Securing businesses and the 2020 elections amid COVID threat - transcript
In this episode of Intelligence Matters, Director of the Cybersecurity and Infrastructure Security Agency (CISA) Chris Krebs speaks with Michael Morell about securing the operations and data of businesses and government agencies as they have adopted teleworking and other protocols amid the COVID-19 pandemic. Krebs also explains how foreign adversaries and hackers have targeted vaccine and treatment research at health care institutions across the country. Morell and Krebs review the preparations being made to protect the 2020 presidential election and discuss the interference campaigns expected from foreign adversaries.
*"This interview was taped last week, before nationwide protests in response to the death of George Floyd began."
HIGHLIGHTS:
- ADVERSARIES TARGETING VACCINE DATA: Predictably any foreign intelligence services would be get trying to get an understanding of what other countries are doing, what their response is, what their approach to therapeutics may be, and treatment going forward. You know, my concern here from a cyber security, resilience perspective is, these are sometimes organizations that are not Fortune 100, Fortune 500 with well-capitalized security teams and CIO and CISO shops. In some cases, they just don't have the same resources and therefore, any sort of intrusion could be disruptive to the overall effort."
- CISA'S ELECTION SECURITY PREPARATIONS: "We work with over 6,000 election jurisdictions. We have intrusion detection systems across all 50 states and their election systems right now. We have mechanisms to share threat intelligence. We do annual exercises. Everything is in place right now. Much, much better posture than we were in 2016. That's just because, you know, there was a Sputnik moment that we just woke up and said, 'Wow, you could destabilize a democracy through these sorts of efforts.' So I think we're in a much, much better position from a resilience perspective on the election infrastructure side."
- LIKELY ELECTION SECURITY THREATS: "[T]he thing I think we we need to get our minds around is things have changed since '16. It's not just Russia. They've put the playbook out there. Any country that that doesn't quite like the way the American experience is going is going to get involved here or could get involved."
Intelligence Matters" has dedicated a series of episodes to understanding the fundamentals and national security implications of COVID-19.
Download, rate and subscribe here: iTunes, Spotify and Stitcher.
INTELLIGENCE MATTERS – CHRISTOPHER KREBS
MICHAEL MORELL: Chris, welcome back to Intelligence Matters, it is good to have you on the show again.
CHRIS KREBS: Hey, Michael. Thanks for having me. Glad to be here.
MICHAEL MORELL: So I'd love to start by having you remind our listeners, Chris, of the responsibilities of your agency, the Cybersecurity and Infrastructure Security Agency, CISA. Could you just give us a reminder on what you guys do? What are you responsible for?
CHRIS KREBS: Yeah, so founded in November 2018, part of the Department of Homeland Security. Effectively, we're the nation's risk advisor. So we work with the private sector across a range of critical infrastructure sectors to address both cyber and physical risks and ultimately get the critical infrastructure of the United States in a much more resilient, hardened position. Of course, that includes a significant number of hot topics these days, including elections, but also helping secure the COVID response, the vaccine developers, the health care institutions, as well as working with any number of organizations as they move into the digital transformation, making sure that they've got the insight and guidance they need to do it in a secure way.
MICHAEL MORELL: Yeah, a great transition, Chris, because, while I want to spend a good chunk of time talking about election security, I do want to ask a couple of questions about COVID. And maybe the first one is, how is your agency handling keeping your employees safe? They're obviously essential and they have to work. So are you on shift work or can they work from home or -- how are you guys handling that?
CHRIS KREBS: So, I mean, that is the kind of the the question of the times, right? So we're actually 93% telework right now. About 2,500 employees, 93% telework. The majority of those folks that are working in an office environment are either in a SCIF, you know, a classified space or in an emergency operations center out across the 50 states. And yeah, we've had the kind of reduced footprint and have introduced social distancing measures for those that are in the office.
But we've been actually pleasantly surprised with the productivity for those folks that are telework or adopting this kind of remote work approach. I know I myself get in the office about once a week or so and I've found honestly as productive, if not more productive than the pre-COVID, you know, the old normal. But for those folks that we do have in the office, again, social distancing or the PPE or at least cloth face coverings and disinfectants. But it's just, you know, being smart about the times and not rushing back into it, really enjoying the ability to free up the workforce a little bit, really try to understand what the post-COVID environment looks like and can we keep this sort of telework posture and maybe save the American taxpayer a few bucks in terms of real estate in leases for office space.
MICHAEL MORELL: Have you been able to keep everybody safe so far?
CHRIS KREBS: Yeah, we've of course had just the normal number of, I think COVID infections across the workforce. But I think across the board, we've been pretty fortunate in terms of a safe and healthy inhale team here at CISA. So, again, you know, looking to keep these best practices in place and following CDC guidance, of course, and following the lead of the various state and local health departments.
MICHAEL MORELL: So, Chris, you've issued guidance on how companies can help employees telework securely. Why did you take that step? Why did you do that?
CHRIS KREBS: So it was pretty clear to me early on, you know, just even what we were doing as an organization, that a number of different -- whether it's a company or federal agency, was going through a pretty dramatic shift. There's a terrible joke that I tend to repeat, you know, "Who was behind your digital transformation? Was it your CEO, your CTO or COVID?" And what we're finding is a lot of organizations have tried to make this shift in the last couple of years, but competing business priorities and other organizational commitments had really hindered that tech transformation. But COVID, man, really snapped folks into action and they had to go to this remote operational environment.
And that brings a whole lot of different security considerations, technology considerations. 'Do you have the appropriate tools in place, whether it's collaboration, how you patch your VPNs,' those things that we've been banging on for a number of years now. And so what we saw was a number of organizations, ourselves included, but also across the federal government, were issuing guidance. So we tried to pull everything together into a one stop shop. And the best place to go for that is CISA.gov/telework, where we pull together our own stuff. NSA, NIST and then private sector resources from the Global Cyber Alliance, Cyber Readiness Institute, even stuff from our international partners over in the UK, just really kind of pulls stuff together so that there's is one place to go to, whether it's, you know, the collaboration tools that folks are using, 'Here's how to deploy them in a secure way,' and providing not just the CIOs and the CISOs, but the executives, the C-suite, the boards, the general counsels things they need to keep in mind there, considering not just what today looks like, but, you know, the next year, two years.
MICHAEL MORELL: So what are some of the key points that you think companies should think about as they work to secure all of this new telework and keep it keep it safe?
CHRIS KREBS: Yeah, so it all goes back to what your vulnerability management approach looks like. How are you patching some of those critical appliances in virtual private network connections?
That's -- we've seen the bad guys exploit it. We've issued some guidance over the last several months.
Just VPNs are a target. What we're seeing in some cases is organizations are not only, you know, they're not patching, in fact, they're moving away from VPNs and just doing direct connections to the cloud.
But also, how are you maintaining your your patch for your Windows machines, your Mac devices. And then multifactor authentication across the board. What can you do to really, truly harden the identity management posture of an organization? Again, best place to go get the CISA stuff is CISA.gov/telework.
MICHAEL MORELL: Chris, you've also issued a joint advisory with the FBI that has formally accused Beijing of attempting to steal COVID-19 research and data. What can you tell us about that threat? Is it all about a vaccine or is it broader than that? How do you think about that?
CHRIS KREBS: Well, you know, you come at it from the top and you're like, 'So China's conducting cyber espionage? Color me surprised.'
These are things that I think we've all expected. In fact, we've been talking about it for months, it's the first real product we've put out. Predictably any foreign intelligence services would be get trying to get an understanding of what other countries are doing, what their response is, what their approach to therapeutics may be, and treatment going forward.
You know, my concern here from a cyber security, resilience perspective is, these are sometimes organizations that are not Fortune 100, Fortune 500 with well-capitalized security teams and CIO and CISO shops. In some cases, they just don't have the same resources and therefore, any sort of intrusion could be disruptive to the overall effort.
So this is much, much bigger than ransomware. This is destabilizing networks, and is focusing on, you know, from a confidentiality-integrity-availability triad perspective, the CIA triad, we're thinking -- I'm focused significantly on maintaining the availability and maintaining the integrity of the systems and the information that's running across those systems.
MICHAEL MORELL: Is it just the Chinese or is it other governments as well? I don't know to what extent you can talk about it.
CHRIS KREBS: Yeah. You know, if you're not doing it, you're not trying, kind of, at this point. We do expect every organ, every intelligence service to be in the mix here. The Chinese have obviously been one of the more brazen in terms of their approach. But others are in the game, too. This is a very active space, very active space. And that's kind of the thing about a pandemic, right? Is that it's not just one or two countries affected. It is truly a global event. So everybody is, every country is experiencing COVID in different ways, but they're all experiencing it.
MICHAEL MORELL: And Chris, is it all about espionage? Is it all about stealing information or is there concern, is there any evidence that people are actually trying to do damage to the work that our research institutes are trying to do on the vaccine?
CHRIS KREBS: So when you roll up all the different threat actors, both state and non-state actors, you get both the intelligence, the espionage piece, but you also get destructive attacks, absolutely. You know, the ransomware actors, you know, we kind of hoped against hope that there would be some honor among thieves. And what we found is even after some initial indications that crews like the Maze ransomware guys, said 'We're going to hold off.' What we found, after all, is that they did not. They were still exploiting the moment to go to get their ransoms.
Those attacks are absolutely destructive. They absolutely take organizations offline. You know, when you think back to WannaCry when the National Health Service in the U.K. was disrupted, there were some significant impacts there. Now, this, again, is on a global scale. So you're seeing a situation where a hospital could be impacted and their network's offline, they can't conduct clinical operations. You can't -- it's not as easy as just transferring those patients to another hospital in this environment. You never know what you're transferring and indeed if you have anything you can transfer to. So we're absolutely seeing destructive attacks across the border right now.
MICHAEL MORELL: So if anybody needs to any reason to be reminded of the importance of cyber security, it's the fact that somebody could actually, you know, hold us back in terms of getting a vaccine to deal with this pandemic.
CHRIS KREBS: Yeah. And I think we've taken we've taken that approach previously for elections -- I'm sure we'll get into that. You know, sometimes when you talk to election officials or you talk to health care officials and you talk about Russia, you talk about China, we talk about North Korea and Iran, it doesn't always resonate with them. They may read about it. They may see it on the news, but they don't necessarily feel it. Ransomware, though, ransomware is something that they intimately feel, whether it's their community or their peer networks, They see ransomware attacks on a regular basis.
And if you can address a number of the key ransomware vectors, then you can actually close out a lot of the threats from some of those state actors. So we've really put a lot of emphasis behind ransomware in a number of different sectors.
MICHAEL MORELL: So, Chris, maybe just one more question before we get to election security, and it's sort of a 50,000 foot question. So if you step back from COVID, where are we today in terms of the government's and the private sector's preparedness for dealing with cyber attacks? How do you think about how far we've come and how far we still need to go? How do you think about that question?
CHRIS KREBS: So just today, we issued a series of products, a toolkit called Cyber Essentials Toolkit. It builds on a product we issued last fall. And really, the concept here is the CISO community has the IT security community has an overwhelming, you know, an abundance of guidance. They're good.
What we have to continue focusing in on are the people that make the decisions that enable the actions of the IT security community. And that's the C Suite, that's the boards of directors, that's the general counsels, the business side folks, underserved communities. So we're put a lot of focus on high-level executives of that community.
Why is that important? Because it starts at the top. It's always about the leadership. The more leadership understands, the more they understand the business risk, which then leads to the investment community, the investment then leads to, you know, opening up the floodgates for the CISO community to make the right to get those investments in place for the capabilities. So I think back a couple of years ago to the RSA conference and the theme was – this was two years ago – the theme was 'Better.' And that was the kind of the feeling was like, 'Hey, things are better than they were a couple of years ago. Still a long way to go, but we're getting better.' It's the awareness that the leadership level is really opening up the investment channel so we can build out those capabilities. And I think across the board you see that. You see that there's more awareness of the need to take the right steps on cyber security. And I think COVID right now is just going to accelerate through the digital transformation, accelerate investment, cyber security capabilities. And, you know, there may be a market consolidation in the meantime, but so we're absolutely headed in the right direction on the defense side.
MICHAEL MORELL: So election security. So how do you assess the threat landscape today as it pertains to foreign interference in the elections? How do you think about the threat that we are facing and are going to face as we get closer to November?
CHRIS KREBS: Yeah. So I always like the framing of the Intelligence Community Assessment of 2017. They had three primary buckets. The first is the technical targeting of election infrastructure. The second is the hack and leak campaigns or activities focusing on the political organizations, trying to get sensitive information and some in some cases up oppo research.
And the third is just the broader destabilising influence operations, trying to just undermine public confidence, create chaos. Those are absolutely three active areas, domains of activity by a range of actors – Russia, China, Iran, North Korea and others that are unattributed at this point. Everybody has their own different strategic objectives.
I tend to think that we have put in place around that first area, that election infrastructure space, we put a number of security improvements in place, resilience improvements.
We built these relationships across the country with the election officials, secretaries of state -- we work with pretty much every single one of them. We work with over 6,000 election jurisdictions. We have intrusion detection systems across all 50 states and their election systems right now. We have mechanisms to share threat intelligence. We do annual exercises. Everything is in place right now. Much, much better posture than we were in 2016. That's just because, you know, there was a Sputnik moment that we just woke up and said, 'Wow, you could destabilize a democracy through these sorts of efforts.' So I think we're in a much, much better position from a resilience perspective on the election infrastructure side.
Same goes, I think, with the hacking, the campaigns are more aware of it. There are ways on the private sector side where Microsoft, Google, a bunch of nonprofits got together, and they're offering and they've gotten from that Federal Election Commission some ability to provide services at low or no cost.
And then on the disinfo aside, I think that's really the more complex aspect of this -- it's just psychological operations, psychological warfare. How are they getting in our heads, hacking our brains, we've said before, trying to get us to to lose confidence in our entire system, this American experiment. And we're not alone here. You know, you talk to our counterparts in Europe and throughout the throughout the world, this is the new normal.
MICHAEL MORELL: So, Chris, have we actually seen successful penetrations of campaigns or any related institutions or or just so far attempts?
CHRIS KREBS: So in terms of that -- again breaking it up into the election infrastructure and then the campaigns, you know, this is one of those things where campaigns have always been on the radar for foreign intelligence services. This is just, you know, it's policy making, they want to be on the inside, they want to know what the campaigns are thinking, what the candidates are thinking, where they're going to go, so countries can start -- our adversaries in particular can understand what the next regime or administration might be thinking. That is active, active, active space.
On the election side -- the infrastructure side, rather. Again, we've got a better understanding and visibility across the landscape. We see on a daily basis just normal automated scanning, bad guys trying to do bad things, taking advantage of, you know, being opportunistic, basically.
But in terms of this sort of coordinated, orchestrated activity that we saw in '16 against, you know, the Illinois voter registration database, for instance, we haven't really seen, you know, something at scale. We have a better ability to see that. We put additional hardening in place. We've messaged very clearly over the last three and a half years about that sort of activity. So we think there's a good combination of deterrence by cost imposition and deterrence by denial in place that will continue to push off that sort of activity, but we're not taking that for granted. We are actively looking for it -- over there, our Intelligence Community partners are actively looking for it and we are actively monitoring systems here to stay ahead of it.
But most importantly, we've got to make sure that resilience is in place, so even if something bad does happen, we got the paper backups, right. Voters know what to do, voters know that election night reporting is unofficial reporting. It takes time to get that final certified result. Again, it's just as much about building the resilience of the people that participate in the voting process as it is about hardening the election systems themselves.
MICHAEL MORELL: So will all the states have permanent paper record for the 2020 vote?
CHRIS KREBS: In the in the 2016 election, it was about 80 to 82 percent of votes cast in the country had a paper record associated with them. That's whether it's automatically generated or it's kind of a sidecar or it's a absentee ballot.
By the time -- and I have not adjusted the numbers for some of the states that are shifting to absentee ballots or mail in voting because of COVID – but what we would expect is somewhere on the order of about 92 percent of votes cast will have that paper record associated with it. And that is a good chunk of the country. That's a good chunk of the competitive states as well from a policy or political side. There are absolutely some states that are going to be in a tough spot in terms of not having paper, and they have invested in additional security controls, monitoring and hardening their systems. New Jersey is the best example just yet -- they don't have the resources funding required right now to get there, but they have been investing in the cyber side. We work really closely with New Jersey on a number of things they're putting in place.
So, again, significantly, dramatically better posture than we were. And, you know, on that note, one thing I'll add is that a lot of these systems that we're concerned about that, you know, that actual equipment you interface with on voting day, you might find in some states that they're out of the process, just because of COVID, because states are making shifts to vote by mail or absentee voting, so again, this COVID in some cases is actually cleaning up some of the lingering vulnerabilities in the system.
MICHAEL MORELL: So, Chris, did you all learn anything in particular from the Iowa caucus smartphone app incident?
CHRIS KREBS: Oh, yeah. I mean, there are a bunch of things to take away here. I think first and foremost is just from a non-technical side, more of a kind of instant response side is, is, you know, whether you're a political party or a state organization, you've got to have an instant response plan. You have to know what you're going to tell the public, what you're going to tell the parties. You have to have a rapid response mechanism to get your arms around the problem and then clearly and confidently communicate to the public what's going on.
The second piece is that unofficial voting or the unofficial results, rather -- We've got to reinforce that these official results, the certification of the vote, takes time. It's in many cases going to be weeks. It's not that night. So not jumping onto some of the issues that may pop up. But then also, you know, we've been kind of on board and we issued some guidance a couple of weeks ago that took a look at Internet-based voting, whether it's an app or whatever.
We said, 'Look, there's a higher degree of risk here just because of the system you're using and the protocols that are supporting the process. We really would encourage you to have a physical ballot associated with the vote rather than, again, relying on the electrons. And I think that just is supported, again, by what we saw in Iowa. The National Academy of Sciences, Engineering and Mathematics had a report on this, a study a year and a half ago that just said 'Internet voting is not ready for prime time. Too many issues still remain in just the overarching security protocols.'
MICHAEL MORELL: So, Chris, you talked earlier about the foreign focus from intelligence collection perspective on the campaigns. I'm sure the same is true of the RNC and DNC. How do they think about securing themselves? Is it a is it a top priority for them? Are they paying attention to it? Do they understand the vulnerabilities? Are you able to help them or not? How does all of that work?
CHRIS KREBS: Yes. So we have been engaged with both the RNC and the DNC for a number of years now, predating, in fact, at least in my time here, predating the 2018 midterms. And, I found, really good uptake and partnership with us and transparency.
We have seen them embrace cyber security and embrace protecting their systems. I think they again, like I said, with the some of the private sectors, technology solutions, provided we're given a break by the FEC that allows them to provide services. Because when you think about a campaign, if you've got a dollar to spend, anything spent on internal security is something that's gone away from from raising the campaign's profile. So the ability to provide those services at low or no cost is is it is a game changer. But again, RNC and DNC both have been all aboard. Campaigns have been all aboard. We've met with both the Trump and the Biden campaigns providing a range of offerings on our cyber services.
MICHAEL MORELL: Chris, there's been a lot of discussion about the security of absentee and mai- in ballots. And I'm just wondering from the perspective of the kinds of things that CISA is paid to worry about, is there anything special with regard to mail in or absentee ballots?
CHRIS KREBS: So I think what you've got to separate here is the systems from the process. The president's concerned about the process. From a systems perspective, we're looking at those infrastructure aspects that facilitate the execution of the process. And what I mean by that is what systems are are required to design a mail-in ballot to print it, to receive it, scan it. tabulate it. Those are things that we're focused on from a cyber security perspective.
So, you know, early on in COVID – it's funny because, again, I come back to the RSA conference -- we were working with our state and local election officials back in early or mid to late February, thinking through, 'OK, how are we going to keep in-person voting safe and sanitized, and, you know, people that can come in and out?' And just things like, 'Do we have enough pencils, have disinfectant,' things like that.
And then over time, we saw, as the pandemic grew, there was a shift om a number of states saying, 'You know what? Maybe we should not have people come in. We can use some of the other authorities that they have available to them.' And that's where we saw this move again towards mail-in ballots.
But again, they didn't necessarily have the systems in place. And so they are rapidly acquiring the systems. We're providing guidance and recommendations on how to control that. But at the same time, we recognize that not everybody is going to be shifting to mail-in ballots, that, you know, that states still provide for in-person voting. So how do we provide them guidance on both these alternative approaches to voting -- which in many states are not the alternatives. You know, Oregon is 100 percent – almost 100 percent – mail-in. These are what we have to address, both the mail-in side as well as the the in-person side in this time of COVID.
MICHAEL MORELL: Let me ask you kind of an unfair question here, but in terms of of everything that you're asked to do with regard to election security, do you have everything you need in terms of both the resources and the authorities to do your job?
CHRIS KREBS: So, I mean, this is a good question on the authority side. One of the examples that I like to use is early in the administration, there was a conversation about shifting some of the Article one, Section Four requirements that the federal government takes a stronger hand in administering federal elections, in regulating certain aspects.
Look, I'm a middle child, so I see compromise in coalition-building where I can. And I've always found that honey is going to get you the flies a little bit easier. And we spent a lot of time early on in the administration on building relationships. We had absolute missteps. We misfired right out of the gate. But I think we got feedback on this. We committed ourselves to election security and supporting our state and locals in and rather than taking an overly burdensome regulatory approach where we would have found ourselves in court like that, we said 'Let's work through this together. Tell us what the problems are. Tell us where we've screwed up. We haven't fixed this. We haven't provided the things you need.'
And that's what got us to where we are today, where we're working with over 6,000 jurisdictions. We've got all 50 states as a member for that multi-state ISAC that shares threat intelligence that shares the best practices. We've got Albert sensors out there on all 50 states. Those are the things that I could point to as real significant progress and validation that we took the right approach.
Now, resources. You know, I think Congress has always been pretty, pretty generous to us.
But in some cases, there's just nothing better than good people out there putting their boots on the ground. I think in the run up to the 2018 election, I had over in the month of October running up I had about five hundred people across the organization that are engaged in election security. That's the same thing we're going to be doing in the run up to 2020. It's people, people, people. So really good people that understand how elections work in their state and how to talk to election officials and tailor solutions to their requirements. That's where I put a lot of the focus.
MICHAEL MORELL: So, Chris, you talked about that third bucket, right, that foreign disinformation bucket, via social media or different ways and how it relates to the election. Is that something that that you will play a role in or is that somebody else's responsibility?
CHRIS KREBS: Michael, I'm disappointed in the question, because that means that you have not seen the War on Pineapple campaign that we launched last summer.
MICHAEL MORELL: I haven't!
CHRIS KREBS: So. Yeah. So here's kind of how at least at CISA that we view the disinformation side of the problem. It's almost a supply and demand issue. So on the supply side, what we're seeing is other parts of the federal government, you know, between the intelligence community, law enforcement, some the Title 10 actors are actively out there trying to disrupt the supply of disinformation from our adversaries. But the companies are also involved in this. You've seen a number of inauthentic account activity disruption from the platforms.
We're on the other side of that, we don't have those authorities, right. I'm the convener or I bring people together, we can help facilitate that by sharing information between state and locals, and the social medias when our state and local partners see disinfo activity they can share through us back to the platforms. We're focused on that -- on the other side, we're on the demand side. We're trying to to increase the awareness of this problem set.
We have been working with state and local officials, election officials on the Trusted Info 2020 campaign, because that's what's going to happen when we run up to the 2020 election, voters need to know where they can go get authoritative information on how to vote in their state. What better place to go than the state senior election officials, secretary of state or the state election director. Trusted Info 20 20 is all about pointing people to those election officials to get info on where to vote, how to vote, and when to vote.
MICHAEL MORELL: So, Chris, you've been you've been great with your time. Let me just ask you one more question. We had Laurie Rosenberger from the Alliance for Securing Democracy at the German Marshall Fund on our show last week. I think you probably know her. She painted for us a picture of her nightmare scenario, which was, you know, many, many more mail-in ballots, absentee ballots, which could take us longer in getting to a winner, take us beyond election night to get a winner.
And then you mix in with add some Russian tampering with election systems, not necessarily to do any damage or to change any counts, but just to sow confusion and distrust and then throw some Russian info ops on top of that in terms of, 'This is a failed election. Right. The Americans couldn't get this right. There was a high degree of fraud.' And, you know, all of that is a mix towards raising Americans' questions about how did the election go. And that has that has a kind of a feel of realism to me. And my question is not how do you prevent that from happening, my question is, how do we build resilience with American citizens not to fall for such a Russian kind of trap? How do you think about that?
CHRIS KREBS: Yeah, I mean, look, the thing I think we we need to get our minds around is things have changed since '16. It's not just Russia. They've put the playbook out there. Any country that that doesn't quite like the way the American experience is going is going to get involved here or could get involved. But back to the, you know, increasing the resilience. I think there's two or three things we need to do .
First is continue to point voters to that trusted information, as I just talked about, the Trusted Info 2020 campaign. You go to your state and local election officials, they're the ones that're going to tell you what the real deal is, when, where and how to vote. And then what the results are.
The second piece is really reinforcing saying election night reporting is unofficial. And so it's on us to work with the media. And we did some some some tabletop exercises in the run up to 2018, we'll do it again for 2020. This is how things are going to work in the run-up to that November, that day in November.
And then lastly, reinforcing that we take this seriously. We're protecting these networks. And this is an all of government -- this isn't just CISA out here all by ourselves, trying to protect these systems. You have the entirety of the federal government behind this effort here and working over there.
So I've got great partners in the intelligence community with Anne Neuberger at NSA, General Nakasone and his team over at Cyber Command, the FBI. We've got the Election Assistance Commission that's helping get the funds out to our state and local partners. But this is something that that I've taken on as one of my top priorities, really, since day one, since I came into this job. And I'm not walking away from it. We're gonna be here and we're gonna we're going to fight through the end on this one.
MICHAEL MORELL: Chris, thank you. Thank you so much for taking time out of your incredibly busy schedule. I really appreciate it. And so do my listeners. Thank you.
CHRIS KREBS: Thanks. Great to be here.
