Hi. Welcome to the first annual Vote Hacking Village here at DEF CON.
Yeah.
Yeah. All right.
So my name is Jake Braun.
This ridiculous thing was my idea, and so somehow that landed me as the emcee today.
So I'll be in here all day introducing people.
Welcome.
And I was a White House liaison to the Department of Homeland Security.
I run a small national security and cybersecurity strategy and policy consulting firm called Cambridge Global Advisors,
and I teach cyber policy at the University of Chicago.
So just to do some quick table setting on what we're actually trying to achieve here
and kind of what we're not trying to achieve here as well before I introduce our first speakers,
let me just start by saying anybody who thinks that their machine's network or database can't be hacked is either a fool or a liar.
Right?
I think that's...
Actually, a totally uncontroversial thing to say at a place like this.
However, unfortunately, it's a pretty controversial thing to say in the election space.
And, by the way, because of some of the great work that this conference has done over the last 20 years, 25 years,
you've got people in some of the top industries, top countries, or top companies in the world,
Apple, Google, Lockheed Martin, J.P. Morgan, even the NSA,
would never say with a straight face, we can't be hacked.
We're unhackable.
And, by the way, 20 years ago, they were all saying the same thing that we hear today in the election industry.
Oh, our machines never touch the Internet.
You know, our databases are air-gapped and backed up all the time, all this stuff.
Well, now, not only...
Again, because of the great work DEF CON has done,
not only would all these industries say that they're hackable,
they would say we're probably being hacked right now successfully by multiple different actors.
Right?
And so the goal of what we're trying to do here is not to play gotcha
and show we can hack into this machine or that database.
Or this county clerk's whatever.
First of all, A, we already know that we can.
Right?
The Russians have already done it.
And many researchers have already done it.
It's just they haven't been able to make their research public.
That's not the point.
The point of this is actually much greater.
The point is to erase the idea of unhackability from the election industry writ large.
Why is that important?
Well, that's important because we are actually now under a direct existential threat to the United States
from a...
from a foreign adversary who has essentially unlimited resources, Russia.
And until we can get this industry to get the whole concept of unhackability out of their mind,
we won't be able to begin to start securing our democracy.
And so what we seek to do as this goes on year after year is help get this industry to come around
and, again, realize...
realize that they are hackable.
They will be hacked.
The Russians are going to be back.
Other bad guys are going to be back.
And they're going to get in.
And so then what do they need to do?
Our friends from Verified Voting are going to talk about.
They need to actually talk to each other and share threat information.
They need to take the help of the hacker community in securing their networks.
And they need to work with our national security apparatus in this country to help secure their networks.
And, by the way, you know, Google, Facebook...
Apple, Lockheed Martin, J.P. Morgan, none of them wanted to work with the national security apparatus
20 years ago when they were first being hacked and so on.
But, you know, they're a sitting duck when there's a nation-state after them.
And they've all now realized this, and the election industry needs to do the same.
And so on that note, by the way, one thing I do want to point out before we get started is that
if it wasn't for some really amazing local election officials like Dean Logan in L.A.,
Ricky Hatch in Utah, Lance Goff in Chicago, and some other people in the Chicago area that prefer to remain nameless,
helping us with this and really taking, understanding this for what it is, which is an opportunity, again,
not for us to play gotcha, but for their staff to get access to some great training
and to have some great research done on their systems and machines and so on,
none of this would have been possible.
So I do want to give the election officials who helped us with this a round of applause
before we get started.
Okay, so without further ado, our first speakers.
David Jefferson is the board chair of Verified Voting.
Verified Voting has been working on this issue for well over a decade.
David is a visiting computer scientist at Lawrence Livermore National Lab, where he works on
supercomputing applications, but has also been active in research in this space since,
well, for decades.
In 1994, while at Digital Equipment Corporation, he oversaw development of the California election
server, the first web server anywhere to provide online voting information on candidates and
issues.
In 1995, he helped develop, in cooperation with the California Voter Foundation, the
first online database of campaign finance information ever for the San Francisco municipal
elections that year.
And Barbara Simons is the president of Verified Voting, same organization.
Barbara has been on the board of advisors of the U.S. Election Assistance Commission
since 2008.
She published a book called Broken Ballots that you should all read, and on voting machines
that she co-authored with a guy named Douglas Jones.
She also co-authored a report that led to the cancellation of Department of Defense
Internet Voting Service, done, okay, oh, and, but I have to say that she's also the
former president of the Association for Computing Machinery, the largest and oldest international
educational scientific society for computing professionals.
Hi, Barbara.
All right.
So, Barbara and David, please come up.
All right, so I'm going to speak first, and what I'm going to try to talk to you about
is the ecosystem of hardware and software and procedures in a U.S. election.
There's a lot of concentration in people's minds on the voting machines.
Those are the gray ones that I have in this diagram, but there's a lot more to it than
that, and I want to introduce you to what it is.
When you learn the architecture about the information flows in an election, you'll
be able to understand the vulnerabilities that are not obvious otherwise.
I'm going to probably just get rid of this microphone and speak to the diagram.
I think you'll all be recording.
I'll be recording.
All right.
Then I'm going to have to move it.
Can I do that?
Can I do that?
All right.
No, I don't mind.
Okay.
All right.
So, there are basically three kinds of information flows in an election.
The red arrows here talk about the flow of software and firmware through the system.
The green arrows talk about the election definition, which is data that describes the election.
What the candidates are, what the propositions are, where they, where you, where the boxes
are that you touch or check.
And then the blue arrows are the flow of votes and ballot information and derived information
from them.
And then I have dotted lines here for, in the case of voter, where systems have what's
called a voter verified paper trail.
Now, I'm going to go over this quickly, and then I'm going to.
I'm going to retrace with some particular marks about the software.
So first of all, in the top left corner, you see the vendor.
The vendor is the company that both builds or contracts for the building of the voting
machines themselves, and also writes all of the software for the voting machines.
Not just the terminal voting machines where voters record their vote, but also the back
.
Pardon me.
.
The back end canvas computers that aggregate all the votes from the voting machines and
produce the final results.
So let's look, follow the red arrows from the vendor.
The vendor, there are very few vendors in the country, a handful, five, six nationally.
There are thousands of jurisdictions.
So many vendors, or each vendor sells to many jurisdictions.
The vendor rates software for both the voting machines and the canvas computers.
Those are treated as a single product, and a given jurisdiction bides all of its software,
both front end and back end, from the same vendor.
The vendor then sells its systems and services to the various jurisdictions.
So the next line there is supposed to represent local election officials, government officials,
who are legally responsible for the system.
for the conduct of the election.
They get copies of the software from the vendors.
They only get binaries.
They never see the source.
That's one of the issues that I'll come back to later.
They load those binaries prior to an election.
They load those binaries onto the voting machines
that are going to be distributed out into the precincts in the jurisdiction.
This diagram is talking about electronic voting machines
such as you have over there in the hackers forum over there.
You could vary this diagram for jurisdictions
that use optical scan voting systems,
but for purposes of today, I'm talking about electronic voting machines.
All right, so the vendors,
sorry, the election administration
officials install software in all of the voting machines
and they distribute all of the voting machines to each precinct
a few days before the election.
The voting machines sit there for a while in the custody of,
maybe in nobody's custody.
They may just be locked in a closet
or they may just be sitting in a hall somewhere
or they may be in the custody of a poll worker,
but they find their ways to the poll on the election day.
Also, the election officials,
install the software in the canvas systems
and the so-called election management systems.
And ideally, the election officials are the ones who run the canvas
and run the election management system.
However, more and more it seems to be the case
that jurisdictions don't actually do that.
They also outsource the running of these applications,
the back-end applications,
to the very same vendors.
So that's the flow of software to the voting machines
and to the election management and canvas systems.
The flow of election definitions data
that describes the election also comes from the vendors
to the election officials
and the election officials load it on to the voting machines
and to the Canvas systems, oftentimes they outsource the production of that election definition file also to the vendors.
So the vendors play an absolutely critical central role here, oftentimes a much stronger role than even the election officials do.
The flow of votes, of course, a voter walks into a precinct, authenticates himself as being allowed to vote in this election,
being registered in this precinct, walks over to a voting machine, casts his vote.
At the end of the day, at the end of election day, all of the votes are recorded on memory cards that were inserted somewhere in the back of the voting machine.
Ideally, those memory cards are removed at the end of the day and hand-transported by poll workers back to the county,
where they are registered.
They are then fed by the Canvas machines, and the Canvas systems aggregate all the results and determine who has won the election.
Of course, they have to deal with absentee ballots as well, and there are many other kinds of ballots.
You have to deal with provisional ballots, so it's much more complicated than I'm talking about, but this is idealized.
Eventually, the Canvas report is published, and that indicates to the world who is supposed to have won the election.
Now, let me do a time check here.
Okay.
Some electronic voting machines have a feature called the voter-verified paper audit trail.
Some of the machines that you will see down the hall have them.
Some do not.
The voter-verified paper audit trail was a late addition to the concept of an electronic voting machine
in attempt to deal with the security weaknesses of all electronic voting machines.
Because with the all electronic voting machines,
you basically have to trust all the software.
We did not want to be in that position, so we tried to, shall we say, backpatch by adding a voter-verified paper trail.
And the way that works is this.
When the voter is standing at the voting machine and presses that cast my ballot button,
of course, his ballot is recorded electronically, but it is also printed on paper at the side of the voting machine,
and the voter is supposed to look at that, and the voter is supposed to,
and the voter is supposed to verify what's printed on the paper is the way I intended to vote.
And he's supposed to report it if there's any difference.
As a matter of fact, hardly anybody ever does that,
which is one of the profound weaknesses of the VVPAT concept.
But if we assume that voters actually did that,
then that printed audit trail from every voting machine,
which now the voters have verified contains their true intents,
in principle, they could all be aggregated and looked at.
It's not just the voters.
It's on paper now, and the paper copies of the votes are, of course,
immune to any kind of software attack.
That's the beauty of it.
No matter whether they're bugs or malicious code, anywhere in the line,
the paper trail is immune to that kind of attack or failure.
So ideally, you could take a random sample or the entire corpus of voter-verified papers,
and compare them to the Canvas report.
And if there were differences, you could know there's a problem somewhere
in the software, in the procedures used to aggregate, or possibly malicious code.
And if the law so supported it, you could actually presumably prefer the results
from the hand-counted paper audit trail.
The law doesn't prefer this, but in principle, it could.
So that's the general flow of,
of software, votes, and election data.
And I just want to make a few quick comments about the software itself,
before I turn this over to my colleague, Barbara Simons.
The software is written by anonymous programmers who work for the vendors.
We don't really know who they are.
We don't know how they're vetted.
They do not have to have security clearances.
We know they're anonymous.
The software itself is considered proprietary
by the vendors.
It is, they are very protective of that proprietary nature.
So there's a network of law and contract restrictions and NDAs that prevent you or me
or anybody else from really seeing the insides of that software.
A few of us have, under certain circumstances, been able to see that source code,
but most people are not.
And that includes election officials.
Election officials all over the country are running software, and they do not even have the,
the source.
A lot of the software in both the Voting Machines and the Canvas systems
is COTS software, commercial, off-the-shelf stuff.
It's both mostly operating system stuff.
You will note that when you go down there you will see that some of these systems are so old
they're running Windows XP,
they're running Windows CE,
some of them run Windows 2000.
Nothing, nowhere in the country,
are they running systems,
systems newer than these, or hardly anywhere. I'm not aware of any. I mean, these are old.
And the reason that they are so old is because once they are certified, you can't change a voting
system without going through a complete recertification process, which is long, slow,
and expensive. The security features of these systems from beginning to end are especially
weak. The weak points would include the software update and installation process, the password and
key management, cryptography and randomization, all generally very weak, and even the physical
security, the ports and seals on voting machines when they're in storage and when they're in use.
It's a mess. I already mentioned that the software has to be certified to meet certain
federal standards. These are drafted by NIST and the EAC. You'll hear more about that in the next
panel.
So I'm not going to go into that now, except to say that the current standards are over a decade
old, quite weak in the subject of security, and they're only voluntary on the states anyway,
and they're enforced only by testing protocols, not by any kind of deep analysis of the source
code. So this, I think I'm going to stop there and turn this over to Barbara Simon,
my colleague. Barbara.
I guess this will work. I'm not going to bother with having slides up because they're not
very exciting. I'm going to be exciting but the slides aren't exciting. So first of all I
want to thank you guys for coming here and for working on this really, really important issue.
I mean we need to get many more people involved. We need to be able to show that there are
major problems with these machines and I'm hoping that some of you will actually be able to show
that with the work you're doing here. So thank you very much. Heretofore it's been very
difficult for independent experts to examine these machines for some of the reasons that David
mentioned. The software is proprietary and some of you guys probably know the digital
millennium copywriter. It's very difficult to get people involved. So I want to thank you guys
for doing this. So this is the new copyright act which makes it very difficult to examine
software if you don't have permission to do so. So there's been an exception made which allows
this to go forward, this hacking village to go forward. Fortunately that will remain for more
than like the next year or two. But they may take it away. So that's another issue. As David
said early, the testing is totally inadequate. The early testing was even worse. So the
results are secret. A lot of these machines that are in use, some of them the ones that you'll see
there, were certified to early testing where there was no penetration testing. I mean can you
imagine, they had a list of requirements. I mean can you imagine a major software vendor doing
testing by just checking off a list of requirements like single entry, single exit loop without
doing penetration testing. And yet that's what's been done for many of these voting machines.
The results are sometimes secret. So even the testing results are secret and there's a case in
California where the then Secretary of State, Kevin Shelly, tried to get the test results from
Diebold machines because he was concerned about the Diebolds that were being used in California. And
the testing agency said to him, these results are owned by Diebold and you can't get them from us.
You have to get them from Diebold and of course Diebold wouldn't turn them over. So even a very
proactive election official who wants to know what's happening, who wants to know the test results couldn't get
them. And so I'm going to talk a little bit about how we got here. And the story kind of begins back
with Florida 2000, which of course I'm sure those of you who aren't old enough to remember what
happened have probably heard of it. And some of us are old enough to remember. But what really
happened was Florida 2002 because they had more problems in the midterm in Florida also. As a
result, the Help America Vote Act was passed in 2002 and it allocated about three billion, that's
$2.3 billion to replace voting systems. And one of the unfortunate conclusions that a number of
people reached from Florida 2000 was that paper is bad. Paper is bad, paperless is good. And in
fact, I would go further than that to say that there was also an effort made to, I'm not sure if
exploit is the right word, but to manipulate voters with disabilities into voting systems. And
I think that's a really important piece of information. Because there were people going around
saying paper, machines with paper discriminate against voters with disabilities as if all voters
with disabilities had vision problems. And as if there weren't alternatives for people who do
have vision problems. So a lot of people felt that to support paper was to be against voters with
disabilities, which is a really bad place to be put as a policy maker. So that's something else that
happened. And of course, all this money was suddenly made available. Election officials wanted to
get it. And they wanted to get the newest and greatest shiny object. And so the vendors would say
completely secure, federally certified, we already know what that meant. And of course, they
could just touch a button at the end of the day and get the results. And if you're a hardworking
election official, that sounds really good. You can go home, you know, and get the results. And
it's some decent hour of the night. And you don't have to worry. No recount. It's perfect. You're
done. So it was very appealing. Plus, there was sort of a gold rush mentality. Everybody wanted to get
this newest thing. And besides, they wanted to get the money while it was still there. So there was a
big rush to buy machines. And of course, computers had to be introduced. If you're going to go
paperless, you need computers. David's already talked a bit about direct recording electronic
machines. These are the machines where, which directly record the voting system. And they're
not all touch screen. They're not all touch screen. But most of them were. You would touch the
screen for your candidate. And presumably, that information would be stored in the memory of the
computer. And initially, most of them were paperless. There were, of course, issues even
early on. Because if the machines were not properly calibrated, you could have problems. You
would have jumping votes. And people, you know, and we've seen this a lot in recent elections
where they say, you know, I don't know, I don't know, I don't know, I don't know, I don't know.
I voted for Obama and this other candidate's name, you know. And then people would say these
machines aren't secure because I touched the button for candidate A and candidate B's name
appeared. But in fact, we don't know if that was insecure or not because we don't know what
happened inside these machines. So it's quite possible they touched the button for candidate A
and A was recorded in the machine. Or maybe B was recorded in the memory. We don't know. Because
of course, nobody knows.
But these machines, on top of everything else, were really badly engineered. I mean, the
technology of the test screen machine was bad because it had to be constantly recalibrated. They
were insecure. The testing was lousy. It was a bad deal all the way around. And yet, they were
used almost throughout the country. In response, as David said, when the computer scientists and
other people, activists started complaining about this, there were retrofits with these voter
verified paper audit trails, which tended to be continuous roll thermal paper. And then, you
know, it was a continuous roll with small font that was hard to read. Bad human factors. One of the
major vendors recorded every single step that the voter did, which made it very hard to figure out
what your final results were. People didn't look at them. And then, if you did want to recount
them, it was a continuous roll, which is hard to recount. Thermal printed, like what you get at a
gas station, which can fade in the heat. I mean, again, so really badly engineered machines were
retrofitted with really bad retrofits. I mean, they were at least consistent.
So, there were also paper ballot systems. Typically, these are what we call OPSCAN systems,
where you have a paper ballot. In California, you connect a broken arrow to decide who you're
going to, you know, to signify who your selection is. Some places, they'll be, you know, you fill in
an oval. And then, these machines are put through scanners, which, of course, have computers in
them. So, there are, again, problems with the scanners. If they're not calibrated properly, they
may, you know, they may, you know, they may, you know, they may, you know, they may, you know,
if they're calibrated to be too sensitive, they may pick up stray marks and think that you voted
twice, which you're not supposed to do. If they're not sensitive enough, they may miss. So,
there are calibration problems there, too. But the good news is that there are paper ballots.
So, with, if there's malware or software bugs or calibration problems, you can find them if you
look at the paper ballots. Another advantage, of course, is that with paper ballots, if the
scanner is down, people can vote the paper ballots and deposit them in a ballot box for counting
later. So, it's a way to avoid long lines. Although, ironically, we've seen in the past couple
of elections that sometimes poor workers don't even know you can do that. And so, the lines still,
they still form because poor workers don't tell voters that they don't have to wait for the
scanners. There's another problem, which is that a lot of people don't understand that these
things have computers in them. I mean, that might, I'm sure this audience finds that hard to
believe. But, in fact, there's a lot of people who don't understand that these things have computers
in them. In fact, people don't understand that the way the scanner works is it's basically a
computer. So, we saw in Wisconsin, in the recount in 2016 in Wisconsin, that some places did a
recount by manually recounting the ballots, which is what a recount is. Other parts re-scanned
them. They put the ballots back into the scanners, which does not check the computer. I mean,
it's sort of a silly exercise. But that's an example of the lack of understanding. So,
I think I'll talk a little bit about Diebold, because Diebold is the poster child of all that's
wrong with these machines. And I have to say, in Diebold's defense, they, I mean, they did have
really lousy security. And they did post their software on an open FTP website, just asking for
people to download, I mean, they weren't asking, but, you know, they set it up so that it could
be downloaded and checked. So, yeah, they deserve a lot of what they got. But the fact is, the
vendors were all bad. We know that at this point. But anyway, Diebold, in 2002, was the first
software that was used in Georgia, in a major Georgia midterm, where both the senator, Senator
Max Cleland, and the governor were ahead in the polls, and they both lost. So, we don't know if
they truly lost or if there was a problem. What we do know is that there were last-minute
changes being made to the software with no oversight. Now, anyone who's worked on a large
software project knows that you're always making last-minute changes, you know, until the company
releases it, because you're always finding problems. So, there could have been very legitimate
reasons for a problem to be solved. But, you know, we don't know. So, we don't know. But, you know,
we don't know. So, we don't know. So, we don't know. So, we don't know. So, we don't know. And
we don't know. So, we don't know. So, we don't know. But the fact is, were there any last-minute
changes, or somebody could have decided who they wanted to win? We don't know. And nobody
examined the software, and, of course, that software is long gone. So, and it was paperless.
So, these machines were used in Georgia, 2002. In 2003, as I said, somebody, actually a
journalist, found Diebold software on an OpenFTP website and downloaded it, handed it off to
some security people at Johns Hopkins and Rice, and they examined that software, and that was
the first case where we've had an independent examination done by computer security experts.
They found gaping holes. For example, there was a single key to encrypt all the data on
every storage device and it was in the program text. And that key was F2654HD4. That's all
you needed. So that was one of the things they found. In 2006, there was another study.
Well, there have been a lot of studies. I'm skipping over a lot of material. In the book
I wrote, there's a whole chapter on D-bold. It's kind of interesting. But in 2006, the
Princeton team showed how to implant a virus on a D-bold machine, on these D-bold machines,
so that you could basically rig an election. In fact, they testified before Congress on
that. Ed Felton did.
They also noted that
they
did. The slot which contains the memory card has a lock, and you could open that lock using
a standard hotel bar key. And they're pretty standard. It was also easy to pick, but you
didn't even have to bother. You just get this bar key. These same machines are in use
today in Georgia. They were used for the Georgia CD50 election. Some of you may recall
that election. $50 million were spent. This was for a House of Representatives seat. It
was the most expensive election ever. And actually, there were some other problems
found in Georgia, which I won't go into. One of the people who found them, Logan Lam, is
here. And so when I finish, he's going to come up and just talk a little bit about Georgia,
because that's also an interesting story. But these machines are still there, still
in use today, and there's no justification whatsoever for their use. So there have been
some studies. So you guys are not the first ones to try to look at these machines. There have
been a couple of studies that were sponsored by secretaries of state. And David mentioned
how he was able to look at something because he was involved with these studies. So in
California, the secretary of state, Bowen, did what was called a top-to-bottom review.
And she required the vendors to produce the machines and the software and all the related
material for getting an election set up. And she was only able to do that because of a
court case that had happened a few years earlier with Kevin Shelley, an earlier secretary of
state who actually went to court and won. That's the only way she could get these machines.
I mean, you wouldn't believe how hard it is for people to get their hands on them. So she
basically went to the University of California. They put together, some folks put together a
team. They examined the security, the documentation, the accessibility. It's the only time
that these machines have ever been examined to see how easy they are for
voters with disabilities to use. They did badly on everything. And I should mention there's
some people here, like Candace Hocus here, who was one of the people involved with this. Matt
Blaze was also. In fact, Matt Blaze had an interesting quote. We found significant deep-rooted
security weaknesses in all three vendors' software. It should now be clear that the red teams
were successful not because they somehow cheated, but rather because the built-in security
mechanisms they were up against simply don't
work properly. There was a pervasive lack of good security engineering across all three
systems. So, as I said, it's not just D-Bolt. These were two other systems as well, I believe,
ES&S and what was the third one? Was it Heart? Heart InterCivic. Yeah. So the red teams were
able to break into all of them. That should be inspiration to you guys. The California study
was validated by a subsequent study done in Ohio called the Everest study, which also again brought
together, you know, really good security people. They found, they basically found that they
validated everything that was discovered in California, plus they found more problems. This was
back in 2006, 2007. And some of these machines are still in use today. They were still used for
the 2016 election. To my way of thinking, this is nothing short of a national scandal. In
addition, many of the old machines are falling apart. David's already mentioned some of the
ancients. Some of the old machines are falling apart. David's already mentioned some of the
software that's on them, and the fact that it's not even updated frequently, even with our
updates, because of the whole certification issue, because then they need to be recertified. So
there's a catch-22 on top of everything else. If you want to be conscientious and update your
software, then you've got to go through recertification, which can be expensive and time
consuming. So if you don't want to go through that, you don't update. The hardware is also failing.
I mean, these machines are just literally falling apart in some cases, and some election officials
are having to cannibalize other machines to keep some of the machines going. So election officials
actually do want to replace these machines. I mean, this is not a case where we are fighting against
election officials. The problem is there isn't money. And so that's another issue, obviously not
directly related to DEF CON, but that's something we need to be concerned about. Oh, I should just
mention that you've all, I'm sure, heard about the long lines in 2012 and 2016. A lot of these were
caused by the DREs, the Direct Recording Elections. And I'm sure you've all heard about the long
lines. And I'm sure you've all heard about the long lines in 2016. So thank you. But the point is,
the long lines are not about voting on electronic machines, because unlike paper ballots, you must
vote on the machine. If there are some machines that are down, or if there are long lines, a lot
of people are coming to the polls at the same time, you have to wait or not vote and go to work,
because you can't afford to spend an hour waiting in line. So the good news, I mean, Jake talked
about how we are under attack, and I agree. I lose sleep over this. And I hope you will, too, because
we have to fix the problem. But we know how to protect ourselves against hacking. We have
the solution. And it's pretty straightforward. We need paper ballots and we need manual post
election ballot audits to check that the computers that count the paper are working correctly.
If we can get that nationwide, we'll be safe from hacking our voting systems. I mean, I'm
not talking about the voter registration databases. That's a different issue. We need to take
significant steps there, too, to protect those. But if you look at the voting technology itself,
paper ballots, manual post election ballot audits. By the way, you have to randomly select
the ballots, clearly, because if you don't use randomness, the bad guys will know what
you're going to look at and they'll just touch the other stuff. And incidentally, a lot of
people don't know what random means. Sometimes election officials will announce beforehand
which precincts or whatever they're going to look at. That ain't random.
So one of the problems we've had historically is convincing people that this is a problem.
Not people like you, but the press, policy makers, election officials. And I've talked
to a lot of reporters where they say to me,
well, give us an example of an election that was hacked. And the problem is the beauty
of these paperless systems, both these touchscreen voting machines and internet voting, by the
way, which is another, which I know there's going to be a whole session on that. That's
another really dangerous, I mean, that's the worst, actually. But the beauty of these
systems that don't have paper ballots that were marked by the voters is there's no evidence.
It's, you know, I mean, it's very, very, very hard to prove that an election has been stolen,
not only because of the lack of evidence but because of the resistance to looking.
We saw that in the 2016 recount, where there was great resistance even to doing recounts
of a small number of states. And in fact, the Michigan recount, which Michigan is all paper,
was halted by the courts. And of course, most of the country wasn't really adequately examined at all.
So in fact, we should be able to, I mean, I think, if we could get the funding, we could get the data and all. So, but there are all kinds of things that we want to do and that are not good at all. There's not a whole lot of things that we can pull out.
we don't know whether or not the 2016 machine election was hacked because
nobody has done an adequate study to determine whether or not it was hacked
so going forward we just can't allow this to happen we have to fix these
systems and we have to get paper ballots everywhere so I'll just end with a quote
from former FBI director Comey which I completely support they'll be back in
2020 they may be back in 2018 and one of the lessons they may draw from this
is that they were successful because they introduced chaos and division and
discord and so doubt about the nature of this amazing country of ours and our
democratic process I think they will be back in 2018 there are major major
midterm elections coming up there are even important elections coming up in
2017 the governors of New Jersey and Pennsylvania are going to be
elected in 2017 and
um
there are a lot of bad machines.
Pennsylvania, 80% of Pennsylvania
is paperless voting machines
that are incredibly insecure, 80%.
And this is a major state.
We've got to fix that.
So thank you for the work you're doing
and thank you for your support.
And I would like to see if Logan Lamb could come up.
Talk about Georgia.
This is Georgia.
I'm a pacer.
All right, cool.
Hey, friends.
So I'm Logan Lamb.
I'm a cybersecurity researcher based out of Atlanta.
I primarily do wireless cybersecurity research,
but since it was election season
and we all like to break things,
I really, really wanted to get my hands on some voting systems.
So I ended up going down to the elections office
in Fulton County,
and I was attended.
I was attempting to speak with the election supervisor,
Richard Barron, I think.
And I was going to say,
hey, I'm a local cybersecurity researcher.
I'd like to do some good work and help you guys.
Well, as you can imagine,
I didn't get past the secretary.
So she ran my card back to Richard Barron,
and then they came back to me
and let me know that all of the election systems in Georgia
are actually handled at Kennesaw State University
by the state government.
And they're actually centered for election systems.
So immediately, I thought this was kind of wacky, right?
It's like, what is this university doing
with all these systems?
So prior to sending an email to the director there,
I figured I'd try and get some background information
on the group and just see, like, who are these people?
What do they do?
So I checked out their website and then just fired off,
like, the simplest Google dork ever.
I was just like, hey, I'd like to see all of your documents
and PDFs you have on this website, okay?
Lo and behold, there were some really, really interesting documents
that were already cached by Google, okay?
I clicked one of the links,
and what appeared to be in front of me
was a list of voter names, okay?
So at this point, I was like,
is this real?
Is this real life?
Is this happening right now?
So, yeah, I mean, this was just a web server.
So I went up a couple directories,
because it had, like, a directory structure in the route,
and then I looked at their robots.txt,
wrote a quick, like, bash script to curl everything off
recursively, and then I went to lunch.
Yeah, so then I went to lunch,
and when I came back and I checked to see how much data I had
on my computer, I had 15 gigs worth of data, y'all.
It's crazy.
Crazy stuff.
So, yeah, amongst this 15 gigabytes worth of data,
I had all of the voter registration information
for everyone in Georgia, okay?
So that includes names, addresses, birthdays,
last four digits of your social,
also your full driver's license number,
which seems relatively innocuous,
but you can actually use all that information
to change people's registration with the DMV.
So that's just a whole other can of worms.
Okay, what else was there?
We had PDFs of election day passwords,
and this seemed to be the same across all counties, okay?
And there were also some gyms databases,
and, like, to this day, I have no clue
what those were doing on that server.
It's just a web server.
And from what I could gather,
it looks like this server was being used
to disseminate information to all of the counties.
And there was, like, a bulk update file,
which had a bunch of voter registration information
and a couple of Windows binaries.
The Center for Election Systems,
they would actually tweet out every couple months
and be like, hey, there's a new bulk update file
that you all should go download and run on your systems.
Well, yeah.
So it looks like this hilariously insecure system
was being used to disseminate information
related to the election systems.
Well, I mean, it keeps getting worse, actually.
So this web server, it was vulnerable to Drupageddon, okay?
And Drupageddon is, like, the easiest exploit.
It's easy mode.
There are YouTube videos detailing
how to pop boxes using Drupageddon.
And this has been around since 2014, I think.
And I'm pretty sure it's 2017 now.
So that's no bueno.
So an attacker could trivially get root on this box
that is being used to disseminate information.
And amongst that information that they are intending
to disseminate are Windows binaries.
I mean, come on.
So, I mean, an attacker could very trivially
implant malware in that.
And, I mean, never mind actually getting root on that box
and then more than likely being able to pivot in deeper
into the Center for Election Systems networks.
Okay, so just to reiterate,
the Center for Election Systems,
they handle provisioning every single DRE in Georgia, okay?
So, I mean, it makes for a hell of a target.
And they say that they're, you know, they're, you know,
they're testing networks or actually, you know,
they're partitioned, segregated from whatever network
that I happen to gain access to.
But given what we've seen so far,
I don't think they have the discipline to really do that.
All right, so, yeah.
I found all this information,
immediately questioned if this was real life,
and then figured out the best way
to actually get this resolved.
Because at the end of the day, this is always
about building more secure systems.
So, I spent a day or two trying to craft an email
to make it sound like I'm not some rando crazy guy
who is getting into their networks.
I sent that to the director
for the Center for Election Systems.
And, yeah, I had a weird conversation with him,
which I'll get to.
So, I sent him this email, and I didn't hear a response.
I didn't wait 24 hours, because I was, you know,
really, really concerned about this.
So, I ended up getting his cell phone number
and giving him a call, right?
So, I was like, hey, Merle, you got my email.
You're actually fixing this, right?
And he...
Oh, gotcha, gotcha.
Yeah, so, chatted with Merle King.
He assured me they were going to fix this.
So, at that point, I dropped it.
Fast forward to the end of the year, and, you know,
it was to March.
In March, I was working on the talk
I'm going to be giving tomorrow,
which you all should come to, CableTap.
And, over beers, working with my buddies,
I was talking to Chris Grayson,
and I hadn't told him about this work previously.
So, he went and double-checked what I'd accomplished,
and they had not remediated it correctly.
So, then, of course, I proceeded
to download everything again, right?
To see if they had actually made any changes.
The system was, they fixed the Drupageddon issue,
but they were still using the server
to disseminate information as recently as 2017.
So, he let an individual at KSU know
who could actually get this issue resolved.
They ended up bringing the FBI into it,
and then I ended up having the feds come
to my apartment unannounced, which, for those of you
who haven't experienced that, I don't recommend it.
It's not fun.
Yeah, so, I chatted with the feds a bit, and, yeah,
as far as I know, I'm told they've actually fixed
this issue now.
I haven't really looked into it
because the feds are unhappy with me.
Thank you, thank you.
Thank you, Logan.
So, I don't know if anybody's moderating this, but, I guess,
I have the mic.
Yes?
I wanted to ask Logan if you could explain
what the JEM databases that he found there are.
Logan, where, do you want to talk to him?
Hi.
Yeah, so, the JEM's databases,
that's where all of the votes were actually tallied,
and I have no clue what those were doing on that server.
Like, I don't have a real explanation there.
We don't know if it's possible to explain.
Yeah.
Sorry.
So, the JEM's databases are not where the votes are tallied.
Those votes are tallied on the JEM's machine.
What we think this is, because we're looking at the dates
of the files when they were uploaded,
they actually come after the elections.
So, it's possible that those JEM's databases were tally totals
that the counties then sent
up to the election center after the elections.
Any further questions?
I can't see who asked the question.
Oh, a question about open source.
There are two jurisdictions in the country, Los Angeles
and Austin, Texas, Travis County and Los Angeles County,
who are building open source voting systems,
and the elections community is certainly aware of open source
as a possibility, but right now,
there are none, as far as I know, in use in the United States.
So, obviously, open source is preferable
to proprietary software.
These, both of these systems are fairly far along,
but at this point, they need money
to do the development work.
So, if you know somebody who wants to invest in these systems,
it would really help with replacing these machines
if we had the open source systems because they'd be cheaper.
I have a question.
Oh, yes.
My name is John Brady, and my name is John Brady,
and I spent three weeks in Wisconsin, and I was shocked
when I found that in the larger counties, it did not hand count
that they had installed in the DS series machines,
like DS and S, SIM cards.
They had built in a virtual private network,
and if you could elaborate how dangerous that is
or whatever, it's crazy.
So, this is the last question, and we're going to have to,
we're running over time.
So, we see this, we see this a lot.
We see VPNs, we see network connections
that are not supposed to be there by law or by practice.
We see VPNs, we see all sorts
of terrible operations security practices
in various jurisdictions all over the United States.
I don't even think Wisconsin is the worst at all.
I wish we had more time to talk about this, but we're going
to have to cut this off now
because the next session is going to have to start.
So, thank you all very much
for being here.