spoke during the opening of a National Security Telecommunications Advisory Committee meeting.
Read 10 tweets
9 Feb
As Trump's second impeachment trial begins with a video montage of the right-wing terrorist attack that he incited, I'm thinking of my fellow journalists who were caught in the middle of the attack, along with the besieged lawmakers and staff. Many are reliving intense trauma.
Rep. Jamie Raskin is doing some next-level receipt-bringing right now to illustrate that the Founders never intended to prohibit impeaching a former president.
This is objectively true. Even many conservative legal analysts have come forward to confirm that the trial is valid.
Read 4 tweets
9 Feb
The @EACgov will vote tmrw on new voting system guidelines that include a compromise measure banning wireless connectivity.

The provision, crafted to help vendors, has sharply divided security experts & advocates.

My new story (paywall now, free later): subscriber.politicopro.com/article/2021/0…
The wireless ban allows networking hardware in a voting system as long as it's disabled.

Supporters say vendors are finding it increasingly hard to find equipment w/o networking components.

Opponents say disabling wireless thru software is a faulty half-measure.
Critics of the compromise point to the AVS WINVote, which VA decertified after it was discovered that turning off wireless in software left the hardware active and vulnerable to exploitation.

Zero-click Wi-Fi hacks have been done, even against iPhones: arstechnica.com/gadgets/2020/1…
Read 12 tweets
21 Jan
.@PressSec just started her first White House press briefing.

"Rebuilding trust with the American people will be central to our focus in the press office and in the White House every single day."
@PressSec Psaki to reporters: "We have a common goal, which is sharing accurate information with the American people."
Psaki on SolarWinds: "We reserve the right to respond at a time and in a manner of our choosing to any cyberattack. But our team is...just getting on the ground today, just getting onto their computers, so I don't have anything...to preview for you at this point in time."
Read 4 tweets

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Follow Us on Twitter!