1
00:00:00,000 --> 00:00:05,620
Thanks, everybody. Our next speaker is Hari Hursti. He's a subject matter expert and co-founder

2
00:00:05,620 --> 00:00:12,940
of Nordic Innovation Labs and one of the foremost election security experts in the world.

3
00:00:13,200 --> 00:00:15,520
So let's give it up for Hari.

4
00:00:18,740 --> 00:00:23,760
All right. Thank you for having me. First, I want to tell the village is extremely busy.

5
00:00:23,760 --> 00:00:30,540
We are under one hour, 40 minutes from opening the doors, which in reality means less than one

6
00:00:30,540 --> 00:00:37,820
half hour starting people pouring in. We first had the first two hacks. We are right now seeing

7
00:00:37,820 --> 00:00:46,440
an extensive progress in three other things. So I don't think we get to early dinner time before

8
00:00:46,440 --> 00:00:51,400
those are complete. It's amazing progress. And one thing which is interesting is that people who

9
00:00:51,400 --> 00:00:53,740
haven't been part of the studies have never seen the results. So I don't think we get to

10
00:00:53,760 --> 00:01:00,060
the machines. They don't know what we did. And hence, they don't have the same tunnel vision as

11
00:01:00,060 --> 00:01:04,060
the people who have been 10 years looking into this. So they have a completely new approach.

12
00:01:04,720 --> 00:01:09,520
And if somebody would be educating them, they'd say, probably don't try it, but there's nobody

13
00:01:09,520 --> 00:01:14,240
telling that. So that's why they make a good success in completely new ways and completely new

14
00:01:14,240 --> 00:01:21,780
approaches. What was interesting was that the first hack was a professor from Denmark who was

15
00:01:21,780 --> 00:01:23,560
able to take control remotely.

16
00:01:23,760 --> 00:01:27,300
He was able to take control remotely over Wi-Fi, the win-vote voting machine, on operating system

17
00:01:27,300 --> 00:01:33,860
level, able to speak directly with the command line to the operating system, able to unrestrictedly go

18
00:01:33,860 --> 00:01:39,340
where the voter data is, et cetera, et cetera. So it was absolutely totally penetrated. Very

19
00:01:39,340 --> 00:01:45,540
interesting how quickly it happened from the point of you have never seen the machine to the place

20
00:01:45,540 --> 00:01:53,000
when you are, okay, proof of concept, I mean. Anyway, this talk was kind of having a different, the

21
00:01:53,000 --> 00:01:53,740
hacker perspective. So I think it was a very interesting talk. I think it was a very interesting talk.

22
00:01:53,760 --> 00:01:59,400
I don't know when it happened, but I'm going to give the speech which I wanted to give, which is to

23
00:01:59,400 --> 00:02:09,300
tell about what has happened since 2005 today. What are the lessons learned? And it also is a speech

24
00:02:09,300 --> 00:02:15,360
which I want to underline that don't make any assumptions, because most likely the assumptions you

25
00:02:15,360 --> 00:02:21,800
make are going to be wrong if you are a security researcher. And my statement from 2005 is still

26
00:02:21,800 --> 00:02:23,740
true. If I wouldn't have seen this, I wouldn't have been able to do this. So I think it was a very

27
00:02:23,740 --> 00:02:27,520
would only have said this with my own eyes, I don't think somebody would be able to convince me.

28
00:02:28,180 --> 00:02:34,900
These things are just a, this science which, there was never a prime time of this kind of

29
00:02:34,900 --> 00:02:40,140
design. So they should have never been in the market in the first place. So it's a, it's a sad

30
00:02:40,140 --> 00:02:46,780
state of affairs. So first of all, who I am and why I'm talking about this. I have been starting

31
00:02:46,780 --> 00:02:53,720
hacking election machines against actually my intention in 2005. And what happened to me was I was

32
00:02:53,740 --> 00:02:57,760
I was for over a year trying to be convinced that I should take a look into the election machines.

33
00:02:57,980 --> 00:02:58,980
I said no.

34
00:02:59,360 --> 00:03:06,060
I said no again until I decided that I want to get rid of the people who are asking me to vote the hacker machines

35
00:03:06,060 --> 00:03:08,460
by setting an impossible set of rules.

36
00:03:08,740 --> 00:03:13,980
And then my impossible set of rules were met by Ian Shanshaw from Tallahassee, Florida.

37
00:03:14,320 --> 00:03:18,240
He invited me over, invited me to take a look into the machines.

38
00:03:18,240 --> 00:03:20,420
And the rest is history.

39
00:03:20,500 --> 00:03:24,340
We discovered a vulnerability in design.

40
00:03:24,580 --> 00:03:25,360
It's not a bug.

41
00:03:25,560 --> 00:03:32,860
It's a vulnerability in design which allows you to pre-stack the electronic ballot box

42
00:03:32,860 --> 00:03:38,960
and gives you a capability of arbitrarily shift the outcome of the election.

43
00:03:39,860 --> 00:03:44,800
And the interesting feature of the voting machine is that the actual evidence,

44
00:03:45,000 --> 00:03:47,980
how much it was shifted, is self-destroying evidence.

45
00:03:48,240 --> 00:03:50,480
And the normal cause of the voting machine suffer.

46
00:03:50,720 --> 00:03:56,580
So you don't need to, as an attacker, worry about erasing the forensic evidence.

47
00:03:56,700 --> 00:03:58,560
The machine will do that for you.

48
00:04:00,120 --> 00:04:04,600
I participated in three government-sanctioned studies in the United States.

49
00:04:04,960 --> 00:04:11,120
Everest is, while it's old and should have been a long, long time ago replaced by a newer study,

50
00:04:11,260 --> 00:04:14,000
it's still the most comprehensive study.

51
00:04:14,300 --> 00:04:17,180
It took the California top-to-bottom review.

52
00:04:17,420 --> 00:04:18,220
Very fascinating.

53
00:04:18,240 --> 00:04:23,380
It verified all the findings of California top-to-bottom review and then added some new information.

54
00:04:23,640 --> 00:04:26,480
The redacted report is 316 pages.

55
00:04:27,200 --> 00:04:28,760
Wonderful bedtime reading.

56
00:04:29,610 --> 00:04:34,940
There is a – the report actually describes every vulnerability found.

57
00:04:35,460 --> 00:04:40,580
But the redacted version is the actual – some of the vulnerabilities are too dangerous.

58
00:04:40,640 --> 00:04:45,220
So the actual cookbook, a recipe, how it works, that is redacted.

59
00:04:45,240 --> 00:04:46,520
So you know there's a vulnerability.

60
00:04:46,660 --> 00:04:47,720
You just –

61
00:04:48,240 --> 00:04:51,720
The report doesn't tell in the most dangerous one how to access that vulnerability.

62
00:04:53,000 --> 00:04:57,420
And after that, I have been doing studies around the world.

63
00:04:57,680 --> 00:05:04,300
We are actually going to have a little bit of, in this presentation, experiences from Estonia,

64
00:05:04,320 --> 00:05:05,780
which Estonia has always referred.

65
00:05:06,360 --> 00:05:08,040
Why can we do internet voting?

66
00:05:08,140 --> 00:05:09,040
Because Estonia can.

67
00:05:09,200 --> 00:05:10,800
The truth is Estonia cannot either.

68
00:05:11,180 --> 00:05:12,940
But they just market it that way.

69
00:05:13,060 --> 00:05:15,000
So we will have a little bit of a look in that.

70
00:05:15,240 --> 00:05:18,020
And this talk is not about –

71
00:05:18,240 --> 00:05:24,080
the last presidential election, but in the last presidential election I participated in a number of lawsuits

72
00:05:24,080 --> 00:05:28,720
in the recount effort testifying about the vulnerabilities of the machines, et cetera.

73
00:05:29,600 --> 00:05:30,880
So, again, disclosure.

74
00:05:31,220 --> 00:05:32,900
I have only interest in security.

75
00:05:33,120 --> 00:05:34,780
I have a – I'm not an American citizen.

76
00:05:34,940 --> 00:05:36,000
I cannot vote.

77
00:05:36,180 --> 00:05:38,060
So I have no stick in this game.

78
00:05:38,540 --> 00:05:41,240
I have – I'm not talking about any specific election.

79
00:05:41,860 --> 00:05:46,360
These all vulnerabilities, all the things we are discussing has been used.

80
00:05:46,460 --> 00:05:47,760
They have been exploited.

81
00:05:47,760 --> 00:05:49,920
They are exploitable in number of elections.

82
00:05:50,140 --> 00:05:52,820
In case of Estonia, I think the number is nine elections.

83
00:05:53,060 --> 00:05:58,080
In the U.S., God knows how many, because these machines are used in a number of jurisdictions where,

84
00:05:58,180 --> 00:06:03,160
for example, in New Jersey, you can have 250 elections a year because of all the local elections.

85
00:06:03,300 --> 00:06:07,760
So we don't even know how many elections these have been potentially affecting the United States.

86
00:06:08,120 --> 00:06:12,200
So verifiability, transparency, integrity, security, those are my interests,

87
00:06:12,300 --> 00:06:17,420
not the politics or discussion about if an adversary, number one,

88
00:06:17,760 --> 00:06:18,700
or two, did anything.

89
00:06:19,040 --> 00:06:21,520
So, first of all, what we are not going to talk about.

90
00:06:22,880 --> 00:06:26,320
We are going to have a presentation at four by Matt Place.

91
00:06:26,580 --> 00:06:33,380
Matt is going to give you a demonstration with the real machine, the punch card machine,

92
00:06:33,540 --> 00:06:37,240
which started this mess in 2000 election in Florida.

93
00:06:37,400 --> 00:06:39,740
So he will show the actual machine.

94
00:06:39,860 --> 00:06:46,880
He will allow probably you to vote, and he will tell you the actual story, what is – what has been –

95
00:06:46,880 --> 00:06:54,420
missed in the weeds why this guy became the icon of year 2000 in count with trying to see the pregnant

96
00:06:54,420 --> 00:06:57,860
and hanging and pimpled sheds on the ballots.

97
00:07:01,420 --> 00:07:05,640
Again, how we got here, 2005 was the Diebold machines had.

98
00:07:05,820 --> 00:07:12,100
Ohio, those are the white independent studies.

99
00:07:12,340 --> 00:07:16,000
There's a lot of studies which are not independent, which are paid studies,

100
00:07:16,140 --> 00:07:16,860
or they're not independent.

101
00:07:16,860 --> 00:07:19,120
They are – the researchers are not independent.

102
00:07:19,920 --> 00:07:21,660
Those are different kinds of studies.

103
00:07:21,700 --> 00:07:29,360
The independent studies are when you have – when the study is made for – without any links or connection to the

104
00:07:29,360 --> 00:07:37,440
vendors or stakeholders in that, other than the government or Secretary of State or, in some cases, a lawsuit.

105
00:07:38,720 --> 00:07:45,320
And Estonian study is important for a perspective of internet voting.

106
00:07:45,820 --> 00:07:46,500
It's very –

107
00:07:46,860 --> 00:07:48,520
it's interesting to have the number.

108
00:07:48,680 --> 00:07:54,800
In 2016, 52 different models of voting machines were used in U.S. elections.

109
00:07:55,440 --> 00:08:05,700
The normal statement has been always to say that U.S. election machinery and infrastructure is protected by diversity.

110
00:08:06,360 --> 00:08:12,700
The argument is because there's so many different kind of machines, there's so many different deployments, that is protected.

111
00:08:12,700 --> 00:08:13,920
There's no single point of failure.

112
00:08:14,100 --> 00:08:16,840
First of all, from attacker's point of view, there's no single point of failure.

113
00:08:16,840 --> 00:08:18,200
Second point of view, it doesn't work that way.

114
00:08:18,320 --> 00:08:24,180
Attacker needs to know only for a few machines, and then you can choose where you attack, based on what you know.

115
00:08:24,460 --> 00:08:34,200
So the diversity actually is giving you a wider range of services, and it gives you an easier way to find where your skills meet your targets.

116
00:08:35,680 --> 00:08:46,120
So diversity, to a certain extent, is good, but it is not a – it's a false sense of security to say diversity itself is giving you a security.

117
00:08:46,120 --> 00:08:46,600
So diversity, to a certain extent, is good, but it is not a false sense of security, and it gives you a security.

118
00:08:46,600 --> 00:08:47,220
In that sense.

119
00:08:47,720 --> 00:08:57,640
The other thing is, the diversity itself is also undermined by a thing which is right now coming more to service, and it's the service companies.

120
00:08:57,860 --> 00:08:59,940
And we will have a slide later about service companies.

121
00:09:00,240 --> 00:09:11,580
In a number of states, a huge amount of jurisdiction is actually programmed and run by a very small number of service companies which are not certified, they are not catalogued, they have various practices in security level.

122
00:09:11,780 --> 00:09:13,900
We will have a little bit more discussion about that.

123
00:09:14,900 --> 00:09:16,100
Anyway, here we have...

124
00:09:16,120 --> 00:09:19,200
little bit of pictures of what has happened to the voting machines in the

125
00:09:19,200 --> 00:09:24,340
previous studies, replacing operating system, replacing the firmware, doing

126
00:09:25,620 --> 00:09:31,820
everything what attacker would do. So theory of election is simple. This is

127
00:09:31,820 --> 00:09:36,380
actually putting a little bit of a reference to what David Jefferson and

128
00:09:36,380 --> 00:09:40,500
Barbara Simons were talking. We all think this is what election should

129
00:09:40,500 --> 00:09:44,940
look like. We will take a vote and you add it to the candidate. That is

130
00:09:44,940 --> 00:09:50,660
what people think election machines are, and voting infrastructure. That is far from the

131
00:09:50,660 --> 00:09:55,720
truth. That is actually the real election systems. This is only the election part.

132
00:09:56,200 --> 00:10:03,100
The side here is a hard into civic infrastructure. The side on this side is

133
00:10:03,100 --> 00:10:07,400
ES&S. Those are two major manufacturers of their voting machine technology in

134
00:10:07,400 --> 00:10:13,680
the United States. This is what the actual architectural overview is. Humans

135
00:10:13,680 --> 00:10:14,920
are complex and these are complex.

136
00:10:14,920 --> 00:10:20,700
doesn't even touch the other areas, which is the election management part, the voter

137
00:10:20,700 --> 00:10:26,860
registration, e-poll books, yada, yada, yada. And it's very important to understand when we

138
00:10:26,860 --> 00:10:32,100
look to what the reports of the recent adversary attacks, they didn't go after the election

139
00:10:32,100 --> 00:10:36,360
machines. They went after the back end infrastructure. They went at the back end

140
00:10:36,360 --> 00:10:42,760
network, the back office. That was the target. Why attacking the voting machine when you can

141
00:10:42,760 --> 00:10:48,700
scratch your belly and send a couple of poison holes word documents and get your access that

142
00:10:48,700 --> 00:10:53,260
way to the back end network? So we have been looking at this area, and this is the voting

143
00:10:53,260 --> 00:10:58,360
technology everybody recognizes, but the actual infrastructure is way larger, and David

144
00:10:58,360 --> 00:11:02,360
Jefferson and Barbara Simons covered that at 10 a.m., so there will be a recording. You can

145
00:11:02,360 --> 00:11:06,360
see the recording and get yourself familiarized with that part of the structure.

146
00:11:07,220 --> 00:11:12,020
So when we now look at the voting machine and voting depilations system, what we have learned

147
00:11:12,020 --> 00:11:12,740
is that the voting machine and the voting depilation system, what we have learned is that we

148
00:11:12,760 --> 00:11:18,220
have a very complex system. First of all, what the systems look like. This is a one major vendor

149
00:11:18,220 --> 00:11:24,260
in the United States. This is the complexity of the code. The election management system,

150
00:11:24,440 --> 00:11:30,860
scripts, COBOL, visual basic. What could possibly go wrong with that and how modern it is?

151
00:11:31,040 --> 00:11:37,780
But if you look at the numbers, these are not numbers of code lines, comment lines. This is

152
00:11:37,780 --> 00:11:41,600
the actual active comment lines of the source code.

153
00:11:42,840 --> 00:11:49,540
These are humongously complex systems, and one would argue, and I think it's a right argument,

154
00:11:50,140 --> 00:11:55,580
unnecessarily complex. But elections in the U.S. are more complex than people think, and

155
00:11:55,580 --> 00:12:02,500
especially new legislation like rank voting is adding complexity, because the new laws allow

156
00:12:02,500 --> 00:12:05,500
new methods of voting, and you have to accommodate that.

157
00:12:05,780 --> 00:12:11,580
But just by looking at that and looking at how much assembler code we have here, how much we have

158
00:12:11,580 --> 00:12:17,340
a raw C, how much we have, I would say, obsolete things like COBOL, you immediately know this

159
00:12:17,340 --> 00:12:23,640
is a humongously expensive system to maintain, and when it's an expensive system to maintain with

160
00:12:23,640 --> 00:12:26,660
that amount of code, bad things will happen.

161
00:12:28,420 --> 00:12:34,380
Just to make sure that we understand that they are not alone, this is another manufacturer, yet

162
00:12:34,380 --> 00:12:41,560
another, it's more C++, maybe C sharp, assembler, no COBOL. I think that's about the same.

163
00:12:41,580 --> 00:12:48,400
But again, the management system, over 100,000 lines of code, the voting terminal, bootloader alone,

164
00:12:49,060 --> 00:12:54,820
72,000 lines of code. And remember, these are not including your operating system, they are not

165
00:12:54,820 --> 00:13:01,000
including your driver code. There is millions and millions of lines of dependencies which come

166
00:13:01,000 --> 00:13:06,480
into place, and especially driver codes which are normally running in a kernel mode. If you don't

167
00:13:06,480 --> 00:13:11,560
know what they are, you don't know what your system is doing. So this is just to underline what is

168
00:13:11,580 --> 00:13:17,740
the complexity. Third vendor, more C++, but still, when you look at the numbers of code,

169
00:13:18,920 --> 00:13:24,300
humongous, and they don't run in the voting terminal standard operating system, they actually have

170
00:13:24,300 --> 00:13:30,280
a home-baked operating system. That number of lines is just the application. The operating system

171
00:13:30,280 --> 00:13:38,700
itself, which doesn't need to be certified under the theory that it's not vote-acting, humongous

172
00:13:38,700 --> 00:13:41,560
code, this is just to tell where, if you look at the code, it's not a vote-acting code.

173
00:13:41,580 --> 00:13:49,180
If you try to understand these two systems by a pure source code audit, you will discover

174
00:13:49,180 --> 00:13:55,400
something, but that is not enough. You are not going to be ever able to establish a sufficient

175
00:13:55,400 --> 00:14:00,240
amount of trust to the system integrity, sufficient amount of trust to the system

176
00:14:00,240 --> 00:14:08,020
performance and error-free producing by just looking at the source code. You have to go to

177
00:14:08,020 --> 00:14:11,560
fully integrated system, end-to-end, where you have the operating system, and you have the

178
00:14:11,580 --> 00:14:16,140
testing, where you have everything coming from drivers, everything, and then you test it as a

179
00:14:16,140 --> 00:14:21,260
whole. Otherwise, you are missing a huge part of the whole infrastructure.

180
00:14:21,760 --> 00:14:31,560
Now, if we compare that to what we have found here, and this is kind of a scary list of things.

181
00:14:33,320 --> 00:14:41,500
First of all, hard-wired PIN codes. We are talking about voting terminals where a supervisor PIN code,

182
00:14:41,580 --> 00:14:49,240
is either hard-wired as the only code, or there's a secondary code which is hard-wired, so even

183
00:14:49,240 --> 00:14:53,820
if the election supervisor changes their PIN code, there is another code which the election

184
00:14:53,820 --> 00:15:01,040
supervisor doesn't know, which can be used to log in. Hard-wired encryption keys. We have a lot

185
00:15:01,040 --> 00:15:05,860
of documentation that this has been across many of the vendors. Some of the vendors have

186
00:15:05,860 --> 00:15:11,560
gotten rid of that. Very bad practice. And, you know, we have a lot of documentation that

187
00:15:11,580 --> 00:15:18,060
the other practice is files starting with the negative encryption keys. I think that's very good for a key

188
00:15:18,060 --> 00:15:23,280
management perspective. If your threat model is that you lose your key, now it's very convenient.

189
00:15:23,420 --> 00:15:28,660
The key is always there, but it also renders the whole encryption meaningless. It's then purely

190
00:15:28,660 --> 00:15:37,580
advertising and decorated. We have a lot of variations of that, where the key itself is artificially mangled

191
00:15:37,580 --> 00:15:41,560
so that the entropy is lost. We talk about a key switch. We talk about a key switch that is

192
00:15:41,580 --> 00:15:47,740
where key strength is 16 or 24 bits, which means that your pocket calculator can track it in a

193
00:15:47,740 --> 00:15:54,600
matter of seconds. Even when you start with strong key, the normal way is you make the binary

194
00:15:54,600 --> 00:16:01,040
key to be converted to base 64, and then you truncate the base 64. Now you are done. Your

195
00:16:01,040 --> 00:16:09,740
entropy is gone. Again, marketing statement, everything is encrypted, technically means it's

196
00:16:09,740 --> 00:16:11,560
true, but when you look at the meaning of the key, it's a little bit different. It's a little bit

197
00:16:11,560 --> 00:16:17,900
meaningless. Is the encryption done in a meaningful way? Not at all. So don't assume when you are

198
00:16:17,900 --> 00:16:24,980
told that it's encrypted that it's encrypted in a meaningful way. Hard-wired secondary passwords.

199
00:16:25,560 --> 00:16:31,900
There is one vendor which their system has a secondary password called idiots. That's a wonderful

200
00:16:31,900 --> 00:16:38,320
idea. It's idiots with the ones and zeros, you know, you mangle. But in any username you can use

201
00:16:38,320 --> 00:16:41,540
with the real password of the user, or you can use it with the real password of the user, or you

202
00:16:41,560 --> 00:16:48,360
can just say idiots, and you are in. What it means is really scary, because now the system logs

203
00:16:48,360 --> 00:16:54,460
that that person came in, and if something is done wrong, there is now a log entry about wrong,

204
00:16:54,620 --> 00:17:01,240
as a real person would have been, the correct person would have been logged in. So it's bad practice,

205
00:17:01,340 --> 00:17:07,320
but also it is telling something about the attitude, if you choose hard-wired password, be idiots.

206
00:17:09,820 --> 00:17:11,540
Hard-wired Wi-Fi passwords.

207
00:17:12,480 --> 00:17:18,200
That's bad, but also it doesn't matter because they use the violent equal privacy, which is old

208
00:17:18,200 --> 00:17:24,020
standard and crackable in two and a half minutes anyway, so why not hard-wire it then? The real

209
00:17:24,020 --> 00:17:31,300
question would be, and discussion would be, why Wi-Fi? But that's another story. When we look at

210
00:17:31,300 --> 00:17:37,800
the newer generation of machines, an interesting choice of words has been started to be used,

211
00:17:39,100 --> 00:17:41,540
because modeming, where modems were called, they were called hard-wired passwords, and they were

212
00:17:41,540 --> 00:17:48,760
connected to Wi-Line, were in some parts of the US and earlier everywhere accepted as a way of

213
00:17:48,760 --> 00:17:58,880
transferring unofficial results. Now the wording has been changed to wireless modems, and the

214
00:17:58,880 --> 00:18:07,420
wireless modems happens to be connecting to Verizon or Sprint network. So it's not anymore that

215
00:18:07,420 --> 00:18:11,520
way of modem, as we think. But just to make it more interesting, there are a number of

216
00:18:11,540 --> 00:18:16,480
reasons, a couple of recent studies, public documents have been discovered when the vendors

217
00:18:16,480 --> 00:18:20,780
have been demonstrating the systems, and the demonstration has failed, and the vendor has been

218
00:18:20,780 --> 00:18:28,300
explaining why it failed by telling the voting machine had wrong IP address, and the

219
00:18:28,300 --> 00:18:34,460
firewall configuration script had a typo. It doesn't mean it's Internet, but it means that it

220
00:18:34,460 --> 00:18:39,460
uses IP addresses and goes wireless over telecoms network, so we don't know what it is. This is not

221
00:18:39,460 --> 00:18:42,980
the statement saying they are connected directly to Internet. It's just saying that we are

222
00:18:42,980 --> 00:18:49,860
discovering things which are raising interesting questions, and at one point of time, somebody

223
00:18:49,860 --> 00:18:56,840
independently should take a look and take a look into the system. Interesting fallback

224
00:18:56,840 --> 00:19:03,360
scenarios. Voter authorization smart card, which you are given when you go to the e-poll book,

225
00:19:03,420 --> 00:19:09,440
you get the card which allows you to vote once. You go with that to the voting terminal, and you get a

226
00:19:09,460 --> 00:19:15,120
card, and you jam it. When it tries to eject, you just keep your finger there, and there were

227
00:19:15,120 --> 00:19:21,020
a number of machines where previously when it panicked, it bumped you to vote election

228
00:19:21,020 --> 00:19:29,260
supervisor mode with no pin code or nothing. I mean, obviously, it's the supervisor who has to

229
00:19:29,260 --> 00:19:39,380
clear the jam, but it is a maybe not well thought through procedure. Another thing which is

230
00:19:39,460 --> 00:19:44,380
found in a number of manufacturers, none of these are actually, don't think about that I don't say

231
00:19:44,380 --> 00:19:52,020
a name of a vendor because there is only a vendor this applies to. It's more that these are seen out

232
00:19:52,020 --> 00:19:57,220
in the wild in more than one place. Secret functional is activated with hidden registry keys.

233
00:19:57,440 --> 00:20:03,460
In many cases, the registry is actually made to be remote registry, so inside of the election

234
00:20:03,460 --> 00:20:09,440
supervisor's closed network, you can remotely trigger the keys, and now the election supervisor

235
00:20:09,460 --> 00:20:09,700
has to make sure that the key is in the right place. So, the key is in the right place.

236
00:20:09,700 --> 00:20:13,800
software, whether it's the central tabulator, canvassing software, whatever part of the complex

237
00:20:13,800 --> 00:20:21,060
back end system, new features pop up. Again, slightly problematic from an auditor point of

238
00:20:21,060 --> 00:20:26,420
view, when you are auditing software and the features you are auditing are, you don't know all

239
00:20:26,420 --> 00:20:31,840
the features because they only become active, or in case of one vendor, this is one vendor,

240
00:20:31,920 --> 00:20:39,440
where it actually dynamically deloads and reloads a DLL. So, the actual library is not active,

241
00:20:39,460 --> 00:20:42,940
it's not even in the memory until the key is there.

242
00:20:43,220 --> 00:20:47,340
And a lot of weird misconceptions, like CRC

243
00:20:48,160 --> 00:20:51,060
considered as a cryptographically saved

244
00:20:51,060 --> 00:20:51,940
algorithm.

245
00:20:54,300 --> 00:20:59,540
It doesn't make any sense. But it is a common term,

246
00:20:59,660 --> 00:21:03,280
and especially 16, which is not really even

247
00:21:03,280 --> 00:21:07,600
giving you a sufficient protection against a non-malicious

248
00:21:08,640 --> 00:21:09,320
hardware

249
00:21:09,460 --> 00:21:12,920
errors, non-malicious storage errors. These are just

250
00:21:13,460 --> 00:21:16,800
examples, and the important thing here is these are not bugs.

251
00:21:17,320 --> 00:21:21,440
These are not buffer overflows, these are not mistakes made by the

252
00:21:21,440 --> 00:21:24,640
programmer, these are not mistakes, these are features

253
00:21:25,540 --> 00:21:29,260
which have been designed and programmed

254
00:21:29,260 --> 00:21:30,180
on purpose.

255
00:21:32,820 --> 00:21:34,400
We have a lot of bugs.

256
00:21:36,700 --> 00:21:39,420
These are different categories because they are not bugs.

257
00:21:40,480 --> 00:21:43,880
If we look the same on the side of our hardware

258
00:21:44,320 --> 00:21:47,540
and firmware, we see an

259
00:21:48,380 --> 00:21:52,160
old technology, which is a RAM, a removable RAM

260
00:21:52,160 --> 00:21:56,000
card, which actually plugs in the mapable, executable memory.

261
00:21:56,720 --> 00:22:00,100
How you can audit ever a system

262
00:22:00,100 --> 00:22:04,140
where removable media becomes part of your execution RAM?

263
00:22:04,400 --> 00:22:08,380
You don't. Anyway, that is a design still in use

264
00:22:08,380 --> 00:22:12,140
in the United States, and it makes it pretty

265
00:22:12,140 --> 00:22:15,640
unauditable. Custom operating system,

266
00:22:15,940 --> 00:22:20,220
I mentioned before that there are manufacturers who have in their terminal

267
00:22:20,220 --> 00:22:23,740
most of the machines are Windows and some of the new ones are Linux,

268
00:22:23,940 --> 00:22:27,700
but there are still manufacturers who have a completely custom made operating system.

269
00:22:28,000 --> 00:22:31,780
Or not an operating system at all. We had found a

270
00:22:31,780 --> 00:22:35,560
custom operating system where there is a remote control features,

271
00:22:35,960 --> 00:22:39,860
which means that inside of the election precinct

272
00:22:39,860 --> 00:22:43,760
network, you can remotely control the voting terminal

273
00:22:43,760 --> 00:22:47,800
as if there would be a voter. You can click up and down and you can click

274
00:22:47,800 --> 00:22:51,560
the candidate name and you say, I vote. And that all can be done

275
00:22:51,560 --> 00:22:54,120
remotely over the precinct network.

276
00:22:56,660 --> 00:23:00,000
Again, not a design feature which thankfully

277
00:23:00,000 --> 00:23:03,180
is being fixed by physical protections.

278
00:23:03,940 --> 00:23:07,080
Live open ports which are accessible to voter in booth.

279
00:23:07,300 --> 00:23:11,660
The interesting thing about secret ballot is you are in the booth alone and nobody is supposed

280
00:23:11,660 --> 00:23:15,760
to look over your shoulder. And if you then have a serial port which is

281
00:23:15,760 --> 00:23:19,140
connected to the computer inside of the voting terminal

282
00:23:19,900 --> 00:23:23,620
live, and you can plug something in the convenience of your

283
00:23:23,620 --> 00:23:27,240
booth and talk with the computer, that's generally speaking a bad idea.

284
00:23:27,240 --> 00:23:31,140
But it's all kinds of ports. We are talking serial ports,

285
00:23:31,380 --> 00:23:34,760
we are talking USB ports, we are talking about a

286
00:23:34,760 --> 00:23:38,920
potentially mountable device, because the smart card standard is another thing which

287
00:23:38,920 --> 00:23:43,000
people don't necessarily know. That the smart card standard

288
00:23:43,000 --> 00:23:47,340
which is commonly used in your prepaid telephone card,

289
00:23:47,520 --> 00:23:51,280
your credit card, that standard actually has an opportunity

290
00:23:51,280 --> 00:23:55,160
to have a file system. It's not a very big file system, it's a small file system.

291
00:23:55,660 --> 00:23:57,220
Now if the smart card standard

292
00:23:57,240 --> 00:24:01,180
reader, as a certain ATM manufacturer

293
00:24:01,180 --> 00:24:05,360
did, is a USB device, which is very common in this

294
00:24:05,360 --> 00:24:09,140
area, and in Windows you have auto mount and auto execution

295
00:24:09,140 --> 00:24:12,040
on. Now you plug your smart card

296
00:24:13,080 --> 00:24:16,800
and it takes their autorun.bat and runs it.

297
00:24:18,740 --> 00:24:21,060
In this example line, one

298
00:24:21,060 --> 00:24:24,700
thing which is recently has become a more

299
00:24:25,020 --> 00:24:27,120
known and understood problem

300
00:24:28,280 --> 00:24:31,000
in the voter registration system and e-poll books,

301
00:24:32,080 --> 00:24:35,080
people are using driving license

302
00:24:35,080 --> 00:24:39,060
and driving license barcodes as the way to register

303
00:24:39,060 --> 00:24:43,220
yourself in. And I know this is shocking, but I have heard a story

304
00:24:43,220 --> 00:24:46,400
that some underage kids might have a false ID.

305
00:24:47,080 --> 00:24:51,120
I know it's shocking, but that seems

306
00:24:51,120 --> 00:24:54,880
to happen. However, that means that you can have a rogue

307
00:24:54,880 --> 00:24:58,660
barcode. And what has been discovered is, first of all,

308
00:24:58,720 --> 00:25:02,580
a lot of these barcode readers, they read more

309
00:25:02,580 --> 00:25:06,800
standards than the standard you're done. Actually you cannot even limit the number of

310
00:25:06,800 --> 00:25:10,000
standards they read. Second thing is their keyboard emulators.

311
00:25:10,740 --> 00:25:14,480
Keyboard emulator means that you can emulate operating system

312
00:25:14,480 --> 00:25:18,480
commands, like command R to have your

313
00:25:18,480 --> 00:25:22,180
command line and type in the command line invisibly.

314
00:25:22,640 --> 00:25:24,680
Very convenient. It also works in

315
00:25:24,880 --> 00:25:27,400
point of sale systems in supermarkets.

316
00:25:29,000 --> 00:25:32,840
The other thing which it can do is if you don't have a sanitized input,

317
00:25:32,980 --> 00:25:36,820
which seems to be also thought that obviously we all know what the barcode is, so you don't

318
00:25:36,820 --> 00:25:40,520
have to sanitize it, a SQL inject directly from the barcode.

319
00:25:43,100 --> 00:25:44,820
It actually, a funny story, this is not

320
00:25:44,820 --> 00:25:48,840
an election story, but one guy in Poland figured out that

321
00:25:48,840 --> 00:25:52,920
SQL inject is possible in your license plate. So he made the license plate

322
00:25:52,920 --> 00:25:56,260
was as wide as a car, which was SQL inject, and deliberately

323
00:25:56,260 --> 00:25:59,560
throw through the red light cameras and speed cameras.

324
00:26:00,540 --> 00:26:04,920
And he just happened to know what is the name of the number of the table you have to drop.

325
00:26:05,120 --> 00:26:08,700
So if you ever read the XKCD, read

326
00:26:08,700 --> 00:26:12,820
Little Bobby tables, Little Bobby tables on license plate is a

327
00:26:12,820 --> 00:26:16,820
real thing. The same thing in voter registration system, e-poll

328
00:26:16,820 --> 00:26:20,020
books, it's something which is right now, thankfully,

329
00:26:21,760 --> 00:26:22,900
it's this year

330
00:26:22,920 --> 00:26:26,380
a lot of jurisdictions are looking to buy e-poll books. This is now flagged.

331
00:26:26,420 --> 00:26:30,660
You have to make certain that you are responsible in a way

332
00:26:30,660 --> 00:26:34,880
you treat unreliable input, which is the driving

333
00:26:34,880 --> 00:26:37,780
license, because they happen to have false ones.

334
00:26:39,360 --> 00:26:41,040
Now, internet voting side.

335
00:26:42,360 --> 00:26:46,580
The reason I'm talking about Estonia for a while here is because Estonia

336
00:26:46,580 --> 00:26:50,780
election, internet voting system is open source, so I can actually show a couple of

337
00:26:50,780 --> 00:26:51,460
code snippets.

338
00:26:52,920 --> 00:26:56,600
When we look, the Norwegian internet voting trial was

339
00:26:56,600 --> 00:27:00,260
stopped. This is a miniscule comparing the size of that code.

340
00:27:00,600 --> 00:27:04,680
We had the Washington D.C. mock election, which was

341
00:27:04,680 --> 00:27:08,620
hacked by Alex Halderman and his team. Way much bigger code.

342
00:27:09,220 --> 00:27:12,920
When we look, what is Estonia internet voting system, which is

343
00:27:14,060 --> 00:27:16,640
considered in a common

344
00:27:16,640 --> 00:27:20,760
knowledge as the gold standard, which it truthfully is not,

345
00:27:20,760 --> 00:27:24,620
what it looks like. It's 16,000 lines of code, and really

346
00:27:24,620 --> 00:27:28,820
we don't have to worry about counting the

347
00:27:28,820 --> 00:27:32,540
comment lines separately, because there's no comments. It's actually

348
00:27:32,540 --> 00:27:36,740
code which is uncommented completely. Well, not

349
00:27:36,740 --> 00:27:40,140
completely, but very little. So it's a 61% Python,

350
00:27:40,360 --> 00:27:44,780
37% C++, and then shell scripts.

351
00:27:45,080 --> 00:27:48,880
And various shell scripts. It is really looking like

352
00:27:48,880 --> 00:27:52,860
a code trap. There is no docs, no

353
00:27:52,860 --> 00:27:56,700
harness, no test modules, no description of the protocol.

354
00:27:56,860 --> 00:27:59,560
Obviously you can learn the protocol by reading the source code.

355
00:28:00,700 --> 00:28:05,000
The documentation itself is interesting because almost all the comments

356
00:28:05,000 --> 00:28:08,960
which are here are actually from a borrowed code. So when they have cut and pasted

357
00:28:08,960 --> 00:28:12,740
a part of code from other source, accidentally

358
00:28:12,740 --> 00:28:14,300
the comments came in.

359
00:28:15,860 --> 00:28:18,300
And when you look at the

360
00:28:18,300 --> 00:28:21,780
lifted code, so the borrowed code, there is an undocumented

361
00:28:22,080 --> 00:28:26,120
code from GNU, which is an open source license requiring

362
00:28:26,120 --> 00:28:30,120
you to commit back the changes, in a sense which

363
00:28:30,120 --> 00:28:34,180
Joe would be telling, and Candice Hawke, it's a legal virus

364
00:28:34,180 --> 00:28:37,760
in a sense. It shouldn't be undocumented. That's a

365
00:28:38,300 --> 00:28:42,140
violation of terms. And the other code is that there's no attribution of

366
00:28:42,140 --> 00:28:46,100
source, no version, no authorship, no license, so there's a lot of code which is coming

367
00:28:46,100 --> 00:28:50,240
from somewhere, and it's not acknowledged where the code comes from.

368
00:28:51,120 --> 00:28:52,980
I would say this is a

369
00:28:53,840 --> 00:28:57,820
high school project with a teacher who is very relaxed. But

370
00:28:57,820 --> 00:29:01,740
it's not much better than that. It's a nasty thing to say, but

371
00:29:01,740 --> 00:29:05,480
it's true. So when they published the code,

372
00:29:06,300 --> 00:29:09,220
this is what I want to show. A security feature.

373
00:29:09,220 --> 00:29:13,160
And the actual code, when it was published in GitHub,

374
00:29:13,280 --> 00:29:17,100
says to do, implement security checks, verifying the correct size

375
00:29:17,100 --> 00:29:21,300
of the encrypted vote, returns okay. No test was ever

376
00:29:21,300 --> 00:29:25,040
programmed. And this, when this code was published,

377
00:29:25,400 --> 00:29:27,900
it had been used in seven real elections.

378
00:29:30,220 --> 00:29:33,280
Now, obviously it was slightly embarrassing when this was

379
00:29:34,120 --> 00:29:36,640
made publicly known, and so they fixed it.

380
00:29:37,580 --> 00:29:38,140
.

381
00:29:41,080 --> 00:29:43,020
I'm not making this up.

382
00:29:43,220 --> 00:29:47,200
This is actually the next commit to GitHub, they removed the

383
00:29:47,200 --> 00:29:50,320
command lines, because there was too much information anyway.

384
00:29:52,060 --> 00:29:55,180
So, again, if

385
00:29:55,180 --> 00:29:58,880
a voting system is not having the security check, obviously

386
00:29:58,880 --> 00:30:03,140
it will not tell you that there's a problem. So everything will

387
00:30:03,140 --> 00:30:06,620
go fine. I don't think this is a

388
00:30:06,620 --> 00:30:10,600
proper and prudent way of programming an election system,

389
00:30:10,840 --> 00:30:12,620
but people make different choices.

390
00:30:14,240 --> 00:30:18,780
Again, in the real world, you would never ever believe

391
00:30:18,780 --> 00:30:22,480
in any system, even including your point of sale system,

392
00:30:22,520 --> 00:30:26,280
a supermarket, or your calculator, that a key feature, year

393
00:30:26,280 --> 00:30:30,260
after year after year, is missing and just

394
00:30:30,260 --> 00:30:34,620
to do. There's a lot of other features there, and one thing that I want

395
00:30:34,620 --> 00:30:38,580
to underline, this is, the example is from Estonia,

396
00:30:38,620 --> 00:30:42,660
because I can show the code. This is not unique. When you go and

397
00:30:42,660 --> 00:30:46,680
look the other vendors, the vendors in America, vendors who are serving

398
00:30:46,680 --> 00:30:50,160
internationally, you see the same thing. You see

399
00:30:50,160 --> 00:30:54,440
key features, which somebody was too busy ten years ago to code,

400
00:30:54,560 --> 00:30:58,320
and nobody has had time ever since, because it's working, and obviously

401
00:30:58,320 --> 00:31:00,820
if you add that feature, you might start to have problems.

402
00:31:00,940 --> 00:31:01,280
.

403
00:31:04,620 --> 00:31:04,880
.

404
00:31:08,260 --> 00:31:12,520
Now, Estonia also is an interesting example, because they

405
00:31:12,520 --> 00:31:16,340
do publish videos. This is their government

406
00:31:16,340 --> 00:31:20,000
assurance, how the system works. They publish

407
00:31:20,440 --> 00:31:23,700
everything from the system being set up

408
00:31:24,500 --> 00:31:28,480
to election being run, the daily logins

409
00:31:28,480 --> 00:31:32,300
into the system while the election is live. Everything is published as a video

410
00:31:32,300 --> 00:31:35,820
by the government. There would be a lot of things I

411
00:31:35,820 --> 00:31:39,460
can tell about. We actually went, Alex Haldeman,

412
00:31:39,680 --> 00:31:43,960
Margaret McAlpine, the University of Michigan team,

413
00:31:44,000 --> 00:31:47,980
three people and two people from Google, we actually flew to Estonia

414
00:31:47,980 --> 00:31:52,140
to witness, because you are allowed to, in person, also

415
00:31:52,140 --> 00:31:55,660
to see the operations on a daily basis. First of all,

416
00:31:56,300 --> 00:32:00,320
because Estonia's system is widely open source, in Ann Arbor,

417
00:32:00,320 --> 00:32:04,300
in University of Michigan, Alex Haldeman and his team built a own Estonia.

418
00:32:04,860 --> 00:32:08,320
If you go to Estonia voting.org,

419
00:32:08,540 --> 00:32:12,300
you actually find a virtual

420
00:32:12,300 --> 00:32:16,220
images of the Estonia government systems, and you can be your

421
00:32:16,220 --> 00:32:20,300
own Estonia. Which means that you can take the binary code given

422
00:32:20,300 --> 00:32:24,040
to you as the voting software, and you can run it against a virtual

423
00:32:24,040 --> 00:32:28,160
Estonia, which is your Estonia, hence you can try your things safely,

424
00:32:28,160 --> 00:32:30,980
and you are not playing against the real system.

425
00:32:33,180 --> 00:32:35,700
The videos were actually very nice, because

426
00:32:36,420 --> 00:32:39,880
when Ann Arbor was building the copy of Estonia, they

427
00:32:39,880 --> 00:32:43,980
didn't know what everything means in Estonian, and

428
00:32:43,980 --> 00:32:48,100
as a result, every name of computer, every sticker was copied, and

429
00:32:48,100 --> 00:32:52,080
when Estonians were saying, well, how you knew this? Well, we don't know

430
00:32:52,080 --> 00:32:55,240
what that word means, but we put the sticker, because you have the sticker.

431
00:32:55,240 --> 00:32:58,960
And so that's how it was copied. Anyway, this evidence is

432
00:32:58,960 --> 00:33:02,180
interesting, because this is

433
00:33:02,180 --> 00:33:07,380
from the video, where they sign, cryptographically

434
00:33:07,380 --> 00:33:11,360
sign the client software the citizens will be using

435
00:33:11,360 --> 00:33:14,100
for casting their vote.

436
00:33:14,980 --> 00:33:19,140
So there's this video, the video goes on, and eventually there comes a

437
00:33:19,140 --> 00:33:23,220
signature and hash, and now as a voter, you can verify your

438
00:33:23,220 --> 00:33:24,960
binary to be

439
00:33:25,240 --> 00:33:28,660
the real binary, because you can compare it to the video, and

440
00:33:29,160 --> 00:33:33,180
they made a big thing that this computer, where they are

441
00:33:33,180 --> 00:33:36,760
doing the sign, this computer has never been connected to internet.

442
00:33:37,360 --> 00:33:41,220
That is the statement they make. So let's take a closer

443
00:33:41,220 --> 00:33:44,980
look. So we have a micro-torrent, we have

444
00:33:44,980 --> 00:33:48,860
the tournament, and

445
00:33:48,860 --> 00:33:53,140
poker's game. Online poker. So I think the statement, this

446
00:33:53,140 --> 00:33:54,720
has never been connected to internet.

447
00:33:57,060 --> 00:34:01,120
Maybe they are interested, they want to install all this software which is not going to use

448
00:34:01,120 --> 00:34:05,020
and they wonder why it doesn't use it. Or the statement might be false. I don't know

449
00:34:05,020 --> 00:34:07,540
which one. Anyway, operational security.

450
00:34:08,720 --> 00:34:13,200
I'm using Estonia as a, I could use

451
00:34:13,200 --> 00:34:17,080
many other jurisdictions in the US. I'm just showing that

452
00:34:17,080 --> 00:34:20,780
a lot of times these statements, we have as

453
00:34:20,780 --> 00:34:24,540
humans, we are trust-based animals. If somebody tells us

454
00:34:24,540 --> 00:34:28,540
sky is blue, we probably take it as a face value,

455
00:34:28,740 --> 00:34:32,400
we don't check. If somebody says in a video, in

456
00:34:32,400 --> 00:34:36,740
official evidence provided by government, this computer has

457
00:34:36,740 --> 00:34:40,600
never been connected to internet, very few people actually go and start checking.

458
00:34:40,940 --> 00:34:43,940
But the evidence is there that something is

459
00:34:44,680 --> 00:34:48,800
well, maybe that's offline poker stars online. Who knows?

460
00:34:48,940 --> 00:34:49,180
.

461
00:34:50,920 --> 00:34:54,060
I was talking before about,

462
00:34:54,300 --> 00:34:58,720
we've come back to US, about these small companies which are

463
00:34:58,720 --> 00:35:02,500
helping local governments to run elections.

464
00:35:02,700 --> 00:35:06,260
This is an actual website. This screenshot

465
00:35:06,940 --> 00:35:10,600
was taken, I think, three weeks ago. It's not from

466
00:35:10,600 --> 00:35:14,540
yesterday. I don't have any belief that election source has changed it.

467
00:35:14,720 --> 00:35:17,760
This is an actual company selling election services.

468
00:35:17,760 --> 00:35:21,620
First of all, this is

469
00:35:21,620 --> 00:35:25,400
a blow-up from here. Our election coding services

470
00:35:25,400 --> 00:35:27,140
saves you time and effort.

471
00:35:29,340 --> 00:35:33,080
If you would be running a national security level service,

472
00:35:33,180 --> 00:35:37,460
would you buy your coding services from a website looking like that?

473
00:35:38,360 --> 00:35:42,020
The answer is yes. They do buy it. That's why they advertise it.

474
00:35:44,940 --> 00:35:45,720
This is

475
00:35:45,720 --> 00:35:49,680
a not-embarrassing example, and I don't want to

476
00:35:49,680 --> 00:35:53,200
embarrass election source. They are not worse or

477
00:35:53,760 --> 00:35:57,020
particularly bad, but the whole concept is elections

478
00:35:58,260 --> 00:36:01,600
are, well, actually that's a different picture. There's

479
00:36:01,600 --> 00:36:05,480
also, say, Manning & President maintenance services. But these

480
00:36:05,480 --> 00:36:08,720
kind of companies are selling their services,

481
00:36:09,460 --> 00:36:13,200
and they are not certified. If this is a

482
00:36:13,200 --> 00:36:16,840
Joe's election services, who will ever check who Joe is,

483
00:36:16,940 --> 00:36:21,180
who owns Joe's services, how Joe is employing his people,

484
00:36:21,320 --> 00:36:25,100
how Joe is vetting his employees? What are

485
00:36:25,100 --> 00:36:27,540
the different stakeholders in Joe's company?

486
00:36:29,240 --> 00:36:31,600
What? Oh, microphone.

487
00:36:32,540 --> 00:36:37,200
Anyway, so this was just an example of what kind of companies

488
00:36:37,200 --> 00:36:41,000
and what kind of marketing methods actually appeal a real election

489
00:36:41,000 --> 00:36:42,240
official, local election officials,

490
00:36:43,280 --> 00:36:46,100
to use their services. On the same website,

491
00:36:46,360 --> 00:36:50,480
when you go to the production site, they have the

492
00:36:51,200 --> 00:36:54,820
new tag here, which is everything you need to secure your election,

493
00:36:54,980 --> 00:36:58,500
like seals. So they sell locks, they sell seals,

494
00:36:59,060 --> 00:37:00,040
all kind of things.

495
00:37:02,540 --> 00:37:05,900
And the one in the corner, this looks very interesting. It's

496
00:37:06,800 --> 00:37:07,860
red, and it's

497
00:37:09,900 --> 00:37:10,400
the seal of the state of Michigan.

498
00:37:10,400 --> 00:37:13,640
It is the great seal of the state of Michigan.

499
00:37:15,340 --> 00:37:19,440
This is actually the paper seal they use in elections. This is my hand.

500
00:37:20,080 --> 00:37:23,640
I used my own credit card, my personal credit card,

501
00:37:23,700 --> 00:37:26,300
and I ordered them. They were four and a half dollars each.

502
00:37:26,960 --> 00:37:31,100
So you don't need to forge a seal, you can just buy them.

503
00:37:33,120 --> 00:37:35,780
Election officials always make the correct

504
00:37:35,780 --> 00:37:39,320
statement. A physical protection

505
00:37:39,320 --> 00:37:43,200
is protecting the machine. When you talk about computer systems,

506
00:37:43,300 --> 00:37:47,320
the rule of the thumb is if you can physically access it, the game is over.

507
00:37:48,820 --> 00:37:51,000
So you have to have physical access. A lot of

508
00:37:51,820 --> 00:37:55,740
security studies have greatly improved the amount of

509
00:37:55,740 --> 00:37:59,220
physical security around the election machines. Great job done,

510
00:37:59,400 --> 00:38:03,820
more job needs to be done. However, that's not a problem

511
00:38:03,820 --> 00:38:07,720
if you can actually buy the original seals, and you don't

512
00:38:07,720 --> 00:38:09,160
need to even forge them.

513
00:38:11,580 --> 00:38:15,000
All right. Again, this is a machine

514
00:38:15,720 --> 00:38:19,020
which is in the hacking village. It's the

515
00:38:20,160 --> 00:38:23,720
Ivatronic. It has the security feature. You have a

516
00:38:23,720 --> 00:38:27,720
special cartridge. The machine only activates when the cartridge is

517
00:38:27,720 --> 00:38:31,700
present. The cartridge has a secret ingredient

518
00:38:31,700 --> 00:38:34,480
which no human can get access. It's called magnet.

519
00:38:35,320 --> 00:38:39,520
So when you have a magnet, the magnet actually activates the

520
00:38:39,520 --> 00:38:42,920
system, and the device is using infrared

521
00:38:43,540 --> 00:38:47,620
to communicate the ballot style, and also to do the tally, because it's also

522
00:38:47,620 --> 00:38:51,760
vote aggregation. So instead of using that device,

523
00:38:51,840 --> 00:38:55,260
you can use pound pilot. Again, when you look,

524
00:38:55,360 --> 00:38:59,120
it's actually very interesting. A lot of people who are not

525
00:38:59,120 --> 00:39:03,100
election security experts, they think

526
00:39:03,100 --> 00:39:07,260
when a specialized device they have never seen before, which has a weird shape

527
00:39:07,260 --> 00:39:11,080
slot which you put, they think it's secure because it's something they have never

528
00:39:11,080 --> 00:39:15,060
seen. It's not common. And because it's a magic, there's no

529
00:39:15,060 --> 00:39:18,900
connectors. It's smooth as ice. There's nothing metallic

530
00:39:18,900 --> 00:39:23,180
because people have a false sense of security

531
00:39:23,180 --> 00:39:26,260
it's safe. The reality is a magnet and

532
00:39:26,940 --> 00:39:29,100
mobile phone or pound pilot, that's how it works.

533
00:39:29,120 --> 00:39:33,000
That's how you talk with. Again, never make an assumption, when you see a machine, never make

534
00:39:33,000 --> 00:39:37,000
an assumption that you know how it works or the people

535
00:39:37,000 --> 00:39:40,220
who tell how it works would know how it works.

536
00:39:40,440 --> 00:39:44,980
And that's why we have the village. This is just a very

537
00:39:44,980 --> 00:39:48,780
quickly top line, one line per huge topic.

538
00:39:48,880 --> 00:39:52,860
Every single line would have been an hour presentation of its own. But to give you an idea

539
00:39:52,860 --> 00:39:56,780
why it's important that we take a look, fresh look,

540
00:39:56,780 --> 00:40:00,820
we analyze, we get the facts straight, and only people

541
00:40:00,820 --> 00:40:04,440
who are educated and know the facts can make an intellectual

542
00:40:04,440 --> 00:40:06,160
decisions and right choices.

543
00:40:09,720 --> 00:40:12,660
One more thing about seals. Yet another

544
00:40:13,840 --> 00:40:16,220
seal example. This is a

545
00:40:16,220 --> 00:40:20,780
D-Bold Aquavote precinct based

546
00:40:20,780 --> 00:40:24,660
scanner, tamper evidence seal, protecting the memory card so that nobody

547
00:40:24,660 --> 00:40:25,660
can tamper with that.

548
00:40:26,780 --> 00:40:30,760
But if you take a look inside, you see, hey, there's two screws. We have been

549
00:40:31,520 --> 00:40:34,700
recommending to put some seals to those screws because they didn't.

550
00:40:34,880 --> 00:40:38,300
And if you take them out, you take that

551
00:40:38,300 --> 00:40:42,120
out, now you can

552
00:40:42,920 --> 00:40:45,140
get to the memory card without breaking the seal.

553
00:40:46,500 --> 00:40:50,680
I have a number of pictures from Estonia where they have sealed the racks

554
00:40:50,680 --> 00:40:54,760
of the servers, and the seal didn't go from the door to the rim.

555
00:40:55,500 --> 00:40:56,760
So you can just open the door.

556
00:40:56,780 --> 00:40:58,940
The seal is not broken.

557
00:41:00,320 --> 00:41:04,720
Anyway, that's a brief thing about keeping your mind

558
00:41:04,720 --> 00:41:06,880
open when you analyze the systems.

559
00:41:07,620 --> 00:41:12,700
When something is presented to you and you want to make certain that you understand

560
00:41:12,700 --> 00:41:16,080
if it's secure or not, you don't need to have any special skills.

561
00:41:16,740 --> 00:41:19,360
You need to take a look and use common sense.

562
00:41:20,440 --> 00:41:24,740
If somebody says this is a tamper evidence seal, see where the seal is

563
00:41:24,740 --> 00:41:28,260
connected. And think like a criminal. Think about

564
00:41:28,260 --> 00:41:32,520
this is, I think, one of the most important things I have been saying in

565
00:41:33,140 --> 00:41:36,600
generally about hacking and security. Hacking is not intellectual

566
00:41:36,600 --> 00:41:40,700
challenge. Movies, and everybody tells

567
00:41:40,700 --> 00:41:44,620
hacker men are wise and cunning and smart. No.

568
00:41:44,660 --> 00:41:48,760
That's not the thing. Hackers want to

569
00:41:48,760 --> 00:41:51,560
steal your stuff. There's no style points.

570
00:41:52,760 --> 00:41:55,720
They look if there's a door. Oh, you have a door.

571
00:41:55,780 --> 00:41:59,680
That's great. Do you have a lock? Oh, you have a lock. Great. Let me go around

572
00:41:59,680 --> 00:42:03,440
the building to see if you have a back door. And do you have locks in the windows?

573
00:42:03,540 --> 00:42:07,220
And it's all about how you achieve your goal as a criminal.

574
00:42:07,700 --> 00:42:11,680
Not if you have style points. Because the best crime is a crime which was never discovered.

575
00:42:11,900 --> 00:42:15,200
So you don't even get to brag about it. Thank you.

576
00:42:22,860 --> 00:42:23,540
Questions?

577
00:42:26,040 --> 00:42:29,920
Are the, I'm talking loud so they can hear.

578
00:42:30,060 --> 00:42:34,100
Are the incidents of non-bugs in later generation

579
00:42:34,100 --> 00:42:36,880
machines becoming less prevalent?

580
00:42:38,260 --> 00:42:41,460
Most of the software hasn't been updated since 2007.

581
00:42:41,720 --> 00:42:43,100
So there is no new version.

582
00:42:45,540 --> 00:42:49,720
Okay. So the question is, is the newer version of the

583
00:42:49,720 --> 00:42:51,240
software, is the bug

584
00:42:51,560 --> 00:42:55,280
becoming less prevalent? And the answer was that

585
00:42:55,280 --> 00:42:59,340
when you go across the U.S. and you see the systems which are used, a lot of

586
00:42:59,340 --> 00:43:03,660
times there has been no software upgrade since this discovery. So it's still the same.

587
00:43:04,240 --> 00:43:07,260
About the newer systems, most of the newer systems have never been

588
00:43:07,260 --> 00:43:10,280
independently verified. So we don't have data one way or another.

589
00:43:13,640 --> 00:43:15,120
Is there anyone regulating

590
00:43:15,120 --> 00:43:15,940
these clouds?

591
00:43:19,580 --> 00:43:20,540
So the

592
00:43:21,560 --> 00:43:24,520
answer to that is a legal question. And that was

593
00:43:24,520 --> 00:43:28,980
Joe Hall and Candice who should be answering that.

594
00:43:29,240 --> 00:43:32,780
The, my answer is there's volunteer standards.

595
00:43:34,200 --> 00:43:37,400
And since they are volunteer, they are volunteer.

596
00:43:37,820 --> 00:43:41,420
I would also point out that the

597
00:43:41,420 --> 00:43:45,240
FEC, David when was FEC regulation?

598
00:43:45,680 --> 00:43:48,220
2002. FEC.

599
00:43:49,240 --> 00:43:51,120
2002 and then the

600
00:43:52,240 --> 00:43:55,540
EACVSS 2005, they both have a

601
00:43:55,540 --> 00:43:59,540
ban to use assembler language. And those

602
00:43:59,540 --> 00:44:02,440
machines had been certified and you see the assembler language there.

603
00:44:02,880 --> 00:44:07,400
So the EATs, the independent task authorities have not been, maybe

604
00:44:07,400 --> 00:44:11,180
they haven't considered that to be that important, but the systems which have been certified

605
00:44:11,180 --> 00:44:15,280
voluntarily but certified still don't necessarily meet the standard

606
00:44:15,280 --> 00:44:19,320
set. Anything

607
00:44:19,320 --> 00:44:21,280
else? Okay.

608
00:44:21,560 --> 00:44:22,460
I'm out of time.

609
00:44:23,120 --> 00:44:23,520
Oh.

610
00:44:26,940 --> 00:44:27,740
I think

611
00:44:27,740 --> 00:44:28,960
I actually went to YouTube live.

612
00:44:30,660 --> 00:44:31,460
I think

613
00:44:31,460 --> 00:44:33,440
I actually went to YouTube live. I thought

614
00:44:33,880 --> 00:44:34,280
one

615
00:44:35,860 --> 00:44:37,580
person there was already posting it

616
00:44:37,580 --> 00:44:38,900
as a live stream, so

617
00:44:38,900 --> 00:44:39,740
it should be there.

618
00:44:41,560 --> 00:44:42,320
Okay. Thank you.