1 00:00:00,000 --> 00:00:05,260 Hi. Welcome to the first annual Vote Hacking Village here at DEF CON. 2 00:00:05,580 --> 00:00:05,980 Yeah. 3 00:00:06,020 --> 00:00:06,800 Yeah. All right. 4 00:00:09,700 --> 00:00:11,000 So my name is Jake Braun. 5 00:00:11,240 --> 00:00:15,340 This ridiculous thing was my idea, and so somehow that landed me as the emcee today. 6 00:00:16,020 --> 00:00:18,260 So I'll be in here all day introducing people. 7 00:00:18,780 --> 00:00:19,180 Welcome. 8 00:00:19,540 --> 00:00:24,380 And I was a White House liaison to the Department of Homeland Security. 9 00:00:24,380 --> 00:00:30,920 I run a small national security and cybersecurity strategy and policy consulting firm called Cambridge Global Advisors, 10 00:00:31,020 --> 00:00:33,840 and I teach cyber policy at the University of Chicago. 11 00:00:34,640 --> 00:00:37,920 So just to do some quick table setting on what we're actually trying to achieve here 12 00:00:37,920 --> 00:00:41,000 and kind of what we're not trying to achieve here as well before I introduce our first speakers, 13 00:00:42,020 --> 00:00:52,080 let me just start by saying anybody who thinks that their machine's network or database can't be hacked is either a fool or a liar. 14 00:00:52,400 --> 00:00:52,840 Right? 15 00:00:53,240 --> 00:00:54,100 I think that's... 16 00:00:54,380 --> 00:00:57,040 Actually, a totally uncontroversial thing to say at a place like this. 17 00:00:57,580 --> 00:01:04,020 However, unfortunately, it's a pretty controversial thing to say in the election space. 18 00:01:05,340 --> 00:01:10,040 And, by the way, because of some of the great work that this conference has done over the last 20 years, 25 years, 19 00:01:11,180 --> 00:01:16,380 you've got people in some of the top industries, top countries, or top companies in the world, 20 00:01:16,480 --> 00:01:19,520 Apple, Google, Lockheed Martin, J.P. Morgan, even the NSA, 21 00:01:20,160 --> 00:01:22,740 would never say with a straight face, we can't be hacked. 22 00:01:22,900 --> 00:01:23,620 We're unhackable. 23 00:01:23,620 --> 00:01:27,680 And, by the way, 20 years ago, they were all saying the same thing that we hear today in the election industry. 24 00:01:27,760 --> 00:01:29,880 Oh, our machines never touch the Internet. 25 00:01:30,140 --> 00:01:33,380 You know, our databases are air-gapped and backed up all the time, all this stuff. 26 00:01:34,160 --> 00:01:35,520 Well, now, not only... 27 00:01:35,520 --> 00:01:38,020 Again, because of the great work DEF CON has done, 28 00:01:38,180 --> 00:01:40,500 not only would all these industries say that they're hackable, 29 00:01:40,640 --> 00:01:45,200 they would say we're probably being hacked right now successfully by multiple different actors. 30 00:01:45,400 --> 00:01:45,660 Right? 31 00:01:46,260 --> 00:01:50,500 And so the goal of what we're trying to do here is not to play gotcha 32 00:01:50,500 --> 00:01:53,080 and show we can hack into this machine or that database. 33 00:01:53,620 --> 00:01:55,600 Or this county clerk's whatever. 34 00:01:56,260 --> 00:01:58,060 First of all, A, we already know that we can. 35 00:01:58,200 --> 00:01:58,380 Right? 36 00:01:58,440 --> 00:01:59,540 The Russians have already done it. 37 00:01:59,740 --> 00:02:02,440 And many researchers have already done it. 38 00:02:02,480 --> 00:02:04,680 It's just they haven't been able to make their research public. 39 00:02:05,360 --> 00:02:06,240 That's not the point. 40 00:02:06,300 --> 00:02:08,320 The point of this is actually much greater. 41 00:02:08,460 --> 00:02:13,560 The point is to erase the idea of unhackability from the election industry writ large. 42 00:02:14,380 --> 00:02:15,380 Why is that important? 43 00:02:15,600 --> 00:02:22,620 Well, that's important because we are actually now under a direct existential threat to the United States 44 00:02:22,620 --> 00:02:23,600 from a... 45 00:02:23,620 --> 00:02:28,600 from a foreign adversary who has essentially unlimited resources, Russia. 46 00:02:30,680 --> 00:02:36,920 And until we can get this industry to get the whole concept of unhackability out of their mind, 47 00:02:37,060 --> 00:02:42,240 we won't be able to begin to start securing our democracy. 48 00:02:44,430 --> 00:02:52,520 And so what we seek to do as this goes on year after year is help get this industry to come around 49 00:02:52,520 --> 00:02:53,600 and, again, realize... 50 00:02:53,620 --> 00:02:55,060 realize that they are hackable. 51 00:02:55,220 --> 00:02:55,900 They will be hacked. 52 00:02:56,060 --> 00:02:56,940 The Russians are going to be back. 53 00:02:57,080 --> 00:02:58,300 Other bad guys are going to be back. 54 00:02:58,440 --> 00:02:59,440 And they're going to get in. 55 00:02:59,680 --> 00:03:01,000 And so then what do they need to do? 56 00:03:01,140 --> 00:03:03,860 Our friends from Verified Voting are going to talk about. 57 00:03:04,960 --> 00:03:07,880 They need to actually talk to each other and share threat information. 58 00:03:08,840 --> 00:03:14,660 They need to take the help of the hacker community in securing their networks. 59 00:03:14,980 --> 00:03:20,540 And they need to work with our national security apparatus in this country to help secure their networks. 60 00:03:20,760 --> 00:03:22,840 And, by the way, you know, Google, Facebook... 61 00:03:23,760 --> 00:03:27,760 Apple, Lockheed Martin, J.P. Morgan, none of them wanted to work with the national security apparatus 62 00:03:27,760 --> 00:03:30,660 20 years ago when they were first being hacked and so on. 63 00:03:30,720 --> 00:03:35,380 But, you know, they're a sitting duck when there's a nation-state after them. 64 00:03:35,460 --> 00:03:39,120 And they've all now realized this, and the election industry needs to do the same. 65 00:03:39,300 --> 00:03:45,820 And so on that note, by the way, one thing I do want to point out before we get started is that 66 00:03:45,820 --> 00:03:53,560 if it wasn't for some really amazing local election officials like Dean Logan in L.A., 67 00:03:53,620 --> 00:04:00,420 Ricky Hatch in Utah, Lance Goff in Chicago, and some other people in the Chicago area that prefer to remain nameless, 68 00:04:01,460 --> 00:04:07,700 helping us with this and really taking, understanding this for what it is, which is an opportunity, again, 69 00:04:07,760 --> 00:04:12,440 not for us to play gotcha, but for their staff to get access to some great training 70 00:04:12,440 --> 00:04:17,700 and to have some great research done on their systems and machines and so on, 71 00:04:18,340 --> 00:04:20,040 none of this would have been possible. 72 00:04:20,160 --> 00:04:23,180 So I do want to give the election officials who helped us with this a round of applause 73 00:04:23,180 --> 00:04:23,980 before we get started. 74 00:04:27,880 --> 00:04:30,300 Okay, so without further ado, our first speakers. 75 00:04:31,500 --> 00:04:34,200 David Jefferson is the board chair of Verified Voting. 76 00:04:34,900 --> 00:04:38,080 Verified Voting has been working on this issue for well over a decade. 77 00:04:38,380 --> 00:04:43,520 David is a visiting computer scientist at Lawrence Livermore National Lab, where he works on 78 00:04:43,520 --> 00:04:49,520 supercomputing applications, but has also been active in research in this space since, 79 00:04:50,020 --> 00:04:51,440 well, for decades. 80 00:04:53,180 --> 00:04:58,180 In 1994, while at Digital Equipment Corporation, he oversaw development of the California election 81 00:04:58,180 --> 00:05:02,960 server, the first web server anywhere to provide online voting information on candidates and 82 00:05:02,960 --> 00:05:03,140 issues. 83 00:05:03,360 --> 00:05:07,480 In 1995, he helped develop, in cooperation with the California Voter Foundation, the 84 00:05:07,480 --> 00:05:11,420 first online database of campaign finance information ever for the San Francisco municipal 85 00:05:11,420 --> 00:05:12,880 elections that year. 86 00:05:13,100 --> 00:05:18,000 And Barbara Simons is the president of Verified Voting, same organization. 87 00:05:18,900 --> 00:05:22,760 Barbara has been on the board of advisors of the U.S. Election Assistance Commission 88 00:05:22,760 --> 00:05:23,540 since 2008. 89 00:05:23,740 --> 00:05:31,400 She published a book called Broken Ballots that you should all read, and on voting machines 90 00:05:31,400 --> 00:05:33,780 that she co-authored with a guy named Douglas Jones. 91 00:05:33,980 --> 00:05:38,320 She also co-authored a report that led to the cancellation of Department of Defense 92 00:05:38,320 --> 00:05:44,140 Internet Voting Service, done, okay, oh, and, but I have to say that she's also the 93 00:05:44,140 --> 00:05:49,280 former president of the Association for Computing Machinery, the largest and oldest international 94 00:05:49,880 --> 00:05:51,900 educational scientific society for computing professionals. 95 00:05:52,200 --> 00:05:52,740 Hi, Barbara. 96 00:05:52,740 --> 00:05:52,920 All right. 97 00:05:53,020 --> 00:05:55,900 So, Barbara and David, please come up. 98 00:06:05,840 --> 00:06:09,300 All right, so I'm going to speak first, and what I'm going to try to talk to you about 99 00:06:10,050 --> 00:06:17,820 is the ecosystem of hardware and software and procedures in a U.S. election. 100 00:06:18,220 --> 00:06:22,420 There's a lot of concentration in people's minds on the voting machines. 101 00:06:22,740 --> 00:06:27,060 Those are the gray ones that I have in this diagram, but there's a lot more to it than 102 00:06:27,060 --> 00:06:29,760 that, and I want to introduce you to what it is. 103 00:06:29,860 --> 00:06:36,240 When you learn the architecture about the information flows in an election, you'll 104 00:06:36,800 --> 00:06:40,860 be able to understand the vulnerabilities that are not obvious otherwise. 105 00:06:41,300 --> 00:06:44,800 I'm going to probably just get rid of this microphone and speak to the diagram. 106 00:06:45,160 --> 00:06:46,560 I think you'll all be recording. 107 00:06:46,740 --> 00:06:47,540 I'll be recording. 108 00:06:47,960 --> 00:06:48,420 All right. 109 00:06:48,440 --> 00:06:49,560 Then I'm going to have to move it. 110 00:06:49,700 --> 00:06:51,340 Can I do that? 111 00:06:51,360 --> 00:06:51,980 Can I do that? 112 00:06:52,320 --> 00:06:52,720 All right. 113 00:06:52,740 --> 00:06:54,300 No, I don't mind. 114 00:06:57,460 --> 00:06:58,080 Okay. 115 00:07:01,880 --> 00:07:03,120 All right. 116 00:07:05,340 --> 00:07:10,800 So, there are basically three kinds of information flows in an election. 117 00:07:11,060 --> 00:07:15,760 The red arrows here talk about the flow of software and firmware through the system. 118 00:07:16,060 --> 00:07:21,860 The green arrows talk about the election definition, which is data that describes the election. 119 00:07:22,740 --> 00:07:28,020 What the candidates are, what the propositions are, where they, where you, where the boxes 120 00:07:28,020 --> 00:07:30,460 are that you touch or check. 121 00:07:31,120 --> 00:07:37,780 And then the blue arrows are the flow of votes and ballot information and derived information 122 00:07:37,780 --> 00:07:38,840 from them. 123 00:07:39,100 --> 00:07:44,580 And then I have dotted lines here for, in the case of voter, where systems have what's 124 00:07:44,580 --> 00:07:46,280 called a voter verified paper trail. 125 00:07:48,320 --> 00:07:52,160 Now, I'm going to go over this quickly, and then I'm going to. 126 00:07:52,740 --> 00:07:56,580 I'm going to retrace with some particular marks about the software. 127 00:07:57,120 --> 00:08:01,660 So first of all, in the top left corner, you see the vendor. 128 00:08:01,760 --> 00:08:07,420 The vendor is the company that both builds or contracts for the building of the voting 129 00:08:07,420 --> 00:08:11,880 machines themselves, and also writes all of the software for the voting machines. 130 00:08:12,140 --> 00:08:18,840 Not just the terminal voting machines where voters record their vote, but also the back 131 00:08:18,840 --> 00:08:19,020 . 132 00:08:19,020 --> 00:08:19,960 Pardon me. 133 00:08:20,100 --> 00:08:20,500 . 134 00:08:20,500 --> 00:08:27,040 The back end canvas computers that aggregate all the votes from the voting machines and 135 00:08:28,160 --> 00:08:30,520 produce the final results. 136 00:08:31,400 --> 00:08:35,160 So let's look, follow the red arrows from the vendor. 137 00:08:35,380 --> 00:08:40,700 The vendor, there are very few vendors in the country, a handful, five, six nationally. 138 00:08:41,200 --> 00:08:42,760 There are thousands of jurisdictions. 139 00:08:43,180 --> 00:08:47,740 So many vendors, or each vendor sells to many jurisdictions. 140 00:08:47,740 --> 00:08:55,260 The vendor rates software for both the voting machines and the canvas computers. 141 00:08:55,540 --> 00:09:01,040 Those are treated as a single product, and a given jurisdiction bides all of its software, 142 00:09:01,220 --> 00:09:03,480 both front end and back end, from the same vendor. 143 00:09:04,740 --> 00:09:11,840 The vendor then sells its systems and services to the various jurisdictions. 144 00:09:12,060 --> 00:09:16,020 So the next line there is supposed to represent local election officials, government officials, 145 00:09:16,240 --> 00:09:17,720 who are legally responsible for the system. 146 00:09:17,720 --> 00:09:19,200 for the conduct of the election. 147 00:09:20,900 --> 00:09:23,700 They get copies of the software from the vendors. 148 00:09:23,880 --> 00:09:25,120 They only get binaries. 149 00:09:25,120 --> 00:09:26,200 They never see the source. 150 00:09:27,200 --> 00:09:30,500 That's one of the issues that I'll come back to later. 151 00:09:31,180 --> 00:09:34,120 They load those binaries prior to an election. 152 00:09:34,200 --> 00:09:37,420 They load those binaries onto the voting machines 153 00:09:37,420 --> 00:09:43,740 that are going to be distributed out into the precincts in the jurisdiction. 154 00:09:47,060 --> 00:09:51,760 This diagram is talking about electronic voting machines 155 00:09:51,760 --> 00:09:58,560 such as you have over there in the hackers forum over there. 156 00:09:59,100 --> 00:10:01,500 You could vary this diagram for jurisdictions 157 00:10:01,500 --> 00:10:05,780 that use optical scan voting systems, 158 00:10:06,100 --> 00:10:10,120 but for purposes of today, I'm talking about electronic voting machines. 159 00:10:10,540 --> 00:10:11,880 All right, so the vendors, 160 00:10:12,060 --> 00:10:13,720 sorry, the election administration 161 00:10:13,720 --> 00:10:16,680 officials install software in all of the voting machines 162 00:10:16,680 --> 00:10:21,160 and they distribute all of the voting machines to each precinct 163 00:10:21,160 --> 00:10:23,800 a few days before the election. 164 00:10:24,040 --> 00:10:27,500 The voting machines sit there for a while in the custody of, 165 00:10:28,640 --> 00:10:30,120 maybe in nobody's custody. 166 00:10:30,220 --> 00:10:31,540 They may just be locked in a closet 167 00:10:31,540 --> 00:10:33,400 or they may just be sitting in a hall somewhere 168 00:10:33,400 --> 00:10:36,460 or they may be in the custody of a poll worker, 169 00:10:36,700 --> 00:10:39,440 but they find their ways to the poll on the election day. 170 00:10:41,580 --> 00:10:43,660 Also, the election officials, 171 00:10:43,720 --> 00:10:47,100 install the software in the canvas systems 172 00:10:47,100 --> 00:10:49,580 and the so-called election management systems. 173 00:10:50,840 --> 00:10:57,880 And ideally, the election officials are the ones who run the canvas 174 00:10:57,880 --> 00:10:59,540 and run the election management system. 175 00:10:59,720 --> 00:11:02,020 However, more and more it seems to be the case 176 00:11:02,020 --> 00:11:05,440 that jurisdictions don't actually do that. 177 00:11:05,520 --> 00:11:09,960 They also outsource the running of these applications, 178 00:11:10,260 --> 00:11:11,300 the back-end applications, 179 00:11:11,300 --> 00:11:14,460 to the very same vendors. 180 00:11:17,700 --> 00:11:21,460 So that's the flow of software to the voting machines 181 00:11:21,460 --> 00:11:24,940 and to the election management and canvas systems. 182 00:11:25,320 --> 00:11:28,520 The flow of election definitions data 183 00:11:29,100 --> 00:11:33,040 that describes the election also comes from the vendors 184 00:11:33,960 --> 00:11:35,220 to the election officials 185 00:11:35,220 --> 00:11:40,380 and the election officials load it on to the voting machines 186 00:11:40,380 --> 00:11:47,600 and to the Canvas systems, oftentimes they outsource the production of that election definition file also to the vendors. 187 00:11:48,100 --> 00:11:56,140 So the vendors play an absolutely critical central role here, oftentimes a much stronger role than even the election officials do. 188 00:11:57,780 --> 00:12:06,840 The flow of votes, of course, a voter walks into a precinct, authenticates himself as being allowed to vote in this election, 189 00:12:06,840 --> 00:12:14,880 being registered in this precinct, walks over to a voting machine, casts his vote. 190 00:12:15,440 --> 00:12:25,980 At the end of the day, at the end of election day, all of the votes are recorded on memory cards that were inserted somewhere in the back of the voting machine. 191 00:12:26,860 --> 00:12:35,400 Ideally, those memory cards are removed at the end of the day and hand-transported by poll workers back to the county, 192 00:12:35,520 --> 00:12:36,820 where they are registered. 193 00:12:36,840 --> 00:12:45,320 They are then fed by the Canvas machines, and the Canvas systems aggregate all the results and determine who has won the election. 194 00:12:45,660 --> 00:12:52,200 Of course, they have to deal with absentee ballots as well, and there are many other kinds of ballots. 195 00:12:52,440 --> 00:12:57,580 You have to deal with provisional ballots, so it's much more complicated than I'm talking about, but this is idealized. 196 00:12:58,180 --> 00:13:03,260 Eventually, the Canvas report is published, and that indicates to the world who is supposed to have won the election. 197 00:13:04,160 --> 00:13:06,140 Now, let me do a time check here. 198 00:13:07,280 --> 00:13:07,600 Okay. 199 00:13:10,720 --> 00:13:18,320 Some electronic voting machines have a feature called the voter-verified paper audit trail. 200 00:13:18,580 --> 00:13:21,420 Some of the machines that you will see down the hall have them. 201 00:13:21,500 --> 00:13:22,280 Some do not. 202 00:13:22,460 --> 00:13:28,700 The voter-verified paper audit trail was a late addition to the concept of an electronic voting machine 203 00:13:28,700 --> 00:13:34,880 in attempt to deal with the security weaknesses of all electronic voting machines. 204 00:13:34,960 --> 00:13:36,820 Because with the all electronic voting machines, 205 00:13:36,840 --> 00:13:39,420 you basically have to trust all the software. 206 00:13:40,200 --> 00:13:48,340 We did not want to be in that position, so we tried to, shall we say, backpatch by adding a voter-verified paper trail. 207 00:13:48,560 --> 00:13:49,940 And the way that works is this. 208 00:13:50,060 --> 00:13:55,360 When the voter is standing at the voting machine and presses that cast my ballot button, 209 00:13:55,520 --> 00:14:03,500 of course, his ballot is recorded electronically, but it is also printed on paper at the side of the voting machine, 210 00:14:03,580 --> 00:14:06,560 and the voter is supposed to look at that, and the voter is supposed to, 211 00:14:06,560 --> 00:14:10,260 and the voter is supposed to verify what's printed on the paper is the way I intended to vote. 212 00:14:10,360 --> 00:14:12,420 And he's supposed to report it if there's any difference. 213 00:14:12,860 --> 00:14:15,640 As a matter of fact, hardly anybody ever does that, 214 00:14:15,720 --> 00:14:18,780 which is one of the profound weaknesses of the VVPAT concept. 215 00:14:19,060 --> 00:14:21,960 But if we assume that voters actually did that, 216 00:14:22,540 --> 00:14:26,620 then that printed audit trail from every voting machine, 217 00:14:27,640 --> 00:14:32,660 which now the voters have verified contains their true intents, 218 00:14:32,780 --> 00:14:36,340 in principle, they could all be aggregated and looked at. 219 00:14:36,360 --> 00:14:36,540 It's not just the voters. 220 00:14:36,540 --> 00:14:41,080 It's on paper now, and the paper copies of the votes are, of course, 221 00:14:41,120 --> 00:14:43,160 immune to any kind of software attack. 222 00:14:43,360 --> 00:14:44,300 That's the beauty of it. 223 00:14:44,360 --> 00:14:47,820 No matter whether they're bugs or malicious code, anywhere in the line, 224 00:14:47,880 --> 00:14:52,520 the paper trail is immune to that kind of attack or failure. 225 00:14:52,840 --> 00:15:06,520 So ideally, you could take a random sample or the entire corpus of voter-verified papers, 226 00:15:06,540 --> 00:15:09,160 and compare them to the Canvas report. 227 00:15:09,540 --> 00:15:12,780 And if there were differences, you could know there's a problem somewhere 228 00:15:12,780 --> 00:15:19,660 in the software, in the procedures used to aggregate, or possibly malicious code. 229 00:15:20,080 --> 00:15:26,060 And if the law so supported it, you could actually presumably prefer the results 230 00:15:26,060 --> 00:15:28,740 from the hand-counted paper audit trail. 231 00:15:28,920 --> 00:15:31,940 The law doesn't prefer this, but in principle, it could. 232 00:15:32,640 --> 00:15:36,180 So that's the general flow of, 233 00:15:36,180 --> 00:15:40,000 of software, votes, and election data. 234 00:15:40,280 --> 00:15:43,260 And I just want to make a few quick comments about the software itself, 235 00:15:43,520 --> 00:15:47,040 before I turn this over to my colleague, Barbara Simons. 236 00:15:48,660 --> 00:15:55,060 The software is written by anonymous programmers who work for the vendors. 237 00:15:55,220 --> 00:15:56,280 We don't really know who they are. 238 00:15:56,340 --> 00:15:57,420 We don't know how they're vetted. 239 00:15:57,620 --> 00:16:00,080 They do not have to have security clearances. 240 00:16:00,240 --> 00:16:01,640 We know they're anonymous. 241 00:16:03,020 --> 00:16:05,360 The software itself is considered proprietary 242 00:16:05,360 --> 00:16:06,480 by the vendors. 243 00:16:06,720 --> 00:16:11,360 It is, they are very protective of that proprietary nature. 244 00:16:12,280 --> 00:16:18,520 So there's a network of law and contract restrictions and NDAs that prevent you or me 245 00:16:18,520 --> 00:16:23,980 or anybody else from really seeing the insides of that software. 246 00:16:24,220 --> 00:16:28,320 A few of us have, under certain circumstances, been able to see that source code, 247 00:16:28,400 --> 00:16:29,980 but most people are not. 248 00:16:30,080 --> 00:16:31,240 And that includes election officials. 249 00:16:31,420 --> 00:16:35,160 Election officials all over the country are running software, and they do not even have the, 250 00:16:35,360 --> 00:16:36,000 the source. 251 00:16:38,620 --> 00:16:42,720 A lot of the software in both the Voting Machines and the Canvas systems 252 00:16:42,720 --> 00:16:45,680 is COTS software, commercial, off-the-shelf stuff. 253 00:16:45,900 --> 00:16:48,100 It's both mostly operating system stuff. 254 00:16:49,400 --> 00:16:54,400 You will note that when you go down there you will see that some of these systems are so old 255 00:16:54,400 --> 00:16:55,980 they're running Windows XP, 256 00:16:56,380 --> 00:16:58,700 they're running Windows CE, 257 00:16:59,300 --> 00:17:01,340 some of them run Windows 2000. 258 00:17:02,280 --> 00:17:03,920 Nothing, nowhere in the country, 259 00:17:04,000 --> 00:17:05,020 are they running systems, 260 00:17:05,020 --> 00:17:10,260 systems newer than these, or hardly anywhere. I'm not aware of any. I mean, these are old. 261 00:17:10,420 --> 00:17:15,280 And the reason that they are so old is because once they are certified, you can't change a voting 262 00:17:15,280 --> 00:17:19,500 system without going through a complete recertification process, which is long, slow, 263 00:17:19,620 --> 00:17:25,980 and expensive. The security features of these systems from beginning to end are especially 264 00:17:25,980 --> 00:17:32,400 weak. The weak points would include the software update and installation process, the password and 265 00:17:32,400 --> 00:17:38,540 key management, cryptography and randomization, all generally very weak, and even the physical 266 00:17:38,540 --> 00:17:47,300 security, the ports and seals on voting machines when they're in storage and when they're in use. 267 00:17:48,680 --> 00:17:55,420 It's a mess. I already mentioned that the software has to be certified to meet certain 268 00:17:55,420 --> 00:18:01,380 federal standards. These are drafted by NIST and the EAC. You'll hear more about that in the next 269 00:18:01,380 --> 00:18:01,820 panel. 270 00:18:02,400 --> 00:18:07,040 So I'm not going to go into that now, except to say that the current standards are over a decade 271 00:18:07,040 --> 00:18:12,680 old, quite weak in the subject of security, and they're only voluntary on the states anyway, 272 00:18:13,060 --> 00:18:22,220 and they're enforced only by testing protocols, not by any kind of deep analysis of the source 273 00:18:22,220 --> 00:18:32,320 code. So this, I think I'm going to stop there and turn this over to Barbara Simon, 274 00:18:32,400 --> 00:18:35,160 my colleague. Barbara. 275 00:18:48,000 --> 00:18:56,280 I guess this will work. I'm not going to bother with having slides up because they're not 276 00:18:56,280 --> 00:19:02,180 very exciting. I'm going to be exciting but the slides aren't exciting. So first of all I 277 00:19:02,180 --> 00:19:07,040 want to thank you guys for coming here and for working on this really, really important issue. 278 00:19:07,260 --> 00:19:11,720 I mean we need to get many more people involved. We need to be able to show that there are 279 00:19:11,720 --> 00:19:17,060 major problems with these machines and I'm hoping that some of you will actually be able to show 280 00:19:17,060 --> 00:19:21,900 that with the work you're doing here. So thank you very much. Heretofore it's been very 281 00:19:21,900 --> 00:19:26,260 difficult for independent experts to examine these machines for some of the reasons that David 282 00:19:26,260 --> 00:19:31,240 mentioned. The software is proprietary and some of you guys probably know the digital 283 00:19:31,240 --> 00:19:32,160 millennium copywriter. It's very difficult to get people involved. So I want to thank you guys 284 00:19:32,160 --> 00:19:36,740 for doing this. So this is the new copyright act which makes it very difficult to examine 285 00:19:36,740 --> 00:19:42,640 software if you don't have permission to do so. So there's been an exception made which allows 286 00:19:43,080 --> 00:19:49,120 this to go forward, this hacking village to go forward. Fortunately that will remain for more 287 00:19:49,120 --> 00:19:58,000 than like the next year or two. But they may take it away. So that's another issue. As David 288 00:19:58,000 --> 00:20:02,140 said early, the testing is totally inadequate. The early testing was even worse. So the 289 00:20:02,140 --> 00:20:05,680 results are secret. A lot of these machines that are in use, some of them the ones that you'll see 290 00:20:05,680 --> 00:20:11,100 there, were certified to early testing where there was no penetration testing. I mean can you 291 00:20:11,100 --> 00:20:16,440 imagine, they had a list of requirements. I mean can you imagine a major software vendor doing 292 00:20:16,440 --> 00:20:21,280 testing by just checking off a list of requirements like single entry, single exit loop without 293 00:20:21,280 --> 00:20:25,600 doing penetration testing. And yet that's what's been done for many of these voting machines. 294 00:20:26,340 --> 00:20:31,420 The results are sometimes secret. So even the testing results are secret and there's a case in 295 00:20:31,420 --> 00:20:36,880 California where the then Secretary of State, Kevin Shelly, tried to get the test results from 296 00:20:36,880 --> 00:20:41,480 Diebold machines because he was concerned about the Diebolds that were being used in California. And 297 00:20:41,480 --> 00:20:47,920 the testing agency said to him, these results are owned by Diebold and you can't get them from us. 298 00:20:47,980 --> 00:20:52,900 You have to get them from Diebold and of course Diebold wouldn't turn them over. So even a very 299 00:20:55,800 --> 00:21:01,340 proactive election official who wants to know what's happening, who wants to know the test results couldn't get 300 00:21:01,420 --> 00:21:08,560 them. And so I'm going to talk a little bit about how we got here. And the story kind of begins back 301 00:21:08,560 --> 00:21:13,760 with Florida 2000, which of course I'm sure those of you who aren't old enough to remember what 302 00:21:13,760 --> 00:21:18,920 happened have probably heard of it. And some of us are old enough to remember. But what really 303 00:21:18,920 --> 00:21:24,100 happened was Florida 2002 because they had more problems in the midterm in Florida also. As a 304 00:21:24,100 --> 00:21:30,800 result, the Help America Vote Act was passed in 2002 and it allocated about three billion, that's 305 00:21:31,920 --> 00:21:38,120 $2.3 billion to replace voting systems. And one of the unfortunate conclusions that a number of 306 00:21:38,120 --> 00:21:46,620 people reached from Florida 2000 was that paper is bad. Paper is bad, paperless is good. And in 307 00:21:46,620 --> 00:21:56,620 fact, I would go further than that to say that there was also an effort made to, I'm not sure if 308 00:21:56,620 --> 00:22:01,400 exploit is the right word, but to manipulate voters with disabilities into voting systems. And 309 00:22:01,420 --> 00:22:03,720 I think that's a really important piece of information. Because there were people going around 310 00:22:03,720 --> 00:22:10,280 saying paper, machines with paper discriminate against voters with disabilities as if all voters 311 00:22:10,280 --> 00:22:16,140 with disabilities had vision problems. And as if there weren't alternatives for people who do 312 00:22:16,140 --> 00:22:22,880 have vision problems. So a lot of people felt that to support paper was to be against voters with 313 00:22:22,880 --> 00:22:27,260 disabilities, which is a really bad place to be put as a policy maker. So that's something else that 314 00:22:27,260 --> 00:22:33,960 happened. And of course, all this money was suddenly made available. Election officials wanted to 315 00:22:33,960 --> 00:22:40,100 get it. And they wanted to get the newest and greatest shiny object. And so the vendors would say 316 00:22:40,100 --> 00:22:47,920 completely secure, federally certified, we already know what that meant. And of course, they 317 00:22:48,420 --> 00:22:53,080 could just touch a button at the end of the day and get the results. And if you're a hardworking 318 00:22:53,080 --> 00:22:57,240 election official, that sounds really good. You can go home, you know, and get the results. And 319 00:22:57,260 --> 00:23:02,600 it's some decent hour of the night. And you don't have to worry. No recount. It's perfect. You're 320 00:23:02,600 --> 00:23:08,080 done. So it was very appealing. Plus, there was sort of a gold rush mentality. Everybody wanted to get 321 00:23:08,080 --> 00:23:12,860 this newest thing. And besides, they wanted to get the money while it was still there. So there was a 322 00:23:12,860 --> 00:23:17,620 big rush to buy machines. And of course, computers had to be introduced. If you're going to go 323 00:23:17,620 --> 00:23:22,040 paperless, you need computers. David's already talked a bit about direct recording electronic 324 00:23:22,040 --> 00:23:27,240 machines. These are the machines where, which directly record the voting system. And they're 325 00:23:30,900 --> 00:23:35,060 not all touch screen. They're not all touch screen. But most of them were. You would touch the 326 00:23:35,060 --> 00:23:39,440 screen for your candidate. And presumably, that information would be stored in the memory of the 327 00:23:39,440 --> 00:23:46,300 computer. And initially, most of them were paperless. There were, of course, issues even 328 00:23:46,300 --> 00:23:51,100 early on. Because if the machines were not properly calibrated, you could have problems. You 329 00:23:51,100 --> 00:23:55,100 would have jumping votes. And people, you know, and we've seen this a lot in recent elections 330 00:23:55,100 --> 00:23:57,240 where they say, you know, I don't know, I don't know, I don't know, I don't know, I don't know. 331 00:23:57,260 --> 00:24:04,340 I voted for Obama and this other candidate's name, you know. And then people would say these 332 00:24:04,340 --> 00:24:09,280 machines aren't secure because I touched the button for candidate A and candidate B's name 333 00:24:09,280 --> 00:24:14,920 appeared. But in fact, we don't know if that was insecure or not because we don't know what 334 00:24:14,920 --> 00:24:19,960 happened inside these machines. So it's quite possible they touched the button for candidate A 335 00:24:19,960 --> 00:24:25,180 and A was recorded in the machine. Or maybe B was recorded in the memory. We don't know. Because 336 00:24:25,180 --> 00:24:26,040 of course, nobody knows. 337 00:24:27,260 --> 00:24:30,620 But these machines, on top of everything else, were really badly engineered. I mean, the 338 00:24:30,620 --> 00:24:34,140 technology of the test screen machine was bad because it had to be constantly recalibrated. They 339 00:24:34,140 --> 00:24:39,540 were insecure. The testing was lousy. It was a bad deal all the way around. And yet, they were 340 00:24:39,540 --> 00:24:45,440 used almost throughout the country. In response, as David said, when the computer scientists and 341 00:24:45,440 --> 00:24:51,040 other people, activists started complaining about this, there were retrofits with these voter 342 00:24:51,040 --> 00:24:57,240 verified paper audit trails, which tended to be continuous roll thermal paper. And then, you 343 00:24:57,260 --> 00:25:02,460 know, it was a continuous roll with small font that was hard to read. Bad human factors. One of the 344 00:25:02,460 --> 00:25:08,120 major vendors recorded every single step that the voter did, which made it very hard to figure out 345 00:25:08,120 --> 00:25:13,440 what your final results were. People didn't look at them. And then, if you did want to recount 346 00:25:13,440 --> 00:25:17,160 them, it was a continuous roll, which is hard to recount. Thermal printed, like what you get at a 347 00:25:17,160 --> 00:25:23,080 gas station, which can fade in the heat. I mean, again, so really badly engineered machines were 348 00:25:23,080 --> 00:25:26,860 retrofitted with really bad retrofits. I mean, they were at least consistent. 349 00:25:30,540 --> 00:25:34,760 So, there were also paper ballot systems. Typically, these are what we call OPSCAN systems, 350 00:25:35,000 --> 00:25:41,260 where you have a paper ballot. In California, you connect a broken arrow to decide who you're 351 00:25:41,260 --> 00:25:45,840 going to, you know, to signify who your selection is. Some places, they'll be, you know, you fill in 352 00:25:45,840 --> 00:25:50,380 an oval. And then, these machines are put through scanners, which, of course, have computers in 353 00:25:50,380 --> 00:25:56,900 them. So, there are, again, problems with the scanners. If they're not calibrated properly, they 354 00:25:56,900 --> 00:25:57,240 may, you know, they may, you know, they may, you know, they may, you know, they may, you know, 355 00:25:57,260 --> 00:26:02,920 if they're calibrated to be too sensitive, they may pick up stray marks and think that you voted 356 00:26:02,920 --> 00:26:09,240 twice, which you're not supposed to do. If they're not sensitive enough, they may miss. So, 357 00:26:09,300 --> 00:26:12,860 there are calibration problems there, too. But the good news is that there are paper ballots. 358 00:26:13,460 --> 00:26:21,540 So, with, if there's malware or software bugs or calibration problems, you can find them if you 359 00:26:21,540 --> 00:26:26,840 look at the paper ballots. Another advantage, of course, is that with paper ballots, if the 360 00:26:26,840 --> 00:26:30,860 scanner is down, people can vote the paper ballots and deposit them in a ballot box for counting 361 00:26:30,860 --> 00:26:35,500 later. So, it's a way to avoid long lines. Although, ironically, we've seen in the past couple 362 00:26:35,500 --> 00:26:39,780 of elections that sometimes poor workers don't even know you can do that. And so, the lines still, 363 00:26:40,200 --> 00:26:44,620 they still form because poor workers don't tell voters that they don't have to wait for the 364 00:26:44,620 --> 00:26:51,720 scanners. There's another problem, which is that a lot of people don't understand that these 365 00:26:51,720 --> 00:26:55,620 things have computers in them. I mean, that might, I'm sure this audience finds that hard to 366 00:26:55,620 --> 00:26:56,820 believe. But, in fact, there's a lot of people who don't understand that these things have computers 367 00:26:56,820 --> 00:27:00,760 in them. In fact, people don't understand that the way the scanner works is it's basically a 368 00:27:00,760 --> 00:27:09,540 computer. So, we saw in Wisconsin, in the recount in 2016 in Wisconsin, that some places did a 369 00:27:09,540 --> 00:27:15,860 recount by manually recounting the ballots, which is what a recount is. Other parts re-scanned 370 00:27:15,860 --> 00:27:21,500 them. They put the ballots back into the scanners, which does not check the computer. I mean, 371 00:27:21,520 --> 00:27:26,280 it's sort of a silly exercise. But that's an example of the lack of understanding. So, 372 00:27:26,820 --> 00:27:30,660 I think I'll talk a little bit about Diebold, because Diebold is the poster child of all that's 373 00:27:30,660 --> 00:27:36,100 wrong with these machines. And I have to say, in Diebold's defense, they, I mean, they did have 374 00:27:36,100 --> 00:27:40,660 really lousy security. And they did post their software on an open FTP website, just asking for 375 00:27:40,660 --> 00:27:44,400 people to download, I mean, they weren't asking, but, you know, they set it up so that it could 376 00:27:44,400 --> 00:27:49,880 be downloaded and checked. So, yeah, they deserve a lot of what they got. But the fact is, the 377 00:27:49,880 --> 00:27:56,800 vendors were all bad. We know that at this point. But anyway, Diebold, in 2002, was the first 378 00:27:56,820 --> 00:28:01,700 software that was used in Georgia, in a major Georgia midterm, where both the senator, Senator 379 00:28:01,700 --> 00:28:08,000 Max Cleland, and the governor were ahead in the polls, and they both lost. So, we don't know if 380 00:28:08,000 --> 00:28:11,600 they truly lost or if there was a problem. What we do know is that there were last-minute 381 00:28:11,600 --> 00:28:16,500 changes being made to the software with no oversight. Now, anyone who's worked on a large 382 00:28:16,500 --> 00:28:22,380 software project knows that you're always making last-minute changes, you know, until the company 383 00:28:22,380 --> 00:28:25,820 releases it, because you're always finding problems. So, there could have been very legitimate 384 00:28:25,820 --> 00:28:26,800 reasons for a problem to be solved. But, you know, we don't know. So, we don't know. But, you know, 385 00:28:26,800 --> 00:28:27,060 we don't know. So, we don't know. So, we don't know. So, we don't know. So, we don't know. And 386 00:28:27,060 --> 00:28:27,360 we don't know. So, we don't know. So, we don't know. But the fact is, were there any last-minute 387 00:28:27,360 --> 00:28:33,660 changes, or somebody could have decided who they wanted to win? We don't know. And nobody 388 00:28:33,660 --> 00:28:39,340 examined the software, and, of course, that software is long gone. So, and it was paperless. 389 00:28:39,500 --> 00:28:45,660 So, these machines were used in Georgia, 2002. In 2003, as I said, somebody, actually a 390 00:28:45,660 --> 00:28:51,500 journalist, found Diebold software on an OpenFTP website and downloaded it, handed it off to 391 00:28:51,500 --> 00:28:56,460 some security people at Johns Hopkins and Rice, and they examined that software, and that was 392 00:28:56,460 --> 00:29:02,220 the first case where we've had an independent examination done by computer security experts. 393 00:29:02,500 --> 00:29:11,620 They found gaping holes. For example, there was a single key to encrypt all the data on 394 00:29:11,620 --> 00:29:22,400 every storage device and it was in the program text. And that key was F2654HD4. That's all 395 00:29:22,400 --> 00:29:27,180 you needed. So that was one of the things they found. In 2006, there was another study. 396 00:29:27,280 --> 00:29:30,960 Well, there have been a lot of studies. I'm skipping over a lot of material. In the book 397 00:29:30,960 --> 00:29:36,180 I wrote, there's a whole chapter on D-bold. It's kind of interesting. But in 2006, the 398 00:29:36,180 --> 00:29:41,900 Princeton team showed how to implant a virus on a D-bold machine, on these D-bold machines, 399 00:29:42,440 --> 00:29:47,700 so that you could basically rig an election. In fact, they testified before Congress on 400 00:29:47,700 --> 00:29:48,600 that. Ed Felton did. 401 00:29:49,820 --> 00:29:51,560 They also noted that 402 00:29:51,560 --> 00:29:51,780 they 403 00:29:51,780 --> 00:29:58,540 did. The slot which contains the memory card has a lock, and you could open that lock using 404 00:29:58,540 --> 00:30:06,140 a standard hotel bar key. And they're pretty standard. It was also easy to pick, but you 405 00:30:06,140 --> 00:30:11,140 didn't even have to bother. You just get this bar key. These same machines are in use 406 00:30:11,140 --> 00:30:16,880 today in Georgia. They were used for the Georgia CD50 election. Some of you may recall 407 00:30:16,880 --> 00:30:21,380 that election. $50 million were spent. This was for a House of Representatives seat. It 408 00:30:21,380 --> 00:30:25,800 was the most expensive election ever. And actually, there were some other problems 409 00:30:25,800 --> 00:30:29,000 found in Georgia, which I won't go into. One of the people who found them, Logan Lam, is 410 00:30:29,000 --> 00:30:32,580 here. And so when I finish, he's going to come up and just talk a little bit about Georgia, 411 00:30:32,680 --> 00:30:38,260 because that's also an interesting story. But these machines are still there, still 412 00:30:38,260 --> 00:30:45,080 in use today, and there's no justification whatsoever for their use. So there have been 413 00:30:45,080 --> 00:30:50,440 some studies. So you guys are not the first ones to try to look at these machines. There have 414 00:30:50,440 --> 00:30:55,600 been a couple of studies that were sponsored by secretaries of state. And David mentioned 415 00:30:55,600 --> 00:30:58,980 how he was able to look at something because he was involved with these studies. So in 416 00:30:58,980 --> 00:31:04,340 California, the secretary of state, Bowen, did what was called a top-to-bottom review. 417 00:31:06,040 --> 00:31:12,620 And she required the vendors to produce the machines and the software and all the related 418 00:31:13,200 --> 00:31:17,520 material for getting an election set up. And she was only able to do that because of a 419 00:31:17,520 --> 00:31:21,780 court case that had happened a few years earlier with Kevin Shelley, an earlier secretary of 420 00:31:21,780 --> 00:31:25,400 state who actually went to court and won. That's the only way she could get these machines. 421 00:31:25,620 --> 00:31:29,940 I mean, you wouldn't believe how hard it is for people to get their hands on them. So she 422 00:31:30,540 --> 00:31:36,240 basically went to the University of California. They put together, some folks put together a 423 00:31:36,240 --> 00:31:43,900 team. They examined the security, the documentation, the accessibility. It's the only time 424 00:31:43,900 --> 00:31:47,340 that these machines have ever been examined to see how easy they are for 425 00:31:47,520 --> 00:31:52,420 voters with disabilities to use. They did badly on everything. And I should mention there's 426 00:31:52,420 --> 00:31:56,200 some people here, like Candace Hocus here, who was one of the people involved with this. Matt 427 00:31:56,200 --> 00:32:04,740 Blaze was also. In fact, Matt Blaze had an interesting quote. We found significant deep-rooted 428 00:32:04,740 --> 00:32:09,960 security weaknesses in all three vendors' software. It should now be clear that the red teams 429 00:32:09,960 --> 00:32:14,940 were successful not because they somehow cheated, but rather because the built-in security 430 00:32:14,940 --> 00:32:17,420 mechanisms they were up against simply don't 431 00:32:17,520 --> 00:32:22,180 work properly. There was a pervasive lack of good security engineering across all three 432 00:32:22,180 --> 00:32:26,840 systems. So, as I said, it's not just D-Bolt. These were two other systems as well, I believe, 433 00:32:26,880 --> 00:32:33,440 ES&S and what was the third one? Was it Heart? Heart InterCivic. Yeah. So the red teams were 434 00:32:33,440 --> 00:32:41,180 able to break into all of them. That should be inspiration to you guys. The California study 435 00:32:41,180 --> 00:32:46,620 was validated by a subsequent study done in Ohio called the Everest study, which also again brought 436 00:32:46,620 --> 00:32:51,920 together, you know, really good security people. They found, they basically found that they 437 00:32:51,920 --> 00:32:56,580 validated everything that was discovered in California, plus they found more problems. This was 438 00:32:56,580 --> 00:33:04,260 back in 2006, 2007. And some of these machines are still in use today. They were still used for 439 00:33:04,260 --> 00:33:11,680 the 2016 election. To my way of thinking, this is nothing short of a national scandal. In 440 00:33:11,680 --> 00:33:16,180 addition, many of the old machines are falling apart. David's already mentioned some of the 441 00:33:16,180 --> 00:33:16,600 ancients. Some of the old machines are falling apart. David's already mentioned some of the 442 00:33:16,620 --> 00:33:20,400 software that's on them, and the fact that it's not even updated frequently, even with our 443 00:33:20,400 --> 00:33:26,240 updates, because of the whole certification issue, because then they need to be recertified. So 444 00:33:26,240 --> 00:33:31,460 there's a catch-22 on top of everything else. If you want to be conscientious and update your 445 00:33:31,460 --> 00:33:35,340 software, then you've got to go through recertification, which can be expensive and time 446 00:33:35,340 --> 00:33:41,980 consuming. So if you don't want to go through that, you don't update. The hardware is also failing. 447 00:33:42,220 --> 00:33:45,860 I mean, these machines are just literally falling apart in some cases, and some election officials 448 00:33:45,860 --> 00:33:50,100 are having to cannibalize other machines to keep some of the machines going. So election officials 449 00:33:50,100 --> 00:33:54,940 actually do want to replace these machines. I mean, this is not a case where we are fighting against 450 00:33:54,940 --> 00:34:01,600 election officials. The problem is there isn't money. And so that's another issue, obviously not 451 00:34:01,600 --> 00:34:06,960 directly related to DEF CON, but that's something we need to be concerned about. Oh, I should just 452 00:34:06,960 --> 00:34:13,380 mention that you've all, I'm sure, heard about the long lines in 2012 and 2016. A lot of these were 453 00:34:13,380 --> 00:34:15,840 caused by the DREs, the Direct Recording Elections. And I'm sure you've all heard about the long 454 00:34:15,860 --> 00:34:16,040 lines. And I'm sure you've all heard about the long lines in 2016. So thank you. But the point is, 455 00:34:16,040 --> 00:34:19,260 the long lines are not about voting on electronic machines, because unlike paper ballots, you must 456 00:34:19,260 --> 00:34:24,980 vote on the machine. If there are some machines that are down, or if there are long lines, a lot 457 00:34:24,980 --> 00:34:30,800 of people are coming to the polls at the same time, you have to wait or not vote and go to work, 458 00:34:30,800 --> 00:34:38,940 because you can't afford to spend an hour waiting in line. So the good news, I mean, Jake talked 459 00:34:38,940 --> 00:34:45,760 about how we are under attack, and I agree. I lose sleep over this. And I hope you will, too, because 460 00:34:45,860 --> 00:34:52,500 we have to fix the problem. But we know how to protect ourselves against hacking. We have 461 00:34:52,500 --> 00:34:58,240 the solution. And it's pretty straightforward. We need paper ballots and we need manual post 462 00:34:58,240 --> 00:35:04,620 election ballot audits to check that the computers that count the paper are working correctly. 463 00:35:05,620 --> 00:35:12,560 If we can get that nationwide, we'll be safe from hacking our voting systems. I mean, I'm 464 00:35:12,560 --> 00:35:17,140 not talking about the voter registration databases. That's a different issue. We need to take 465 00:35:17,840 --> 00:35:21,780 significant steps there, too, to protect those. But if you look at the voting technology itself, 466 00:35:22,460 --> 00:35:26,920 paper ballots, manual post election ballot audits. By the way, you have to randomly select 467 00:35:26,920 --> 00:35:31,040 the ballots, clearly, because if you don't use randomness, the bad guys will know what 468 00:35:31,040 --> 00:35:36,420 you're going to look at and they'll just touch the other stuff. And incidentally, a lot of 469 00:35:36,420 --> 00:35:41,340 people don't know what random means. Sometimes election officials will announce beforehand 470 00:35:41,340 --> 00:35:45,520 which precincts or whatever they're going to look at. That ain't random. 471 00:35:49,880 --> 00:35:58,420 So one of the problems we've had historically is convincing people that this is a problem. 472 00:35:59,880 --> 00:36:08,960 Not people like you, but the press, policy makers, election officials. And I've talked 473 00:36:08,960 --> 00:36:10,640 to a lot of reporters where they say to me, 474 00:36:10,640 --> 00:36:17,800 well, give us an example of an election that was hacked. And the problem is the beauty 475 00:36:18,160 --> 00:36:23,760 of these paperless systems, both these touchscreen voting machines and internet voting, by the 476 00:36:23,760 --> 00:36:26,340 way, which is another, which I know there's going to be a whole session on that. That's 477 00:36:26,340 --> 00:36:30,600 another really dangerous, I mean, that's the worst, actually. But the beauty of these 478 00:36:30,600 --> 00:36:36,680 systems that don't have paper ballots that were marked by the voters is there's no evidence. 479 00:36:36,680 --> 00:36:43,800 It's, you know, I mean, it's very, very, very hard to prove that an election has been stolen, 480 00:36:44,360 --> 00:36:47,860 not only because of the lack of evidence but because of the resistance to looking. 481 00:36:48,220 --> 00:36:53,920 We saw that in the 2016 recount, where there was great resistance even to doing recounts 482 00:36:53,920 --> 00:36:58,500 of a small number of states. And in fact, the Michigan recount, which Michigan is all paper, 483 00:36:58,640 --> 00:37:05,420 was halted by the courts. And of course, most of the country wasn't really adequately examined at all. 484 00:37:05,880 --> 00:37:06,660 So in fact, we should be able to, I mean, I think, if we could get the funding, we could get the data and all. So, but there are all kinds of things that we want to do and that are not good at all. There's not a whole lot of things that we can pull out. 485 00:37:06,660 --> 00:37:11,500 we don't know whether or not the 2016 machine election was hacked because 486 00:37:11,500 --> 00:37:14,440 nobody has done an adequate study to determine whether or not it was hacked 487 00:37:15,580 --> 00:37:20,880 so going forward we just can't allow this to happen we have to fix these 488 00:37:20,880 --> 00:37:27,540 systems and we have to get paper ballots everywhere so I'll just end with a quote 489 00:37:27,540 --> 00:37:34,400 from former FBI director Comey which I completely support they'll be back in 490 00:37:34,400 --> 00:37:39,700 2020 they may be back in 2018 and one of the lessons they may draw from this 491 00:37:39,700 --> 00:37:43,360 is that they were successful because they introduced chaos and division and 492 00:37:43,360 --> 00:37:47,220 discord and so doubt about the nature of this amazing country of ours and our 493 00:37:47,220 --> 00:37:51,720 democratic process I think they will be back in 2018 there are major major 494 00:37:51,720 --> 00:37:54,760 midterm elections coming up there are even important elections coming up in 495 00:37:54,760 --> 00:38:00,440 2017 the governors of New Jersey and Pennsylvania are going to be 496 00:38:00,440 --> 00:38:03,780 elected in 2017 and 497 00:38:03,780 --> 00:38:04,180 um 498 00:38:05,260 --> 00:38:06,860 there are a lot of bad machines. 499 00:38:07,060 --> 00:38:09,740 Pennsylvania, 80% of Pennsylvania 500 00:38:09,740 --> 00:38:11,540 is paperless voting machines 501 00:38:12,240 --> 00:38:14,500 that are incredibly insecure, 80%. 502 00:38:14,500 --> 00:38:16,240 And this is a major state. 503 00:38:16,680 --> 00:38:17,640 We've got to fix that. 504 00:38:17,820 --> 00:38:19,480 So thank you for the work you're doing 505 00:38:19,480 --> 00:38:20,380 and thank you for your support. 506 00:38:20,520 --> 00:38:24,260 And I would like to see if Logan Lamb could come up. 507 00:38:26,100 --> 00:38:27,060 Talk about Georgia. 508 00:38:27,240 --> 00:38:28,000 This is Georgia. 509 00:38:32,760 --> 00:38:33,620 I'm a pacer. 510 00:38:36,000 --> 00:38:36,920 All right, cool. 511 00:38:37,380 --> 00:38:38,300 Hey, friends. 512 00:38:38,440 --> 00:38:40,240 So I'm Logan Lamb. 513 00:38:40,700 --> 00:38:43,840 I'm a cybersecurity researcher based out of Atlanta. 514 00:38:44,160 --> 00:38:48,060 I primarily do wireless cybersecurity research, 515 00:38:48,200 --> 00:38:50,840 but since it was election season 516 00:38:50,840 --> 00:38:52,560 and we all like to break things, 517 00:38:52,780 --> 00:38:56,140 I really, really wanted to get my hands on some voting systems. 518 00:38:57,260 --> 00:39:01,400 So I ended up going down to the elections office 519 00:39:01,400 --> 00:39:02,380 in Fulton County, 520 00:39:03,000 --> 00:39:04,120 and I was attended. 521 00:39:04,180 --> 00:39:06,380 I was attempting to speak with the election supervisor, 522 00:39:07,040 --> 00:39:08,360 Richard Barron, I think. 523 00:39:08,580 --> 00:39:09,600 And I was going to say, 524 00:39:09,680 --> 00:39:12,300 hey, I'm a local cybersecurity researcher. 525 00:39:12,540 --> 00:39:14,160 I'd like to do some good work and help you guys. 526 00:39:15,960 --> 00:39:17,580 Well, as you can imagine, 527 00:39:17,720 --> 00:39:18,960 I didn't get past the secretary. 528 00:39:20,260 --> 00:39:23,000 So she ran my card back to Richard Barron, 529 00:39:23,600 --> 00:39:25,620 and then they came back to me 530 00:39:25,620 --> 00:39:29,180 and let me know that all of the election systems in Georgia 531 00:39:29,180 --> 00:39:32,660 are actually handled at Kennesaw State University 532 00:39:33,260 --> 00:39:34,160 by the state government. 533 00:39:34,160 --> 00:39:35,300 And they're actually centered for election systems. 534 00:39:36,720 --> 00:39:39,460 So immediately, I thought this was kind of wacky, right? 535 00:39:39,600 --> 00:39:41,480 It's like, what is this university doing 536 00:39:41,480 --> 00:39:42,360 with all these systems? 537 00:39:43,920 --> 00:39:48,500 So prior to sending an email to the director there, 538 00:39:48,720 --> 00:39:52,160 I figured I'd try and get some background information 539 00:39:52,160 --> 00:39:56,840 on the group and just see, like, who are these people? 540 00:39:56,980 --> 00:39:57,520 What do they do? 541 00:39:58,660 --> 00:40:03,760 So I checked out their website and then just fired off, 542 00:40:03,760 --> 00:40:05,920 like, the simplest Google dork ever. 543 00:40:06,240 --> 00:40:10,080 I was just like, hey, I'd like to see all of your documents 544 00:40:10,080 --> 00:40:13,020 and PDFs you have on this website, okay? 545 00:40:14,280 --> 00:40:18,800 Lo and behold, there were some really, really interesting documents 546 00:40:18,800 --> 00:40:21,520 that were already cached by Google, okay? 547 00:40:21,940 --> 00:40:23,580 I clicked one of the links, 548 00:40:23,700 --> 00:40:26,020 and what appeared to be in front of me 549 00:40:26,020 --> 00:40:30,700 was a list of voter names, okay? 550 00:40:31,420 --> 00:40:33,080 So at this point, I was like, 551 00:40:33,140 --> 00:40:33,640 is this real? 552 00:40:33,760 --> 00:40:33,780 Is this real life? 553 00:40:34,100 --> 00:40:35,140 Is this happening right now? 554 00:40:37,900 --> 00:40:39,980 So, yeah, I mean, this was just a web server. 555 00:40:40,160 --> 00:40:42,440 So I went up a couple directories, 556 00:40:43,160 --> 00:40:46,340 because it had, like, a directory structure in the route, 557 00:40:47,240 --> 00:40:49,660 and then I looked at their robots.txt, 558 00:40:49,820 --> 00:40:52,680 wrote a quick, like, bash script to curl everything off 559 00:40:54,280 --> 00:40:55,800 recursively, and then I went to lunch. 560 00:40:57,100 --> 00:40:59,520 Yeah, so then I went to lunch, 561 00:40:59,940 --> 00:41:03,600 and when I came back and I checked to see how much data I had 562 00:41:03,600 --> 00:41:07,540 on my computer, I had 15 gigs worth of data, y'all. 563 00:41:08,420 --> 00:41:09,100 It's crazy. 564 00:41:09,340 --> 00:41:10,380 Crazy stuff. 565 00:41:11,340 --> 00:41:16,300 So, yeah, amongst this 15 gigabytes worth of data, 566 00:41:16,440 --> 00:41:19,160 I had all of the voter registration information 567 00:41:19,160 --> 00:41:21,300 for everyone in Georgia, okay? 568 00:41:21,800 --> 00:41:26,920 So that includes names, addresses, birthdays, 569 00:41:27,520 --> 00:41:29,520 last four digits of your social, 570 00:41:30,880 --> 00:41:32,840 also your full driver's license number, 571 00:41:32,840 --> 00:41:34,480 which seems relatively innocuous, 572 00:41:35,220 --> 00:41:37,340 but you can actually use all that information 573 00:41:37,340 --> 00:41:41,000 to change people's registration with the DMV. 574 00:41:42,020 --> 00:41:44,140 So that's just a whole other can of worms. 575 00:41:45,200 --> 00:41:46,540 Okay, what else was there? 576 00:41:46,680 --> 00:41:49,080 We had PDFs of election day passwords, 577 00:41:49,800 --> 00:41:53,460 and this seemed to be the same across all counties, okay? 578 00:41:54,380 --> 00:41:57,480 And there were also some gyms databases, 579 00:41:57,740 --> 00:41:59,980 and, like, to this day, I have no clue 580 00:41:59,980 --> 00:42:01,200 what those were doing on that server. 581 00:42:01,380 --> 00:42:02,220 It's just a web server. 582 00:42:03,800 --> 00:42:05,740 And from what I could gather, 583 00:42:05,820 --> 00:42:07,460 it looks like this server was being used 584 00:42:07,460 --> 00:42:10,200 to disseminate information to all of the counties. 585 00:42:11,580 --> 00:42:15,000 And there was, like, a bulk update file, 586 00:42:15,240 --> 00:42:17,500 which had a bunch of voter registration information 587 00:42:17,500 --> 00:42:19,120 and a couple of Windows binaries. 588 00:42:19,780 --> 00:42:21,500 The Center for Election Systems, 589 00:42:21,720 --> 00:42:24,100 they would actually tweet out every couple months 590 00:42:24,100 --> 00:42:26,760 and be like, hey, there's a new bulk update file 591 00:42:26,760 --> 00:42:30,000 that you all should go download and run on your systems. 592 00:42:31,580 --> 00:42:32,540 Well, yeah. 593 00:42:32,840 --> 00:42:36,500 So it looks like this hilariously insecure system 594 00:42:36,500 --> 00:42:38,300 was being used to disseminate information 595 00:42:39,130 --> 00:42:40,580 related to the election systems. 596 00:42:41,950 --> 00:42:44,500 Well, I mean, it keeps getting worse, actually. 597 00:42:45,400 --> 00:42:50,000 So this web server, it was vulnerable to Drupageddon, okay? 598 00:42:50,770 --> 00:42:54,500 And Drupageddon is, like, the easiest exploit. 599 00:42:54,820 --> 00:42:55,740 It's easy mode. 600 00:42:55,940 --> 00:42:58,300 There are YouTube videos detailing 601 00:42:58,300 --> 00:43:00,760 how to pop boxes using Drupageddon. 602 00:43:00,760 --> 00:43:04,560 And this has been around since 2014, I think. 603 00:43:05,340 --> 00:43:07,200 And I'm pretty sure it's 2017 now. 604 00:43:07,380 --> 00:43:08,700 So that's no bueno. 605 00:43:10,220 --> 00:43:15,820 So an attacker could trivially get root on this box 606 00:43:15,820 --> 00:43:17,620 that is being used to disseminate information. 607 00:43:18,540 --> 00:43:21,500 And amongst that information that they are intending 608 00:43:21,500 --> 00:43:23,920 to disseminate are Windows binaries. 609 00:43:24,300 --> 00:43:25,420 I mean, come on. 610 00:43:25,920 --> 00:43:28,820 So, I mean, an attacker could very trivially 611 00:43:28,820 --> 00:43:30,100 implant malware in that. 612 00:43:31,240 --> 00:43:35,400 And, I mean, never mind actually getting root on that box 613 00:43:35,400 --> 00:43:39,100 and then more than likely being able to pivot in deeper 614 00:43:39,100 --> 00:43:41,140 into the Center for Election Systems networks. 615 00:43:42,960 --> 00:43:45,980 Okay, so just to reiterate, 616 00:43:46,300 --> 00:43:47,840 the Center for Election Systems, 617 00:43:48,100 --> 00:43:53,920 they handle provisioning every single DRE in Georgia, okay? 618 00:43:54,540 --> 00:43:56,700 So, I mean, it makes for a hell of a target. 619 00:43:58,160 --> 00:44:00,740 And they say that they're, you know, they're, you know, 620 00:44:00,740 --> 00:44:03,740 they're testing networks or actually, you know, 621 00:44:03,780 --> 00:44:06,880 they're partitioned, segregated from whatever network 622 00:44:06,880 --> 00:44:09,560 that I happen to gain access to. 623 00:44:09,920 --> 00:44:12,740 But given what we've seen so far, 624 00:44:13,440 --> 00:44:16,780 I don't think they have the discipline to really do that. 625 00:44:17,900 --> 00:44:20,360 All right, so, yeah. 626 00:44:20,560 --> 00:44:22,280 I found all this information, 627 00:44:23,120 --> 00:44:25,200 immediately questioned if this was real life, 628 00:44:25,380 --> 00:44:27,440 and then figured out the best way 629 00:44:27,440 --> 00:44:28,760 to actually get this resolved. 630 00:44:29,000 --> 00:44:30,460 Because at the end of the day, this is always 631 00:44:30,460 --> 00:44:31,940 about building more secure systems. 632 00:44:33,380 --> 00:44:37,060 So, I spent a day or two trying to craft an email 633 00:44:37,060 --> 00:44:40,460 to make it sound like I'm not some rando crazy guy 634 00:44:40,460 --> 00:44:41,880 who is getting into their networks. 635 00:44:42,260 --> 00:44:44,520 I sent that to the director 636 00:44:44,520 --> 00:44:45,860 for the Center for Election Systems. 637 00:44:48,840 --> 00:44:51,820 And, yeah, I had a weird conversation with him, 638 00:44:51,880 --> 00:44:52,600 which I'll get to. 639 00:44:53,520 --> 00:44:57,520 So, I sent him this email, and I didn't hear a response. 640 00:44:57,980 --> 00:45:00,440 I didn't wait 24 hours, because I was, you know, 641 00:45:00,460 --> 00:45:01,920 really, really concerned about this. 642 00:45:02,000 --> 00:45:03,800 So, I ended up getting his cell phone number 643 00:45:04,260 --> 00:45:05,920 and giving him a call, right? 644 00:45:06,980 --> 00:45:11,080 So, I was like, hey, Merle, you got my email. 645 00:45:11,160 --> 00:45:12,400 You're actually fixing this, right? 646 00:45:12,640 --> 00:45:13,580 And he... 647 00:45:17,520 --> 00:45:18,680 Oh, gotcha, gotcha. 648 00:45:19,920 --> 00:45:21,760 Yeah, so, chatted with Merle King. 649 00:45:22,040 --> 00:45:25,880 He assured me they were going to fix this. 650 00:45:26,440 --> 00:45:28,440 So, at that point, I dropped it. 651 00:45:29,380 --> 00:45:30,440 Fast forward to the end of the year, and, you know, 652 00:45:30,440 --> 00:45:30,960 it was to March. 653 00:45:31,400 --> 00:45:34,140 In March, I was working on the talk 654 00:45:34,140 --> 00:45:35,640 I'm going to be giving tomorrow, 655 00:45:35,920 --> 00:45:37,880 which you all should come to, CableTap. 656 00:45:38,820 --> 00:45:41,360 And, over beers, working with my buddies, 657 00:45:41,600 --> 00:45:43,660 I was talking to Chris Grayson, 658 00:45:43,760 --> 00:45:45,840 and I hadn't told him about this work previously. 659 00:45:46,220 --> 00:45:49,780 So, he went and double-checked what I'd accomplished, 660 00:45:50,060 --> 00:45:52,360 and they had not remediated it correctly. 661 00:45:52,880 --> 00:45:54,880 So, then, of course, I proceeded 662 00:45:54,880 --> 00:45:56,660 to download everything again, right? 663 00:45:56,820 --> 00:45:59,620 To see if they had actually made any changes. 664 00:46:00,440 --> 00:46:03,900 The system was, they fixed the Drupageddon issue, 665 00:46:04,080 --> 00:46:06,040 but they were still using the server 666 00:46:06,040 --> 00:46:09,200 to disseminate information as recently as 2017. 667 00:46:11,280 --> 00:46:15,460 So, he let an individual at KSU know 668 00:46:15,900 --> 00:46:17,760 who could actually get this issue resolved. 669 00:46:18,820 --> 00:46:21,880 They ended up bringing the FBI into it, 670 00:46:21,920 --> 00:46:24,340 and then I ended up having the feds come 671 00:46:24,340 --> 00:46:28,160 to my apartment unannounced, which, for those of you 672 00:46:28,160 --> 00:46:30,300 who haven't experienced that, I don't recommend it. 673 00:46:30,440 --> 00:46:31,320 It's not fun. 674 00:46:33,500 --> 00:46:37,540 Yeah, so, I chatted with the feds a bit, and, yeah, 675 00:46:38,040 --> 00:46:42,500 as far as I know, I'm told they've actually fixed 676 00:46:42,500 --> 00:46:43,120 this issue now. 677 00:46:43,280 --> 00:46:44,520 I haven't really looked into it 678 00:46:44,520 --> 00:46:46,420 because the feds are unhappy with me. 679 00:46:48,400 --> 00:46:49,580 Thank you, thank you. 680 00:46:54,500 --> 00:46:55,500 Thank you, Logan. 681 00:46:55,700 --> 00:47:00,420 So, I don't know if anybody's moderating this, but, I guess, 682 00:47:00,440 --> 00:47:00,840 I have the mic. 683 00:47:01,540 --> 00:47:01,980 Yes? 684 00:47:02,180 --> 00:47:04,580 I wanted to ask Logan if you could explain 685 00:47:04,580 --> 00:47:07,280 what the JEM databases that he found there are. 686 00:47:09,620 --> 00:47:11,620 Logan, where, do you want to talk to him? 687 00:47:12,700 --> 00:47:13,140 Hi. 688 00:47:15,440 --> 00:47:17,340 Yeah, so, the JEM's databases, 689 00:47:17,420 --> 00:47:20,440 that's where all of the votes were actually tallied, 690 00:47:21,060 --> 00:47:24,800 and I have no clue what those were doing on that server. 691 00:47:25,340 --> 00:47:27,700 Like, I don't have a real explanation there. 692 00:47:28,320 --> 00:47:30,200 We don't know if it's possible to explain. 693 00:47:30,900 --> 00:47:31,420 Yeah. 694 00:47:34,100 --> 00:47:34,620 Sorry. 695 00:47:34,820 --> 00:47:38,620 So, the JEM's databases are not where the votes are tallied. 696 00:47:39,000 --> 00:47:41,360 Those votes are tallied on the JEM's machine. 697 00:47:41,980 --> 00:47:44,520 What we think this is, because we're looking at the dates 698 00:47:44,520 --> 00:47:45,940 of the files when they were uploaded, 699 00:47:46,400 --> 00:47:48,060 they actually come after the elections. 700 00:47:48,340 --> 00:47:52,620 So, it's possible that those JEM's databases were tally totals 701 00:47:52,620 --> 00:47:54,320 that the counties then sent 702 00:47:54,320 --> 00:47:56,700 up to the election center after the elections. 703 00:47:58,640 --> 00:47:59,820 Any further questions? 704 00:48:05,440 --> 00:48:07,500 I can't see who asked the question. 705 00:48:07,780 --> 00:48:09,440 Oh, a question about open source. 706 00:48:09,760 --> 00:48:14,060 There are two jurisdictions in the country, Los Angeles 707 00:48:14,060 --> 00:48:17,680 and Austin, Texas, Travis County and Los Angeles County, 708 00:48:17,820 --> 00:48:21,600 who are building open source voting systems, 709 00:48:21,680 --> 00:48:25,620 and the elections community is certainly aware of open source 710 00:48:25,620 --> 00:48:30,420 as a possibility, but right now, 711 00:48:30,440 --> 00:48:33,880 there are none, as far as I know, in use in the United States. 712 00:48:35,040 --> 00:48:37,240 So, obviously, open source is preferable 713 00:48:37,240 --> 00:48:39,060 to proprietary software. 714 00:48:40,060 --> 00:48:42,420 These, both of these systems are fairly far along, 715 00:48:42,540 --> 00:48:43,600 but at this point, they need money 716 00:48:43,600 --> 00:48:44,760 to do the development work. 717 00:48:45,080 --> 00:48:48,560 So, if you know somebody who wants to invest in these systems, 718 00:48:48,840 --> 00:48:50,880 it would really help with replacing these machines 719 00:48:50,880 --> 00:48:53,380 if we had the open source systems because they'd be cheaper. 720 00:48:55,060 --> 00:48:55,840 I have a question. 721 00:48:55,960 --> 00:48:56,200 Oh, yes. 722 00:48:57,260 --> 00:49:00,420 My name is John Brady, and my name is John Brady, 723 00:49:00,420 --> 00:49:05,000 and I spent three weeks in Wisconsin, and I was shocked 724 00:49:05,800 --> 00:49:10,080 when I found that in the larger counties, it did not hand count 725 00:49:10,640 --> 00:49:14,900 that they had installed in the DS series machines, 726 00:49:15,020 --> 00:49:17,680 like DS and S, SIM cards. 727 00:49:17,860 --> 00:49:21,060 They had built in a virtual private network, 728 00:49:21,300 --> 00:49:24,080 and if you could elaborate how dangerous that is 729 00:49:24,080 --> 00:49:25,600 or whatever, it's crazy. 730 00:49:26,240 --> 00:49:29,000 So, this is the last question, and we're going to have to, 731 00:49:29,100 --> 00:49:30,400 we're running over time. 732 00:49:30,420 --> 00:49:33,540 So, we see this, we see this a lot. 733 00:49:33,640 --> 00:49:36,100 We see VPNs, we see network connections 734 00:49:36,100 --> 00:49:38,760 that are not supposed to be there by law or by practice. 735 00:49:39,020 --> 00:49:42,340 We see VPNs, we see all sorts 736 00:49:42,340 --> 00:49:46,120 of terrible operations security practices 737 00:49:46,520 --> 00:49:48,860 in various jurisdictions all over the United States. 738 00:49:49,080 --> 00:49:51,480 I don't even think Wisconsin is the worst at all. 739 00:49:52,760 --> 00:49:55,840 I wish we had more time to talk about this, but we're going 740 00:49:55,840 --> 00:49:56,900 to have to cut this off now 741 00:49:56,900 --> 00:49:58,460 because the next session is going to have to start. 742 00:49:58,580 --> 00:49:59,840 So, thank you all very much 743 00:49:59,840 --> 00:50:00,980 for being here.